@sap/cds-dk 10.1.0 → 10.1.2

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/protected-namespace.js

@@ -0,0 +1,45 @@
+const LinterMessage = require('./message')
+const { PROTECTED_NAMESPACES } = require('./config')
+
+function _protectedNamespaceOf(name) {
+  if (!name) return null
+  return PROTECTED_NAMESPACES.find(ns => name === ns || name.startsWith(`${ns}.`)) ?? null
+}
+
+function locationString(element) {
+  const loc = element?.$location
+  if (!loc) return ''
+  const line = loc.line ? `${loc.line}:` : ''
+  return loc.col ? `${loc.file}:${line}${loc.col}:` : `${loc.file}:${line}`
+}
+
+// Rejects defining, extending or annotating artifacts in a protected namespace (e.g. 'cds.xt').
+// Runs unconditionally, independent of linter configuration.
+module.exports = class ProtectedNamespaceChecker {
+
+  // eslint-disable-next-line no-unused-vars
+  check(reflectedCsn, fullCsn, compileDir, mtxConfig) {
+    const messages = []
+
+    for (const name of Object.keys(reflectedCsn.definitions ?? {})) {
+      if (_protectedNamespaceOf(name)) {
+        messages.push(this._createWarning(name, reflectedCsn.definitions[name]))
+      }
+    }
+
+    for (const extension of reflectedCsn.extensions ?? []) {
+      const target = extension.extend ?? extension.annotate
+      if (_protectedNamespaceOf(target)) {
+        messages.push(this._createWarning(target, extension))
+      }
+    }
+
+    return messages
+  }
+
+  _createWarning(name, element) {
+    const namespace = _protectedNamespaceOf(name)
+    const message = `Extending, annotating or defining '${name}' in the protected namespace '${namespace}' is not supported in extensions`
+    return new LinterMessage(locationString(element) + message, element)
+  }
+}

package/node_modules/@sap/cds-mtxs/srv/extensibility-service.js

@@ -58,7 +58,12 @@ class DbAdapter {
       try {
         const root = await mkdirp(path.join(temp, 'data'))
         for (const csv in ext.csvs) {
-          await write(path.join(root, csv), ext.csvs[csv])
+          // defense-in-depth: 'csv' is user-supplied and must not escape 'root'
+          const target = path.join(root, csv)
+          if (path.relative(root, target).match(/^\.\.($|[/\\])/) || path.isAbsolute(path.relative(root, target))) {
+            throw Error(`Invalid file name: "${csv}"`)
+          }
+          await write(target, ext.csvs[csv])
         }
         ext.archive = await tar.cz(temp)
       } finally {
@@ -74,7 +79,7 @@ class DbAdapter {
     const csn = JSON.stringify(ext.csn)
     const i18n = ext.i18n ? JSON.stringify(ext.i18n) : null
     const tag = ext.ID
-    await cds.tx({ tenant, user: new cds.User.Privileged() }, async tx => {
+    await cds.tx({ tenant }, async tx => {
       // remove current inactive extension with tag
       if (tag) await tx.run(DELETE.from('cds.xt.Extensions').where({ tag, activated: { '!=': this.activated(ACTIVE) } }))
       // will break with missing appid
@@ -455,7 +460,7 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
     let extEntry
     try {
       // TODO: handle '*'?
-      await cds.tx(async () => {
+      await cds.tx({ tenant },async () => {
         // use native table names to avoid issues with missing appid
         extEntry = await SELECT(['ID','csn', 'tag','activated']).one.from('cds.xt.Extensions').where({ tag, activated: { '!=': 'database' } }).forUpdate() // select only entries with activated != 'database'
         if (!extEntry) {

package/node_modules/@sap/cds-mtxs/srv/jobs-service.js

@@ -6,9 +6,13 @@ const LOG = cds.log('mtx'), DEBUG = cds.debug('mtx')
 const Jobs = 'cds.xt.Jobs', Tasks = 'cds.xt.Tasks'
 
 const { t0_ } = require('../lib/utils')
+const getDeploymentPool = require('./worker/job-worker-pool')
 
 const RUNNING = 'RUNNING', FINISHED = 'FINISHED', FAILED = 'FAILED', QUEUED = 'QUEUED', TIMEOUT = 'TIMEOUT'
 
+// Pseudo-db-id for skipped tenants (e.g. already upgraded); their tasks are recorded FINISHED, not run.
+const SKIPPED_DB = 'skipped'
+
 // A queue, implemented as a circular buffer for O(1) insert + delete
 class Queue {
   constructor(capacity) {
@@ -71,13 +75,13 @@ module.exports = class JobsService extends cds.ApplicationService {
 
   _config() {
     const {
-      queueSize = 100, clusterSize = 3, workerSize = 4, poolSize = 1
+      queueSize = 100, clusterSize = 3, workerSize = 4, poolSize = 1, nativeWorkers = false
     } = {
       ...(cds.env.requires.multitenancy?.jobs ?? {}),
       ...(cds.env.requires['cds.xt.SaasProvisioningService']?.jobs ?? {}),
       ...(cds.env.requires['cds.xt.SmsProvisioningService']?.jobs ?? {})
     }
-    return { queueSize, clusterSize, workerSize, poolSize }
+    return { queueSize, clusterSize, workerSize, poolSize, nativeWorkers }
   }
 
   async enqueue(service, op, clusters, args, onJobDone) {
@@ -99,32 +103,52 @@ module.exports = class JobsService extends cds.ApplicationService {
     const job_ID = uuid()
     const job = { ID: job_ID, service, op, args, status: QUEUED }
     const clustered = Object.entries(clusters).map(([database, cluster]) => {
-      if (database !== '0') return Array.from(cluster).map(tenant => ({ job_ID, ID: uuid(), tenant, service, op, args, database, status: QUEUED }))
-      else return Array.from(cluster).map(tenant => ({ job_ID, ID: uuid(), tenant, service, op, args, status: QUEUED }))
+      // Skipped-cluster tasks are recorded FINISHED right away; others are QUEUED for processing.
+      const status = database === SKIPPED_DB ? FINISHED : QUEUED
+      if (database !== '0') return Array.from(cluster).map(tenant => ({ job_ID, ID: uuid(), tenant, service, op, args, database, status }))
+      else return Array.from(cluster).map(tenant => ({ job_ID, ID: uuid(), tenant, service, op, args, status }))
     })
     const tasks = clustered.flat()
+    // Clusters still needing processing (excluding the skipped pseudo-cluster and empty ones).
+    const openClusters = clustered.filter(cluster => cluster.length && cluster[0].database !== SKIPPED_DB)
+    const openTasks = openClusters.flat()
     await t0_(async () => {
       await INSERT.into(Jobs, job)
-      if (tasks.length) {
+      if (openTasks.length) {
         await INSERT.into(Tasks, tasks)
         job.tasks = tasks
         await this.emit('jobUpdate', { job })
       } else {
+        // Nothing to process (empty or only skipped) -> finish directly.
+        if (tasks.length) await INSERT.into(Tasks, tasks)
         await UPDATE(Jobs, { ID: job_ID }).with({ status: FINISHED })
-        await this.emit('jobUpdate', { job: { ...job, status: FINISHED } })
+        await this.emit('jobUpdate', { job: { ...job, tasks, status: FINISHED } })
       }
     })
 
-    if (tasks.length) {
-      if (cds.services[service]) {
+    if (openTasks.length) {
+      if (_canUseWorkers(this._conf)) {
+        const pool = getDeploymentPool(this._conf.workerSize)
+        const fn = async task => {
+          const result = await pool.exec(service, op, task.tenant, args)
+          // Worker ran in an isolated thread; invalidate this process's stale
+          // pool for the tenant (worker's disconnect didn't affect us).
+          if (_invalidatesTenantPool(op)) cds.db?.disconnect(task.tenant)
+          return result
+        }
+        this.jobQueue.enqueue({ job_ID, clusters: openClusters, fn, onJobDone })
+      } else if (cds.services[service]) {
         const fn = task => cds.services[service].tx({ tenant: task.tenant }, tx => tx[op](task.tenant, ...Object.values(args)))
-        this.jobQueue.enqueue({ job_ID, clusters: clustered, fn, onJobDone })
+        this.jobQueue.enqueue({ job_ID, clusters: openClusters, fn, onJobDone })
       } else {
-        this.jobQueue.enqueue({ job_ID, clusters: clustered, fn: () => {
+        this.jobQueue.enqueue({ job_ID, clusters: openClusters, fn: () => {
           LOG.warn('service', service, 'is not available, skipping job')
         }, onJobDone })
       }
       this.pickJob()
+    } else if (tasks.length) {
+      // Only skipped tasks (already FINISHED) -> notify callback since the job won't run.
+      await onJobDone?.()
     }
 
     const url = process.env.VCAP_APPLICATION ? 'https://' + JSON.parse(process.env.VCAP_APPLICATION).uris?.[0] : cds.server.url
@@ -260,6 +284,8 @@ module.exports = class JobsService extends cds.ApplicationService {
   }
 }
 
+module.exports.SKIPPED_DB = SKIPPED_DB
+
 function _errorMessage(e) {
   let message = e.message ?? 'Unknown error'
   if (e.error) message += ' ' + e.error
@@ -267,6 +293,19 @@ function _errorMessage(e) {
   return message.length > 5000 ? message.substring(0, 4997) + '...' : message // TODO use different datatype for errors -> next release
 }
 
+function _canUseWorkers(conf) {
+  // Workers must be explicitly enabled via configuration since they run in
+  // isolated threads with their own CDS bootstrap (no shared handlers/state)
+  if (!conf?.nativeWorkers) return false
+  return true
+}
+
+// Operations that change or drop a tenant's database, requiring the serving
+// process to disconnect its stale pooled connection for the tenant.
+function _invalidatesTenantPool(op) {
+  return op === 'unsubscribe' || op === 'subscribe'
+}
+
 /*********************************************
  * Clean-up
  *********************************************/

package/node_modules/@sap/cds-mtxs/srv/model-provider.js

@@ -3,7 +3,7 @@ const fs = require('fs').promises
 const path = require('path')
 const cds = require('@sap/cds/lib'), { tar, rimraf, exists, read, merge } = cds.utils
 const { readData, readDataCsv } = require('../lib/utils')
-const { worker4 } = require('./worker/pool')
+const { worker4 } = require('./worker/model-worker-pool')
 const conf = cds.requires['cds.xt.ModelProviderService'] || cds.requires.kinds['cds.xt.ModelProviderService']
 const TEMP_DIR = require('fs').realpathSync(require('os').tmpdir())
 const main = require('./config')
@@ -74,6 +74,15 @@ module.exports = class ModelProviderService extends cds.ApplicationService {
       if (invalid) return req.reject(400, `Unsupported input toggle param ${production ? '' : invalid}`)
     })
 
+    // `service` and `flavor` are interpolated into a file system path in `_getPrebuiltBundle`.
+    // Validate them here to prevent path traversal (e.g. reading arbitrary *.xml files).
+    this.before('getEdmx', req => {
+      const { service, flavor } = req.data
+      const _valid = v => v == null || /^(?!.*\.\.)[\w-.]+$/.test(v)
+      if (!_valid(service)) return req.reject(400, `Unsupported input service param ${service}`)
+      if (!_valid(flavor)) return req.reject(400, `Unsupported input flavor param ${flavor}`)
+    })
+
     this.on('getCsn', req => _getCsn(req))
 
     this.on('getExtCsn', req => {
@@ -202,7 +211,7 @@ module.exports = class ModelProviderService extends cds.ApplicationService {
 
       const skipMinify = (!!extensions || reqSkipMinify) && _delayMinify()
       let csn = await lru4(baseCache, JSON.stringify({ models, flavor, javaornode, skipMinify }), () =>
-        worker4(path.join(__dirname, 'worker/load.js'), { models, flavor, javaornode, skipMinify })
+        worker4(path.join(__dirname, 'worker/model-worker.js'), { models, flavor, javaornode, skipMinify })
       )
 
       if (extensions) {

package/node_modules/@sap/cds-mtxs/srv/plugins/common.js

@@ -43,13 +43,17 @@ cds.on('serving:cds.xt.DeploymentService', ds => {
     if (existingExt) cds.error(`Extensions exist, but extensibility is disabled. Upgrade aborted to avoid data loss`, { status: 500 })
   })
 
+  const _getVersion = () => JSON.stringify({ version: require(cds.root + '/package.json').version })
+
   ds.after('subscribe', async (_, req) => {
     const { tenant, metadata, schema } = req.data
     if (tenant === t0) return
 
+    const version = _getVersion()
+
     try {
       // can't use UPSERT here so @cds.on.insert still works for createdAt
-      await t0_(INSERT.into(Tenants, { ID: tenant, metadata: JSON.stringify(metadata), ...(schema ? { schema } : {}) }))
+      await t0_(INSERT.into(Tenants, { ID: tenant, metadata: JSON.stringify(metadata), ...(schema ? { schema } : {}), version }))
     } catch (e) {
       if (e.message === 'ENTITY_ALREADY_EXISTS' || e.code === 301 || e.message.match(/unique constraint/i)) {
         await t0_(async () => {
@@ -68,17 +72,15 @@ cds.on('serving:cds.xt.DeploymentService', ds => {
     LOG.info('subscribed tenant', tenant)
   })
 
-  // ds.after(['upgrade', 'extend'], async (_, req) => {
-  //   const { tenant } = req.data
-  //   if (tenant === t0) return
+  ds.after(['upgrade', 'extend'], async (_, req) => {
+    const { tenant } = req.data
+    if (tenant === t0) return
 
-  //   const version = JSON.stringify({
-  //     version: require(cds.root + '/package.json').version
-  //   })
+    const version = _getVersion()
 
-  //   await t0_(UPSERT.into(Tenants, { ID: tenant, version }))
-  //   LOG.info('upgraded tenant', tenant)
-  // })
+    await t0_(UPSERT.into(Tenants, { ID: tenant, version }))
+    LOG.info('upgraded tenant', tenant)
+  })
 
   ds.after('unsubscribe', async (_, req) => {
     const { tenant } = req.data
@@ -87,9 +89,14 @@ cds.on('serving:cds.xt.DeploymentService', ds => {
   })
 
   ds.prepend(() => {
-    ds.on('getTenants', async () => {
+    ds.on('getTenants', async req => {
+      const { options } = req.data ?? {}
+      const skipAfter = options?.skipAfter
+      const query = skipAfter
+        ? SELECT.from(Tenants, tenant => { tenant.ID }).where('modifiedAt <', skipAfter)
+        : SELECT.from(Tenants, tenant => { tenant.ID })
       return (await cds.tx({ tenant: t0 }, tx =>
-        tx.run(SELECT.from(Tenants, tenant => { tenant.ID }))
+        tx.run(query)
       )).map(({ ID }) => ID)
     })
   })

package/node_modules/@sap/cds-mtxs/srv/plugins/hana/hdi-ctnr-mgr.js

@@ -1,5 +1,6 @@
 const cds = require('@sap/cds')
-const { sm_url, baseurl } = cds.env.requires.db.credentials
+const { db } = cds.env.requires
+const { sm_url, baseurl, url, identity } = db.credentials || {}
 const LOG = cds.log('mtx')
 
 if (sm_url) {
@@ -9,7 +10,9 @@ if (sm_url) {
     LOG.warn('SaaS Provisioning Service is configured with ignoreNonExistingContainers. This can cause problems when using HANA TMS v2 as container manager.')
   }
   module.exports = require('./tms')
+} else if (db.serverless || db.kind === 'hana-serverless' || (url && identity)) {
+  module.exports = require('./serverless')
 } else {
-  LOG.warn('Neither Service Manager nor HANA TMS credentials found. No HANA HDI Containers will be accessible.')
+  LOG.warn('Neither Service Manager, HANA TMS, nor serverless credentials found. No HANA HDI Containers will be accessible.')
   module.exports = { defaultInstance: ()=> {} }
-}
+}

package/node_modules/@sap/cds-mtxs/srv/plugins/hana/serverless.js

@@ -0,0 +1,271 @@
+const cds = require('@sap/cds')
+const AbstractContainerManagerClient = require('./ctnr-mgr-base')
+const { token, fetchResiliently } = require('../../../lib/utils')
+const { uuid } = cds.utils
+const LOG = cds.log('mtx'), DEBUG = cds.debug('mtx|serverless')
+
+const API = '/serverless/v1/containers'
+
+class ServerlessClient extends AbstractContainerManagerClient {
+  constructor(credentials) {
+    super({ clientid: credentials.identity?.clientid, url: credentials.identity?.url })
+    this.gateway = credentials.url
+    this.identity = credentials.identity
+    this.certificate = this.identity?.certificate
+    this.key = this.identity?.key
+    this.certurl = this.identity?.certurl
+    this.url = this.identity?.url
+    this.clientid = this.identity?.clientid
+    this.credentialCache = {}
+    this.tokenCache = new Map()
+    this.delete = this.remove
+  }
+
+  static defaultInstance() {
+    ServerlessClient._defaultInstance ??= ServerlessClient.newInstance(ServerlessClient._resolveCredentials())
+    return ServerlessClient._defaultInstance
+  }
+
+  static _resolveCredentials() {
+    const credentials = { ...cds.env.requires.db.credentials }
+    let vcap
+    const _vcap = () => (vcap ??= (() => { try { return JSON.parse(process.env.VCAP_SERVICES || '{}') } catch { return {} } })())
+    if (!credentials.url) {
+      const serverless = (_vcap()['hana-cloud'] || []).find(s => s.plan === 'serverless') || (_vcap()['hana-cloud'] || [])[0]
+      const gw = credentials.credentials?.url || serverless?.credentials?.url || serverless?.credentials?.credentials?.url
+      if (gw) credentials.url = gw
+    }
+    const iasBinding = (_vcap().identity || [])[0]?.credentials
+    if (iasBinding) credentials.identity = iasBinding
+    else if (!credentials.identity) credentials.identity = credentials.credentials?.identity
+    if (!credentials.identity?.certificate) {
+      const identityBinding = ServerlessClient._resolveIdentityBinding()
+      if (identityBinding?.certificate) credentials.identity = identityBinding
+    }
+    return credentials
+  }
+
+  static _resolveIdentityBinding() {
+    const isIdentity = conf => conf?.kind === 'ias' || conf?.vcap?.label === 'identity'
+    for (const conf of Object.values(cds.env.requires || {})) {
+      if (isIdentity(conf) && conf.credentials?.certificate) return conf.credentials
+    }
+    return undefined
+  }
+
+  static newInstance(credentials) {
+    if (!credentials?.url) cds.error('Serverless gateway URL is not configured in credentials')
+    if (!credentials.identity?.certificate) cds.error('No identity (IAS) credentials found for the serverless Tenant API')
+    return new ServerlessClient(credentials)
+  }
+
+  _tokenFor = async () => {
+    const cached = this.tokenCache.get('provider')
+    if (cached && cached.expiry >= Date.now() + 30_000) return `Bearer ${cached.access_token}`
+    const raw = await token(this.identity, { form: { grant_type: 'client_credentials' }, path: '/oauth2/token' })
+    const { access_token, expires_in } = JSON.parse(raw)
+    this.tokenCache.set('provider', { access_token, expiry: Date.now() + expires_in * 1000 })
+    return `Bearer ${access_token}`
+  }
+
+  _api = async (tenant, path, conf = {}) => {
+    conf.headers ??= {}
+    conf.headers.Authorization ??= await this._tokenFor(tenant)
+    conf.headers['Accept'] ??= 'application/json'
+    conf.headers['Content-Type'] ??= 'application/json'
+    conf.headers['X-CorrelationID'] ??= cds.context?.id
+    const { retries, maxRetryAfter } = cds.requires?.multitenancy?.serviceManager ?? cds.requires?.multitenancy?.containerManager ?? {}
+    return fetchResiliently(this.gateway + path, conf, { retriesLeft: retries ?? 10, maxRetryAfter: maxRetryAfter ?? 5000 })
+  }
+
+  _pollLocation = async (tenant, location, extract) => {
+    let attempts = 0
+    const maxAttempts = 60, interval = 3000
+    for (;;) {
+      const { data } = await this._api(tenant, location.startsWith('http') ? location.slice(this.gateway.length) : location, { method: 'GET' })
+      const state = extract(data)
+      if (state === true) return data
+      if (state === 'FAILED') cds.error(`Serverless operation failed for ${location}: ${JSON.stringify(data)}`)
+      if (++attempts > maxAttempts) cds.error(`Polling ${location} timed out after ${(interval * maxAttempts) / 1000} seconds`)
+      await new Promise(r => setTimeout(r, interval))
+    }
+  }
+
+  _matchingContainers = (list, tenant) => {
+    const base = this._baseName(tenant)
+    return (list || []).filter(c => (c.labels || []).includes(`tenant_id=${tenant}`) || c.name === base || (c.name || '').startsWith(`${base}_`))
+  }
+
+  _findContainer = async (tenant) => {
+    const { data } = await this._api(tenant, API, { method: 'GET' })
+    const usable = c => !/(FAILED|DELETED|NOT_EXIST)$/.test(c.status?.state || '')
+    return this._matchingContainers(data.data, tenant).find(usable)
+  }
+
+  _removeStaleContainers = async (tenant) => {
+    const { data } = await this._api(tenant, API, { method: 'GET' })
+    const stale = this._matchingContainers(data.data, tenant).filter(c => /FAILED$/.test(c.status?.state || ''))
+    for (const c of stale) {
+      LOG.info('removing stale serverless container for', { tenant }, 'container', c.name, 'in state', c.status?.state)
+      const del = await this._api(tenant, `${API}/${c.id}`, { method: 'DELETE' }).catch(() => ({}))
+      const location = del.headers?.['location']
+      if (location) await this._pollLocation(tenant, location, d => /(SUCCEEDED|DELETED|NOT_EXIST)$/.test(d.status?.state || '') ? true : false).catch(() => {})
+    }
+  }
+
+  _findCredentials = async (tenant, containerId) => {
+    const { data } = await this._api(tenant, `${API}/${containerId}/credentials`, { method: 'GET' })
+    const list = data.data || []
+    return list.find(x => (x.state || '').endsWith('SUCCEEDED')) || list[0]
+  }
+
+  _credentialsDetail = async (tenant, containerId, credentialId) => {
+    const { data } = await this._api(tenant, `${API}/${containerId}/credentials/${credentialId}`, { method: 'GET' })
+    return this._toHdiCredentials(data)
+  }
+
+  _toHdiCredentials = (c) => ({
+    host: c.host,
+    port: String(c.port),
+    driver: c.driver || 'com.sap.db.jdbc.Driver',
+    schema: c.schema,
+    hdi_user: c.hdiUser,
+    hdi_password: c.hdiPassword,
+    user: c.user,
+    password: c.password,
+    certificate: c.certificate,
+    encrypt: true,
+    sslTrustAll: false,
+    validate_certificate: true,
+  })
+
+  get = async (tenant, options = {}) => {
+    const { disableCache } = options
+    if (!tenant) throw new Error('Tenant name is required')
+    if (!disableCache && this.credentialCache[tenant]) return this.credentialCache[tenant]
+    const container = await this._findContainer(tenant)
+    if (!container) cds.error(`Tenant '${tenant}' does not exist`, { status: 404 })
+    const credential = await this._findCredentials(tenant, container.id)
+    if (!credential) cds.error(`Tenant '${tenant}' has no usable credentials`, { status: 404 })
+    const credentials = await this._credentialsDetail(tenant, container.id, credential.id)
+    LOG.info('resolved serverless container for', { tenant }, 'container', container.name, 'schema', credentials.schema)
+    return this.credentialCache[tenant] = { name: container.name, tenant_id: tenant, credentials, container, tags: ['hana'] }
+  }
+
+  _waitContainerReady = async (tenant, containerId) => {
+    await this._pollLocation(tenant, `${API}/${containerId}`, d =>
+      d.status?.ready === true || d.status?.state?.endsWith('SUCCEEDED') ? true : (d.status?.state?.endsWith('FAILED') ? 'FAILED' : false)
+    )
+  }
+
+  _awaitBrokerContainer = async (tenant, attempts = 20, interval = 3000) => {
+    for (let i = 0; i < attempts; i++) {
+      const container = await this._findContainer(tenant)
+      if (container) return container
+      await new Promise(r => setTimeout(r, interval))
+    }
+    return undefined
+  }
+
+  create = async (tenant, parameters) => {
+    LOG.info('creating serverless HDI container for', { tenant })
+    let container = await this._findContainer(tenant)
+    const t0 = cds.env.requires.multitenancy?.t0 ?? 't0'
+    if (!container && tenant !== t0 && cds.env.requires.multitenancy?.serverless?.autoSubscription) {
+      LOG.info('awaiting broker-provisioned serverless container for', { tenant })
+      container = await this._awaitBrokerContainer(tenant)
+    }
+    if (!container) {
+      await this._removeStaleContainers(tenant)
+      const create = await this._api(tenant, API, {
+        method: 'POST',
+        data: { name: this._newContainerName(tenant), type: 'hdi', labels: [`tenant_id=${tenant}`, ...(parameters?.customLabels ?? [])] },
+      })
+      const location = create.headers['location']
+      await this._pollLocation(tenant, location, d => d.status?.state?.endsWith('SUCCEEDED') ? true : (d.status?.state?.endsWith('FAILED') ? 'FAILED' : false))
+      container = await this._findContainer(tenant)
+      if (!container) cds.error(`Serverless container for tenant '${tenant}' not found after creation`)
+    }
+    await this._waitContainerReady(tenant, container.id)
+    let credential = await this._findCredentials(tenant, container.id)
+    if (!credential) {
+      const create = await this._api(tenant, `${API}/${container.id}/credentials`, { method: 'POST', data: {} })
+      const location = create.headers['location']
+      await this._pollLocation(tenant, location, d => d.state?.endsWith('SUCCEEDED') ? true : (d.state?.endsWith('FAILED') ? 'FAILED' : false))
+      credential = await this._findCredentials(tenant, container.id)
+    }
+    const credentials = await this._credentialsDetail(tenant, container.id, credential.id)
+    LOG.info('created serverless container for', { tenant }, 'container', container.name, 'schema', credentials.schema)
+    return this.credentialCache[tenant] = { name: container.name, tenant_id: tenant, credentials, container, tags: ['hana'] }
+  }
+
+  getAll = async (tenants = '*', options = {}) => {
+    const seed = tenants === '*' ? null : tenants
+    const listTenant = seed?.[0]
+    let containers = []
+    if (listTenant) {
+      const { data } = await this._api(listTenant, API, { method: 'GET' })
+      containers = (data.data || []).filter(c => (c.labels || []).some(l => l.startsWith('tenant_id=')))
+    }
+    const results = []
+    for (const c of containers) {
+      const tenant_id = (c.labels.find(l => l.startsWith('tenant_id=')) || '').split('=')[1]
+      if (!tenant_id) continue
+      const entry = { labels: { tenant_id: [tenant_id] }, container: c }
+      if (options.skipCredentials) { results.push(entry); continue }
+      try {
+        const { credentials } = await this.get(tenant_id, options)
+        results.push({ ...entry, credentials })
+      } catch (e) {
+        if (e.status === 404) DEBUG?.('skipping tenant', tenant_id, 'without usable credentials')
+        else throw e
+      }
+    }
+    return results
+  }
+
+  remove = async (tenant) => {
+    const container = await this._findContainer(tenant)
+    if (!container) { delete this.credentialCache[tenant]; return {} }
+    const { data } = await this._api(tenant, `${API}/${container.id}/credentials`, { method: 'GET' })
+    for (const cred of data.data || []) {
+      const del = await this._api(tenant, `${API}/${container.id}/credentials/${cred.id}`, { method: 'DELETE' })
+      const location = del.headers['location']
+      if (location) await this._pollLocation(tenant, location, d => d.state?.endsWith('SUCCEEDED') || d.state?.endsWith('DELETED') ? true : false).catch(() => {})
+    }
+    const del = await this._api(tenant, `${API}/${container.id}`, { method: 'DELETE' })
+    const location = del.headers['location']
+    if (location) await this._pollLocation(tenant, location, d => d.status?.state?.endsWith('SUCCEEDED') || d.status?.state?.endsWith('DELETED') ? true : false).catch(() => {})
+    delete this.credentialCache[tenant]
+    return { container: container.id }
+  }
+
+  _createParams = (tenant, params = {}, metadata) => {
+    const hdiParams = this._hdiParams(tenant, params, metadata) ?? {}
+    const result = {}
+    const { custom_label } = hdiParams?.create ?? {}
+    if (custom_label) {
+      const [k] = custom_label.split('=')
+      if (k === 'tenant_id') cds.error('"tenant_id" is not allowed as a custom label key')
+      result.customLabels = [custom_label]
+    }
+    return Object.keys(result).length > 0 ? result : null
+  }
+
+  _encryptionParams = () => {
+    return {}
+  }
+
+  _baseName = (tenant) => {
+    let sanitized = String(tenant).replace(/[^A-Za-z0-9_]/g, '_').toUpperCase()
+    if (!/^[A-Za-z0-9]/.test(sanitized)) sanitized = `T${sanitized}`
+    return sanitized.slice(0, 24)
+  }
+
+  _newContainerName = (tenant) => {
+    const suffix = uuid().replace(/-/g, '').toUpperCase()
+    return `${this._baseName(tenant)}_${suffix}`.slice(0, 62)
+  }
+}
+
+module.exports = ServerlessClient

package/node_modules/@sap/cds-mtxs/srv/plugins/hana.js

@@ -15,8 +15,9 @@ const resources = new Map()
 
 const { deepMerge } = require('../../lib/utils')
 
-if (db?.kind === 'hana') {
-  if (!db.credentials?.sm_url && !db.credentials?.baseurl) cds.error('No Service Manager credentials found. Make sure the application is bound to a BTP Service Manager instance.')
+if (db?.kind === 'hana' || db?.kind === 'hana-serverless') {
+  const serverless = db.serverless || db.kind === 'hana-serverless' || (db.credentials?.url && db.credentials?.identity)
+  if (!db.credentials?.sm_url && !db.credentials?.baseurl && !serverless) cds.error('No Service Manager credentials found. Make sure the application is bound to a BTP Service Manager instance.')
 
   const hana = require('./hana/hdi-ctnr-mgr').defaultInstance()
   exports.activated = 'HANA Database'