@sap/cds-dk 10.0.7 → 10.1.0

package/node_modules/@sap/cds/libx/_runtime/remote/utils/destinationClient.js

@@ -0,0 +1,150 @@
+const cds = require('../../cds')
+const { getToken } = require('./token')
+const { LruCache } = require('./LruCache')
+const { isTimeoutError, getTimeoutError } = require('./error')
+
+const LOG = cds.log('remote')
+
+const _destinationCache = new LruCache(cds.env.remote.cache_size)
+
+let BUFFER_MS
+
+const SUPPORTED_AUTH_TYPES = { NoAuthentication: 1, BasicAuthentication: 1, OAuth2ClientCredentials: 1 }
+
+const HEADERS_PREFIX = 'URL.headers.'
+const QUERIES_PREFIX = 'URL.queries.'
+
+const _decodeJwt = jwt => {
+  try {
+    const payload = JSON.parse(Buffer.from(jwt.split('.')[1], 'base64url').toString())
+    const { zid, app_tid, zone_uuid, user_id, user_uuid } = payload
+    return { tenant: zid || app_tid || zone_uuid, user: user_id || user_uuid }
+  } catch {
+    LOG.warn('Failed to decode JWT payload')
+    return {}
+  }
+}
+
+const _identity = jwt => {
+  const { tenant, user } = (jwt ? _decodeJwt(jwt) : cds.context) ?? {}
+  return { tenant, user: user?.id ?? user }
+}
+
+const _fetchDestination = async (uri, name, token, userJwt) => {
+  const headers = { authorization: `Bearer ${token}` }
+  // Note: Cloud SDK only sends x-user-token for OAuth2UserTokenExchange/OAuth2SAMLBearerAssertion
+  if (userJwt) headers['x-user-token'] = userJwt
+  LOG._debug && LOG.debug(`Fetching destination '${name}'`)
+
+  const { timeout } = cds.env.remote
+  const signal = AbortSignal.timeout(cds.utils.ms4(timeout))
+  let res
+  try {
+    res = await fetch(`${uri}/destination-configuration/v1/destinations/${encodeURIComponent(name)}`, {
+      headers,
+      signal
+    })
+  } catch (e) {
+    if (isTimeoutError(e)) throw getTimeoutError(e, `Fetching destination '${name}'`, timeout)
+    throw e
+  }
+
+  if (res.status === 404) return null
+  if (!res.ok) throw new Error(`Fetching destination '${name}' failed with status ${res.status}.`)
+  return res.json()
+}
+
+const _processResponse = ({ destinationConfiguration: dc, authTokens }) => {
+  if (!(dc.Authentication in SUPPORTED_AUTH_TYPES))
+    LOG.warn(`Auth type ${dc.Authentication} is not yet supported. Falling back to best-effort.`)
+
+  const authToken = authTokens?.[0]
+  const headers = {}
+  if (authToken?.error != null) throw new Error(`Destination returned auth token error: ${authToken.error}`)
+  if (authToken?.http_header) headers[authToken.http_header.key.toLowerCase()] = authToken.http_header.value
+  if (dc['sap-client']) headers['sap-client'] = dc['sap-client']
+
+  const queryParameters = {}
+  for (const [k, v] of Object.entries(dc)) {
+    if (k.startsWith(HEADERS_PREFIX)) headers[k.slice(HEADERS_PREFIX.length).toLowerCase()] = v
+    else if (k.startsWith(QUERIES_PREFIX)) queryParameters[k.slice(QUERIES_PREFIX.length)] = v
+  }
+
+  const expiresIn = authToken?.expiresIn && Number(authToken.expiresIn)
+
+  return {
+    url: dc.URL,
+    authentication: dc.Authentication,
+    expiresIn,
+    ...(Object.keys(headers).length && { headers }),
+    ...(Object.keys(queryParameters).length && { queryParameters })
+  }
+}
+
+const _lookup = async (creds, destinationName, tenant, jwt) => {
+  if (tenant) {
+    const subscriberToken = await getToken(creds, tenant)
+    const subscriberResult = await _fetchDestination(creds.uri, destinationName, subscriberToken, jwt)
+    if (subscriberResult) {
+      LOG._debug && LOG.debug(`Destination '${destinationName}' resolved for subscriber tenant '${tenant}'`)
+      return _processResponse(subscriberResult)
+    }
+    LOG._debug &&
+      LOG.debug(
+        `Destination '${destinationName}' not found for subscriber tenant '${tenant}', falling back to provider`
+      )
+  }
+
+  const providerToken = await getToken(creds)
+  const providerResult = await _fetchDestination(creds.uri, destinationName, providerToken)
+  if (providerResult) {
+    LOG._debug && LOG.debug(`Destination '${destinationName}' resolved for provider tenant`)
+    return _processResponse(providerResult)
+  }
+
+  throw new Error(`Destination '${destinationName}' not found.`)
+}
+
+const getDestination = async (destinationName, { jwt } = {}) => {
+  const creds = cds.env.requires?.destinations?.credentials
+  if (!creds?.uri || !creds?.clientid) {
+    LOG._debug && LOG.debug('No Destination Service credentials found')
+    return null
+  }
+
+  LOG._debug && LOG.debug(`Resolving destination '${destinationName}'`)
+
+  const { tenant, user } = _identity(jwt)
+  // JWT present but no tenant claim — skip cache to avoid cross-tenant pollution
+  const cacheKey = jwt && !tenant ? undefined : [destinationName, tenant, user].filter(Boolean).join(':')
+  if (!cacheKey) LOG._debug && LOG.debug(`Destination '${destinationName}': JWT has no tenant claim, skipping cache`)
+
+  const cached = _destinationCache.get(cacheKey)
+  if (cached) {
+    LOG._debug && LOG.debug(`Destination '${destinationName}' served from cache`)
+    return cached
+  }
+
+  const promise = _lookup(creds, destinationName, tenant, jwt)
+    .then(resolved => {
+      if (!resolved) return null
+      const { expiresIn = 60 * 60, ...destination } = resolved
+      const expiresInMs = expiresIn * 1000
+      BUFFER_MS ??= cds.utils.ms4(cds.env.remote.cache_expiry_buffer)
+      const ttl = Math.max(0, expiresInMs - BUFFER_MS)
+      LOG._debug && LOG.debug(`Destination for '${cacheKey}' cached for ${ttl}ms`)
+      _destinationCache.set(cacheKey, destination, ttl)
+      return destination
+    })
+    .catch(err => {
+      LOG.warn(`Failed to resolve destination '${destinationName}':`, err.message)
+      _destinationCache.delete(cacheKey)
+      throw err
+    })
+
+  // cache promise immediately to deduplicate concurrent in-flight requests
+  _destinationCache.set(cacheKey, promise)
+  return promise
+}
+
+module.exports = { getDestination }

package/node_modules/@sap/cds/libx/_runtime/remote/utils/error.js

@@ -0,0 +1,13 @@
+const isTimeoutError = e => e.name === 'TimeoutError'
+
+/**
+ * @param {Error} cause
+ * @param {string} prefix
+ * @param {number|string} timeout
+ */
+const getTimeoutError = (cause, prefix, timeout) =>
+  Object.assign(new Error(`${prefix} exceeded timeout of ${typeof timeout === 'number' ? `${timeout}ms` : timeout}.`), {
+    cause
+  })
+
+module.exports = { isTimeoutError, getTimeoutError }

package/node_modules/@sap/cds/libx/_runtime/remote/utils/fetchClient.js

@@ -2,6 +2,8 @@ const cds = require('../../cds')
 const LOG = cds.log('remote')
 
 const { Readable } = require('stream')
+const { getDestination } = require('./destinationClient')
+const { isTimeoutError, getTimeoutError } = require('./error')
 
 // process.env.destinations — CloudSDK convention for local destination resolution:
 // a JSON array of { name, url, ... } objects, e.g. for local development or testing.
@@ -23,7 +25,7 @@ const _normalizeAuthentication = destination => {
   return { ...destination, authentication }
 }
 
-const _resolveDestination = destination => {
+const _resolveDestination = async destination => {
   if (destination.url) return _normalizeAuthentication(destination)
 
   const matches = findLocalDestinations(destination.destinationName)
@@ -38,7 +40,8 @@ const _resolveDestination = destination => {
     return _normalizeAuthentication({ ...destination, ...found })
   }
 
-  // REVISIT: resolve named destination via BTP Destination Service
+  const fetched = await getDestination(destination.destinationName, { jwt: destination.jwt })
+  if (fetched) return _normalizeAuthentication({ ...destination, ...fetched })
 
   throw new Error(`Cannot resolve destination '${destination.destinationName}'.`)
 }
@@ -109,11 +112,19 @@ const _readBody = async (response, responseType) => {
  */
 const executeHttpRequest = async (destination, requestConfig) => {
   // Resolve destination
-  destination = _resolveDestination(destination)
+  destination = await _resolveDestination(destination)
   const baseUrl = (destination.url || '').replace(/\/$/, '')
 
-  const { method = 'GET', url = '', data, responseType, maxBodyLength, timeout, csrf } = requestConfig
-  const signal = timeout ? AbortSignal.timeout(timeout) : undefined // eslint-disable-line no-undef
+  const {
+    method = 'GET',
+    url = '',
+    data,
+    responseType,
+    maxBodyLength,
+    timeout = cds.env.remote.timeout,
+    csrf
+  } = requestConfig
+  const signal = timeout && AbortSignal.timeout(cds.utils.ms4(timeout))
 
   // Assemble headers
   const headers = { ...destination.headers, ...requestConfig.headers }
@@ -122,10 +133,16 @@ const executeHttpRequest = async (destination, requestConfig) => {
     headers.authorization = 'Basic ' + Buffer.from(`${username}:${password}`).toString('base64')
   }
 
-  const urlWithoutQuery = baseUrl + (url && !url.startsWith('/') ? `/${url}` : url)
+  // Build full URL
+  let fullUrl = baseUrl + (url && !url.startsWith('/') ? `/${url}` : url)
+  const queryParameters = { ...destination.queryParameters, ...requestConfig.params }
+  if (Object.keys(queryParameters).length) {
+    const qs = new URLSearchParams(Object.entries(queryParameters).map(([k, v]) => [k, String(v)])).toString()
+    fullUrl += (fullUrl.includes('?') ? '&' : '?') + qs
+  }
 
   if (csrf && method !== 'GET' && method !== 'HEAD') {
-    const result = await _fetchCsrfToken(urlWithoutQuery, headers, csrf, signal)
+    const result = await _fetchCsrfToken(fullUrl.split('?')[0], headers, csrf, signal)
     if (result?.token) headers['x-csrf-token'] = result.token
     if (result?.cookie) headers.cookie = headers.cookie ? `${headers.cookie};${result.cookie}` : result.cookie
   }
@@ -143,14 +160,6 @@ const executeHttpRequest = async (destination, requestConfig) => {
       throw new Error(`Request body length ${len} exceeds configured max_body_length ${maxBodyLength}.`)
   }
 
-  // Build full URL
-  const { queryParameters } = destination
-  let fullUrl = urlWithoutQuery
-  if (queryParameters && Object.keys(queryParameters).length) {
-    const qs = new URLSearchParams(Object.entries(queryParameters).map(([k, v]) => [k, String(v)])).toString()
-    fullUrl += (fullUrl.includes('?') ? '&' : '?') + qs
-  }
-
   if (LOG._debug) LOG.debug(`${method} ${fullUrl}`)
 
   // Execute request
@@ -158,9 +167,8 @@ const executeHttpRequest = async (destination, requestConfig) => {
   try {
     response = await fetch(fullUrl, { method, headers, body, signal })
   } catch (e) {
-    const timedOut = e.name === 'TimeoutError'
-    const msg = timedOut ? `Exceeded timeout of ${timeout}ms.` : e.message
-    throw Object.assign(new Error(msg), { cause: e })
+    if (isTimeoutError(e)) throw getTimeoutError(e, 'Remote request', timeout)
+    throw e
   }
 
   // Parse response

package/node_modules/@sap/cds/libx/_runtime/remote/utils/query.js

@@ -25,38 +25,39 @@ const _cqnWithPublicEntries = query => {
   return Object.fromEntries(Object.entries(query).filter(([key]) => !key.startsWith('_')))
 }
 
-const _cqnToHcqlRequestConfig = cqn => {
+const _extractHcqlRequestConfig = cqn => {
+  if (cqn.flat) cqn.flat()
+
   if (cqn.SELECT && cqn.SELECT.from) return { method: 'POST', data: { SELECT: _cqnWithPublicEntries(cqn.SELECT) } }
   if (cqn.INSERT && cqn.INSERT.into) return { method: 'POST', data: { INSERT: _cqnWithPublicEntries(cqn.INSERT) } }
   if (cqn.UPDATE && cqn.UPDATE.entity) return { method: 'POST', data: { UPDATE: _cqnWithPublicEntries(cqn.UPDATE) } }
   if (cqn.UPSERT && cqn.UPSERT.into) return { method: 'POST', data: { UPSERT: _cqnWithPublicEntries(cqn.UPSERT) } }
   if (cqn.DELETE && cqn.DELETE.from) return { method: 'POST', data: { DELETE: _cqnWithPublicEntries(cqn.DELETE) } }
 
-  cds.error(400, 'Invalid CQN object can not be processed.', JSON.stringify(cqn), _cqnToHcqlRequestConfig)
+  cds.error(400, 'Invalid CQN object can not be processed.', JSON.stringify(cqn), _extractHcqlRequestConfig)
 }
 
-const _cqnToRequestConfig = (query, service, req) => {
-  const { kind, model } = service
+const _extractODataRequestConfig = (req, srv) => {
+  if (req.query.UPDATE?.where) cds.error(400, 'Filtering is not supported to specify the subject of UPDATE requests')
+  if (req.query.DELETE?.where) cds.error(400, 'Filtering is not supported to specify the subject of DELETE requests')
 
-  const queryObject = cds.odata.urlify(query, { kind, model, method: req.method })
+  const queryObject = cds.odata.urlify(req, srv)
 
   const requestConfig = {
     method: queryObject.method,
-    url: queryObject.path
-      // REVISIT: remove when we can assume that number of remote services running Okra is negligible
-      // ugly workaround for Okra not allowing spaces in ( x eq 1 )
-      .replace(/\( /g, '(')
-      .replace(/ \)/g, ')')
+    // REVISIT: remove when we can assume that number of remote services running Okra is negligible
+    // ugly workaround for Okra not allowing spaces in ( x eq 1 )
+    url: queryObject.path.replace(/\( /g, '(').replace(/ \)/g, ')')
   }
 
   if (queryObject.method !== 'GET' && queryObject.method !== 'HEAD') {
-    requestConfig.data = kind === 'odata-v2' ? convertV2PayloadData(queryObject.body, req.target) : queryObject.body
+    requestConfig.data = srv.kind === 'odata-v2' ? convertV2PayloadData(queryObject.body, req.target) : queryObject.body
   }
 
   return requestConfig
 }
 
-const _stringToRequestConfig = (query, data, target) => {
+const _createODataRequestConfig = (query, data, target, srvKind) => {
   const cleanQuery = query.trim()
   const blankIndex = cleanQuery.substring(0, 8).indexOf(' ')
 
@@ -66,13 +67,13 @@ const _stringToRequestConfig = (query, data, target) => {
   }
 
   if (data && requestConfig.method !== 'GET' && requestConfig.method !== 'HEAD') {
-    requestConfig.data = this.kind === 'odata-v2' ? Object.assign({}, convertV2PayloadData(data, target)) : data
+    requestConfig.data = srvKind === 'odata-v2' ? Object.assign({}, convertV2PayloadData(data, target)) : data
   }
 
   return requestConfig
 }
 
-const _pathToRequestConfig = (method, path, data, target, srvName) => {
+const _pathToRequestConfig = (method, path, data, target, srvName, srvKind) => {
   let url = path
 
   if (!url.startsWith('/')) {
@@ -88,7 +89,7 @@ const _pathToRequestConfig = (method, path, data, target, srvName) => {
 
   const requestConfig = { method, url }
   if (data && requestConfig.method !== 'GET' && requestConfig.method !== 'HEAD') {
-    requestConfig.data = this.kind === 'odata-v2' ? Object.assign({}, convertV2PayloadData(data, target)) : data
+    requestConfig.data = srvKind === 'odata-v2' ? Object.assign({}, convertV2PayloadData(data, target)) : data
   }
 
   return requestConfig
@@ -101,12 +102,22 @@ const _hasHeader = (headers, header) =>
 
 const KINDS_SUPPORTING_BATCH = { odata: true, 'odata-v2': true, 'odata-v4': true }
 
-const _extractRequestConfig = (req, query, service) => {
-  if (service.kind === 'hcql' && typeof query === 'object') return _cqnToHcqlRequestConfig(query)
-  if (typeof query === 'object') return _cqnToRequestConfig(query, service, req)
-  if (typeof query === 'string') return _stringToRequestConfig(query, req.data, req.target)
-  //> no model, no service.definition
-  return _pathToRequestConfig(req.method, req.path, req.data, req.target, service.definition?.name || service.namespace)
+const _extractRequestConfig = (req, srv) => {
+  // REVISIT: Split off the other 'kind's here? odata / odata-v4, odata-v2, rest ...
+
+  if (srv.kind === 'hcql' && typeof req.query === 'object') return _extractHcqlRequestConfig(req.query)
+  if (typeof req.query === 'object') return _extractODataRequestConfig(req, srv)
+  if (typeof req.query === 'string') return _createODataRequestConfig(req.query, req.data, req.target, srv.kind)
+
+  // > no model, no service.definition
+  return _pathToRequestConfig(
+    req.method,
+    req.path,
+    req.data,
+    req.target,
+    srv.definition?.name || srv.namespace,
+    srv.kind
+  )
 }
 
 const _batchEnvelope = (requestConfig, maxGetUrlLength) => {
@@ -137,8 +148,8 @@ const _batchEnvelope = (requestConfig, maxGetUrlLength) => {
   requestConfig.data = batchedRequest
 }
 
-module.exports.extractRequestConfig = (req, query, service) => {
-  const requestConfig = _extractRequestConfig(req, query, service)
+module.exports.extractRequestConfig = (req, service) => {
+  const requestConfig = _extractRequestConfig(req, service)
 
   if (service.kind === 'odata-v2' && req.event === 'READ' && requestConfig.url?.match(/(\/any\()|(\/all\()/)) {
     req.reject(501, 'Lambda expressions are not supported in OData v2')

package/node_modules/@sap/cds/libx/_runtime/remote/utils/token.js

@@ -0,0 +1,82 @@
+const cds = require('../../cds')
+const { LruCache } = require('./LruCache')
+const { isTimeoutError, getTimeoutError } = require('./error')
+
+const LOG = cds.log('remote')
+
+const _tokenCache = new LruCache(cds.env.remote.cache_size)
+
+let BUFFER_MS
+
+const _fetchToken = async ({ clientid, clientsecret, certificate, key, url }, tenant) => {
+  const headers = { 'content-type': 'application/x-www-form-urlencoded' }
+  if (tenant) headers['x-zid'] = tenant
+  let body = 'grant_type=client_credentials'
+  let dispatcher
+
+  if (certificate) {
+    let Agent
+    try {
+      ;({ Agent } = require('node:undici'))
+    } catch {
+      throw new Error(
+        'mTLS token fetching requires Node.js 24 or higher (built-in module "node:undici" not available).'
+      )
+    }
+    body += `&client_id=${encodeURIComponent(clientid)}`
+    dispatcher = new Agent({ connect: { cert: certificate, key } })
+  } else {
+    headers.authorization = 'Basic ' + Buffer.from(`${clientid}:${clientsecret}`).toString('base64')
+  }
+
+  const { timeout } = cds.env.remote
+  const signal = AbortSignal.timeout(cds.utils.ms4(timeout))
+  let res
+  try {
+    res = await fetch(url + '/oauth/token', { method: 'POST', headers, body, dispatcher, signal })
+  } catch (e) {
+    if (isTimeoutError(e)) throw getTimeoutError(e, 'OAuth2 token request', timeout)
+    throw e
+  }
+  if (!res.ok) throw Object.assign(new Error('OAuth2 token request failed.'), { statusCode: res.status })
+  const json = await res.json()
+  if (!json.access_token) throw new Error('OAuth2 token response missing access_token.')
+  return json
+}
+
+/**
+ * Returns a cached OAuth2 client credentials token, fetching a new one when absent or expired.
+ * @param {{ clientid, clientsecret?, url, certificate?, key? }} creds
+ * @param {string} [tenant]
+ * @returns {Promise<string>} access_token
+ */
+const getToken = async (creds, tenant) => {
+  const key = [creds.clientid, tenant].filter(Boolean).join(':')
+  const cached = _tokenCache.get(key)
+  if (cached) {
+    LOG._debug && LOG.debug(`OAuth2 token for '${key}' served from cache`)
+    return cached
+  }
+
+  LOG._debug && LOG.debug(`Fetching OAuth2 token for '${key}' from ${creds.url}`)
+  const promise = _fetchToken(creds, tenant)
+    .then(({ access_token, expires_in = 60 * 60 }) => {
+      const expiresInMs = expires_in * 1000
+      BUFFER_MS ??= cds.utils.ms4(cds.env.remote.cache_expiry_buffer)
+      const ttl = Math.max(0, expiresInMs - BUFFER_MS)
+      LOG._debug && LOG.debug(`OAuth2 token for '${key}' cached for ${ttl}ms`)
+      _tokenCache.set(key, access_token, ttl)
+      return access_token
+    })
+    .catch(err => {
+      LOG.warn(`Failed to fetch OAuth2 token for '${key}':`, err.message)
+      _tokenCache.delete(key)
+      throw err
+    })
+
+  // store promise immediately to deduplicate concurrent in-flight requests
+  _tokenCache.set(key, promise)
+  return promise
+}
+
+module.exports = { getToken }