@sap/cds-dk 10.0.7 → 10.1.1

package/node_modules/@sap/cds-mtxs/srv/extensibility/compat/update.js

@@ -1,9 +1,15 @@
 const cds = require('@sap/cds')
+const { path } = cds.utils
 module.exports = (srv) => {
     // mainly normalizing the input
     srv.before(['UPDATE', 'UPSERT'], 'Extensions', req => { // must be synchronous to be handled first
         const { csn: extension, i18n: bundles, csvs: csvData } = req.data
 
+        // reject file names with path components (path traversal, see DbAdapter.put)
+        for (const files of [bundles, csvData]) {
+            if (Array.isArray(files)) files.forEach(_assertPlainFileName)
+        }
+
         // Validation of extension
         if (!extension) throw new cds.error({ message: 'Property "extension" is missing', code: 400 })
         if (Array.isArray(extension)) {
@@ -41,6 +47,15 @@ module.exports = (srv) => {
         req.data.csn = extCsn
     })
 
+    // rejects a FILE name that is not a plain file name (prevents path traversal)
+    const _assertPlainFileName = function (file) {
+        const name = file?.name
+        if (typeof name !== 'string' || !name.length) return
+        if (path.isAbsolute(name) || name.includes('/') || name.includes('\\') || path.basename(name) !== name) {
+            throw new cds.error({ message: `Invalid file name: "${name}"`, code: 400 })
+        }
+    }
+
     const _isCSN = str => str.substring(0, 1) === '{'
 
     const _mergeCSN = function (extension, merged) {

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/annotations.js

@@ -143,8 +143,8 @@ module.exports = class AnnotationsChecker {
          // get element permissions from allowlist
         const kind = this._getExtendedKind(fullCsn, extCsn, entityOrService)
         const permissions = allowList.getPermission(kind, entityOrService)
-        // check if annotation is allowed
-        if (permissions && permissions.annotations && permissions.annotations.includes(annotationName)) return null
+        // skip only this annotation; keep checking the remaining ones on the same element
+        if (permissions && permissions.annotations && permissions.annotations.includes(annotationName)) continue
 
         const fn = checkedExtensionAnnotations.get(annotationName) ?? _createGenericAnnotationWarning
         const warning = fn(annotationName, annotation);

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/config.js

@@ -2,6 +2,8 @@ const EXTENSION_ALLOWLIST = 'extension-allowlist'
 
 const PROTECTED_NAMESPACES = ['cds.xt']
 
+module.exports.PROTECTED_NAMESPACES = PROTECTED_NAMESPACES
+
 const BUILT_IN_NAMESPACES = ['cds.core', 'cds.outbox'] //> cds.outbox for legacy apps
 
 module.exports.isBuiltIn = (name) => {

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/index.js

@@ -4,6 +4,7 @@ const { deduplicateMessages } = require('@sap/cds-compiler')
 const NamespaceChecker = require('./namespace')
 const AnnotationsChecker = require('./annotations')
 const AllowlistChecker = require('./allowlist')
+const ProtectedNamespaceChecker = require('./protected-namespace')
 
 const customLinters = []
 
@@ -39,6 +40,7 @@ module.exports.lint = (extCsn, fullCsn, env = cds.env, cloneExt = false) => {
   const reflectedFullCsn = cds.reflect(fullCsn)
   const compileBaseDir = cds.root
   const messages = [
+    ...new ProtectedNamespaceChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options),
     ...new NamespaceChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options),
     ...new AnnotationsChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options, extCsn),
     ...new AllowlistChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options)

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/protected-namespace.js

@@ -0,0 +1,45 @@
+const LinterMessage = require('./message')
+const { PROTECTED_NAMESPACES } = require('./config')
+
+function _protectedNamespaceOf(name) {
+  if (!name) return null
+  return PROTECTED_NAMESPACES.find(ns => name === ns || name.startsWith(`${ns}.`)) ?? null
+}
+
+function locationString(element) {
+  const loc = element?.$location
+  if (!loc) return ''
+  const line = loc.line ? `${loc.line}:` : ''
+  return loc.col ? `${loc.file}:${line}${loc.col}:` : `${loc.file}:${line}`
+}
+
+// Rejects defining, extending or annotating artifacts in a protected namespace (e.g. 'cds.xt').
+// Runs unconditionally, independent of linter configuration.
+module.exports = class ProtectedNamespaceChecker {
+
+  // eslint-disable-next-line no-unused-vars
+  check(reflectedCsn, fullCsn, compileDir, mtxConfig) {
+    const messages = []
+
+    for (const name of Object.keys(reflectedCsn.definitions ?? {})) {
+      if (_protectedNamespaceOf(name)) {
+        messages.push(this._createWarning(name, reflectedCsn.definitions[name]))
+      }
+    }
+
+    for (const extension of reflectedCsn.extensions ?? []) {
+      const target = extension.extend ?? extension.annotate
+      if (_protectedNamespaceOf(target)) {
+        messages.push(this._createWarning(target, extension))
+      }
+    }
+
+    return messages
+  }
+
+  _createWarning(name, element) {
+    const namespace = _protectedNamespaceOf(name)
+    const message = `Extending, annotating or defining '${name}' in the protected namespace '${namespace}' is not supported in extensions`
+    return new LinterMessage(locationString(element) + message, element)
+  }
+}

package/node_modules/@sap/cds-mtxs/srv/extensibility-service.js

@@ -2,7 +2,7 @@ const express = require('express')
 const cds = require('@sap/cds/lib')
 const { SELECT, DELETE } = cds.ql
 const { fs, path, tar, rimraf, read, readdir, mkdirp, write } = cds.utils
-const { token: authToken } = require('../lib/utils')
+const { token: authToken, authUrl } = require('../lib/utils')
 const main = require('./config')
 const linter = require('./extensibility/linter')
 
@@ -58,7 +58,12 @@ class DbAdapter {
       try {
         const root = await mkdirp(path.join(temp, 'data'))
         for (const csv in ext.csvs) {
-          await write(path.join(root, csv), ext.csvs[csv])
+          // defense-in-depth: 'csv' is user-supplied and must not escape 'root'
+          const target = path.join(root, csv)
+          if (path.relative(root, target).match(/^\.\.($|[/\\])/) || path.isAbsolute(path.relative(root, target))) {
+            throw Error(`Invalid file name: "${csv}"`)
+          }
+          await write(target, ext.csvs[csv])
         }
         ext.archive = await tar.cz(temp)
       } finally {
@@ -74,7 +79,7 @@ class DbAdapter {
     const csn = JSON.stringify(ext.csn)
     const i18n = ext.i18n ? JSON.stringify(ext.i18n) : null
     const tag = ext.ID
-    await cds.tx({ tenant, user: new cds.User.Privileged() }, async tx => {
+    await cds.tx({ tenant }, async tx => {
       // remove current inactive extension with tag
       if (tag) await tx.run(DELETE.from('cds.xt.Extensions').where({ tag, activated: { '!=': this.activated(ACTIVE) } }))
       // will break with missing appid
@@ -399,17 +404,21 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
     })
 
     cds.on('served', () => {
-      cds.app?.post('/-/cds/login/token', express.urlencoded({ extended: false }), async (req, res) => {
+      cds.app?.post('/-/cds/login/grant', express.urlencoded({ extended: false }), async (req, res) => {
         try {
-          if (req.method === 'HEAD') return res.status(204).send()
-
           const cred = cds.env.requires.auth.credentials || {}
           if (!cred.clientid) throw cds.error('missing authentication service binding', { status: 500 })
 
-          const query = req.method === 'POST' ? (req.body || {}) : (req.query || {})
+          const query = req.body || {}
+
+          // Endpoint accepts only passcode and refresh_token grant requests.
+          const refresh_token = typeof query.refresh_token === 'string' ? query.refresh_token : undefined
+          const passcode = typeof query.passcode === 'string' ? query.passcode : undefined
+          if (!refresh_token && !passcode)
+            throw cds.error('missing passcode or refresh_token', { status: 400 })
 
-          const form = query.refresh_token ? { grant_type: 'refresh_token', refresh_token: query.refresh_token } :
-                       query.passcode      ? { grant_type: 'password', passcode: query.passcode } : {}
+          const form = refresh_token ? { grant_type: 'refresh_token', refresh_token } :
+                                       { grant_type: 'password', passcode }
           form.scope = `${cred.xsappname}.cds.ExtensionDeveloper`
           const raw = await authToken(cred, { form, subdomain: query.subdomain })
           const data = JSON.parse(raw)
@@ -424,7 +433,11 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
         }
       })
 
-      cds.app?.get('/-/cds/login/authorization-metadata', authMeta)
+      cds.app?.get('/-/cds/login/grant-metadata', authMeta)
+
+      const redirectTo = to => (req, res) => res.redirect(308, to + req.url.slice(req.path.length))
+      cds.app?.post('/-/cds/login/token', redirectTo('/-/cds/login/grant'))
+      cds.app?.get('/-/cds/login/authorization-metadata', redirectTo('/-/cds/login/grant-metadata'))
     })
 
     const _tenant = function (req) {
@@ -447,7 +460,7 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
     let extEntry
     try {
       // TODO: handle '*'?
-      await cds.tx(async () => {
+      await cds.tx({ tenant },async () => {
         // use native table names to avoid issues with missing appid
         extEntry = await SELECT(['ID','csn', 'tag','activated']).one.from('cds.xt.Extensions').where({ tag, activated: { '!=': 'database' } }).forUpdate() // select only entries with activated != 'database'
         if (!extEntry) {
@@ -493,15 +506,16 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
 }
 
 function _passcodeUrl(c, sub) {
-  const u = new URL(c.url)
-  if (sub) u.hostname = u.hostname.replace(/^[^.]+/, sub)
-  u.pathname = '/passcode'
-  return u.toString()
+  return authUrl(c.url, sub, '/passcode').toString()
 }
 
 function authMeta(req, res) {
   const cred = cds.env.requires?.auth?.credentials || {}
-  res.send({ passcode_url: _passcodeUrl(cred, req.query?.subdomain) })
+  try {
+    res.send({ passcode_url: _passcodeUrl(cred, req.query?.subdomain) })
+  } catch (err) {
+    res.status(err.status || err.statusCode || 500).json({ error: err.message })
+  }
 }
 
 const _getCompilerError = messages => {

package/node_modules/@sap/cds-mtxs/srv/jobs-service.js

@@ -6,9 +6,13 @@ const LOG = cds.log('mtx'), DEBUG = cds.debug('mtx')
 const Jobs = 'cds.xt.Jobs', Tasks = 'cds.xt.Tasks'
 
 const { t0_ } = require('../lib/utils')
+const getDeploymentPool = require('./worker/job-worker-pool')
 
 const RUNNING = 'RUNNING', FINISHED = 'FINISHED', FAILED = 'FAILED', QUEUED = 'QUEUED', TIMEOUT = 'TIMEOUT'
 
+// Pseudo-db-id for skipped tenants (e.g. already upgraded); their tasks are recorded FINISHED, not run.
+const SKIPPED_DB = 'skipped'
+
 // A queue, implemented as a circular buffer for O(1) insert + delete
 class Queue {
   constructor(capacity) {
@@ -71,13 +75,13 @@ module.exports = class JobsService extends cds.ApplicationService {
 
   _config() {
     const {
-      queueSize = 100, clusterSize = 3, workerSize = 4, poolSize = 1
+      queueSize = 100, clusterSize = 3, workerSize = 4, poolSize = 1, nativeWorkers = false
     } = {
       ...(cds.env.requires.multitenancy?.jobs ?? {}),
       ...(cds.env.requires['cds.xt.SaasProvisioningService']?.jobs ?? {}),
       ...(cds.env.requires['cds.xt.SmsProvisioningService']?.jobs ?? {})
     }
-    return { queueSize, clusterSize, workerSize, poolSize }
+    return { queueSize, clusterSize, workerSize, poolSize, nativeWorkers }
   }
 
   async enqueue(service, op, clusters, args, onJobDone) {
@@ -99,32 +103,52 @@ module.exports = class JobsService extends cds.ApplicationService {
     const job_ID = uuid()
     const job = { ID: job_ID, service, op, args, status: QUEUED }
     const clustered = Object.entries(clusters).map(([database, cluster]) => {
-      if (database !== '0') return Array.from(cluster).map(tenant => ({ job_ID, ID: uuid(), tenant, service, op, args, database, status: QUEUED }))
-      else return Array.from(cluster).map(tenant => ({ job_ID, ID: uuid(), tenant, service, op, args, status: QUEUED }))
+      // Skipped-cluster tasks are recorded FINISHED right away; others are QUEUED for processing.
+      const status = database === SKIPPED_DB ? FINISHED : QUEUED
+      if (database !== '0') return Array.from(cluster).map(tenant => ({ job_ID, ID: uuid(), tenant, service, op, args, database, status }))
+      else return Array.from(cluster).map(tenant => ({ job_ID, ID: uuid(), tenant, service, op, args, status }))
     })
     const tasks = clustered.flat()
+    // Clusters still needing processing (excluding the skipped pseudo-cluster and empty ones).
+    const openClusters = clustered.filter(cluster => cluster.length && cluster[0].database !== SKIPPED_DB)
+    const openTasks = openClusters.flat()
     await t0_(async () => {
       await INSERT.into(Jobs, job)
-      if (tasks.length) {
+      if (openTasks.length) {
         await INSERT.into(Tasks, tasks)
         job.tasks = tasks
         await this.emit('jobUpdate', { job })
       } else {
+        // Nothing to process (empty or only skipped) -> finish directly.
+        if (tasks.length) await INSERT.into(Tasks, tasks)
         await UPDATE(Jobs, { ID: job_ID }).with({ status: FINISHED })
-        await this.emit('jobUpdate', { job: { ...job, status: FINISHED } })
+        await this.emit('jobUpdate', { job: { ...job, tasks, status: FINISHED } })
       }
     })
 
-    if (tasks.length) {
-      if (cds.services[service]) {
+    if (openTasks.length) {
+      if (_canUseWorkers(this._conf)) {
+        const pool = getDeploymentPool(this._conf.workerSize)
+        const fn = async task => {
+          const result = await pool.exec(service, op, task.tenant, args)
+          // Worker ran in an isolated thread; invalidate this process's stale
+          // pool for the tenant (worker's disconnect didn't affect us).
+          if (_invalidatesTenantPool(op)) cds.db?.disconnect(task.tenant)
+          return result
+        }
+        this.jobQueue.enqueue({ job_ID, clusters: openClusters, fn, onJobDone })
+      } else if (cds.services[service]) {
         const fn = task => cds.services[service].tx({ tenant: task.tenant }, tx => tx[op](task.tenant, ...Object.values(args)))
-        this.jobQueue.enqueue({ job_ID, clusters: clustered, fn, onJobDone })
+        this.jobQueue.enqueue({ job_ID, clusters: openClusters, fn, onJobDone })
       } else {
-        this.jobQueue.enqueue({ job_ID, clusters: clustered, fn: () => {
+        this.jobQueue.enqueue({ job_ID, clusters: openClusters, fn: () => {
           LOG.warn('service', service, 'is not available, skipping job')
         }, onJobDone })
       }
       this.pickJob()
+    } else if (tasks.length) {
+      // Only skipped tasks (already FINISHED) -> notify callback since the job won't run.
+      await onJobDone?.()
     }
 
     const url = process.env.VCAP_APPLICATION ? 'https://' + JSON.parse(process.env.VCAP_APPLICATION).uris?.[0] : cds.server.url
@@ -260,6 +284,8 @@ module.exports = class JobsService extends cds.ApplicationService {
   }
 }
 
+module.exports.SKIPPED_DB = SKIPPED_DB
+
 function _errorMessage(e) {
   let message = e.message ?? 'Unknown error'
   if (e.error) message += ' ' + e.error
@@ -267,6 +293,19 @@ function _errorMessage(e) {
   return message.length > 5000 ? message.substring(0, 4997) + '...' : message // TODO use different datatype for errors -> next release
 }
 
+function _canUseWorkers(conf) {
+  // Workers must be explicitly enabled via configuration since they run in
+  // isolated threads with their own CDS bootstrap (no shared handlers/state)
+  if (!conf?.nativeWorkers) return false
+  return true
+}
+
+// Operations that change or drop a tenant's database, requiring the serving
+// process to disconnect its stale pooled connection for the tenant.
+function _invalidatesTenantPool(op) {
+  return op === 'unsubscribe' || op === 'subscribe'
+}
+
 /*********************************************
  * Clean-up
  *********************************************/

package/node_modules/@sap/cds-mtxs/srv/model-provider.js

@@ -3,7 +3,7 @@ const fs = require('fs').promises
 const path = require('path')
 const cds = require('@sap/cds/lib'), { tar, rimraf, exists, read, merge } = cds.utils
 const { readData, readDataCsv } = require('../lib/utils')
-const { worker4 } = require('./worker/pool')
+const { worker4 } = require('./worker/model-worker-pool')
 const conf = cds.requires['cds.xt.ModelProviderService'] || cds.requires.kinds['cds.xt.ModelProviderService']
 const TEMP_DIR = require('fs').realpathSync(require('os').tmpdir())
 const main = require('./config')
@@ -74,6 +74,15 @@ module.exports = class ModelProviderService extends cds.ApplicationService {
       if (invalid) return req.reject(400, `Unsupported input toggle param ${production ? '' : invalid}`)
     })
 
+    // `service` and `flavor` are interpolated into a file system path in `_getPrebuiltBundle`.
+    // Validate them here to prevent path traversal (e.g. reading arbitrary *.xml files).
+    this.before('getEdmx', req => {
+      const { service, flavor } = req.data
+      const _valid = v => v == null || /^(?!.*\.\.)[\w-.]+$/.test(v)
+      if (!_valid(service)) return req.reject(400, `Unsupported input service param ${service}`)
+      if (!_valid(flavor)) return req.reject(400, `Unsupported input flavor param ${flavor}`)
+    })
+
     this.on('getCsn', req => _getCsn(req))
 
     this.on('getExtCsn', req => {
@@ -202,14 +211,20 @@ module.exports = class ModelProviderService extends cds.ApplicationService {
 
       const skipMinify = (!!extensions || reqSkipMinify) && _delayMinify()
       let csn = await lru4(baseCache, JSON.stringify({ models, flavor, javaornode, skipMinify }), () =>
-        worker4(path.join(__dirname, 'worker/load.js'), { models, flavor, javaornode, skipMinify })
+        worker4(path.join(__dirname, 'worker/model-worker.js'), { models, flavor, javaornode, skipMinify })
       )
 
       if (extensions) {
         const key = crypto.createHash('sha256').update(JSON.stringify({ extensions, models, javaornode })).digest('hex')
         csn = lru4(extensionCache, key, () => {
-          const result = cds.extend(csn).with(extensions)
-          return _delayMinify ? cds.minify(result) : result
+          try {
+            const result = cds.extend(csn).with(extensions)
+            return _delayMinify ? cds.minify(result) : result
+          } catch (e) {
+            if (!activated || e.code !== 'ERR_CDS_COMPILATION_FAILURE') throw e
+            const message = _getCompilerError(e.messages)
+            throw cds.error(`Extensions of tenant '${tenant}' are incompatible with the base model: ${message}`, { code: 'ERR_CDS_COMPILATION_FAILURE', status: 422, tenant, messages: e.messages })
+          }
         })
       }
 
@@ -410,3 +425,12 @@ module.exports = class ModelProviderService extends cds.ApplicationService {
 }
 
 module.exports.prototype._add_stub_methods = true
+
+const _getCompilerError = messages => {
+  const defaultMsg = 'Error while compiling extension'
+  if (!messages) return defaultMsg
+  for (const msg of messages) {
+    if (msg.severity === 'Error') return msg.message
+  }
+  return defaultMsg
+}

package/node_modules/@sap/cds-mtxs/srv/plugins/common.js

@@ -43,13 +43,17 @@ cds.on('serving:cds.xt.DeploymentService', ds => {
     if (existingExt) cds.error(`Extensions exist, but extensibility is disabled. Upgrade aborted to avoid data loss`, { status: 500 })
   })
 
+  const _getVersion = () => JSON.stringify({ version: require(cds.root + '/package.json').version })
+
   ds.after('subscribe', async (_, req) => {
     const { tenant, metadata, schema } = req.data
     if (tenant === t0) return
 
+    const version = _getVersion()
+
     try {
       // can't use UPSERT here so @cds.on.insert still works for createdAt
-      await t0_(INSERT.into(Tenants, { ID: tenant, metadata: JSON.stringify(metadata), ...(schema ? { schema } : {}) }))
+      await t0_(INSERT.into(Tenants, { ID: tenant, metadata: JSON.stringify(metadata), ...(schema ? { schema } : {}), version }))
     } catch (e) {
       if (e.message === 'ENTITY_ALREADY_EXISTS' || e.code === 301 || e.message.match(/unique constraint/i)) {
         await t0_(async () => {
@@ -68,17 +72,15 @@ cds.on('serving:cds.xt.DeploymentService', ds => {
     LOG.info('subscribed tenant', tenant)
   })
 
-  // ds.after(['upgrade', 'extend'], async (_, req) => {
-  //   const { tenant } = req.data
-  //   if (tenant === t0) return
+  ds.after(['upgrade', 'extend'], async (_, req) => {
+    const { tenant } = req.data
+    if (tenant === t0) return
 
-  //   const version = JSON.stringify({
-  //     version: require(cds.root + '/package.json').version
-  //   })
+    const version = _getVersion()
 
-  //   await t0_(UPSERT.into(Tenants, { ID: tenant, version }))
-  //   LOG.info('upgraded tenant', tenant)
-  // })
+    await t0_(UPSERT.into(Tenants, { ID: tenant, version }))
+    LOG.info('upgraded tenant', tenant)
+  })
 
   ds.after('unsubscribe', async (_, req) => {
     const { tenant } = req.data
@@ -87,9 +89,14 @@ cds.on('serving:cds.xt.DeploymentService', ds => {
   })
 
   ds.prepend(() => {
-    ds.on('getTenants', async () => {
+    ds.on('getTenants', async req => {
+      const { options } = req.data ?? {}
+      const skipAfter = options?.skipAfter
+      const query = skipAfter
+        ? SELECT.from(Tenants, tenant => { tenant.ID }).where('modifiedAt <', skipAfter)
+        : SELECT.from(Tenants, tenant => { tenant.ID })
       return (await cds.tx({ tenant: t0 }, tx =>
-        tx.run(SELECT.from(Tenants, tenant => { tenant.ID }))
+        tx.run(query)
       )).map(({ ID }) => ID)
     })
   })

package/node_modules/@sap/cds-mtxs/srv/plugins/hana/ctnr-mgr-base.js

@@ -48,7 +48,7 @@ class AbstractContainerManagerClient {
     if (this.cachedToken && this.cachedToken.expiry >= Date.now() + 30_000) {
       return `Bearer ${this.cachedToken.access_token}`
     }
-    const raw = await token(this)
+    const raw = await token(this, { form: { grant_type: 'client_credentials' } })
     const { access_token, expires_in } = JSON.parse(raw)
     this.cachedToken = { access_token, expiry: Date.now() + expires_in * 1000 }
     return `Bearer ${access_token}`

package/node_modules/@sap/cds-mtxs/srv/plugins/hana/hdi-ctnr-mgr.js

@@ -1,5 +1,6 @@
 const cds = require('@sap/cds')
-const { sm_url, baseurl } = cds.env.requires.db.credentials
+const { db } = cds.env.requires
+const { sm_url, baseurl, url, identity } = db.credentials || {}
 const LOG = cds.log('mtx')
 
 if (sm_url) {
@@ -9,7 +10,9 @@ if (sm_url) {
     LOG.warn('SaaS Provisioning Service is configured with ignoreNonExistingContainers. This can cause problems when using HANA TMS v2 as container manager.')
   }
   module.exports = require('./tms')
+} else if (db.serverless || db.kind === 'hana-serverless' || (url && identity)) {
+  module.exports = require('./serverless')
 } else {
-  LOG.warn('Neither Service Manager nor HANA TMS credentials found. No HANA HDI Containers will be accessible.')
+  LOG.warn('Neither Service Manager, HANA TMS, nor serverless credentials found. No HANA HDI Containers will be accessible.')
   module.exports = { defaultInstance: ()=> {} }
-}
+}