@sap/cds-dk 10.0.6 → 10.1.0

package/node_modules/@sap/cds/libx/_runtime/remote/utils/token.js

@@ -0,0 +1,82 @@
+const cds = require('../../cds')
+const { LruCache } = require('./LruCache')
+const { isTimeoutError, getTimeoutError } = require('./error')
+
+const LOG = cds.log('remote')
+
+const _tokenCache = new LruCache(cds.env.remote.cache_size)
+
+let BUFFER_MS
+
+const _fetchToken = async ({ clientid, clientsecret, certificate, key, url }, tenant) => {
+  const headers = { 'content-type': 'application/x-www-form-urlencoded' }
+  if (tenant) headers['x-zid'] = tenant
+  let body = 'grant_type=client_credentials'
+  let dispatcher
+
+  if (certificate) {
+    let Agent
+    try {
+      ;({ Agent } = require('node:undici'))
+    } catch {
+      throw new Error(
+        'mTLS token fetching requires Node.js 24 or higher (built-in module "node:undici" not available).'
+      )
+    }
+    body += `&client_id=${encodeURIComponent(clientid)}`
+    dispatcher = new Agent({ connect: { cert: certificate, key } })
+  } else {
+    headers.authorization = 'Basic ' + Buffer.from(`${clientid}:${clientsecret}`).toString('base64')
+  }
+
+  const { timeout } = cds.env.remote
+  const signal = AbortSignal.timeout(cds.utils.ms4(timeout))
+  let res
+  try {
+    res = await fetch(url + '/oauth/token', { method: 'POST', headers, body, dispatcher, signal })
+  } catch (e) {
+    if (isTimeoutError(e)) throw getTimeoutError(e, 'OAuth2 token request', timeout)
+    throw e
+  }
+  if (!res.ok) throw Object.assign(new Error('OAuth2 token request failed.'), { statusCode: res.status })
+  const json = await res.json()
+  if (!json.access_token) throw new Error('OAuth2 token response missing access_token.')
+  return json
+}
+
+/**
+ * Returns a cached OAuth2 client credentials token, fetching a new one when absent or expired.
+ * @param {{ clientid, clientsecret?, url, certificate?, key? }} creds
+ * @param {string} [tenant]
+ * @returns {Promise<string>} access_token
+ */
+const getToken = async (creds, tenant) => {
+  const key = [creds.clientid, tenant].filter(Boolean).join(':')
+  const cached = _tokenCache.get(key)
+  if (cached) {
+    LOG._debug && LOG.debug(`OAuth2 token for '${key}' served from cache`)
+    return cached
+  }
+
+  LOG._debug && LOG.debug(`Fetching OAuth2 token for '${key}' from ${creds.url}`)
+  const promise = _fetchToken(creds, tenant)
+    .then(({ access_token, expires_in = 60 * 60 }) => {
+      const expiresInMs = expires_in * 1000
+      BUFFER_MS ??= cds.utils.ms4(cds.env.remote.cache_expiry_buffer)
+      const ttl = Math.max(0, expiresInMs - BUFFER_MS)
+      LOG._debug && LOG.debug(`OAuth2 token for '${key}' cached for ${ttl}ms`)
+      _tokenCache.set(key, access_token, ttl)
+      return access_token
+    })
+    .catch(err => {
+      LOG.warn(`Failed to fetch OAuth2 token for '${key}':`, err.message)
+      _tokenCache.delete(key)
+      throw err
+    })
+
+  // store promise immediately to deduplicate concurrent in-flight requests
+  _tokenCache.set(key, promise)
+  return promise
+}
+
+module.exports = { getToken }

package/node_modules/@sap/cds/libx/_runtime/ucl/Service.js

@@ -2,12 +2,8 @@ const cds = require('../cds')
 const LOG = cds.log('ucl')
 
 const { X509Certificate } = require('crypto')
-const fs = require('fs').promises
-const https = require('https')
 const sdkProvider = require('../remote/utils/cloudSdkProvider')
 
-const { READ_QUERY, CREATE_MUTATION, UPDATE_MUTATION, DELETE_MUTATION } = require('./queries')
-
 const SSL_CLIENT_VERIFY_HEADER = 'x-ssl-client-verify'
 const SSL_CLIENT_SUBJECT_HEADER = 'x-ssl-client-subject-dn'
 const SSL_CLIENT_ISSUER_HEADER = 'x-ssl-client-issuer-dn'
@@ -172,14 +168,15 @@ module.exports = class UCLService extends cds.Service {
     if (!OPERATION_DEFAULT_STATES[operation])
       return cds.error(
         400,
-        `Invalid operation "${operation}" in tenant mapping notification. Expected one of: ${Object.keys(
-          OPERATION_DEFAULT_STATES
-        )
-          .map(o => `"${o}"`)
-          .join(', ')}.`
+        `Invalid operation "${operation}" in tenant mapping notification. ` +
+          `Expected one of: ${Object.keys(OPERATION_DEFAULT_STATES)
+            .map(o => `"${o}"`)
+            .join(', ')}.`
       )
 
     const locationUrl = req.headers.location
+    LOG.debug(`Extracted UCL callback location from header: ${locationUrl}`)
+
     if (locationUrl?.length) return this._dispatchAsyncMappingNotification(req, operation, locationUrl)
     return this._dispatchSyncMappingNotification(req, operation)
   }
@@ -187,10 +184,14 @@ module.exports = class UCLService extends cds.Service {
   async _dispatchAsyncMappingNotification(req, operation, locationUrl) {
     // Get destination based on configured destination name
     const destinationName = cds.env.requires.ucl.destination
+
+    LOG.debug(`Callback destination configured: ${destinationName} (${typeof destinationName})`)
     if (typeof destinationName != 'string' || !destinationName?.length)
       return cds.error(500, 'UCL Notification includes location but no callback destination was configured')
+
     const cloudSdkConnectivity = sdkProvider.getCloudSdkConnectivity()
-    const destination = await cloudSdkConnectivity.getDestination(destinationName)
+    const destination = await cloudSdkConnectivity.getDestination({ destinationName })
+    LOG.debug(`Fetched Destination from destination service: ${destination.name}(${destination.url})`)
 
     // Make sure the received callback location matches the configured destination
     let destinationHost, locationHost
@@ -211,16 +212,28 @@ module.exports = class UCLService extends cds.Service {
       )
     }
 
+    const receiverTenantId = req.data?.receiverTenant?.applicationTenantId
+    LOG.debug(`Handling '${operation}' asynchronously, as tenant: ${receiverTenantId}`)
+
+    LOG.debug(`Established destination host for UCL callbacks: ${destinationHost}`)
+    LOG.debug(`Established intended UCL callback host from location header: ${locationHost}`)
+
     // Schedule the tenant mapping task
-    await cds.queued(this).send(operation, req.data, req.headers)
+    await cds.tx({ tenant: receiverTenantId }, async () => {
+      await cds.queued(this).send(operation, req.data, req.headers)
+    })
 
-    // Respond 202 Accepted to UCL
-    req.http.res.status(202)
+    LOG.debug(`Successfully dispatched '${operation}' operation for: ${receiverTenantId}`)
+
+    req.http.res.status(202) // Respond '202: Accepted' to UCL
     return
   }
 
   async _dispatchSyncMappingNotification(req, operation) {
-    const response = (await this.send(operation, req.data)) ?? {}
+    const receiverTenantId = req.data?.receiverTenant?.applicationTenantId
+    LOG.debug(`Handling '${operation}' synchronously, as tenant: ${receiverTenantId}`)
+
+    const response = (await cds.tx({ tenant: receiverTenantId }, async () => this.send(operation, req.data))) ?? {}
     if (response.error) req.http.res.status(400)
     else response.state ??= OPERATION_DEFAULT_STATES[operation]
     return response
@@ -228,8 +241,9 @@ module.exports = class UCLService extends cds.Service {
 
   async handleSuccessfulMapping(callbackResult, tenantMapping) {
     const { operation, operationId } = tenantMapping.data.context
+    if (!callbackResult) callbackResult = {}
 
-    LOG.debug(`UCL ${operation} operation succeeded:`, callbackResult, tenantMapping)
+    LOG.debug(`UCL ${operation} operation succeeded with result:`, callbackResult)
 
     // SPII v3 (operationId exists) vs v2
     const method = operationId ? 'PUT' : 'PATCH'
@@ -242,7 +256,8 @@ module.exports = class UCLService extends cds.Service {
     const cloudSdkHttpClient = sdkProvider.getCloudSdk()
     const response = await cloudSdkHttpClient.executeHttpRequest(
       { destinationName: cds.env.requires.ucl.destination },
-      { method, url: tenantMapping.headers.location, data }
+      { method, url: tenantMapping.headers.location, data },
+      { fetchCsrfToken: false }
     )
 
     if (response.status >= 500)
@@ -251,6 +266,8 @@ module.exports = class UCLService extends cds.Service {
       cds.error(`UCL rejected successful ${operation} operation callback: ${response.data.error}`, {
         unrecoverable: true
       })
+
+    LOG.debug(`UCL Callback completed with status: ${response.status}`)
   }
 
   async handleFailedMapping(callbackError, tenantMapping) {
@@ -264,7 +281,8 @@ module.exports = class UCLService extends cds.Service {
     const cloudSdkHttpClient = sdkProvider.getCloudSdk()
     const response = await cloudSdkHttpClient.executeHttpRequest(
       { destinationName: cds.env.requires.ucl.destination },
-      { method, url: tenantMapping.headers.location, data: { state: 'ERROR' } }
+      { method, url: tenantMapping.headers.location, data: { state: 'ERROR' } },
+      { fetchCsrfToken: false }
     )
 
     if (response.status >= 500)
@@ -273,178 +291,7 @@ module.exports = class UCLService extends cds.Service {
       cds.error(`UCL rejected failed ${operation} operation callback: ${response.data.error}`, {
         unrecoverable: true
       })
-  }
-
-  /*
-   * the rest is for upserting the application template
-   */
-
-  async _upsertApplicationTemplate() {
-    const _getApplicationTemplate = options => {
-      let applicationTemplate = {
-        applicationInput: {
-          providerName: 'SAP',
-          localTenantID: '{{tenant-id}}',
-          labels: {
-            displayName: '{{subdomain}}'
-          }
-        },
-        labels: {
-          managed_app_provisioning: true,
-          xsappname: '${xsappname}'
-        },
-        placeholders: [
-          { name: 'subdomain', description: 'The subdomain of the consumer tenant' },
-          {
-            name: 'tenant-id',
-            description: "The tenant id as it's known in the product's domain",
-            jsonPath: '$.subscribedTenantId'
-          }
-        ],
-        accessLevel: 'GLOBAL'
-      }
-      applicationTemplate = cds.utils.merge(applicationTemplate, options.applicationTemplate)
-
-      const pkg = require(cds.root + '/package')
-      if (!applicationTemplate.name) applicationTemplate.name = pkg.name
-      if (!applicationTemplate.applicationInput.name) applicationTemplate.applicationInput.name = pkg.name
-      if (applicationTemplate.labels.xsappname === '${xsappname}')
-        applicationTemplate.labels.xsappname = options.credentials.xsappname
-
-      return applicationTemplate
-    }
-
-    this._applicationTemplate = _getApplicationTemplate(cds.env.requires.ucl)
-    if (!this._applicationTemplate.applicationNamespace) {
-      cds.error(
-        'The UCL service requires a valid `applicationTemplate`, please provide it as described in the documentation.'
-      )
-    }
-
-    if (!cds.requires.multitenancy && cds.env.profile !== 'mtx-sidecar')
-      cds.error(
-        'The UCL service requires multitenancy, please enable it in your cds configuration with `cds.requires.multitenancy` or by using the mtx sidecar.'
-      )
-    if (!cds.env.requires.ucl.credentials)
-      cds.error('No credentials found for the UCL service, please bind the service to your app.')
-
-    if (!cds.env.requires.ucl.x509?.cert && !cds.env.requires.ucl.x509?.certPath)
-      cds.error('UCL requires `x509.cert` or `x509.certPath`.')
-    if (!cds.env.requires.ucl.x509?.pkey && !cds.env.requires.ucl.x509?.pkeyPath)
-      cds.error('UCL requires `x509.pkey` or `x509.pkeyPath`.')
-
-    const [cert, key] = await Promise.all([
-      cds.env.requires.ucl.x509?.cert ??
-        fs.readFile(cds.utils.path.resolve(cds.root, cds.env.requires.ucl.x509?.certPath)),
-      cds.env.requires.ucl.x509?.pkey ??
-        fs.readFile(cds.utils.path.resolve(cds.root, cds.env.requires.ucl.x509?.pkeyPath))
-    ])
-
-    this.agent = new https.Agent({ cert, key })
-
-    const existingTemplate = await this._readTemplate()
-    const template = existingTemplate ? await this._updateTemplate(existingTemplate) : await this._createTemplate() // TODO: Make sure return value is correct
-
-    if (!template) cds.error('The UCL service could not create an application template.')
-
-    cds.once('listening', async () => {
-      const provisioning = await cds.connect.to('cds.xt.SaasProvisioningService')
-      provisioning.prepend(() => {
-        provisioning.on('dependencies', async (_, next) => {
-          const dependencies = await next()
-          dependencies.push({ xsappname: template.labels.xsappnameCMPClone })
-          return dependencies
-        })
-      })
-    })
-  }
-
-  // REVISIT: Replace with fetch (?)
-  async _request(query, variables) {
-    // Query GraphQL API
-
-    const opts = {
-      host: cds.env.requires.ucl.host || 'compass-gateway-sap-mtls.mps.kyma.cloud.sap',
-      path: cds.env.requires.ucl.path || '/director/graphql',
-      agent: this.agent,
-      method: 'POST',
-      headers: { 'Content-Type': 'application/json' }
-    }
-
-    return new Promise((resolve, reject) => {
-      const req = https.request(opts, res => {
-        const chunks = []
-
-        res.on('data', chunk => {
-          chunks.push(chunk)
-        })
-
-        res.on('end', () => {
-          const response = {
-            statusCode: res.statusCode,
-            headers: res.headers,
-            body: Buffer.concat(chunks).toString()
-          }
-
-          const body = JSON.parse(response.body)
-
-          if (body.errors) cds.error('Request to UCL service failed with:\n' + JSON.stringify(body.errors, null, 2))
-
-          resolve(body.data)
-        })
-      })
-
-      req.on('error', error => {
-        reject(error)
-      })
-
-      if (query) {
-        req.write(JSON.stringify({ query, variables }))
-      }
-
-      req.end()
-    })
-  }
-
-  _handleResponse(result) {
-    if (result.response && result.response.errors) {
-      let errorMessage = result.response.errors[0].message
-      throw new Error(errorMessage)
-    } else {
-      return result.result
-    }
-  }
-
-  async _readTemplate() {
-    const xsappname = cds.env.requires.ucl.credentials.xsappname
-    const variables = { key: 'xsappname', value: `"${xsappname}"` }
-    const res = await this._request(READ_QUERY, variables)
-    if (res) return res.applicationTemplates.data[0]
-  }
-
-  async _createTemplate() {
-    try {
-      return this._handleResponse(await this._request(CREATE_MUTATION, { input: this._applicationTemplate }))
-    } catch (e) {
-      this._handleResponse(e)
-    }
-  }
-
-  async _updateTemplate(template) {
-    try {
-      const input = { ...this._applicationTemplate }
-      delete input.labels
-      const response = this._handleResponse(await this._request(UPDATE_MUTATION, { id: template.id, input }))
-      LOG.info('Application template updated successfully.')
-      return response
-    } catch (e) {
-      this._handleResponse(e)
-    }
-  }
 
-  async _deleteTemplate() {
-    const template = await this._readTemplate()
-    if (!template) return
-    return this._handleResponse(await this._request(DELETE_MUTATION, { id: template.id }))
+    LOG.debug(`UCL Callback completed with status: ${response.status}`)
   }
 }

package/node_modules/@sap/cds/libx/common/utils/streaming.js

@@ -5,7 +5,7 @@ exports.validateMimetypeIsAcceptedOrThrow = (headers, contentType) => {
   if (!contentType || !headers?.accept) return
   if (headers.accept.includes('*/*')) return
   if (headers.accept.includes(contentType)) return
-  if (headers.accept.includes(contentType.slice(0,contentType.indexOf('/')) + '/*')) return
+  if (headers.accept.includes(contentType.slice(0, contentType.indexOf('/')) + '/*')) return
   const msg = `Content type "${contentType}" is not listed in accept header "${headers.accept}"`
   cds.error({ status: 406, message: msg })
 }
@@ -18,7 +18,7 @@ const _mimetypes = {
   '.css': 'text/css',
   '.png': 'image/png',
   '.jpeg': 'image/jpeg',
-  '.jpg': 'image/jpeg',
+  '.jpg': 'image/jpeg'
 }
 
 const { extname } = require('path')
@@ -28,7 +28,7 @@ const _mimetype4 = filename => {
   return _mimetypes[filetype]
 }
 
-const _annotation = (def,a) => {
+const _annotation = (def, a) => {
   if (!def) return
   if (typeof def[a] === 'string') return def[a]
 }
@@ -41,32 +41,32 @@ exports.collectStreamMetadata = (result, operation, query) => {
   const filename =
     result.$mediaContentDispositionFilename ?? // legacy -> support for odata only?
     result.filename ??
-    _annotation (returns, '@Core.ContentDisposition.Filename')
-    _annotation (element, '@Core.ContentDisposition.Filename')
+    _annotation(returns, '@Core.ContentDisposition.Filename') ??
+    _annotation(element, '@Core.ContentDisposition.Filename')
 
   const disposition =
     result.$mediaContentDispositionType ?? // legacy -> support for odata only?
-    _annotation (returns, '@Core.ContentDisposition.Type') ??
-    _annotation (element, '@Core.ContentDisposition.Type') ??
+    _annotation(returns, '@Core.ContentDisposition.Type') ??
+    _annotation(element, '@Core.ContentDisposition.Type') ??
     (filename ? 'attachment' : 'inline')
 
   const mimetype =
-    result['*@odata.mediaContentType'] ??  // compat -> support for odata only?
-    result.$mediaContentType ??           // legacy -> support for odata only?
+    result['*@odata.mediaContentType'] ?? // compat -> support for odata only?
+    result.$mediaContentType ?? // legacy -> support for odata only?
     result.mimetype ??
-    _mimetype4 (filename) ??
-    _mimetype4 (result.path) ??         // e.g. for file downloads
-    _annotation (returns, '@Core.MediaType') ??
-    _annotation (element, '@Core.MediaType') ??
+    _mimetype4(filename) ??
+    _mimetype4(result.path) ?? // e.g. for file downloads
+    _annotation(returns, '@Core.MediaType') ??
+    _annotation(element, '@Core.MediaType') ??
     'application/octet-stream' // REVISIT: or rather default to undefined?
 
   return { mimetype, filename, disposition }
 }
 
-exports.getReadable = function readable4 (result) {
+exports.getReadable = function readable4(result) {
   if (result == null) return null
   if (result instanceof Readable) return result
-  if (Array.isArray(result)) return readable4 (result[0]) // compat
-  if (typeof result === 'object' && 'value' in result) return readable4 (result.value)
+  if (Array.isArray(result)) return readable4(result[0]) // compat
+  if (typeof result === 'object' && 'value' in result) return readable4(result.value)
   cds.error(500, `Unexpected result type for streaming: Expected stream.Readable or null but got ${typeof result}`)
 }

package/node_modules/@sap/cds/libx/http/location.js

@@ -21,10 +21,10 @@ module.exports = (target, srv, result, keys_as_segments) => {
     return acc
   }, {})
 
-  if (keys_as_segments) { 
+  if (keys_as_segments) {
     let location = targetName
-    for (const k in keyValuePairs) location += `/${keyValuePairs[k]}` 
-    return location 
+    for (const k in keyValuePairs) location += `/${keyValuePairs[k]}`
+    return location
   }
 
   let keys

package/node_modules/@sap/cds/libx/odata/middleware/batch.js

@@ -33,7 +33,7 @@ const _validateProperty = (name, value, type) => {
   }
 }
 
-const _deconstructAndValidateBatchBody = body => {
+const _deconstructAndValidateBatchBody = (body, ct) => {
   const { requests } = body
 
   _validateProperty('requests', requests, 'Array')
@@ -58,6 +58,12 @@ const _deconstructAndValidateBatchBody = body => {
 
     const { id, method, url, body, atomicityGroup } = request
 
+    if (atomicityGroup !== undefined) {
+      _validateProperty('atomicityGroup', atomicityGroup, 'string')
+      if (ct === 'JSON' && !/^[a-zA-Z0-9._~-]+$/.test(atomicityGroup))
+        throw _deserializationError('Invalid characters in atomicityGroup')
+    }
+
     if (atomicityGroup && atomicityGroups.length && atomicityGroup === atomicityGroups.at(-1)[0]?.atomicityGroup)
       atomicityGroups.at(-1).push(request)
     else atomicityGroups.push([request])
@@ -78,8 +84,6 @@ const _deconstructAndValidateBatchBody = body => {
       throw _deserializationError('A Content-Type header has to be specified for a non JSON body.')
 
     if (atomicityGroup) {
-      _validateProperty('atomicityGroup', atomicityGroup, 'string')
-
       // All request objects with the same value for atomicityGroup MUST be adjacent in the requests array
       if (atomicityGroup !== previousAtomicityGroup) {
         if (requestsById[atomicityGroup])
@@ -251,7 +255,7 @@ const _formatResponseMultipart = response => {
   return [txt]
 }
 
-const _writeResponseMultipart = (responses, res, boundary) => {
+const _writeResponseMultipart = (responses, res, boundary, ct) => {
   res.write(`--${boundary}${CRLF}`)
 
   const rejected = responses.find(r => r.status === 'fail')
@@ -261,16 +265,18 @@ const _writeResponseMultipart = (responses, res, boundary) => {
   }
 
   const groupId = responses[0].atomicityGroup
-  if (groupId) res.write(`content-type: multipart/mixed;boundary=${groupId}${CRLF}${CRLF}`)
+  const groupBoundary =
+    groupId && (ct !== 'JSON' && /^[a-zA-Z0-9.'+_-]{1,70}$/.test(groupId) ? groupId : `changeset_${cds.utils.uuid()}`)
+  if (groupBoundary) res.write(`content-type: multipart/mixed;boundary=${groupBoundary}${CRLF}${CRLF}`)
 
   for (const response of responses) {
     for (const each of _formatResponseMultipart(response)) {
-      if (groupId) res.write(`--${groupId}${CRLF}`)
+      if (groupBoundary) res.write(`--${groupBoundary}${CRLF}`)
       res.write(`${each}${CRLF}`)
     }
   }
 
-  if (groupId) res.write(`--${groupId}--${CRLF}`)
+  if (groupBoundary) res.write(`--${groupBoundary}--${CRLF}`)
 }
 
 /*
@@ -478,7 +484,7 @@ module.exports = adapter => {
       // 1. Each individual request accessible by its id
       // 2. Arrays of requests in the same atomicity group
       // > We will only process requests in atomicity groups
-      let { requestsById, atomicityGroups } = _deconstructAndValidateBatchBody(body)
+      let { requestsById, atomicityGroups } = _deconstructAndValidateBatchBody(body, ct)
 
       const only_gets = body.requests.every(r => r.method === 'GET')
       const max_parallel = only_gets ? cds.env.odata.max_batch_parallelization : 1
@@ -611,7 +617,7 @@ module.exports = adapter => {
 
               sendPreludeOnce()
               if (isJson) _writeResponseJson(responses, res)
-              else _writeResponseMultipart(responses, res, boundary)
+              else _writeResponseMultipart(responses, res, boundary, ct)
             })
 
           if (requestsById[groupId]) requestsById[groupId].promise = promise
@@ -650,7 +656,7 @@ module.exports = adapter => {
       // NOTE: error middlewares have 4 params
       // create "subrouter" without the error middlewares for handling subrequests
       subrouter = Object.create(adapter.router)
-      subrouter.stack = subrouter.stack.filter(l => l.handle.length === 3)
+      subrouter.stack = subrouter.stack.filter(l => l.handle.length !== 4)
       // combine adapter and global error middlewares to be invoked during error serialization
       error_mws = adapter.router.stack.filter(l => l.handle.length === 4).map(l => l.handle)
       error_mws = error_mws.concat(cds.middlewares.after.filter(mw => mw.length === 4).map(mw => mw.bind(adapter)))

package/node_modules/@sap/cds/libx/odata/middleware/metadata.js

@@ -80,8 +80,9 @@ module.exports = adapter => {
       }
     }
 
-    const { 'cds.xt.ModelProviderService': mps } = cds.services
-    if (mps) {
+    // same check as in ctx-model.js
+    if (cds.requires.extensibility || cds.requires.toggles) {
+      const mps = await cds.connect.to('cds.xt.ModelProviderService')
       if (format === 'json') {
         LOG._warn && LOG.warn('JSON metadata is not supported in case of cds.requires.extensibility: true')
         const msg = 'JSON metadata is not supported for this service'
@@ -94,12 +95,14 @@ module.exports = adapter => {
         let edmx = metadataCache.edm
 
         if (!edmx) {
-          // IMPORTANT: Only provide the extended model!
-          // If model is undefined, MPS has a shortcut to return the prebuilt edmx
-          edmx = await mps.getEdmx({ tenant, model: cds.context.model, service: service.definition.name })
+          // IMPORTANT
+          // If MPS is served in process, only provide the extended model. If undefined, MPS has a shortcut to return the prebuilt edmx.
+          // If MPS is a remote service, never provide the model. It potentially get's corrupted during serialization.
+          const model = mps instanceof cds.ApplicationService ? cds.context.model : undefined
+          edmx = await mps.getEdmx({ tenant, model, service: service.definition.name })
           metadataCache.edm = edmx
         }
-        const extBundle = cds.env.requires.extensibility && (await mps.getI18n({ tenant, locale }))
+        const extBundle = await mps.getI18n({ tenant, locale })
         edmx = cds.localize(service.model, locale, edmx, extBundle)
         metadataCache.xmlEtag[locale] = generateEtag(edmx)
         res.set('ETag', metadataCache.xmlEtag[locale])

package/node_modules/@sap/cds/libx/odata/middleware/service-document.js

@@ -44,7 +44,7 @@ module.exports = adapter => {
     }
 
     // service.entities does not work because it excludes the texts entities
-    const srvEntities = service.reflect(d => d.is_entity)
+    const srvEntities = service.reflect(d => d.kind === 'entity')
 
     const exposedEntities = []
     for (const e in srvEntities) {

package/node_modules/@sap/cds/libx/odata/parse/afterburner.js

@@ -377,7 +377,7 @@ function _processSegments(from, model, namespace, cqn, protocol) {
       current = _getDefinition(current, seg, namespace) || _getDefinition(current, seg.replace(/_/g, '.'), namespace)
 
       // REVISIT: 404 or 400?
-      if (!current) throw new cds.error(404, `Invalid resource path "${path}"`)
+      if (!current || current.kind === 'event') throw new cds.error(404, `Invalid resource path "${path}"`)
 
       if (current.params && current.kind === 'entity') {
         // > View with params
@@ -802,6 +802,20 @@ const _checkAllKeysProvided = (params, entity) => {
       cds.error({ status: 400, message: msg })
     }
   }
+  for (const keyInParam in params) {
+    // REVISIT cds^11: entity.keys is used instead of keysOfEntity because it also covers keys excluded
+    // from keysOf (e.g. @cds.api.ignore or up_ FK backlinks) that may still appear in request URLs.
+    // Reconsider: it's questionable whether @cds.api.ignore-annotated keys should be accepted in URLs,
+    // and current Fiori versions may no longer send requests with up_ FK keys.
+    const allowed = isView
+      ? keyInParam in (entity.params ?? {})
+      : entity.keys?.[keyInParam] && !entity.keys[keyInParam].isAssociation
+    if (!allowed) {
+      // prettier-ignore
+      const msg = `${isView ? 'Parameter' : 'Key'} "${keyInParam}" is not a ${isView ? 'parameter' : 'key'} of ${isView ? 'view' : 'entity'} "${entity.name}"`
+      cds.error({ status: 400, message: msg })
+    }
+  }
 }
 
 const _doesNotExistError = (isExpand, refName, { name, kind, _return_of }) => {
@@ -981,8 +995,10 @@ module.exports = (cqn, model, namespace, protocol) => {
     }
   }
 
-  if (cqn.SELECT.where) {
-    _processWhere(cqn.SELECT.where, target)
+  let _sel = cqn.SELECT
+  while (_sel) {
+    if (_sel.where) _processWhere(_sel.where, target)
+    _sel = _sel.from?.SELECT
   }
 
   // one?