@sap/cds-dk 10.1.2 → 10.2.1

package/node_modules/@sap/cds/lib/srv/protocols/hcql.js

@@ -1,8 +1,6 @@
-const { pipeline } = require('node:stream/promises')
-const cds = require('../../index'), { inspect, decodeURI } = cds.utils
-const express = require('express')
-const SELECT = require('../../ql/SELECT')
-const PROD = process.env.NODE_ENV === 'production'
+const { pipeline } = require ('node:stream/promises')
+const express = require ('express')
+const cds = require ('../../index')
 const LOG = cds.log ('hcql')
 
 
@@ -11,11 +9,12 @@ class HCQLAdapter extends require('./http') {
   get router() {
     const bpo = this.body_parser_options
     const router = super.router
-      .get ('/\\$csn', this.schema.bind(this))
+      .get ('/', this.describe.bind(this))
       .use (express.json(bpo)) //> for application/json -> cqn
       .use (express.text(bpo)) //> for text/plain -> cql -> cqn
-      .use (this.log_request)
-    PROD || router.use (['/:entity/:id','/:entity'], this.shortcuts.bind(this))
+      .use (log_request)
+    if (process.env.NODE_ENV !== 'production')
+      router.use (['/:entity/:id','/:entity'], this.shortcut.bind(this))
     router.use ('/:event', this.action.bind(this))
     router.use (this.query.bind(this))
     return router
@@ -23,23 +22,63 @@ class HCQLAdapter extends require('./http') {
 
 
   /**
-   * Handler for logging incoming requests.
+   * Handler for /?describe requests.
+   * @type {express.RequestHandler}
    */
-  log_request (req,_,next) {
-    LOG.info (req.method,
-      decodeURI (req.baseUrl + req.path),
-      typeof req.body === 'string' ? req.body : inspect (req.body, { depth: 4 })
-    ); next()
-  }
+  describe (req, res) {
+    LOG.info (req.method, decodeURI (req.baseUrl + req.path), {...req.query})
+    const srv = this.service, response = { service: srv.name }
+    const { describe } = req.query
 
+    // Handle special describe requests like $csn
+    if (describe === '$csn') return res.json (
+      cds.minify (this.service.model, response)
+    )
+
+    // If no entities or actions are requested, return a service summary.
+    const entities = Object.keys(srv.entities)
+    const actions = Object.keys(srv.actions)
+    if (!describe) return res.json ({ ...response, entities, actions })
+
+    // Otherwise, return the description for the specified entities or actions.
+    const chosen = describe === 'all' ? [ ...entities, ...actions ] : describe.split(',')
+    chosen.forEach (each => {
+      const d = srv.entities[each] || srv.actions[each]
+      if (!d) return (response.unknown??=[]).push(each)
+      const section = response [d.kind === 'entity' ? 'entities' : 'actions'] ??= {}
+      const spec =  section[each] = { kind: d.kind }
+      if (d.elements) spec.elements = squeezed (d.elements)
+      if (d.params) spec.params = squeezed (d.params)
+      if (d.returns) spec.returns = Object.values(squeezed ([d.returns]))[0]
+    })
+    return res.json (response)
+
+    // Helper function to squeeze elements for concise representation
+    function squeezed (elements, fks) {
+      const response = {}
+      for (let e of elements) {
+        if (e['@odata.foreignKey4']) continue
+        if (e.target) {
+          let local = e.target.slice (srv.name.length + 1)
+          if (!srv.entities[local]) continue
+        }
+        let spec = response[e.name] = {}
+        if (e.key && !fks) spec.key = true
+        if (e.items) { spec = spec.items = {}; e = e.items }
+        if (e.type) spec.type =
+          e.isComposition ? `Composition of ${e.is2many ? 'many ':''}${local(e.target)}` :
+          e.isAssociation ? `Association to ${e.is2many ? 'many ':''}${local(e.target)}` :
+          e.type.replace(/^cds\./,'')
+        if (e.length) spec.type += `(${e.length})`
+        if (e.elements) spec.elements = squeezed (e.elements)
+        if (e.foreignKeys) spec.elements = squeezed (e.foreignKeys, 'fks')
+      }
+      return response
+    }
+    function local (name) {
+      return name.startsWith(srv.name+'.') ? name.slice (srv.name.length + 1) : name
+    }
 
-  /**
-   * Return the CSN as schema in response to /<srv>/$csn requests
-   * @type {express.RequestHandler}
-   */
-  schema (_, res) {
-    let csn = cds.minify (this.service.model, { service: this.service.name })
-    return res.json (csn)
   }
 
 
@@ -47,30 +86,44 @@ class HCQLAdapter extends require('./http') {
    * Handler for REST-style convenience shortcuts like GET /Books/201
    * @type {express.RequestHandler}
    */
-  shortcuts (req, res, next) {
-    let { entity, id } = req.params, tail, body = req.body
-    if (entity in this.service.actions) return this.action (req, res, next)
-    switch (req.method) {
-      case 'GET': {
-        if (entity.includes(' ')) [,entity,tail] = /^(\w+)( .*)?/.exec(entity)
-        else if (id?.includes(' ')) [,id,tail] = /^(\w+)( .*)/.exec(id)
-        else if (typeof body === 'string') [tail,body] = [body,undefined]
-        req.body = tail?.length ? id ? SELECT (`from ${entity} [ID=${id}] ${tail}`)
-          : SELECT (`from ${entity} ${tail}`)
-          : SELECT.from (entity, id)
-        if (typeof body === 'object') Object.assign (req.body.SELECT, body)
-        if (typeof body === 'string') {
-          let { from, ...clauses } = SELECT(`from x ${body}`).SELECT // eslint-disable-line no-unused-vars
-          Object.assign (req.body.SELECT, clauses)
-        }
-        break
+  shortcut (req, res, next) {
+    let { entity, id } = req.params, tail, body = req.body, srv =this.service
+    if (entity in srv.actions) return this.action (req, res, next)
+
+    if (req.method === 'GET') {
+      if (entity.includes(' ')) [,entity,tail] = /^(\w+)( .*)?/.exec(entity)
+      else if (id?.includes(' ')) [,id,tail] = /^(\w+)( .*)/.exec(id)
+      else if (typeof body === 'string') [tail,body] = [body,undefined]
+      const { SELECT } = cds.ql
+      const q = req.body = tail?.length ? id ? SELECT (`from ${entity} [${id}] ${tail}`)
+        : SELECT (`from ${entity} ${tail}`)
+        : {SELECT: subject('from') }
+      if (id !== undefined) q.SELECT.one = true //> ensures we reply 404 instead of 200 or 204
+      if (typeof body === 'object') Object.assign (q.SELECT, body)
+      if (typeof body === 'string') {
+        let { from, ...clauses } = SELECT(`from x ${body}`).SELECT // eslint-disable-line no-unused-vars
+        Object.assign (q.SELECT, clauses)
+      }
+    } else if (typeof body === 'string') {
+      throw new cds.error (400, `Request body cannot be a string for ${req.method} requests.`)
+    } else {
+      switch (req.method) {
+        case 'POST':   req.body = {INSERT:{ ...subject('into'), entries: [{...req.query,...body}] }}; break
+        case 'PUT':    req.body = {UPSERT:{ ...subject('into'), entries: [{...req.query,...body}] }}; break
+        case 'PATCH':  req.body = {UPDATE:{ ...subject('entity'), data: {...req.query,...body} }}; break
+        case 'DELETE': req.body = {DELETE:{ ...subject('from') }}; break
       }
-      case 'POST': req.body = INSERT.into (entity) .entries ({...req.query,...req.body}); break
-      case 'PUT': req.body = UPSERT.into (entity) .entries ({...req.query,...req.body}); break
-      case 'PATCH': req.body = UPDATE (entity, id) .with ({...req.query,...req.body}); break
-      case 'DELETE': req.body = DELETE.from (entity, id); break
     }
     return next()
+
+    /** Resolve the query's subject; expanding given id to {ID:id}, if any. */
+    function subject (clause) {
+      if (!id) return {[clause]: {ref:[entity]}}
+      let target = srv.entities[entity] || cds.error (400, `Couldn't resolve target entity: ${entity}`)
+      let keys = Object.keys (target.keys)
+      if (keys.length !== 1) cds.error (400, `Target entity ${entity} must have exactly one key`)
+      return {[clause]: {ref:[{ id:entity, where:[{ref:keys},'=',{val:id}] }]}, one:true }
+    }
   }
 
 
@@ -83,68 +136,122 @@ class HCQLAdapter extends require('./http') {
     if (!(event in this.service.actions)) return next() //> CRUD /:entity/:id
     if (!(req.method in {GET:1,POST:2})) return next(501) //> only GET and POST allowed
     const data = { ...req.query, ...req.body }
-    return this.exec ({ event, data }, req) .catch (next)
+    return this.exec ({ event, data, req, res }) .catch (next)
   }
 
 
   /**
-   * Handler for all CRUD requests.
+   * Handler for all CRUD requests with CQN or CQL queries.
    * @type {express.RequestHandler}
    */
   query (req, res, next) {
 
-    // Obtain query from request body, which may be a CQN object or a CQL string
-    const q = cds.ql (req.body) || cds.error (400, 'Invalid query', { query: req.body })
+    // Get query from request body
+    const body = req.body || cds.error (400, `Request body is missing.`)
+    const cqn = body.cqn || parse(body.cql) || parse(body) || body
+    const q = this.valid (cqn)
+    const $ = q[q.kind] // SELECT, INSERT, UPDATE, DELETE, ...
 
-    // Validate target entity against given model
-    if (this.service.definition) {
-      const t = cds.infer.target (q, this.service)
-      if (!t || t._unresolved) throw cds.error (400, 'Cannot determine target entity of query.', { query:q })
-    }
-
-    // Apply request headers
-    const $ = q.SELECT
-    if ($) {
-      if (req.get('Accept-Language')) $.localized = true
-      if (req.get('X-Total-Count')) $.count = true
-    }
+    // Apply additional request parameters to the query if present
+    if (req.get('X-Total-Count')) $.count = true
+    if (req.body.args) q.args = req.body.args
 
-    // Turn SELECT where $search(...) predicates into SELECT.search = [...] as expected for CQNs
-    if ($?.where?.[0].func === '$search') {
+    // Turn SELECT where $search(...) into SELECT.search = [...]
+    if ($.where?.[0].func === '$search') {
       $.search = $.where[0].args
       if ($.where.length === 1) delete $.where
       else $.where.splice (0, $.where[1] === '>' ? 4 : 2)
     }
 
-    // Deviate to streaming if query has .stream and client accepts octet-stream
-    if (q.stream && req.headers.accept?.includes ('application/octet-stream'))
-      // return this.service.read(q) .then (stream => {
-      return this.service.run (()=> q.bind (this.service) .stream() .then (stream => {
-        res.set ('content-type', 'application/octet-stream')
-        return pipeline (stream, res)
-      })) .catch (next)
+    // Deviate to streaming if client accepts octet-stream
+    if ($.stream || q.stream && req.headers.accept?.includes('application/octet-stream'))
+      return this.stream(q,req) .catch (next)
 
     // Regular handling for non-streaming queries
-    return this.exec (q,req) .catch (next)
+    return this.exec(q,req) .catch (next)
+  }
+
+
+  /**
+   * Validates a received and parsed query in CQN format.
+   * @returns {object|undefined} the validated query or undefined if invalid
+   */
+  valid (qry) {
+    const q = cds.ql(qry) || cds.error (400, `Not a valid query:`, q)
+    if (q.SET) cds.error (400, `UNIONs are not supported.`)
+
+    const $ = q[q.kind] || cds.error (400, `Not a valid query:`, q)
+
+    const has_subselect = $.from?.SELECT
+     || $.columns?.some(x => x.SELECT)
+     || $.having?.some(x => x.SELECT)
+     || $.where?.some(x => x.SELECT)
+    if (has_subselect) cds.error (400, `SUBSELECTs are not supported.`)
+    if ($.from?.join) cds.error (400, `JOINs are not supported.`)
+
+    const srv = this.service
+    if (srv.definition && cds.infer.target(q,srv)?.kind !== 'entity')
+      cds.error (400, `Couldn't resolve target entity for query:`, q)
+
+    const {allows} = cds.env.protocols.hcql
+    if (q.SELECT || q.INSERT || q.UPSERT) ;
+    else if (q.UPDATE && !allows.UPDATE.many) is_one(q,'entity')
+    else if (q.DELETE && !allows.DELETE.many) is_one(q,'from')
+
+    return q // looks good
+
+    /** Ensure it's a to-one query */
+    function is_one (q,subject) {
+      let keys = new Set (Object.keys(q._target.keys)) // expects q._target has been inferred before
+      let where = q[q.kind][subject]?.ref?.[0]?.where || $.where
+      if (where?.length === 1 && where[0]?.val != undefined) return true //> ok
+      if (where) for (;;) {
+        let [ref,op,val,and] = where
+        if (op !== '=' && op != '==') break
+        if (ref?.ref == undefined) break; else keys.delete(ref.ref[0])
+        if (val?.val == undefined) break
+        if (!and) {
+          if (keys.size === 0) return true //> ok
+          else break
+        }
+        if (and.toLowerCase() !== 'and') break
+        else where = where.slice(4)
+      }
+      throw new cds.error(403, `${q.kind} is allowed for single records only`) //> not ok
+    }
   }
 
 
   /**
    * Central method to dispatch requests to the service and replying outcomes back to the client.
-   * @param {cds.ql.Query} query the query to be executed
+   * @param {{ event, data }} qed a query of request details
    * @param {express.Request} req the HTTP request object
    * @param {express.Response} res the HTTP response object
-   * @returns {Promise<any>} results from service dispatch, which will be sent as JSON response body
+   * @returns {Promise<any>} results from service dispatch
    */
-  async exec (query, req, res = req.res) {
-    const request = new cds.Request (query.event ? { ...query, req, res } : { query, req, res })
-    const data = await this.service.dispatch (request)
-    if (res.headersSent) return
-    if (data == null && !request.messages) return res.sendStatus(204)
+  async exec (qed, req = qed.req, res = qed.res || req.res) {
+    const request = new cds.Request (qed.event ? qed : { query:qed, req, res })
+    const results = await this.service.dispatch (request)
+    if (res.headersSent) return //> response already sent by custom code
+    if (results?.$count !== undefined) res.set ('X-Total-Count', results.$count)
     if (request.event === 'CREATE') res.status(201)
-    if (data.$count !== undefined) res.set ('X-Total-Count', data.$count)
-    res.json (this.response4 ({ data, messages: request.messages }))
-    return data
+    if (request.messages == null && results == null)
+      return qed.SELECT?.one ? cds.error(404) : res.sendStatus(204)
+    else res.json (this.response4 ({ data: results, messages: request.messages }))
+    return results
+  }
+
+
+  /**
+   * Central method to execute streaming requests.
+   * @param {express.Request} req the HTTP request object
+   * @param {express.Response} res the HTTP response object
+   * @returns {Promise<void>} as returned by the streaming pipeline
+   */
+  async stream (q, req, res = req.res) {
+    const stream = await this.service.run (()=> q.bind(this.service).stream())
+    res.set ('content-type', 'application/octet-stream')
+    return pipeline (stream, res)
   }
 
 
@@ -167,4 +274,48 @@ class HCQLAdapter extends require('./http') {
   }
 }
 
+
+/**
+ * Parses the request body as a CQL query if it is a string.
+ * Returns the CQN or the original object if it is not a string.
+ */
+const parse = Object.assign (x => {
+  if (typeof x === 'string') try { return parse.cql(x) } catch(e) {
+    throw new cds.error (400, `Failed to parse CQL query: ${e.message}`, { query:x, cause:e })
+  }
+  else return x
+}, { cql: (
+  cds.env.ql.parser === 'cds-compiler' ? cds.parse.cql :
+  cds.env.ql.parser === 'compatible' ? require('../../ql/core').cql :
+  cds.env.ql.parser === 'cap.core' ? require('../../ql/core').cql :
+  cds.parse.cql
+)})
+
+
+/**
+ * Request logging middleware for HCQL adapter. Wrapped into an immediately
+ * invoked function expression (IIFE) to keep outline views clean and tidy.
+ */
+const log_request = (()=>{
+
+  const { YELLOW, GREEN, RESET, enabled:colors } = cds.utils.colors
+  const { inspect:cqn, decodeURI } = cds.utils, o = { colors, depth:11 }
+  const cql = x => {
+    let [cmd] = /^SELECT|INSERT|UPDATE|UPSERT|DELETE|CALL/i.exec(x) || ['']
+    return YELLOW + cmd.toUpperCase() + GREEN + x.slice(cmd.length) + RESET
+  }
+
+  /** @type {express.RequestHandler} */
+  return function log_request (req, res, next) {
+    LOG.info (req.method, decodeURI (req.baseUrl + req.path), (
+      typeof req.body === 'object' ? cqn(req.body,o) :
+      typeof req.body === 'string' ? cql(req.body) :
+      req.body ?? ''
+    ))
+    next()
+  }
+
+})()
+
+
 module.exports = HCQLAdapter

package/node_modules/@sap/cds/lib/srv/protocols/http.js

@@ -1,12 +1,16 @@
 const cds = require('../../index'), {i18n} = cds
 const express = require('express')
 
-
+/**
+ * The HTTP adapter for CDS services.
+ * @import {Service} from '../cds.Service.js'
+ */
 class HttpAdapter {
 
+
   /**
    * Constructs and returns a new express.Router
-   * @param {object} srv - The service instance
+   * @param {Service} srv - The service instance
    * @param {object} [o] - Options for the adapter
    * @returns {express.Router} The constructed router
    */
@@ -73,7 +77,7 @@ class HttpAdapter {
     const rr = d['@requires'] || d['@restrict']?.map(r => r.to).flat().filter(r => r)
     const roles = rr?.length ? Array.isArray(rr) ? rr : [rr] : (
       process.env.NODE_ENV === 'production' &&
-      cds.env.requires.auth?.restrict_all_services !== false &&
+      cds.requires.auth?.restrict_all_services !== false &&
       ['authenticated-user']
     )
     return super.authorize = roles && function check_roles (req, res, next) {

package/node_modules/@sap/cds/lib/srv/protocols/index.js

@@ -68,7 +68,12 @@ class Protocols {
           if (impl[0] === '.') impl = __dirname+impl.slice(1)
           else impl = require.resolve(impl,{paths:[cds.root]})
           impl = conf.impl = require(impl)
-        } catch { cds.error `Cannot find impl for protocol adapter: ${impl}` }
+          if (impl.default) impl = conf.impl = impl.default
+        } catch (e) {
+          if (e.code === 'MODULE_NOT_FOUND' && e.message.includes(impl))
+            cds.error `Cannot find impl for protocol adapter: ${impl}`
+          else throw e
+        }
         adapter = cached[kind] = impl.prototype ? new impl(srv, conf) : impl(srv, conf)
         if (!adapter) continue
       }
@@ -101,7 +106,7 @@ class Protocols {
    * @returns {{ kind:string, path:string }[]} Array of { kind, path } objects
    */
   endpoints4 (srv, o = srv.options) {
-    const def = srv.definition || {}
+    const def = srv.definition || srv || {}
     if (def.kind !== 'service') return [] //> no endpoints, e.g. for cds.db
 
     // get @protocol annotations from service definition

package/node_modules/@sap/cds/lib/srv/srv-dispatch.js

@@ -60,7 +60,7 @@ class CoreService {
       }()
       if (req.errors) throw req.reject()
     }
-    else if (req.event in (req.target?.actions ?? srv.actions)) throw _unhandled(this,req)
+    else if (!srv.mocked && req.event in (req.target?.actions ?? srv.actions)) throw _unhandled(this,req)
 
     // .after handlers run in parallel
     handlers = this.handlers.after.filter (h => h.for(req))
@@ -104,8 +104,8 @@ const _ensure_target = (srv,req) => {
 const _ensure_fqn = (x,p,srv, name = x[p]) => {
   if (name.id) return _ensure_fqn (name,'id', srv, name.id)
   if (srv.model) {
+    if (name in srv.entities) return x[p] = srv.entities[name].name // service local name
     if (name in srv.model.definitions) return // already an fqn
-    if (name in srv.entities) return x[p] = srv.entities[name].name
   }
   if (srv.isDatabaseService) return // db services allow unknown entities, e.g. 'sqlite.schema'
   if (!name.startsWith(srv.namespace+'.')) x[p] = `${srv.namespace}.${name}`

package/node_modules/@sap/cds/lib/utils/cds-utils.js

@@ -202,6 +202,56 @@ exports.write = function write (file, data, o) {
   return exports.mkdirp (dirname(f)).then (()=> fs.promises.writeFile (f,data,o))
 }
 
+const { setTimeout: sleep } = require('node:timers/promises')
+exports.lock = async function (file, retries = 10, delay = 20, stale = 5_000) {
+  file = resolve (cds.root, file)
+  const lockfile = file + '.lock'
+  const { open, unlink, stat } = fs.promises
+  // `retries` bounds waits on a live lock and, independently, reclaim attempts:
+  // a stale reclaim or a vanished-lock race retries the acquire at once — so the
+  // final reclaim still gets a matching attempt — without spinning unbounded.
+  for (let waited = 0, reclaims = 0; ;) try {
+    const handle = await open (lockfile, 'wx')
+    await handle.close()
+    return {release:() => unlink (lockfile) .catch (err => {
+      if (err.code !== 'ENOENT') throw err // ignore if already deleted
+    })}
+  } catch (err) {
+    if (err.code !== 'EEXIST') throw err
+    // Config edits normally complete quickly, so a lock older than `stale`
+    // likely belongs to a process that crashed mid-edit. A negative age means
+    // the lock vanished between the failed open and the stat — retry at once.
+    const age = await stat (lockfile) .then (s => Date.now() - s.mtimeMs, () => -1)
+    if (age < 0 || age > stale) {           // vanished, or stale → reclaim and retry now
+      if (age > stale) await unlink (lockfile) .catch (() => {})
+      if (reclaims++ < retries) continue
+    } else if (waited++ < retries) {        // held by a live process → wait and retry
+      await sleep (delay); continue
+    }
+    throw new Error (`Could not acquire lock on ${file}`, { cause: err })
+  }
+}
+
+
+exports.edit = async function (json_file, callback, ifAbsent = ()=>({})) {
+    json_file = resolve (cds.root, json_file)
+    const lock = await exports.lock (json_file)
+  try {
+    const { readFile:read, writeFile:write, rename } = fs.promises
+    const data = await read (json_file, 'utf8') .then (JSON.parse, ifAbsent)
+    const edited = callback(data); if (!edited) return
+    const json = JSON.stringify (edited, null, 2)
+    const temp_file = `${json_file}.${process.pid}.tmp`
+    await write (temp_file, json, 'utf8')
+    await rename (temp_file, json_file)
+  } catch (error) {
+    throw new cds.error (`Failed to update ${json_file}!`, {cause: error})
+  } finally {
+    await lock.release()
+  }
+}
+
+
 exports.append = function append (file, data, o) {
   if (arguments.length === 1) return {to:(...path) => append(join(...path), data)}
   const f = resolve (cds.root,file)

package/node_modules/@sap/cds/lib/utils/csv-reader.js

@@ -4,7 +4,7 @@ const cds = require('..')
 
 const SEPARATOR = /[,;\t]/
 
-exports.parse = cds.parse.csv
+exports.parse = (...args) => cds.parse.csv (...args)
 
 exports.serialize = function (rows, columns, bom = '\ufeff') {
   let csv = bom + (columns || Object.keys(rows[0])).join(';') + "\n"
@@ -23,7 +23,7 @@ exports.readHeader = async function (inStream, o = { ignoreComments: true }) {
         return false
       }
       [delimiter] = SEPARATOR.exec(line) || [';']
-      cols = line.split(delimiter).map(each => each.trim()).filter(each => each.length)
+      cols = line.split(delimiter).map(each => each.trim().replace(/^"(.*)"$/, '$1')).filter(each => each.length)
       readLine.close() // signal that we have seen enough --> this only ends the readLine interface
     }
     return true

package/node_modules/@sap/cds/libx/_runtime/common/generic/assert.js

@@ -6,19 +6,12 @@ const $has_asserts = Symbol.for('has_asserts')
 
 const { compileUpdatedDraftMessages } = require('../../fiori/lean-draft')
 
+const _stringify = val =>
+  Buffer.isBuffer(val) ? val.toString('base64') : val instanceof Date ? val.toISOString() : `${val}`
 const _serialize = obj =>
-  JSON.stringify(
-    Object.keys(obj)
-      .sort()
-      .reduce((a, k) => ((a[k] = obj[k]), a), {})
-  )
-
-const _bufferReviver = (key, value) => {
-  if (value && typeof value === 'object' && value.type === 'Buffer' && Array.isArray(value.data)) {
-    return Buffer.from(value.data)
-  }
-  return value
-}
+  Object.keys(obj)
+    .sort()
+    .reduce((_, k) => _ + k + ':' + _stringify(obj[k]) + '|', '|')
 
 const _hasAssert = entity => {
   if ($has_asserts in entity) return entity[$has_asserts]
@@ -50,7 +43,8 @@ module.exports = cds.service.impl(function () {
     if (!req.target) return
     if (!($has_asserts in req.target)) _hasAssert(req.target)
 
-    if (!cds.context?.tx || !req.target[$has_asserts]) return
+    const tx = cds.context?.tx
+    if (!tx || !req.target[$has_asserts]) return
 
     const IS_DRAFT_ENTITY = req.target.isDraft
 
@@ -65,21 +59,18 @@ module.exports = cds.service.impl(function () {
       ignore: element => element.isAssociation && !element.isComposition
     })
 
-    if (!cds.context.tx.changes) {
-      cds.context.tx.changes = {}
+    if (!tx.changes) {
+      tx.changes = {}
 
       req.before('commit', async () => {
-        const { changes } = cds.context.tx
+        const { changes } = tx
 
         const errors = []
 
         for (const [entityName, serializedChanges] of Object.entries(changes)) {
           if (!serializedChanges.size) continue
 
-          const deserializedChanges = Array.from(serializedChanges).map(([k, v]) => [JSON.parse(k, _bufferReviver), v])
-
           const entity = this.model.definitions[entityName]
-          const IS_DRAFT_ENTITY = entity.isDraft
 
           // Cache assert query on entity
           if (!Object.hasOwn(entity, 'assert')) {
@@ -101,21 +92,22 @@ module.exports = cds.service.impl(function () {
             entity.assert = cds.ql.SELECT([...Object.keys(entity.keys), ...asserts]).from(entity)
           }
 
-          const query = cds.ql.clone(entity.assert)
-
           // Select only rows with changes
           const keyNames = Object.keys(entity.keys).filter(
             k => !entity.keys[k].virtual && !entity.keys[k].isAssociation
           )
-          const keyMap = Object.fromEntries(keyNames.map(k => [k, true]))
 
-          query.where([
+          const deserializedChanges = Array.from(serializedChanges).map(([, v]) => [v.keys, v])
+
+          const query = cds.ql.clone(entity.assert)
+          const results = await query.where([
             { list: keyNames.map(k => ({ ref: [k] })) },
             'in',
             { list: deserializedChanges.map(([keyKV]) => ({ list: keyNames.map(k => ({ val: keyKV[k] })) })) }
           ])
 
-          const results = await query
+          const keyMap = Object.fromEntries(keyNames.map(k => [k, true]))
+          const IS_DRAFT_ENTITY = entity.isDraft
 
           for (const row of results) {
             const keyColumns = Object.fromEntries(Object.entries(row).filter(([k]) => k in keyMap))
@@ -201,7 +193,7 @@ module.exports = cds.service.impl(function () {
         const { row, target, pathSegmentsInfo } = elementInfo
         const targetName = target.name
 
-        cds.context.tx.changes[targetName] ??= new Map()
+        const changes = (tx.changes[targetName] ??= new Map())
 
         const keys = {}
         for (const key in target.keys) {
@@ -213,10 +205,9 @@ module.exports = cds.service.impl(function () {
         if (!Object.keys(keys).length) return
 
         const serialized = _serialize(keys)
-        const changes = cds.context.tx.changes[targetName]
         if (changes.has(serialized)) return
 
-        changes.set(serialized, { touched, req, pathSegmentsInfo: [...pathSegmentsInfo] })
+        changes.set(serialized, { keys, touched, req, pathSegmentsInfo: [...pathSegmentsInfo] })
       },
       templateProcessOptions
     )

package/node_modules/@sap/cds/libx/_runtime/common/generic/crud.js

@@ -60,7 +60,7 @@ async function new_behavior(req, result, parent_readable_check) {
   switch (req.event) {
     case 'READ':
       if (!n && req._etagValidationType === 'if-match') req.reject(412)
-      if (!n && parent_readable_check != null) (await parent_readable_check()) || req.reject(404)
+      if ( (!n || result[0]?.$count === 0) && parent_readable_check != null) (await parent_readable_check()) || req.reject(404)
       return result
     case 'INSERT': case 'CREATE':
       if (result.affected != null) return result //> db service returned [affected]

package/node_modules/@sap/cds/libx/_runtime/common/utils/rewriteAsterisks.js

@@ -72,7 +72,7 @@ const _resolveTarget = (ref, target) => {
   const element = target.elements[_ref]
   if (element) return element._target
 
-  throw cds.error(400, `Navigation property "${_ref}" is not defined in ${target.name}`)
+  throw cds.error(400, `Navigation property "${_ref}" does not exist in "${target.name}"`)
 }
 
 const rewriteExpandAsterisk = (columns, target) => {