@sap/cds-dk 10.1.2 → 10.2.0

package/node_modules/@sap/cds/lib/srv/middlewares/auth/ias-auth.js

@@ -11,7 +11,7 @@ const {
 } = require('./xssec')
 
 module.exports = function ias_auth(config) {
-  // cds.env.requires.auth.known_claims is not an official config!
+  // cds.requires.auth.known_claims is not an official config!
   const { kind, credentials, config: serviceConfig = {}, known_claims = KNOWN_CLAIMS, xsuaa = 'xsuaa' } = config
   const skipped_attrs = known_claims.reduce((a, x) => ((a[x] = 1), a), {})
 
@@ -54,8 +54,8 @@ module.exports = function ias_auth(config) {
   // xsuaa fallback allows to also accept XSUAA tokens during migration to IAS
   // automatically enabled if xsuaa credentials are available
   let xsuaa_service, xsuaa_user_factory
-  if (cds.env.requires[xsuaa]?.credentials) {
-    const { credentials: xsuaa_credentials, config: xsuaa_serviceConfig = {} } = cds.env.requires[xsuaa]
+  if (cds.requires[xsuaa]?.credentials) {
+    const { credentials: xsuaa_credentials, config: xsuaa_serviceConfig = {} } = cds.requires[xsuaa]
     xsuaa_service = new XsuaaService(xsuaa_credentials, xsuaa_serviceConfig)
     const get_xsuaa_user_factory = require('./jwt-auth')._get_user_factory
     xsuaa_user_factory = get_xsuaa_user_factory(xsuaa_credentials, xsuaa_credentials.xsappname, 'xsuaa')
@@ -86,46 +86,47 @@ module.exports = function ias_auth(config) {
 }
 
 function get_user_factory(credentials, skipped_attrs) {
+  const enforce_provider_tenant = cds.env.requires.auth?.enforce_provider_tenant !== false
+
   return function user_factory(securityContext) {
     const tokenInfo = securityContext.token
     const payload = tokenInfo.getPayload()
 
-    /*
-     * NOTE:
-     *  for easier migration, xssec will offer IAS without policies via so-called XsuaaFallback.
-     *  in that case, we would need to add the roles here based on the tokenInfo (similar to xsuaa-auth).
-     *  however, it is not yet clear where the roles will be stored in IAS' tokenInfo object.
-     *  further, stakeholders would need to configure the "extension" programmatically (e.g., in a custom server.js).
-     */
+    let id = payload.sub
+
+    const roles = {}
+    if (Array.isArray(payload.ias_apis)) payload.ias_apis.forEach(r => (roles[r] = 1))
+    delete roles['system-user']
+    delete roles['internal-user']
 
     const clientid = tokenInfo.getClientId()
-    if (clientid === payload.sub) {
+    // An explicit identity type supersedes the legacy client/subject heuristic; unknown types fail closed.
+    const is_system_user = payload.sap_id_type == null ? !!clientid && clientid === payload.sub : payload.sap_id_type === 'app'
+    if (is_system_user) {
       //> grant_type === client_credentials or x509
-      const roles = { 'system-user': 1 }
-      if (Array.isArray(payload.ias_apis)) payload.ias_apis.forEach(r => (roles[r] = 1))
-      if (clientid === credentials.clientid) roles['internal-user'] = 1
-      else delete roles['internal-user']
-
-      const user = new cds.User({ id: 'system', roles, authInfo: securityContext })
-      return user
+      id = 'system'
+      roles['system-user'] = 1
+      const provider_tenant = credentials.app_tid ?? credentials.zone_uuid
+      const is_provider_tenant = !!provider_tenant && tokenInfo.getZoneId() === provider_tenant
+      if (clientid && clientid === credentials.clientid && (!enforce_provider_tenant || is_provider_tenant))
+        roles['internal-user'] = 1
     }
 
-    // add all unknown attributes to req.user.attr in order to keep public API small
     const attr = {}
-    for (const key in payload) {
-      if (key in skipped_attrs)
-        continue // REVISIT: Why do we need to do that?
-      else attr[key] = payload[key]
+    if (!('system-user' in roles)) {
+      // add all unknown attributes to req.user.attr in order to keep public API small
+      for (const key in payload) {
+        if (key in skipped_attrs)
+          continue // REVISIT: Why do we need to do that?
+        else attr[key] = payload[key]
+      }
+      // same api as xsuaa-auth for easier migration
+      if (attr.user_name) attr.logonName = attr.user_name
+      if (attr.given_name) attr.givenName = attr.given_name
+      if (attr.family_name) attr.familyName = attr.family_name
     }
 
-    // REVISIT: just don't such things, please! -> We're just piling up tech dept through tons of unoficcial long tail APIs like that!
-    // REVISIT: looks like wrong direction to me, btw
-    // same api as xsuaa-auth for easier migration
-    if (attr.user_name) attr.logonName = attr.user_name
-    if (attr.given_name) attr.givenName = attr.given_name
-    if (attr.family_name) attr.familyName = attr.family_name
-
-    const user = new cds.User({ id: payload.sub, attr, authInfo: securityContext })
+    const user = new cds.User({ id, roles, attr, authInfo: securityContext })
     return user
   }
 }
@@ -160,8 +161,10 @@ const KNOWN_CLAIMS = Object.values({
   SAP_GLOBAL_ZONE_ID: 'zone_uuid',
   // GROUPS: 'groups', //> do not exclude
   AUTHORIZATION_PARTY: 'azp',
+  SAP_ID_TYPE: 'sap_id_type',
   CNF: 'cnf',
   CNF_X5T: 'x5t#S256',
   // own
-  APP_TENANT_ID: 'app_tid'
+  APP_TENANT_ID: 'app_tid',
+  IAS_APIS: 'ias_apis'
 })

package/node_modules/@sap/cds/lib/srv/middlewares/auth/jwt-auth.js

@@ -51,6 +51,7 @@ module.exports = function jwt_auth(config) {
 
 function get_user_factory(credentials, xsappname, kind) {
   xsappname = xsappname + '.'
+  const enforce_provider_tenant = cds.env.requires.auth?.enforce_provider_tenant !== false
 
   return function user_factory(securityContext) {
     const tokenInfo = securityContext.token
@@ -70,7 +71,10 @@ function get_user_factory(credentials, xsappname, kind) {
     if (payload.grant_type in { client_credentials: 1, client_x509: 1 }) {
       id = 'system'
       roles['system-user'] = 1
-      if (tokenInfo.getClientId() === credentials.clientid) roles['internal-user'] = 1
+      const clientid = tokenInfo.getClientId()
+      const is_provider_tenant = !!credentials.tenantid && tokenInfo.getZoneId() === credentials.tenantid
+      if (clientid && clientid === credentials.clientid && (!enforce_provider_tenant || is_provider_tenant))
+        roles['internal-user'] = 1
     }
 
     const attr = { ...payload['xs.user.attributes'] }

package/node_modules/@sap/cds/lib/srv/middlewares/auth/mocked-users.js

@@ -7,7 +7,7 @@ class MockedUsers {
     const tenants = this.tenants = options.tenants || {}
     const users = this.users = options.users || {}
     for (let [k,v] of Object.entries(users)) {
-      if (!cds.env.requires.multitenancy) delete v.tenant
+      if (!cds.requires.multitenancy) delete v.tenant
       if (typeof v === 'boolean') continue
       if (typeof v === 'string') v = { password:v }
       let id = _configured(v).id || k

package/node_modules/@sap/cds/lib/srv/protocols/hcql.js

@@ -1,8 +1,6 @@
-const { pipeline } = require('node:stream/promises')
-const cds = require('../../index'), { inspect, decodeURI } = cds.utils
-const express = require('express')
-const SELECT = require('../../ql/SELECT')
-const PROD = process.env.NODE_ENV === 'production'
+const { pipeline } = require ('node:stream/promises')
+const express = require ('express')
+const cds = require ('../../index')
 const LOG = cds.log ('hcql')
 
 
@@ -11,11 +9,12 @@ class HCQLAdapter extends require('./http') {
   get router() {
     const bpo = this.body_parser_options
     const router = super.router
-      .get ('/\\$csn', this.schema.bind(this))
+      .get ('/', this.describe.bind(this))
       .use (express.json(bpo)) //> for application/json -> cqn
       .use (express.text(bpo)) //> for text/plain -> cql -> cqn
-      .use (this.log_request)
-    PROD || router.use (['/:entity/:id','/:entity'], this.shortcuts.bind(this))
+      .use (log_request)
+    if (process.env.NODE_ENV !== 'production')
+      router.use (['/:entity/:id','/:entity'], this.shortcut.bind(this))
     router.use ('/:event', this.action.bind(this))
     router.use (this.query.bind(this))
     return router
@@ -23,23 +22,63 @@ class HCQLAdapter extends require('./http') {
 
 
   /**
-   * Handler for logging incoming requests.
+   * Handler for /?describe requests.
+   * @type {express.RequestHandler}
    */
-  log_request (req,_,next) {
-    LOG.info (req.method,
-      decodeURI (req.baseUrl + req.path),
-      typeof req.body === 'string' ? req.body : inspect (req.body, { depth: 4 })
-    ); next()
-  }
+  describe (req, res) {
+    LOG.info (req.method, decodeURI (req.baseUrl + req.path), {...req.query})
+    const srv = this.service, response = { service: srv.name }
+    const { describe } = req.query
 
+    // Handle special describe requests like $csn
+    if (describe === '$csn') return res.json (
+      cds.minify (this.service.model, response)
+    )
+
+    // If no entities or actions are requested, return a service summary.
+    const entities = Object.keys(srv.entities)
+    const actions = Object.keys(srv.actions)
+    if (!describe) return res.json ({ ...response, entities, actions })
+
+    // Otherwise, return the description for the specified entities or actions.
+    const chosen = describe === 'all' ? [ ...entities, ...actions ] : describe.split(',')
+    chosen.forEach (each => {
+      const d = srv.entities[each] || srv.actions[each]
+      if (!d) return (response.unknown??=[]).push(each)
+      const section = response [d.kind === 'entity' ? 'entities' : 'actions'] ??= {}
+      const spec =  section[each] = { kind: d.kind }
+      if (d.elements) spec.elements = squeezed (d.elements)
+      if (d.params) spec.params = squeezed (d.params)
+      if (d.returns) spec.returns = Object.values(squeezed ([d.returns]))[0]
+    })
+    return res.json (response)
+
+    // Helper function to squeeze elements for concise representation
+    function squeezed (elements, fks) {
+      const response = {}
+      for (let e of elements) {
+        if (e['@odata.foreignKey4']) continue
+        if (e.target) {
+          let local = e.target.slice (srv.name.length + 1)
+          if (!srv.entities[local]) continue
+        }
+        let spec = response[e.name] = {}
+        if (e.key && !fks) spec.key = true
+        if (e.items) { spec = spec.items = {}; e = e.items }
+        if (e.type) spec.type =
+          e.isComposition ? `Composition of ${e.is2many ? 'many ':''}${local(e.target)}` :
+          e.isAssociation ? `Association to ${e.is2many ? 'many ':''}${local(e.target)}` :
+          e.type.replace(/^cds\./,'')
+        if (e.length) spec.type += `(${e.length})`
+        if (e.elements) spec.elements = squeezed (e.elements)
+        if (e.foreignKeys) spec.elements = squeezed (e.foreignKeys, 'fks')
+      }
+      return response
+    }
+    function local (name) {
+      return name.startsWith(srv.name+'.') ? name.slice (srv.name.length + 1) : name
+    }
 
-  /**
-   * Return the CSN as schema in response to /<srv>/$csn requests
-   * @type {express.RequestHandler}
-   */
-  schema (_, res) {
-    let csn = cds.minify (this.service.model, { service: this.service.name })
-    return res.json (csn)
   }
 
 
@@ -47,30 +86,44 @@ class HCQLAdapter extends require('./http') {
    * Handler for REST-style convenience shortcuts like GET /Books/201
    * @type {express.RequestHandler}
    */
-  shortcuts (req, res, next) {
-    let { entity, id } = req.params, tail, body = req.body
-    if (entity in this.service.actions) return this.action (req, res, next)
-    switch (req.method) {
-      case 'GET': {
-        if (entity.includes(' ')) [,entity,tail] = /^(\w+)( .*)?/.exec(entity)
-        else if (id?.includes(' ')) [,id,tail] = /^(\w+)( .*)/.exec(id)
-        else if (typeof body === 'string') [tail,body] = [body,undefined]
-        req.body = tail?.length ? id ? SELECT (`from ${entity} [ID=${id}] ${tail}`)
-          : SELECT (`from ${entity} ${tail}`)
-          : SELECT.from (entity, id)
-        if (typeof body === 'object') Object.assign (req.body.SELECT, body)
-        if (typeof body === 'string') {
-          let { from, ...clauses } = SELECT(`from x ${body}`).SELECT // eslint-disable-line no-unused-vars
-          Object.assign (req.body.SELECT, clauses)
-        }
-        break
+  shortcut (req, res, next) {
+    let { entity, id } = req.params, tail, body = req.body, srv =this.service
+    if (entity in srv.actions) return this.action (req, res, next)
+
+    if (req.method === 'GET') {
+      if (entity.includes(' ')) [,entity,tail] = /^(\w+)( .*)?/.exec(entity)
+      else if (id?.includes(' ')) [,id,tail] = /^(\w+)( .*)/.exec(id)
+      else if (typeof body === 'string') [tail,body] = [body,undefined]
+      const { SELECT } = cds.ql
+      const q = req.body = tail?.length ? id ? SELECT (`from ${entity} [${id}] ${tail}`)
+        : SELECT (`from ${entity} ${tail}`)
+        : {SELECT: subject('from') }
+      if (id !== undefined) q.SELECT.one = true //> ensures we reply 404 instead of 200 or 204
+      if (typeof body === 'object') Object.assign (q.SELECT, body)
+      if (typeof body === 'string') {
+        let { from, ...clauses } = SELECT(`from x ${body}`).SELECT // eslint-disable-line no-unused-vars
+        Object.assign (q.SELECT, clauses)
+      }
+    } else if (typeof body === 'string') {
+      throw new cds.error (400, `Request body cannot be a string for ${req.method} requests.`)
+    } else {
+      switch (req.method) {
+        case 'POST':   req.body = {INSERT:{ ...subject('into'), entries: [{...req.query,...body}] }}; break
+        case 'PUT':    req.body = {UPSERT:{ ...subject('into'), entries: [{...req.query,...body}] }}; break
+        case 'PATCH':  req.body = {UPDATE:{ ...subject('entity'), data: {...req.query,...body} }}; break
+        case 'DELETE': req.body = {DELETE:{ ...subject('from') }}; break
       }
-      case 'POST': req.body = INSERT.into (entity) .entries ({...req.query,...req.body}); break
-      case 'PUT': req.body = UPSERT.into (entity) .entries ({...req.query,...req.body}); break
-      case 'PATCH': req.body = UPDATE (entity, id) .with ({...req.query,...req.body}); break
-      case 'DELETE': req.body = DELETE.from (entity, id); break
     }
     return next()
+
+    /** Resolve the query's subject; expanding given id to {ID:id}, if any. */
+    function subject (clause) {
+      if (!id) return {[clause]: {ref:[entity]}}
+      let target = srv.entities[entity] || cds.error (400, `Couldn't resolve target entity: ${entity}`)
+      let keys = Object.keys (target.keys)
+      if (keys.length !== 1) cds.error (400, `Target entity ${entity} must have exactly one key`)
+      return {[clause]: {ref:[{ id:entity, where:[{ref:keys},'=',{val:id}] }]}, one:true }
+    }
   }
 
 
@@ -83,68 +136,122 @@ class HCQLAdapter extends require('./http') {
     if (!(event in this.service.actions)) return next() //> CRUD /:entity/:id
     if (!(req.method in {GET:1,POST:2})) return next(501) //> only GET and POST allowed
     const data = { ...req.query, ...req.body }
-    return this.exec ({ event, data }, req) .catch (next)
+    return this.exec ({ event, data, req, res }) .catch (next)
   }
 
 
   /**
-   * Handler for all CRUD requests.
+   * Handler for all CRUD requests with CQN or CQL queries.
    * @type {express.RequestHandler}
    */
   query (req, res, next) {
 
-    // Obtain query from request body, which may be a CQN object or a CQL string
-    const q = cds.ql (req.body) || cds.error (400, 'Invalid query', { query: req.body })
+    // Get query from request body
+    const body = req.body || cds.error (400, `Request body is missing.`)
+    const cqn = body.cqn || parse(body.cql) || parse(body) || body
+    const q = this.valid (cqn)
+    const $ = q[q.kind] // SELECT, INSERT, UPDATE, DELETE, ...
 
-    // Validate target entity against given model
-    if (this.service.definition) {
-      const t = cds.infer.target (q, this.service)
-      if (!t || t._unresolved) throw cds.error (400, 'Cannot determine target entity of query.', { query:q })
-    }
-
-    // Apply request headers
-    const $ = q.SELECT
-    if ($) {
-      if (req.get('Accept-Language')) $.localized = true
-      if (req.get('X-Total-Count')) $.count = true
-    }
+    // Apply additional request parameters to the query if present
+    if (req.get('X-Total-Count')) $.count = true
+    if (req.body.args) q.args = req.body.args
 
-    // Turn SELECT where $search(...) predicates into SELECT.search = [...] as expected for CQNs
-    if ($?.where?.[0].func === '$search') {
+    // Turn SELECT where $search(...) into SELECT.search = [...]
+    if ($.where?.[0].func === '$search') {
       $.search = $.where[0].args
       if ($.where.length === 1) delete $.where
       else $.where.splice (0, $.where[1] === '>' ? 4 : 2)
     }
 
-    // Deviate to streaming if query has .stream and client accepts octet-stream
-    if (q.stream && req.headers.accept?.includes ('application/octet-stream'))
-      // return this.service.read(q) .then (stream => {
-      return this.service.run (()=> q.bind (this.service) .stream() .then (stream => {
-        res.set ('content-type', 'application/octet-stream')
-        return pipeline (stream, res)
-      })) .catch (next)
+    // Deviate to streaming if client accepts octet-stream
+    if ($.stream || q.stream && req.headers.accept?.includes('application/octet-stream'))
+      return this.stream(q,req) .catch (next)
 
     // Regular handling for non-streaming queries
-    return this.exec (q,req) .catch (next)
+    return this.exec(q,req) .catch (next)
+  }
+
+
+  /**
+   * Validates a received and parsed query in CQN format.
+   * @returns {object|undefined} the validated query or undefined if invalid
+   */
+  valid (qry) {
+    const q = cds.ql(qry) || cds.error (400, `Not a valid query:`, q)
+    if (q.SET) cds.error (400, `UNIONs are not supported.`)
+
+    const $ = q[q.kind] || cds.error (400, `Not a valid query:`, q)
+
+    const has_subselect = $.from?.SELECT
+     || $.columns?.some(x => x.SELECT)
+     || $.having?.some(x => x.SELECT)
+     || $.where?.some(x => x.SELECT)
+    if (has_subselect) cds.error (400, `SUBSELECTs are not supported.`)
+    if ($.from?.join) cds.error (400, `JOINs are not supported.`)
+
+    const srv = this.service
+    if (srv.definition && cds.infer.target(q,srv)?.kind !== 'entity')
+      cds.error (400, `Couldn't resolve target entity for query:`, q)
+
+    const {allows} = cds.env.protocols.hcql
+    if (q.SELECT || q.INSERT || q.UPSERT) ;
+    else if (q.UPDATE && !allows.UPDATE.many) is_one(q,'entity')
+    else if (q.DELETE && !allows.DELETE.many) is_one(q,'from')
+
+    return q // looks good
+
+    /** Ensure it's a to-one query */
+    function is_one (q,subject) {
+      let keys = new Set (Object.keys(q._target.keys)) // expects q._target has been inferred before
+      let where = q[q.kind][subject]?.ref?.[0]?.where || $.where
+      if (where?.length === 1 && where[0]?.val != undefined) return true //> ok
+      if (where) for (;;) {
+        let [ref,op,val,and] = where
+        if (op !== '=' && op != '==') break
+        if (ref?.ref == undefined) break; else keys.delete(ref.ref[0])
+        if (val?.val == undefined) break
+        if (!and) {
+          if (keys.size === 0) return true //> ok
+          else break
+        }
+        if (and.toLowerCase() !== 'and') break
+        else where = where.slice(4)
+      }
+      throw new cds.error(403, `${q.kind} is allowed for single records only`) //> not ok
+    }
   }
 
 
   /**
    * Central method to dispatch requests to the service and replying outcomes back to the client.
-   * @param {cds.ql.Query} query the query to be executed
+   * @param {{ event, data }} qed a query of request details
    * @param {express.Request} req the HTTP request object
    * @param {express.Response} res the HTTP response object
-   * @returns {Promise<any>} results from service dispatch, which will be sent as JSON response body
+   * @returns {Promise<any>} results from service dispatch
    */
-  async exec (query, req, res = req.res) {
-    const request = new cds.Request (query.event ? { ...query, req, res } : { query, req, res })
-    const data = await this.service.dispatch (request)
-    if (res.headersSent) return
-    if (data == null && !request.messages) return res.sendStatus(204)
+  async exec (qed, req = qed.req, res = qed.res || req.res) {
+    const request = new cds.Request (qed.event ? qed : { query:qed, req, res })
+    const results = await this.service.dispatch (request)
+    if (res.headersSent) return //> response already sent by custom code
+    if (results?.$count !== undefined) res.set ('X-Total-Count', results.$count)
     if (request.event === 'CREATE') res.status(201)
-    if (data.$count !== undefined) res.set ('X-Total-Count', data.$count)
-    res.json (this.response4 ({ data, messages: request.messages }))
-    return data
+    if (request.messages == null && results == null)
+      return qed.SELECT?.one ? cds.error(404) : res.sendStatus(204)
+    else res.json (this.response4 ({ data: results, messages: request.messages }))
+    return results
+  }
+
+
+  /**
+   * Central method to execute streaming requests.
+   * @param {express.Request} req the HTTP request object
+   * @param {express.Response} res the HTTP response object
+   * @returns {Promise<void>} as returned by the streaming pipeline
+   */
+  async stream (q, req, res = req.res) {
+    const stream = await this.service.run (()=> q.bind(this.service).stream())
+    res.set ('content-type', 'application/octet-stream')
+    return pipeline (stream, res)
   }
 
 
@@ -167,4 +274,48 @@ class HCQLAdapter extends require('./http') {
   }
 }
 
+
+/**
+ * Parses the request body as a CQL query if it is a string.
+ * Returns the CQN or the original object if it is not a string.
+ */
+const parse = Object.assign (x => {
+  if (typeof x === 'string') try { return parse.cql(x) } catch(e) {
+    throw new cds.error (400, `Failed to parse CQL query: ${e.message}`, { query:x, cause:e })
+  }
+  else return x
+}, { cql: (
+  cds.env.ql.parser === 'cds-compiler' ? cds.parse.cql :
+  cds.env.ql.parser === 'compatible' ? require('../../ql/core').cql :
+  cds.env.ql.parser === 'cap.core' ? require('../../ql/core').cql :
+  cds.parse.cql
+)})
+
+
+/**
+ * Request logging middleware for HCQL adapter. Wrapped into an immediately
+ * invoked function expression (IIFE) to keep outline views clean and tidy.
+ */
+const log_request = (()=>{
+
+  const { YELLOW, GREEN, RESET, enabled:colors } = cds.utils.colors
+  const { inspect:cqn, decodeURI } = cds.utils, o = { colors, depth:11 }
+  const cql = x => {
+    let [cmd] = /^SELECT|INSERT|UPDATE|UPSERT|DELETE|CALL/i.exec(x) || ['']
+    return YELLOW + cmd.toUpperCase() + GREEN + x.slice(cmd.length) + RESET
+  }
+
+  /** @type {express.RequestHandler} */
+  return function log_request (req, res, next) {
+    LOG.info (req.method, decodeURI (req.baseUrl + req.path), (
+      typeof req.body === 'object' ? cqn(req.body,o) :
+      typeof req.body === 'string' ? cql(req.body) :
+      req.body ?? ''
+    ))
+    next()
+  }
+
+})()
+
+
 module.exports = HCQLAdapter

package/node_modules/@sap/cds/lib/srv/protocols/http.js

@@ -1,12 +1,16 @@
 const cds = require('../../index'), {i18n} = cds
 const express = require('express')
 
-
+/**
+ * The HTTP adapter for CDS services.
+ * @import {Service} from '../cds.Service.js'
+ */
 class HttpAdapter {
 
+
   /**
    * Constructs and returns a new express.Router
-   * @param {object} srv - The service instance
+   * @param {Service} srv - The service instance
    * @param {object} [o] - Options for the adapter
    * @returns {express.Router} The constructed router
    */
@@ -73,7 +77,7 @@ class HttpAdapter {
     const rr = d['@requires'] || d['@restrict']?.map(r => r.to).flat().filter(r => r)
     const roles = rr?.length ? Array.isArray(rr) ? rr : [rr] : (
       process.env.NODE_ENV === 'production' &&
-      cds.env.requires.auth?.restrict_all_services !== false &&
+      cds.requires.auth?.restrict_all_services !== false &&
       ['authenticated-user']
     )
     return super.authorize = roles && function check_roles (req, res, next) {

package/node_modules/@sap/cds/lib/srv/protocols/index.js

@@ -68,7 +68,12 @@ class Protocols {
           if (impl[0] === '.') impl = __dirname+impl.slice(1)
           else impl = require.resolve(impl,{paths:[cds.root]})
           impl = conf.impl = require(impl)
-        } catch { cds.error `Cannot find impl for protocol adapter: ${impl}` }
+          if (impl.default) impl = conf.impl = impl.default
+        } catch (e) {
+          if (e.code === 'MODULE_NOT_FOUND' && e.message.includes(impl))
+            cds.error `Cannot find impl for protocol adapter: ${impl}`
+          else throw e
+        }
         adapter = cached[kind] = impl.prototype ? new impl(srv, conf) : impl(srv, conf)
         if (!adapter) continue
       }
@@ -101,7 +106,7 @@ class Protocols {
    * @returns {{ kind:string, path:string }[]} Array of { kind, path } objects
    */
   endpoints4 (srv, o = srv.options) {
-    const def = srv.definition || {}
+    const def = srv.definition || srv || {}
     if (def.kind !== 'service') return [] //> no endpoints, e.g. for cds.db
 
     // get @protocol annotations from service definition

package/node_modules/@sap/cds/lib/srv/srv-dispatch.js

@@ -60,7 +60,7 @@ class CoreService {
       }()
       if (req.errors) throw req.reject()
     }
-    else if (req.event in (req.target?.actions ?? srv.actions)) throw _unhandled(this,req)
+    else if (!srv.mocked && req.event in (req.target?.actions ?? srv.actions)) throw _unhandled(this,req)
 
     // .after handlers run in parallel
     handlers = this.handlers.after.filter (h => h.for(req))
@@ -104,8 +104,8 @@ const _ensure_target = (srv,req) => {
 const _ensure_fqn = (x,p,srv, name = x[p]) => {
   if (name.id) return _ensure_fqn (name,'id', srv, name.id)
   if (srv.model) {
+    if (name in srv.entities) return x[p] = srv.entities[name].name // service local name
     if (name in srv.model.definitions) return // already an fqn
-    if (name in srv.entities) return x[p] = srv.entities[name].name
   }
   if (srv.isDatabaseService) return // db services allow unknown entities, e.g. 'sqlite.schema'
   if (!name.startsWith(srv.namespace+'.')) x[p] = `${srv.namespace}.${name}`

package/node_modules/@sap/cds/lib/utils/cds-utils.js

@@ -202,6 +202,43 @@ exports.write = function write (file, data, o) {
   return exports.mkdirp (dirname(f)).then (()=> fs.promises.writeFile (f,data,o))
 }
 
+const { setTimeout: sleep } = require('node:timers/promises')
+exports.lock = async function (file, retries = 10, delay = 20) {
+  file = resolve (cds.root, file)
+  const { open, unlink } = fs.promises
+  for (let i = 0; i < retries; i++) try {
+    const handle = await open (file+'.lock', 'wx')
+    await handle.close()
+    return {release:() => unlink (file+'.lock') .catch (err => {
+      if (err.code !== 'ENOENT') throw err // ignore if already deleted
+    })}
+  } catch (err) {
+    if (err.code === 'EEXIST') await sleep (delay)
+    else throw err
+  }
+  throw new Error('Could not acquire lock: connection timed out')
+}
+
+
+exports.edit = async function (json_file, callback, ifAbsent = ()=>({})) {
+    json_file = resolve (cds.root, json_file)
+    const lock = await exports.lock (json_file)
+  try {
+    const { readFile:read, writeFile:write, rename } = fs.promises
+    const data = await read (json_file, 'utf8') .then (JSON.parse, ifAbsent)
+    const edited = callback(data); if (!edited) return
+    const json = JSON.stringify (edited, null, 2)
+    const temp_file = `${json_file}.${process.pid}.tmp`
+    await write (temp_file, json, 'utf8')
+    await rename (temp_file, json_file)
+  } catch (error) {
+    throw new cds.error (`Failed to update ${json_file}!`, {cause: error})
+  } finally {
+    await lock.release()
+  }
+}
+
+
 exports.append = function append (file, data, o) {
   if (arguments.length === 1) return {to:(...path) => append(join(...path), data)}
   const f = resolve (cds.root,file)

package/node_modules/@sap/cds/lib/utils/csv-reader.js

@@ -4,7 +4,7 @@ const cds = require('..')
 
 const SEPARATOR = /[,;\t]/
 
-exports.parse = cds.parse.csv
+exports.parse = (...args) => cds.parse.csv (...args)
 
 exports.serialize = function (rows, columns, bom = '\ufeff') {
   let csv = bom + (columns || Object.keys(rows[0])).join(';') + "\n"
@@ -23,7 +23,7 @@ exports.readHeader = async function (inStream, o = { ignoreComments: true }) {
         return false
       }
       [delimiter] = SEPARATOR.exec(line) || [';']
-      cols = line.split(delimiter).map(each => each.trim()).filter(each => each.length)
+      cols = line.split(delimiter).map(each => each.trim().replace(/^"(.*)"$/, '$1')).filter(each => each.length)
       readLine.close() // signal that we have seen enough --> this only ends the readLine interface
     }
     return true