@sap/cds-dk 10.1.1 → 10.2.0

package/lib/mtx/browser_login.js

@@ -0,0 +1,181 @@
+const cds = require('../cds');
+const crypto = require('node:crypto');
+const http = require('node:http');
+
+const DEBUG = cds.debug('cli');
+
+// Fixed candidate ports for the loopback redirect: IAS matches redirect_uri exactly
+// (incl. port), so `http://localhost:<port>/callback` must be pre-registered. First free wins.
+const DEFAULT_PORTS = [8990, 8991, 8992, 8993, 8994];
+
+// Base64-URL without padding (PKCE, RFC 7636).
+function base64url(buffer) {
+    return buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+
+// PKCE code_verifier + S256 code_challenge.
+function createPkce() {
+    const codeVerifier = base64url(crypto.randomBytes(32));
+    const codeChallenge = base64url(crypto.createHash('sha256').update(codeVerifier).digest());
+    return { codeVerifier, codeChallenge };
+}
+
+// Opens the URL in the default browser; returns whether a command was spawned.
+function openBrowser(url) {
+    const platform = process.platform;
+    let command, args, spawnOpts = { stdio: 'ignore', detached: true };
+    if (platform === 'darwin') {
+        command = 'open';
+        args = [url];
+    } else if (platform === 'win32') {
+        // Caret-escape cmd metacharacters (esp. `&`) so `start` doesn't truncate the URL.
+        const escaped = url.replace(/[&^|<>()%"]/g, m => '^' + m);
+        command = `start "" ${escaped}`;
+        args = [];
+        spawnOpts = { ...spawnOpts, shell: true, windowsVerbatimArguments: true };
+    } else {
+        command = 'xdg-open';
+        args = [url];
+    }
+    try {
+        const child = require('node:child_process').spawn(command, args, spawnOpts);
+        child.on('error', err => DEBUG?.(`Failed to open browser via ${command}: ${err.message}`));
+        child.unref();
+        return true;
+    } catch (err) {
+        DEBUG?.(`Failed to open browser via ${command}: ${err.message}`);
+        return false;
+    }
+}
+
+function escapeHtml(s) {
+    return String(s)
+        .replaceAll('&', '&amp;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;')
+        .replaceAll('"', '&quot;');
+}
+
+function htmlResponse(title, message) {
+    return `<!DOCTYPE html><html><head><meta charset="utf-8"><title>${escapeHtml(title)}</title></head>` +
+        `<body style="font-family:sans-serif;text-align:center;padding-top:3em">` +
+        `<h1>${escapeHtml(title)}</h1><p>${escapeHtml(message)}</p></body></html>`;
+}
+
+/**
+ * OAuth 2.0 Authorization Code + PKCE via a loopback redirect (RFC 8252): starts a
+ * local server on a fixed port (IAS requires an exact, pre-registered redirect_uri),
+ * opens the browser, and resolves with the authorization code.
+ *
+ * @param {object} metadata Authorization metadata from the server.
+ * @param {string} metadata.authorization_endpoint
+ * @param {string} metadata.client_id
+ * @param {string} [metadata.scope]
+ * @param {object} [options]
+ * @param {boolean} [options.noBrowser] Only print the URL instead of opening a browser.
+ * @param {number} [options.timeout] Milliseconds to wait for the redirect (default 300000).
+ * @param {number[]} [options.ports] Candidate fixed ports for the loopback server.
+ * @param {string} [options.host] Loopback host to bind/redirect to (default 'localhost').
+ * @returns {Promise<{code: string, codeVerifier: string, redirectUri: string}>}
+ */
+async function authorizeViaBrowser(metadata, { noBrowser = false, timeout = 5 * 60 * 1000, ports = DEFAULT_PORTS, host = 'localhost' } = {}) {
+    const { authorization_endpoint, client_id, scope, app_tid } = metadata;
+    if (!authorization_endpoint || !client_id) {
+        throw 'Incomplete authorization metadata received from server (missing authorization_endpoint or client_id).';
+    }
+
+    const { codeVerifier, codeChallenge } = createPkce();
+    const state = base64url(crypto.randomBytes(16));
+
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let timer;
+        const finish = (fn, arg) => {
+            if (settled) return;
+            settled = true;
+            clearTimeout(timer);
+            server.close();
+            fn(arg);
+        };
+
+        const server = http.createServer((req, res) => {
+            const requestUrl = new URL(req.url, redirectBase);
+            if (requestUrl.pathname !== '/callback') {
+                res.statusCode = 404;
+                return res.end();
+            }
+            const params = requestUrl.searchParams;
+            const error = params.get('error');
+            const returnedState = params.get('state');
+            const code = params.get('code');
+
+            if (error) {
+                res.setHeader('Content-Type', 'text/html');
+                res.end(htmlResponse('Login failed', `The identity provider returned an error: ${error}.`));
+                return finish(reject, `Authorization failed: ${error}${params.get('error_description') ? ` (${params.get('error_description')})` : ''}.`);
+            }
+            if (returnedState !== state) {
+                res.statusCode = 400;
+                res.setHeader('Content-Type', 'text/html');
+                res.end(htmlResponse('Login failed', 'State mismatch. Please try again.'));
+                return finish(reject, 'Authorization failed: state mismatch (possible CSRF). Please retry the login.');
+            }
+            if (!code) {
+                res.statusCode = 400;
+                res.setHeader('Content-Type', 'text/html');
+                res.end(htmlResponse('Login failed', 'No authorization code received.'));
+                return finish(reject, 'Authorization failed: no authorization code received.');
+            }
+
+            res.setHeader('Content-Type', 'text/html');
+            res.end(htmlResponse('Login successful', 'You may now close this tab and return to the terminal.'));
+            finish(resolve, { code, codeVerifier, redirectUri });
+        });
+
+        server.on('error', err => {
+            if (err.code === 'EADDRINUSE' && candidates.length) return listenNext(); // try next port
+            finish(reject, `Failed to start local login server: ${err.message}`);
+        });
+
+        let redirectBase, redirectUri;
+        const candidates = [...ports];
+        const listenNext = () => {
+            const port = candidates.shift();
+            server.listen(port, '127.0.0.1');
+        };
+        server.on('listening', () => {
+            const { port } = server.address();
+            redirectBase = `http://${host}:${port}`;
+            redirectUri = `${redirectBase}/callback`;
+
+            const authUrl = new URL(authorization_endpoint);
+            authUrl.searchParams.set('response_type', 'code');
+            authUrl.searchParams.set('client_id', client_id);
+            authUrl.searchParams.set('redirect_uri', redirectUri);
+            authUrl.searchParams.set('code_challenge', codeChallenge);
+            authUrl.searchParams.set('code_challenge_method', 'S256');
+            authUrl.searchParams.set('state', state);
+            if (scope) authUrl.searchParams.set('scope', scope);
+            if (app_tid) authUrl.searchParams.set('app_tid', app_tid); // multi-tenant IAS client disambiguation
+
+            timer = setTimeout(
+                () => finish(reject, 'Timed out waiting for browser login. Please try again.'),
+                timeout
+            );
+            timer.unref?.();
+
+            const url = authUrl.toString();
+            if (noBrowser || !openBrowser(url)) {
+                console.log('Please open the following URL in your browser to log in:');
+                console.log(`\n  ${url}\n`);
+            } else {
+                console.log('Opening browser for single sign-on. Complete the login there to continue…');
+                DEBUG?.(`Authorization URL: ${url}`);
+            }
+            DEBUG?.(`Waiting for the authorization code on ${redirectUri}`);
+        });
+        listenNext();
+    });
+}
+
+module.exports = { authorizeViaBrowser, createPkce, openBrowser, DEFAULT_PORTS };

package/lib/mtx/params.js

@@ -175,6 +175,12 @@ class BasicParams {
         // AUTH PARAMS
         // - non-persisted
         this.passcode               = new Param('passcode',               undefined, { obfuscate: ObfuscationLevel.partial });
+        this.authorizationCode      = new Param('authorizationCode',      undefined, { obfuscate: ObfuscationLevel.partial }); // IAS SSO: auth code
+        this.codeVerifier           = new Param('codeVerifier',           undefined, { obfuscate: ObfuscationLevel.full }); // IAS SSO: PKCE verifier
+        this.redirectUri            = new Param('redirectUri',            undefined, { internal: true }); // IAS SSO: loopback redirect
+        this.noBrowser              = new Param('noBrowser',              false, { internal: true }); // IAS SSO: don't auto-open browser
+        this.port                   = new Param('port',                   undefined); // IAS SSO: fixed loopback port
+        this.appTid                 = new Param('appTid',                 undefined, { internal: true }); // IAS SSO: app_tid
         this.password               = new Param('password',               undefined, { obfuscate: ObfuscationLevel.full });
         this.clientid               = new Param('clientid',               undefined);
         this.clientsecret           = new Param('clientsecret',           undefined, { obfuscate: ObfuscationLevel.partial });

package/lib/mtx/settings_manager.js

@@ -137,9 +137,10 @@ async function deriveUaaTokenUrl(params) {
 async function fetchAuthMetadata(params) {
     let fetchUrl = appUrlWith(OAUTH_META_PATH, params);
     DEBUG?.(`Trying to get authorization metadata from GET`, fetchUrl);
-    if (params.has('subdomain')) {
+    if (params.has('subdomain') || params.has('appTid')) {
         const u = new URL(fetchUrl);
-        u.searchParams.set('subdomain', params.get('subdomain'));
+        if (params.has('subdomain')) u.searchParams.set('subdomain', params.get('subdomain'));
+        if (params.has('appTid')) u.searchParams.set('app_tid', params.get('appTid'));
         fetchUrl = u.toString();
     }
     let responseData;
@@ -396,6 +397,27 @@ class SettingsManager {
                 throw 'Passcode cannot be empty';
             }
         }
+        // IAS browser SSO (Authorization Code + PKCE, loopback). Returns true if used,
+        // false to fall back to passcode entry (XSUAA).
+        async function addBrowserSso() {
+            const metadata = await fetchAuthMetadata(params);
+            if (metadata?.flow !== 'authorization_code') {
+                return false;
+            }
+            const { authorizeViaBrowser } = require('./browser_login');
+            const port = params.get('port');
+            // An explicit --app-tid wins over the server-resolved value on the authorize URL.
+            if (params.has('appTid')) metadata.app_tid = params.get('appTid');
+            const { code, codeVerifier, redirectUri } = await authorizeViaBrowser(metadata, {
+                noBrowser: params.get('noBrowser'),
+                ...(port && { ports: [Number(port)] })
+            });
+            params.set('authorizationCode', code);
+            params.set('codeVerifier', codeVerifier);
+            params.set('redirectUri', redirectUri);
+            if (metadata.app_tid) params.set('appTid', metadata.app_tid); // for the token exchange
+            return true;
+        }
         async function addAuthSettings() {
             function removeObsoleteToken() {
                 if (params.get('renewLogin') || params.get('tokenExpirationDate') <= Date.now()) {
@@ -467,8 +489,11 @@ class SettingsManager {
         }
 
         await addAuthSettings();
-        if (!logout && !params.has('token') && !params.has('refreshToken') && !params.has('passcode') && !params.has('clientsecret') && !params.has('key')) {
-            await addPasscode();
+        if (!logout && !params.has('token') && !params.has('refreshToken') && !params.has('passcode') && !params.has('authorizationCode') && !params.has('clientsecret') && !params.has('key')) {
+            // Prefer browser-based SSO (IAS); fall back to passcode entry (XSUAA).
+            if (!await addBrowserSso()) {
+                await addPasscode();
+            }
         }
     }
 

package/lib/util/cf.js

@@ -1,4 +1,5 @@
 const cp = require('child_process');
+const { X509Certificate } = require('crypto');
 const fsp = require('fs').promises;
 const os = require('os');
 const path = require('path');
@@ -13,6 +14,7 @@ const LOG = cds.log ? cds.log('cli') : console;
 const DEBUG = cds.debug('cli');
 
 const { bold, warn } = require('./term');
+const { ask4 } = require('./question');
 
 const { URLS } = require('../init/constants');
 
@@ -64,7 +66,7 @@ module.exports = new class CfUtil {
         }
     }
 
-    async curl(urlPath, queryObj, bodyObj) {
+    async curl(urlPath, queryObj, bodyObj, method = bodyObj ? 'POST' : 'GET') {
         let url = this.#target.apiEndpoint + urlPath
 
         const headers = { 'Authorization': this.#target.token }
@@ -77,9 +79,8 @@ module.exports = new class CfUtil {
             url += '?' + parts.join('&')
         }
 
-        const fetchOptions = { headers }
+        const fetchOptions = { headers, method }
         if (bodyObj) {
-            fetchOptions.method = 'POST'
             fetchOptions.headers['Content-Type'] = 'application/json'
             fetchOptions.body = JSON.stringify(bodyObj)
         }
@@ -100,7 +101,6 @@ module.exports = new class CfUtil {
         const data = text ? JSON.parse(text) : {}
 
         if (LOG._debug) {
-            const method = fetchOptions.method || 'GET'
             LOG.debug(`${method} ${url}\n${JSON.stringify({ headers: { ...headers, Authorization: 'bearer <token>' } }, null, 4)}\n${JSON.stringify(data, null, 4)}`)
         }
 
@@ -359,17 +359,24 @@ module.exports = new class CfUtil {
             }
         }
 
-        throw `Timeout occurred while getting service key ${bold(serviceKeyName)}`;
+        throw `timeout occurred while getting service key ${bold(serviceKeyName)}`;
     }
 
-    async getOrCreateServiceKey(serviceInstance, serviceKeyName, parameters, { silent = false } = {}) {
+    async getOrCreateServiceKey(serviceInstance, serviceKeyName, parameters, { silent = false, create = true } = {}) {
         const serviceKey = await this._getServiceKey(serviceInstance, serviceKeyName);
-        if (serviceKey) {
+        const expired = serviceKey?.certificate && serviceKey?.key && Date.parse(new X509Certificate(serviceKey.certificate).validTo) <= Date.now()
+        if (serviceKey && !expired) {
             DEBUG?.(`getting service key ${bold(serviceKeyName)}`)
             return serviceKey;
         }
+        if (expired) {
+            if (!create || !process.stdin.isTTY) throw `service key ${bold(serviceKeyName)} has expired`
+            await this.deleteServiceKey(serviceInstance, serviceKeyName, { silent })
+        } else if (!create) {
+            return
+        }
 
-        if (!silent) console.log(`creating service key ${bold(serviceKeyName)} - please be patient...`);
+        if (!silent && !expired) console.log(`creating service key ${bold(serviceKeyName)} - please be patient...`);
 
         const body = {
             type: 'key',
@@ -397,6 +404,35 @@ module.exports = new class CfUtil {
         throw `could not create service key ${bold(serviceKeyName)}`;
     }
 
+    async deleteServiceKey(serviceInstance, serviceKeyName, { silent = false } = {}) {
+        const query = { names: serviceKeyName, service_instance_guids: serviceInstance.guid }
+        const bindings = await this.curl('/v3/service_credential_bindings', query)
+        const binding = bindings?.resources?.find(binding => binding.name === serviceKeyName)
+        if (!binding) return
+        const bindingGuid = binding.guid
+
+        if (!await this.confirmServiceKeyDeletion(serviceKeyName)) {
+            throw `service key ${bold(serviceKeyName)} was not renewed because deletion was not confirmed`
+        }
+        if (!silent) console.log(`renewing expired service key ${bold(serviceKeyName)} - please be patient...`);
+        await this.curl(`/v3/service_credential_bindings/${encodeURIComponent(bindingGuid)}`, undefined, undefined, 'DELETE')
+
+        let counter = POLL_COUNTER
+        while (counter > 0) {
+            counter--
+            const remaining = await this.curl('/v3/service_credential_bindings', query)
+            if (!remaining?.resources?.some(binding => binding.guid === bindingGuid)) return
+            await this._sleep(POLL_DELAY)
+        }
+
+        throw `timeout occurred while deleting service key ${bold(serviceKeyName)}`
+    }
+
+    async confirmServiceKeyDeletion(serviceKeyName) {
+        const answer = await ask4([`service key ${bold(serviceKeyName)} has expired and must be deleted before it can be recreated, continue? (y/N) `])
+        return /^(y|yes)$/i.test(answer.trim())
+    }
+
     // CF V3 API treats commas in the 'names' filter as delimiters.
     // When a name contains a comma, omit it from the query and rely on client-side filtering.
     #safeNameQuery(query) {

package/lib/util/fs.js

@@ -61,8 +61,8 @@ async function copyRenderedJSON(src, dst, project) {
 /* General */
 
 function isRoot(folder) {
-    const { root, dir } = parse(folder)
-    return root === dir
+    const { root, dir, base } = parse(folder)
+    return root === dir && base === ''
 }
 
 const DEFAULT_CONCURRENCY = (() => {

package/node_modules/@cap-js/db-service/CHANGELOG.md

@@ -4,6 +4,29 @@
 - The format is based on [Keep a Changelog](http://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](http://semver.org/).
 
+## [3.1.2](https://github.com/cap-js/cds-dbs/compare/db-service-v3.1.1...db-service-v3.1.2) (2026-10-09)
+
+
+### Fixed
+
+* allow path expressions in infix filter of expands ([#1755](https://github.com/cap-js/cds-dbs/issues/1755)) ([cbe4f65](https://github.com/cap-js/cds-dbs/commit/cbe4f659add279fdb4155aad6bc155552dd276db))
+* **cqn2pql:** handle parameterized views in from_args ([#1738](https://github.com/cap-js/cds-dbs/issues/1738)) ([8f4dc35](https://github.com/cap-js/cds-dbs/commit/8f4dc354022b861569eab014cb469d4259c91278))
+* Primary keys were not resolved for localized. entities ([#1749](https://github.com/cap-js/cds-dbs/issues/1749)) ([410eef8](https://github.com/cap-js/cds-dbs/commit/410eef8f4487bd8e0c8b5a34a3637959095e255b))
+* recurse into xpr nodes in collectDistanceTo ([#1746](https://github.com/cap-js/cds-dbs/issues/1746)) ([c5dc20d](https://github.com/cap-js/cds-dbs/commit/c5dc20d8c1cd467aec4df3a33f0b6abe43027fe8))
+
+## [3.1.1](https://github.com/cap-js/cds-dbs/compare/db-service-v3.1.0...db-service-v3.1.1) (2026-09-15)
+
+
+### Fixed
+
+* **cqn4sql:** correctly expand `not exists <assoc>` alongside a null-check branch ([#1736](https://github.com/cap-js/cds-dbs/issues/1736)) ([bfb0a01](https://github.com/cap-js/cds-dbs/commit/bfb0a010cce2cea089f4fabf92a3ecea43486a09))
+
+
+### Performance Improvements
+
+* do not use ranked search for static values ([#1727](https://github.com/cap-js/cds-dbs/issues/1727)) ([33fb36b](https://github.com/cap-js/cds-dbs/commit/33fb36bbf0f86291e5fc0b9e2ff5b7244b49d19e))
+* if explicit order by is specified, do not add ranked search as a secondary clause ([33fb36b](https://github.com/cap-js/cds-dbs/commit/33fb36bbf0f86291e5fc0b9e2ff5b7244b49d19e))
+
 ## [3.1.0](https://github.com/cap-js/cds-dbs/compare/db-service-v3.0.1...db-service-v3.1.0) (2026-09-07)
 
 

package/node_modules/@cap-js/db-service/lib/cqn2pql.js

@@ -22,6 +22,10 @@ class CQN2PQLRenderer extends CQN2SQL {
     return super.column_expr(x, q)
   }
 
+  from_args(args) {
+    return `(${Object.keys(args).map(k => `${k}: ${this.expr(args[k])}`).join(', ')})`
+  }
+
   SELECT_expand(q, sql) { return sql }
 
   INSERT_entries(q) {

package/node_modules/@cap-js/db-service/lib/cqn2sql.js

@@ -579,6 +579,9 @@ class CQN2SQLRenderer {
           distanceVal = where[i]
           where[i] = { val: where[i].val + 1 }
         }
+        else if (c.xpr) {
+          collectDistanceTo(c.xpr, innot)
+        }
       }
     }
 

package/node_modules/@cap-js/db-service/lib/cqn4sql.js

@@ -33,9 +33,6 @@ const notSupportedOps = [['>'], ['<'], ['>='], ['<='], ['*'], ['+'], ['-'], ['/'
 
 const allOps = eqOps.concat(eqOps).concat(notEqOps).concat(notSupportedOps)
 
-
-const { depthGuarded, guardEntry } = require('./recursion-guard')
-
 const { pseudos } = require('./infer/pseudos')
 /**
  * Transforms a CDL style query into SQL-Like CQN:
@@ -58,17 +55,7 @@ const { pseudos } = require('./infer/pseudos')
  * @returns {object} transformedQuery the transformed query
  */
 function cqn4sql(originalQuery, model, useTechnicalAlias = true) {
-  // guardEntry bounds subquery nesting and resets the depth budget per top-level call
-  return guardEntry(_cqn4sql)(originalQuery, model, useTechnicalAlias)
-}
-
-function _cqn4sql(originalQuery, model, useTechnicalAlias = true) {
   const getImplicitAlias = str => _getImplicitAlias(str, useTechnicalAlias)
-  // guard xpr and inline/expand-on-struct nesting
-  // eslint-disable-next-line no-func-assign
-  getTransformedTokenStream = depthGuarded(getTransformedTokenStream)
-  // eslint-disable-next-line no-func-assign
-  nestedProjectionOnStructure = depthGuarded(nestedProjectionOnStructure)
   let inferred = typeof originalQuery === 'string' ? cds.parse.cql(originalQuery) : cds.ql.clone(originalQuery)
   const hasCustomJoins =
     originalQuery.SELECT?.from.args && (!originalQuery.joinTree || originalQuery.joinTree.isInitial)
@@ -198,7 +185,7 @@ function _cqn4sql(originalQuery, model, useTechnicalAlias = true) {
   /**
    * If the target entity is annotated with persistence skip and has an underlying db entity,
    * we treat it as a runtime view and transform it into a CTE.
-   *
+   * 
    * @param {object} transformedQuery - The query object to be transformed.
    * @param {string} model - The data model used for inference and transformation.
    */
@@ -214,10 +201,10 @@ function _cqn4sql(originalQuery, model, useTechnicalAlias = true) {
   }
 
   /**
-   * Recursively call cqn4sql for all nested runtime views to calculate cte and
+   * Recursively call cqn4sql for all nested runtime views to calculate cte and 
    * add it as a with clause to the transformed query.
    * Alias the runtime view with a unique alias and update all references to the runtime view to point to the alias.
-   *
+   * 
    * @param {object} rootDefinition - The root definition of the query. This is used to recursively process nested runtime views.
    * @param {object} transformedQuery - The query object to be transformed.
    * @param {string} model - The data model used for infer and cqn4sql.
@@ -338,9 +325,11 @@ function _cqn4sql(originalQuery, model, useTechnicalAlias = true) {
     // it would sort by a constant boolean.
     const ranksSearch =
       cds.db?.kind === 'hana' && cds.env.hana?.fuzzy !== false && cds.env.hana?.fuzzy?.ranked_search !== false
-    // count queries do not need ranked search
-    const isCountQuery = columns?.length === 1 && columns[0].func === 'count'
-    const searchRank = ranksSearch && !isCountQuery && inferred.$searchRank && buildSearchRankOrderBy(inferred.$searchRank)
+    // count queries or static values do not need ranked search
+    const isCountQuery = columns?.length === 1 && typeof columns[0] === 'object' && (columns[0].func === 'count' || 'val' in columns[0])
+    // a user-provided ORDER BY takes precedence over the search rank — don't inject the ranking then
+    const hasExplicitOrderBy = (orderBy || []).some(o => !o.implicit)
+    const searchRank = ranksSearch && !isCountQuery && !hasExplicitOrderBy && inferred.$searchRank && buildSearchRankOrderBy(inferred.$searchRank)
     if (searchRank) {
       // precedence: user ordering, then rank, then the runtime's implicit key ordering
       const implicitAt = (orderBy || []).findIndex(o => o.implicit)
@@ -419,8 +408,6 @@ function _cqn4sql(originalQuery, model, useTechnicalAlias = true) {
    */
   function translateAssocsToJoins() {
     let from
-    // guard association-path length
-    const joinForBranch = depthGuarded(_joinForBranch)
     /**
      * remember already seen aliases, do not create a join for them again
      */
@@ -444,7 +431,7 @@ function _cqn4sql(originalQuery, model, useTechnicalAlias = true) {
     })
     return from.args.length > 1 ? from : from.args[0]
 
-    function _joinForBranch(lhs, node) {
+    function joinForBranch(lhs, node) {
       const nextAssoc = inferred.joinTree.findNextAssoc(node)
       if (!nextAssoc || alreadySeen.has(nextAssoc.$refLink.alias)) return lhs.args.length > 1 ? lhs : lhs.args[0]
 
@@ -1033,11 +1020,11 @@ function _cqn4sql(originalQuery, model, useTechnicalAlias = true) {
             const keyName = k.as || k.ref.join('_')
             const fkName = `${elemName}_${keyName}`  // e.g., 'head_id'
             const fkFullName = `${columnAlias}_${fkName}`  // e.g., 'department_head_id'
-
+            
             // Check if this FK is excluded
             if (exclude.some(e => (e.ref?.at(-1) || e.as || e) === fkName)) continue
             if (exclude.some(e => (e.ref?.at(-1) || e.as || e) === fkFullName)) continue
-
+            
             const flatColumn = {
               ref: [joinAlias, fkName],
               as: fkFullName,
@@ -1055,7 +1042,7 @@ function _cqn4sql(originalQuery, model, useTechnicalAlias = true) {
             calcElement.as = fullName
           }
           res.push(calcElement)
-        }
+        }        
         else {
           // Scalar element
           const flatColumn = {
@@ -1776,8 +1763,10 @@ function _cqn4sql(originalQuery, model, useTechnicalAlias = true) {
         }
 
         const whereExists = { SELECT: whereExistsSubqueries(whereExistsSubSelects) }
-        transformedTokenStream[i + 1] = whereExists
-        // skip newly created subquery from being iterated
+        // append, don't index by `i`: a preceding branch (e.g. flattening `<assoc> is null`)
+        // may have changed the transformed stream's length, so `[i + 1]` would leave holes
+        transformedTokenStream.push(whereExists)
+        // skip the association ref which we just turned into the subquery
         i += 1
       } else if (token !== null && typeof token === 'object' && '#' in token) {
         // Enum token: resolve to its value
@@ -2966,7 +2955,7 @@ function setElementOnColumns(col, element) {
 
 function getPrimaryKey(entity, tableAlias = null) {
   const primaryKey = []
-  for (const k of Object.keys(entity.elements)) {
+  for (const k in entity.elements) {
     const e = entity.elements[k]
     if (e.key === true && !e.virtual && e.isAssociation !== true) {
       primaryKey.push({ ref: tableAlias ? [tableAlias, e.name] : [e.name] })

package/node_modules/@cap-js/db-service/lib/infer/index.js

@@ -5,19 +5,15 @@ const cds = require('@sap/cds')
 const JoinTree = require('./join-tree')
 const { pseudos } = require('./pseudos')
 const { isCalculatedOnRead, getImplicitAlias, getModelUtils, defineProperty, hasOwnSkip, isRuntimeView } = require('../utils')
-const { depthGuarded, guardEntry } = require('../recursion-guard')
 const cdsTypes = cds.builtin.types
 /**
  * @param {import('@sap/cds/apis/cqn').Query|string} originalQuery
  * @param {import('@sap/cds/apis/csn').CSN} [model]
  * @returns {import('./cqn').Query} = q with .target and .elements
  */
-function _infer(originalQuery, model, useTechnicalAlias = true) {
+function infer(originalQuery, model, useTechnicalAlias = true) {
   if (!model) throw new Error('Please specify a model')
   const inferred = originalQuery
-  // guard func args / lists / xpr / exists nesting
-  // eslint-disable-next-line no-func-assign
-  inferArg = depthGuarded(inferArg)
 
   const { getDefinition } = getModelUtils(model, originalQuery)
 
@@ -295,23 +291,19 @@ function _infer(originalQuery, model, useTechnicalAlias = true) {
      */
     function walkTokenStream(tokenStream, inXpr = false) {
       let skipJoins
-      const processToken = depthGuarded(walker())
-      tokenStream.forEach(processToken)
-
-      function walker() {
-        return t => {
-          if (t === 'exists') {
-            // no joins for infix filters along `exists <path>`
-            skipJoins = true
-          } else if (t.xpr) {
-            // don't miss an exists within an expression
-            t.xpr.forEach(processToken)
-          } else {
-            inferArg(t, queryElements, null, { inExists: skipJoins, inXpr, inQueryModifier: true })
-            skipJoins = false
-          }
+      const processToken = t => {
+        if (t === 'exists') {
+          // no joins for infix filters along `exists <path>`
+          skipJoins = true
+        } else if (t.xpr) {
+          // don't miss an exists within an expression
+          t.xpr.forEach(processToken)
+        } else {
+          inferArg(t, queryElements, null, { inExists: skipJoins, inXpr, inQueryModifier: true })
+          skipJoins = false
         }
       }
+      tokenStream.forEach(processToken)
     }
     /**
      * Processes references starting with `$self`, which are intended to target other query elements.
@@ -585,6 +577,10 @@ function _infer(originalQuery, model, useTechnicalAlias = true) {
         if ((!definition.target && definition.kind !== 'entity') || (!inFrom && !inCalcElement && danglingFilter))
           throw new Error('A filter can only be provided when navigating along associations')
         if (!inFrom && !arg.expand)defineProperty(arg, 'isJoinRelevant', true)
+        // The filter of an `expand` becomes the `where` of the expand subquery.
+        // Just like `where exists <assoc>[…]` semi-joins, path expressions in it are
+        // resolved via joins inside that subquery, so they must not be rejected here.
+        const filterOfExpand = !!arg.expand
         let skipJoinsForFilter = false
         step.where.forEach(token => {
           if (token === 'exists') {
@@ -595,7 +591,7 @@ function _infer(originalQuery, model, useTechnicalAlias = true) {
             // because they will become part of an EXISTS subquery
             inferArg(token, false, arg.$refLinks[i], {
               ...context,
-              inExists: skipJoinsForFilter || inExists || (inFrom && !danglingFilter),
+              inExists: skipJoinsForFilter || inExists || filterOfExpand || (inFrom && !danglingFilter),
               inXpr: !!token.xpr,
               inInfixFilter: true,
               inFrom,
@@ -605,7 +601,7 @@ function _infer(originalQuery, model, useTechnicalAlias = true) {
               applyToFunctionArgs(token.args, inferArg, [
                 false,
                 arg.$refLinks[i],
-                { inExists: skipJoinsForFilter || inExists || (inFrom && !danglingFilter), inXpr: true, inInfixFilter: true, inFrom },
+                { inExists: skipJoinsForFilter || inExists || filterOfExpand || (inFrom && !danglingFilter), inXpr: true, inInfixFilter: true, inFrom },
               ])
             }
           }
@@ -639,7 +635,7 @@ function _infer(originalQuery, model, useTechnicalAlias = true) {
         } else if (arg.inline && queryElements) {
           const elements = resolveInline(arg)
           for (const elName in elements) {
-            if (queryElements[elName] !== undefined) rejectDuplicatedElement(elName)
+            if (queryElements[elName] !== undefined) rejectDuplicatedElement(elName)  
           }
           Object.assign(queryElements, elements)
         } else {
@@ -675,7 +671,7 @@ function _infer(originalQuery, model, useTechnicalAlias = true) {
     // ignore whole expand if target of assoc along path has ”@cds.persistence.skip”
     if (arg.expand) {
       const { $refLinks } = arg
-
+      
       const skip = $refLinks.some(link => {
         const def = getDefinition(link.definition.target)
         return hasOwnSkip(def) && !isRuntimeView(def)
@@ -1295,7 +1291,4 @@ function getMainAlias (query) {
   return mainAlias
 }
 
-// guardEntry bounds nested-subquery re-entry (expand, from, set)
-const infer = guardEntry(_infer)
-
 module.exports = infer