@sap/cds-dk 10.1.1 → 10.2.0

package/node_modules/@sap/cds/libx/_runtime/common/generic/assert.js

@@ -6,19 +6,12 @@ const $has_asserts = Symbol.for('has_asserts')
 
 const { compileUpdatedDraftMessages } = require('../../fiori/lean-draft')
 
+const _stringify = val =>
+  Buffer.isBuffer(val) ? val.toString('base64') : val instanceof Date ? val.toISOString() : `${val}`
 const _serialize = obj =>
-  JSON.stringify(
-    Object.keys(obj)
-      .sort()
-      .reduce((a, k) => ((a[k] = obj[k]), a), {})
-  )
-
-const _bufferReviver = (key, value) => {
-  if (value && typeof value === 'object' && value.type === 'Buffer' && Array.isArray(value.data)) {
-    return Buffer.from(value.data)
-  }
-  return value
-}
+  Object.keys(obj)
+    .sort()
+    .reduce((_, k) => _ + k + ':' + _stringify(obj[k]) + '|', '|')
 
 const _hasAssert = entity => {
   if ($has_asserts in entity) return entity[$has_asserts]
@@ -50,7 +43,8 @@ module.exports = cds.service.impl(function () {
     if (!req.target) return
     if (!($has_asserts in req.target)) _hasAssert(req.target)
 
-    if (!cds.context?.tx || !req.target[$has_asserts]) return
+    const tx = cds.context?.tx
+    if (!tx || !req.target[$has_asserts]) return
 
     const IS_DRAFT_ENTITY = req.target.isDraft
 
@@ -65,21 +59,18 @@ module.exports = cds.service.impl(function () {
       ignore: element => element.isAssociation && !element.isComposition
     })
 
-    if (!cds.context.tx.changes) {
-      cds.context.tx.changes = {}
+    if (!tx.changes) {
+      tx.changes = {}
 
       req.before('commit', async () => {
-        const { changes } = cds.context.tx
+        const { changes } = tx
 
         const errors = []
 
         for (const [entityName, serializedChanges] of Object.entries(changes)) {
           if (!serializedChanges.size) continue
 
-          const deserializedChanges = Array.from(serializedChanges).map(([k, v]) => [JSON.parse(k, _bufferReviver), v])
-
           const entity = this.model.definitions[entityName]
-          const IS_DRAFT_ENTITY = entity.isDraft
 
           // Cache assert query on entity
           if (!Object.hasOwn(entity, 'assert')) {
@@ -101,21 +92,22 @@ module.exports = cds.service.impl(function () {
             entity.assert = cds.ql.SELECT([...Object.keys(entity.keys), ...asserts]).from(entity)
           }
 
-          const query = cds.ql.clone(entity.assert)
-
           // Select only rows with changes
           const keyNames = Object.keys(entity.keys).filter(
             k => !entity.keys[k].virtual && !entity.keys[k].isAssociation
           )
-          const keyMap = Object.fromEntries(keyNames.map(k => [k, true]))
 
-          query.where([
+          const deserializedChanges = Array.from(serializedChanges).map(([, v]) => [v.keys, v])
+
+          const query = cds.ql.clone(entity.assert)
+          const results = await query.where([
             { list: keyNames.map(k => ({ ref: [k] })) },
             'in',
             { list: deserializedChanges.map(([keyKV]) => ({ list: keyNames.map(k => ({ val: keyKV[k] })) })) }
           ])
 
-          const results = await query
+          const keyMap = Object.fromEntries(keyNames.map(k => [k, true]))
+          const IS_DRAFT_ENTITY = entity.isDraft
 
           for (const row of results) {
             const keyColumns = Object.fromEntries(Object.entries(row).filter(([k]) => k in keyMap))
@@ -201,7 +193,7 @@ module.exports = cds.service.impl(function () {
         const { row, target, pathSegmentsInfo } = elementInfo
         const targetName = target.name
 
-        cds.context.tx.changes[targetName] ??= new Map()
+        const changes = (tx.changes[targetName] ??= new Map())
 
         const keys = {}
         for (const key in target.keys) {
@@ -213,10 +205,9 @@ module.exports = cds.service.impl(function () {
         if (!Object.keys(keys).length) return
 
         const serialized = _serialize(keys)
-        const changes = cds.context.tx.changes[targetName]
         if (changes.has(serialized)) return
 
-        changes.set(serialized, { touched, req, pathSegmentsInfo: [...pathSegmentsInfo] })
+        changes.set(serialized, { keys, touched, req, pathSegmentsInfo: [...pathSegmentsInfo] })
       },
       templateProcessOptions
     )

package/node_modules/@sap/cds/libx/_runtime/common/generic/crud.js

@@ -1,4 +1,5 @@
 const cds = require('../../cds')
+const LOG = cds.log('app')
 const { SELECT } = cds.ql
 
 module.exports = exports = cds.service.impl(function () {
@@ -18,7 +19,7 @@ module.exports = exports = cds.service.impl(function () {
       ? SELECT.one`1 as $parent`.from({ ref: ref.slice(0, -1) })
       : null
     const parent_readable_check = parent_exists_query
-      ? async () => (parent_skip_auth ? cds.db : this).run(parent_exists_query).catch(() => null)
+      ? async () => (parent_skip_auth ? cds.db : this).run(parent_exists_query).catch(parent_unreadable_error)
       : null
 
     if (req.event === 'CREATE' && parent_readable_check != null) (await parent_readable_check()) || req.reject(404)
@@ -59,7 +60,7 @@ async function new_behavior(req, result, parent_readable_check) {
   switch (req.event) {
     case 'READ':
       if (!n && req._etagValidationType === 'if-match') req.reject(412)
-      if (!n && parent_readable_check != null) (await parent_readable_check()) || req.reject(404)
+      if ( (!n || result[0]?.$count === 0) && parent_readable_check != null) (await parent_readable_check()) || req.reject(404)
       return result
     case 'INSERT': case 'CREATE':
       if (result.affected != null) return result //> db service returned [affected]
@@ -84,6 +85,11 @@ async function legacy_behavior(req, result, parent) {
   }
 }
 
+function parent_unreadable_error(e) {
+  if (cds.error.isSystemError(e)) throw e
+  LOG._debug && LOG.debug('Parent readable check failed:', e)
+}
+
 exports._handle_result = legacy_behavior
 exports._always_return_arrays = on_off => {
   if (on_off === undefined) return exports._handle_result === new_behavior

package/node_modules/@sap/cds/libx/_runtime/common/utils/cqn.js

@@ -4,7 +4,7 @@ const { setEntityContained } = require('./csn')
 
 // scope: simple wheres à la "[{ ref: ['foo'] }, '=', { val: 'bar' }, 'and', ... ]"
 function where2obj(where, target = null, data = {}) {
-  for (let i = 0; i < where.length;) {
+  for (let i = 0; i < where.length; ) {
     const a = where[i++]
     if (a.xpr) {
       where2obj(a.xpr, target, data)

package/node_modules/@sap/cds/libx/_runtime/common/utils/rewriteAsterisks.js

@@ -72,7 +72,7 @@ const _resolveTarget = (ref, target) => {
   const element = target.elements[_ref]
   if (element) return element._target
 
-  throw cds.error(400, `Navigation property "${_ref}" is not defined in ${target.name}`)
+  throw cds.error(400, `Navigation property "${_ref}" does not exist in "${target.name}"`)
 }
 
 const rewriteExpandAsterisk = (columns, target) => {

package/node_modules/@sap/cds/libx/_runtime/fiori/lean-draft.js

@@ -195,6 +195,22 @@ const _cleanUpOldDrafts = (service, tenant) => {
   if (lastCheck && Date.now() - lastCheck < Number(interval)) return
 
   cds.spawn({ tenant, user: cds.User.privileged }, async () => {
+    //> Clean up orphaned drafts (drafts without DraftAdministrativeData)
+    if (cds.env.fiori.draft_orphan_cleanup) {
+      const orphanCleanups = []
+      for (const name in service.model.definitions) {
+        const target = service.model.definitions[name]
+        if (target.drafts) {
+          orphanCleanups.push(
+            DELETE.from(target.drafts).where({
+              DraftAdministrativeData_DraftUUID: { 'not in': SELECT('DraftUUID').from('DRAFT.DraftAdministrativeData') }
+            }).then(orphans => orphans > 0 && LOG.warn(`Cleaned up ${orphans} orphaned drafts from ${target.drafts.name}`))
+          )
+        }
+      }
+      await Promise.allSettled(orphanCleanups)
+    }
+
     const expiredDrafts = await SELECT.from('DRAFT.DraftAdministrativeData', ['DraftUUID']).where(
       `LastChangeDateTime <`,
       expiryDate
@@ -223,7 +239,7 @@ const _cleanUpOldDrafts = (service, tenant) => {
     for (let i = 0; i < draftRoots.length; i++) {
       const ids = draftRootIds[i]
       if (!ids.length) continue
-      const srv = await cds.connect.to(draftRoots[i]._service.name).catch(() => {})
+      const srv = await cds.connect.to(draftRoots[i]._service.name).catch(() => { })
       if (!srv) continue // srv might not be loaded
       for (const idObj of ids) {
         promises.push(srv.send({ event: 'CANCEL', query: DELETE.from(draftRoots[i], idObj), data: idObj }))
@@ -1031,10 +1047,14 @@ const draftHandle = async function (req) {
     }
 
     // Delete draft artefacts
-    await _promiseAll([
-      DELETE.from({ ref: draftRef }).where(query.SELECT.where),
-      DELETE.from('DRAFT.DraftAdministrativeData').where({ DraftUUID: DraftAdministrativeData_DraftUUID })
-    ])
+    if (cds.env.fiori.draft_admin_integrity) {
+      await DELETE.from('DRAFT.DraftAdministrativeData').where({ DraftUUID: DraftAdministrativeData_DraftUUID })
+    } else {
+      await _promiseAll([
+        DELETE.from({ ref: draftRef }).where(query.SELECT.where),
+        DELETE.from('DRAFT.DraftAdministrativeData').where({ DraftUUID: DraftAdministrativeData_DraftUUID })
+      ])
+    }
 
     if (req.res) {
       // status code must be set in handler to allow overriding for FE V2
@@ -1090,7 +1110,7 @@ const draftHandle = async function (req) {
       for (const assoc in target.associations) {
         const val = data[assoc]
         if (val && typeof val === 'object') {
-          const _target = req.target.associations[assoc]._target
+          const _target = target.associations[assoc]._target
           if (Array.isArray(val)) {
             val.forEach(v => _rmIsActiveEntity(v, _target))
           } else {
@@ -1352,6 +1372,7 @@ const Read = {
     LOG.debug('List Editing Status: Own Draft')
 
     if (!query._drafts) cds.error({ status: 400, message: 'INVALID_DRAFT_REQUEST' }) // only via drafts
+    if (query.SELECT.groupBy) cds.error({status: 400, message: '$groupby is not supported for drafts'})
 
     // read active from draft
     if (!query._drafts._target?.name.endsWith('.drafts')) {
@@ -1369,13 +1390,16 @@ const Read = {
       return result
     }
 
+    let innerQuery = query._drafts
+    while (innerQuery.SELECT.from.SELECT) innerQuery = innerQuery.SELECT.from
+
     const selectedColumnNames = query._drafts.SELECT.columns?.map(c => c.ref?.[0] || c) || ['*']
     const isAllKeysSelected =
       selectedColumnNames.includes('*') ||
       Object.keys(query._drafts._target.keys).every(k => selectedColumnNames.includes(k))
 
     let txModel
-    if (IS_PERSISTED_DRAFT_MESSAGES_ENABLED && isAllKeysSelected) {
+    if (IS_PERSISTED_DRAFT_MESSAGES_ENABLED && isAllKeysSelected && !innerQuery.SELECT.groupBy) {
       // Replace selection of 'DraftMessages' with the proper path expression
 
       query._drafts.SELECT.columns = [
@@ -1386,13 +1410,9 @@ const Read = {
       txModel = cds.context.tx.model
     }
 
-    const draftsQuery = query._drafts.where(
-      { ref: ['DraftAdministrativeData', 'InProcessByUser'] },
-      '=',
-      cds.context.user.id
-    )
+    innerQuery.where({ ref: ['DraftAdministrativeData', 'InProcessByUser'] }, '=', cds.context.user.id)
 
-    const drafts = await run(draftsQuery)
+    const drafts = await run(query._drafts)
     Read.merge(query._target, drafts, [], row => {
       Object.assign(row, {
         HasDraftEntity: false
@@ -1403,8 +1423,10 @@ const Read = {
         // Based on the query for own drafts, compile the ref of a query matching
         // the format produced by cds.odata.parse to compare against message prefixes
 
-        const queryRootEntity = txModel.definitions[draftsQuery.SELECT.from.ref[0].id || draftsQuery.SELECT.from.ref[0]]
-        const queryPrefixRef = _extractPrefixRef(draftsQuery.SELECT.from.ref, queryRootEntity)
+        const querySubjectRef = innerQuery.SELECT.from.ref
+
+        const queryRootEntity = txModel.definitions[querySubjectRef[0].id || querySubjectRef[0]]
+        const queryPrefixRef = _extractPrefixRef(querySubjectRef, queryRootEntity)
 
         if (queryPrefixRef.length > 1) {
           let targetRef = queryPrefixRef[queryPrefixRef.length - 1]
@@ -1416,8 +1438,8 @@ const Read = {
             // This repliactes the strucutally equivalent logic from _compileUpdatedDraftMessages
             // > This is necessary to enable filtering for messages realted to a newly created entity
             // > Since readAfterRide will put key info into a filter rather than into the path
-            for (const k in draftsQuery._target.actives.keys) {
-              const key = draftsQuery._target.actives.keys[k]
+            for (const k in query._drafts._target.actives.keys) {
+              const key = query._drafts._target.actives.keys[k]
               let v = row[key.name]
               if (v === undefined)
                 if (key.name === 'IsActiveEntity') v = false
@@ -1489,19 +1511,21 @@ const Read = {
     const getOrderByColumns = columns => {
       const selectAll = columns === undefined || columns.includes('*')
       const queryColumns = !selectAll && columns && columns.map(column => column.as || column?.ref?.[0]).filter(c => c)
-      const newColumns = []
+      const newColumns = new Map()
 
       for (const column of orderByExpr) {
+        const alias = column.ref.join('_')
+        if (newColumns.has(alias)) continue
         if (selectAll || !queryColumns.includes(column.ref.join('_'))) {
           if (column.ref.length === 1 && selectAll) continue
           const columnClone = { ...column }
           delete columnClone.sort
-          columnClone.as = columnClone.ref.join('_')
-          newColumns.push(columnClone)
+          columnClone.as = alias
+          newColumns.set(alias, columnClone)
         }
       }
 
-      return newColumns
+      return [...newColumns.values()]
     }
 
     let orderByDraftColumns
@@ -1617,29 +1641,29 @@ const Read = {
 
       const getSortFn =
         (index = 0) =>
-        (entityA, entityB) => {
-          const orderBy = orderByExpr[index]
-          const elementName = elementNamesToSort[index]
-          const collator = collatorMap.get(elementName)
-          const valueA = entityA[elementName]
-          const valueB = entityB[elementName]
-
-          if (valueA == null && valueB == null) {
-            // continue to next sort criterion
-            if (index + 1 < orderByExpr.length) return getSortFn(index + 1)(entityA, entityB)
-            return 0
-          }
+          (entityA, entityB) => {
+            const orderBy = orderByExpr[index]
+            const elementName = elementNamesToSort[index]
+            const collator = collatorMap.get(elementName)
+            const valueA = entityA[elementName]
+            const valueB = entityB[elementName]
+
+            if (valueA == null && valueB == null) {
+              // continue to next sort criterion
+              if (index + 1 < orderByExpr.length) return getSortFn(index + 1)(entityA, entityB)
+              return 0
+            }
 
-          const nullsFirst = orderBy.nulls ? orderBy.nulls.toLowerCase() === 'first' : orderBy.sort === 'asc'
-          if (valueA == null) return nullsFirst ? -1 : 1
-          if (valueB == null) return nullsFirst ? 1 : -1
+            const nullsFirst = orderBy.nulls ? orderBy.nulls.toLowerCase() === 'first' : orderBy.sort === 'asc'
+            if (valueA == null) return nullsFirst ? -1 : 1
+            if (valueB == null) return nullsFirst ? 1 : -1
 
-          const diff = collator.compare(valueA, valueB)
+            const diff = collator.compare(valueA, valueB)
 
-          if (diff === 0 && index + 1 < orderByExpr.length) return getSortFn(index + 1)(entityA, entityB)
-          if (orderBy.sort === 'desc') return diff * -1
-          return diff
-        }
+            if (diff === 0 && index + 1 < orderByExpr.length) return getSortFn(index + 1)(entityA, entityB)
+            if (orderBy.sort === 'desc') return diff * -1
+            return diff
+          }
 
       resultSet.sort(getSortFn())
     }
@@ -1660,8 +1684,8 @@ const Read = {
 
     const additionalCols = draftsQuery.SELECT.columns
       ? draftsQuery.SELECT.columns.filter(
-          c => c.ref && ['DraftAdministrativeData', 'DraftAdministrativeData_DraftUUID'].includes(c.ref[0])
-        )
+        c => c.ref && ['DraftAdministrativeData', 'DraftAdministrativeData_DraftUUID'].includes(c.ref[0])
+      )
       : [{ ref: ['DraftAdministrativeData_DraftUUID'] }]
     draftsQuery.SELECT.columns = _entityKeys(query._target)
       .map(k => ({ ref: [k] }))
@@ -1941,6 +1965,7 @@ function _cleansed(query, model) {
     if (target.drafts && cqn.where) cqn.where = _cleanseWhere(cqn.where, draftParams, DRAFT_ELEMENTS)
     if (target.drafts && cqn.orderBy) cqn.orderBy = _cleanseCols(cqn.orderBy, DRAFT_ELEMENTS, target) // allowed to reuse
     if (cqn.columns) cqn.columns = _cleanseCols(cqn.columns, DRAFT_ELEMENTS, target)
+    
     return q
   }
 
@@ -2015,13 +2040,16 @@ function _cleansed(query, model) {
 
   function _cleanseWhere(xpr, draftParams, ignoredElements) {
     const cleansed = []
+
     for (let i = 0; i < xpr.length; ++i) {
       let x = xpr[i]
-      const e = x.ref?.[0]
-      if (ignoredElements.has(e) && !xpr[i + 2]) {
+
+      const xprElement = x.ref?.[0]
+      if (ignoredElements.has(xprElement) && !xpr[i + 2]) {
         continue
       }
-      if (ignoredElements.has(e) && xpr[i + 2]) {
+
+      if (ignoredElements.has(xprElement) && xpr[i + 2]) {
         let { val } = xpr[i + 2]
         const param = x.ref.join('_')
         // outer-most parameters win
@@ -2032,6 +2060,7 @@ function _cleansed(query, model) {
         if (last === 'and' || last === 'or') cleansed.pop()
         continue
       }
+
       if (x.xpr) {
         x = { xpr: _cleanseWhere(x.xpr, draftParams, ignoredElements) }
         if (!x.xpr) {
@@ -2039,8 +2068,10 @@ function _cleansed(query, model) {
           continue
         }
       }
+
       cleansed.push(x)
     }
+
     const first = cleansed[0]
     if (first === 'and' || first === 'or') cleansed.shift()
     const last = cleansed[cleansed.length - 1]
@@ -2169,24 +2200,24 @@ async function onNew(req, next) {
 
   const adminDataCQN = isDirectAccess
     ? INSERT.into('DRAFT.DraftAdministrativeData').entries({
-        DraftUUID,
-        CreationDateTime: timestamp,
-        CreatedByUser: req.user.id,
-        LastChangeDateTime: timestamp,
-        LastChangedByUser: req.user.id,
-        DraftIsCreatedByMe: true, // Dummy values
-        DraftIsProcessedByMe: true, // Dummy values
+      DraftUUID,
+      CreationDateTime: timestamp,
+      CreatedByUser: req.user.id,
+      LastChangeDateTime: timestamp,
+      LastChangedByUser: req.user.id,
+      DraftIsCreatedByMe: true, // Dummy values
+      DraftIsProcessedByMe: true, // Dummy values
+      InProcessByUser: req.user.id,
+      ...(IS_PERSISTED_DRAFT_MESSAGES_ENABLED ? { DraftMessages: nextDraftMessages } : {})
+    })
+    : UPDATE('DRAFT.DraftAdministrativeData')
+      .data({
         InProcessByUser: req.user.id,
+        LastChangedByUser: req.user.id,
+        LastChangeDateTime: timestamp,
         ...(IS_PERSISTED_DRAFT_MESSAGES_ENABLED ? { DraftMessages: nextDraftMessages } : {})
       })
-    : UPDATE('DRAFT.DraftAdministrativeData')
-        .data({
-          InProcessByUser: req.user.id,
-          LastChangedByUser: req.user.id,
-          LastChangeDateTime: timestamp,
-          ...(IS_PERSISTED_DRAFT_MESSAGES_ENABLED ? { DraftMessages: nextDraftMessages } : {})
-        })
-        .where({ DraftUUID })
+      .where({ DraftUUID })
 
   await adminDataCQN
 
@@ -2278,15 +2309,15 @@ async function onEdit(req, next) {
       transition.mapping.size === 0
         ? rootWhere
         : (() => {
-            const whereKeys = Object.keys(rootWhere)
-            const w = {}
-            whereKeys.forEach(key => {
-              const mappedKey = transition.mapping.get(key)
-              const lockKey = mappedKey ? mappedKey.ref[0] : key
-              w[lockKey] = rootWhere[key]
-            })
-            return w
-          })()
+          const whereKeys = Object.keys(rootWhere)
+          const w = {}
+          whereKeys.forEach(key => {
+            const mappedKey = transition.mapping.get(key)
+            const lockKey = mappedKey ? mappedKey.ref[0] : key
+            w[lockKey] = rootWhere[key]
+          })
+          return w
+        })()
 
     const activeLockCQN = SELECT.from(lockTarget, [1]).where(lockWhere).forUpdate({ wait: 0 })
     activeLockCQN.SELECT.localized = false
@@ -2305,7 +2336,7 @@ async function onEdit(req, next) {
       existingDraft
     ]
 
-    ;[res, draft] = await _promiseAll(cqns)
+      ;[res, draft] = await _promiseAll(cqns)
   } else {
     const activeLockCQN = SELECT.from({ ref: req.query.SELECT.from.ref }, [1]).forUpdate({ wait: 0 })
     activeLockCQN.SELECT.localized = false
@@ -2411,21 +2442,29 @@ async function onCancel(req, next) {
   if (!cds.context.user._is_privileged && processByUser && processByUser !== cds.context.user.id)
     cds.error({ status: 403, message: 'DRAFT_LOCKED_BY_ANOTHER_USER', args: [processByUser] })
 
-  const deleteQuery = DELETE.from({ ref: req.query.DELETE.from.ref })
-  const deleteReq = _newReq(req, deleteQuery, draftParams, {})
-  const queries = [this.dispatch(deleteReq)]
-
   if (req.target['@Common.DraftRoot.ActivationAction']) {
     // The root entity is being deleted and draft admin data can be deleted
 
-    queries.push(
-      DELETE.from('DRAFT.DraftAdministrativeData').where({
+    if (cds.env.fiori.draft_admin_integrity) {
+      await DELETE.from('DRAFT.DraftAdministrativeData').where({
         DraftUUID: draft.DraftAdministrativeData_DraftUUID
       })
-    )
+    } else {
+      const deleteQuery = DELETE.from({ ref: req.query.DELETE.from.ref })
+      const deleteReq = _newReq(req, deleteQuery, draftParams, {})
+      await _promiseAll([
+        this.dispatch(deleteReq),
+        DELETE.from('DRAFT.DraftAdministrativeData').where({
+          DraftUUID: draft.DraftAdministrativeData_DraftUUID
+        })
+      ])
+    }
   } else {
     // A child entity is being deleted and draft admin data must be updated
 
+    const deleteQuery = DELETE.from({ ref: req.query.DELETE.from.ref })
+    const deleteReq = _newReq(req, deleteQuery, draftParams, {})
+
     const nextDraftAdminData = {
       InProcessByUser: cds.context.user.id,
       LastChangedByUser: cds.context.user.id,
@@ -2463,11 +2502,9 @@ async function onCancel(req, next) {
       .data(nextDraftAdminData)
       .where({ DraftUUID: draft.DraftAdministrativeData_DraftUUID })
 
-    queries.push(updateDraftAdminDataQuery)
+    await _promiseAll([this.dispatch(deleteReq), updateDraftAdminDataQuery])
   }
 
-  await _promiseAll(queries)
-
   return Object.assign([], { affected: 1 })
 }
 
@@ -2594,11 +2631,11 @@ module.exports = cds.service.impl(function () {
   this.handle = !cds.env.features.legacy_srv_results
     ? draftHandle
     : async function (req) {
-        if (req.protocol?.match(/odata/) && req.event in { NEW: 1 }) req._.readAfterWrite = true
+      if (req.protocol?.match(/odata/) && req.event in { NEW: 1 }) req._.readAfterWrite = true
 
-        const res = await draftHandle.call(this, req)
-        return Array.isArray(res) && 'affected' in res ? req.data : res
-      }
+      const res = await draftHandle.call(this, req)
+      return Array.isArray(res) && 'affected' in res ? req.data : res
+    }
 
   // NOTE: These handler registrations MUST use inline functions
   // NOTE: > Arrow functions or functions bound with `.bind` will 

package/node_modules/@sap/cds/libx/_runtime/messaging/common-utils/authorizedRequest.js

@@ -9,7 +9,30 @@ const authorizedRequest = ({ method, uri, path, oa2, tenant, dataObj, headers, t
     tokenStore = tokenStore[tenant]
   }
   return new Promise((resolve, reject) => {
-    if (LOG._debug) LOG.debug({ method, uri, path, oa2, tenant, dataObj, headers, tokenStore })
+    if (LOG._debug) {
+      const safeHeaders =
+        headers &&
+        Object.fromEntries(
+          Object.entries(headers).map(([k, v]) => [
+            k,
+            /^authorization$/i.test(k) ? String(v).split(' ')[0] + ' ...' : v
+          ])
+        )
+      // redacted() masks oa2.secret and mTLS cert/key by field name, but its key regex
+      // covers neither the bearer token in tokenStore nor the Authorization header.
+      LOG.debug(
+        cds.utils.redacted({
+          method,
+          uri,
+          path,
+          oa2,
+          tenant,
+          dataObj,
+          headers: safeHeaders,
+          tokenStore: tokenStore && { token: tokenStore.token ? '...' : undefined, expires_in: tokenStore.expires_in }
+        })
+      )
+    }
     ;((tokenStore.token && Promise.resolve(tokenStore.token)) || requestToken(oa2, tenant, tokenStore))
       .catch(err => reject(err))
       .then(token => {

package/node_modules/@sap/cds/libx/_runtime/messaging/common-utils/normalizeIncomingMessage.js

@@ -11,7 +11,7 @@ const _JSONorString = string => {
 const normalizeIncomingMessage = message => {
   const _payload = typeof message === 'object' ? message : _JSONorString(message)
   let data, headers
-  if (typeof _payload === 'object' && 'data' in _payload) {
+  if (_payload !== null && typeof _payload === 'object' && 'data' in _payload) {
     data = _payload.data
     headers = { ..._payload }
     delete headers.data

package/node_modules/@sap/cds/libx/_runtime/messaging/kafka.js

@@ -161,7 +161,7 @@ function _JSONorString(string) {
 function _normalizeIncomingMessage(message) {
   const _payload = _JSONorString(message)
   let data, headers
-  if (typeof _payload === 'object' && 'data' in _payload) {
+  if (_payload !== null && typeof _payload === 'object' && 'data' in _payload) {
     data = _payload.data
     headers = { ..._payload }
     delete headers.data

package/node_modules/@sap/cds/libx/_runtime/remote/Service.js

@@ -237,7 +237,7 @@ class RemoteService extends cds.Service {
       const requestConfig = extractRequestConfig(req, this)
       requestConfig.headers = _getHeaders(requestConfig.headers, req)
 
-      if (this.kind === 'hcql' && req.iterator && !req.objectMode)
+      if (this.kind === 'hcql' && (query?.SELECT?.stream || req.iterator && !req.objectMode))
         requestConfig.headers.accept = 'application/octet-stream,application/json'
 
       // REVISIT: we should not have to set the content-type at all for that
@@ -247,7 +247,7 @@ class RemoteService extends cds.Service {
       // Ensure request correlation (even with systems that use x-correlationid)
       const correlationId = requestConfig.headers['x-correlation-id'] || cds.context?.id
       requestConfig.headers['x-correlation-id'] = correlationId
-      requestConfig.headers['x-correlationid'] = correlationId
+      requestConfig.headers['x-correlationid'] = correlationId // REVISIT
 
       // Compile Cloud SDK options
       const additionalOptions = {

package/node_modules/@sap/cds/libx/_runtime/remote/utils/client.js

@@ -202,7 +202,7 @@ module.exports.run = async (requestConfig, options) => {
     response = await _executeHttpRequest({ requestConfig, destination, destinationOptions, jwt })
   } catch (e) {
     // for hcql, do not wrap error into a generic 502 error
-    if (options.kind === 'hcql') {
+    if (options.kind === 'hcql' && e.response?.data) {
       const { errors } = e.response.data
       if (errors) {
         const error =
@@ -278,7 +278,8 @@ module.exports.run = async (requestConfig, options) => {
 
   if (kind === 'hcql') {
     if (response.headers?.['content-type']?.includes('application/octet-stream')) return response.data
-    let { data = [], affected, $count } = response.data
+    let { data, errors, affected, $count } = response.data
+    if (!data && !errors) return response.data
     if (affected !== undefined) data.affected = affected
     if ($count == null && response.headers['x-total-count']) $count = Number(response.headers['x-total-count'])
     if ($count !== undefined) data.$count = $count