@sap/cds-dk 10.1.2 → 10.2.1

package/node_modules/@sap/cds-mtxs/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-mtxs",
-  "version": "4.1.0",
+  "version": "4.2.1",
   "description": "SAP Cloud Application Programming Model - Multitenancy library",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [
@@ -23,7 +23,8 @@
   },
   "main": "lib/index.js",
   "dependencies": {
-    "@sap/hdi-deploy": "^5"
+    "@sap/hdi-deploy": "^5",
+    "tar": "^7"
   },
   "peerDependencies": {
     "@sap/cds": ">=9"
@@ -32,10 +33,12 @@
     "requires": {
       "kinds": {
         "multitenancy": {
-          "model": [
-            "@sap/cds-mtxs/srv/bootstrap"
-          ],
           "kind": "saas-registry",
+          "containerManager": {
+            "retries": 10,
+            "maxRetryAfter": 5000,
+            "lifecycleMaxRetryAfter": 300000
+          },
           "[subscription-manager]": {
             "kind": "subscription-manager"
           },
@@ -43,7 +46,6 @@
         },
         "extensibility": {
           "model": [
-            "@sap/cds-mtxs/srv/bootstrap",
             "@sap/cds-mtxs/db/extensions"
           ],
           "tenantCheckInterval": 10000
@@ -53,11 +55,7 @@
             "@sap/cds-mtxs/db/extensions"
           ]
         },
-        "toggles": {
-          "model": [
-            "@sap/cds-mtxs/srv/bootstrap"
-          ]
-        },
+        "toggles": {},
         "cds.xt.ModelProviderService": {
           "model": "@sap/cds-mtxs/srv/model-provider"
         },
@@ -139,12 +137,13 @@
           }
         },
         "cds.xt.ModelProviderService-from-sidecar": {
-          "kind": "rest"
+          "kind": "cds.xt.ModelProviderService"
         },
         "cds.xt.DeploymentService-from-sidecar": {
-          "kind": "rest"
+          "kind": "cds.xt.DeploymentService"
         },
         "cds.xt.ModelProviderService-in-sidecar": {
+          "kind": "cds.xt.ModelProviderService",
           "[development]": {
             "root": "../.."
           },
@@ -156,7 +155,9 @@
           },
           "_in_sidecar": true
         },
-        "cds.xt.DeploymentService-in-sidecar": {}
+        "cds.xt.DeploymentService-in-sidecar": {
+          "kind": "cds.xt.DeploymentService"
+        }
       }
     },
     "[with-mtx-sidecar]": {

package/node_modules/@sap/cds-mtxs/srv/cf/abstract-provisioning-service.js

@@ -5,6 +5,7 @@ const { fetchResiliently, token } = require('../../lib/utils')
 const DeploymentService = 'cds.xt.DeploymentService'
 const JobsService = 'cds.xt.JobsService'
 const Tenants = 'cds.xt.Tenants'
+const SUBSCRIBED = 'SUBSCRIBED'
 const { SKIPPED_DB } = require('../jobs-service')
 
 // we need to run in multitenancy mode for t0 ops
@@ -77,8 +78,8 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
       const js = await cds.connect.to(JobsService)
       const tx = js.tx({ tenant: context.tenant, user: new cds.User.Privileged() })
       const result = await tx.enqueue(DeploymentService, 'subscribe', [new Set([tenant])], { data, options }, error => {
-        if (error) this._sendCallback('FAILED', `Tenant creation failed with error '${error}'`)
-        else this._sendCallback('SUCCEEDED', 'Tenant creation succeeded', appUrl)
+        if (error) return this._sendCallback('FAILED', `Tenant creation failed with error '${error}'`)
+        return this._sendCallback('SUCCEEDED', 'Tenant creation succeeded', appUrl)
       })
       if (context.data.eventType === 'UPDATE') {
         return appUrl
@@ -102,20 +103,20 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
     const tenant = this._getSubscribedTenant(context)
     if (tenant) {
       const one = await cds.tx({ tenant: t0 }, tx =>
-        tx.run(SELECT.one.from(Tenants).columns(['metadata', 'createdAt', 'modifiedAt']).where({ ID: tenant }))
+        tx.run(SELECT.one.from(Tenants).columns(['metadata', 'status', 'createdAt', 'modifiedAt']).where({ ID: tenant }))
       )
       if (!one) cds.error(`Tenant ${tenant} not found`, { status: 404 })
-      const { metadata, createdAt, modifiedAt } = one
-      return { subscribedTenantId: tenant, ...this._toMetadataJson(metadata, tenant), createdAt, modifiedAt }
+      const { metadata, status = 'SUBSCRIBED', createdAt, modifiedAt } = one
+      return { subscribedTenantId: tenant, ...this._toMetadataJson(metadata, tenant), status, createdAt, modifiedAt }
     }
     return (await cds.tx({ tenant: t0 }, tx =>
-      tx.run(SELECT.from(Tenants).columns(['ID', 'metadata', 'createdAt', 'modifiedAt']))
-    )).map(({ ID, metadata, createdAt, modifiedAt }) => ({ subscribedTenantId: ID, ...this._toMetadataJson(metadata, ID), createdAt, modifiedAt }))
+      tx.run(SELECT.from(Tenants).columns(['ID', 'metadata', 'status', 'createdAt', 'modifiedAt']))
+    )).map(({ ID, metadata, status = 'SUBSCRIBED', createdAt, modifiedAt }) => ({ subscribedTenantId: ID, ...this._toMetadataJson(metadata, ID), status, createdAt, modifiedAt }))
   }
 
   async _getTenants(options) {
     const ds = await cds.connect.to(DeploymentService)
-    const all = await ds.getTenants(options)
+    const all = await ds.getTenants({ ...options, status: SUBSCRIBED })
     if (cds.env.requires[this.name]?.upgrade?.ignoreNonExistingContainers) {
       const containers = await ds.getContainers()
       return all.filter(t => containers.includes(t))
@@ -189,10 +190,10 @@ module.exports = class ProvisioningService extends cds.ApplicationService {
 
     return await new Promise((resolve, reject) => {
       const tx = js.tx({ tenant: cds.context.tenant, user: new cds.User.Privileged() })
-      const job = tx.enqueue(DeploymentService, 'upgrade', clusters, { options }, async error => {
-        if (error) {
-          await this._sendCallback('FAILED', `Tenant upgrade failed with error '${error}'`)
-          if (isSync) reject(new Error(error))
+      const job = tx.enqueue(DeploymentService, 'upgrade', clusters, { options }, async (message, error) => {
+        if (message) {
+          await this._sendCallback('FAILED', `Tenant upgrade failed with error '${message}'`)
+          if (isSync) reject(error)
         } else {
           await this._sendCallback('SUCCEEDED', 'Tenant upgrade succeeded')
           if (isSync) {

package/node_modules/@sap/cds-mtxs/srv/cf/saas-provisioning-service.cds

@@ -13,6 +13,7 @@ service cds.xt.SaasProvisioningService @(impl:'@sap/cds-mtxs/srv/cf/saas-provisi
             subscribedSubdomain : String(256);
             subscriptionAppName : String(256); // name of main subscribed application
             eventType: String(64); // "CREATE/UPDATE", indicates if called for new subscription (CREATE) or dependencies update (UPDATE)
+            status: cds.xt.TenantStatus;
     }
 
     function dependencies() returns array of { xsappname: String };

package/node_modules/@sap/cds-mtxs/srv/cf/sms-provisioning-service.cds

@@ -13,6 +13,7 @@ service cds.xt.SmsProvisioningService @(impl:'@sap/cds-mtxs/srv/cf/sms-provision
         key subscribedTenantId : String @assert.format: '^[^\*]+$';
             subscriber: Subscriber;
             eventType: String(64); // "CREATE/UPDATE", indicates if called for new subscription (CREATE) or dependencies update (UPDATE)
+            status: cds.xt.TenantStatus;
     }
 
     //returns array of { xsappname: String };

package/node_modules/@sap/cds-mtxs/srv/extensibility/compat/update.js

@@ -21,10 +21,13 @@ module.exports = (srv) => {
 
         // Merge extension to one extension csn
         let extCsn
-        for (let ext of extension) {
+        const extensions = Array.isArray(extension) ? extension : [extension] // wrap single string/object
+        for (let ext of extensions) {
             if (typeof ext === 'string') {
                 if (!ext.length) throw new cds.error({ message: 'Missing extension', code: 400 })
-                if (_isCSN(ext)) extCsn = _mergeCSN(JSON.parse(ext), extCsn)
+                if (_isCSN(ext)) try { extCsn = _mergeCSN(JSON.parse(ext), extCsn) } catch (e) {
+                    throw new cds.error({ message: `Invalid extension: ${e.message}`, code: 422 })
+                }
                 else try { extCsn = _mergeCSN(cds.parse.cdl(ext), extCsn) } catch (e) {
                     if (e.code === 'ERR_CDS_COMPILATION_FAILURE') throw new cds.error({ message: e.message, code: 422 })
                     else throw e

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/config.js

@@ -1,6 +1,6 @@
 const EXTENSION_ALLOWLIST = 'extension-allowlist'
 
-const PROTECTED_NAMESPACES = ['cds.xt']
+const PROTECTED_NAMESPACES = ['cds.xt', 'cds.core', 'cds.outbox']
 
 module.exports.PROTECTED_NAMESPACES = PROTECTED_NAMESPACES
 
@@ -13,7 +13,6 @@ module.exports.isBuiltIn = (name) => {
   return false
 }
 
-
 module.exports.Allowlist = class Allowlist {
     constructor(mtxConfig, fullCsn) {
       this.allowlist = Allowlist._setupPermissionList(mtxConfig, fullCsn)

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/csv-allowlist.js

@@ -0,0 +1,64 @@
+const LinterMessage = require('./message')
+const { Allowlist, isBuiltIn } = require('./config')
+
+// Checks uploaded CSV data files against the entity 'extension-allowlist'.
+// Only entities that are allowed to be extended may also receive data via CSV.
+
+// Maps a CSV data file name to the fully-qualified entity name it provides data for.
+// Mirrors the convention in cds core (cds/lib/dbs/cds-deploy.js _entity4)
+const entityNameFromCsvFile = (file, csn) => {
+  const base = file.replace(/\.csv$/i, '')
+  const name = base.replace(/-/g, '.')
+  if (csn?.definitions?.[name]) return name
+  // localization files: 'Books.texts', 'Books.texts_de', 'Books_texts'
+  const m = /(.+)[._]texts_?/.exec(name)
+  if (m) {
+    const target = csn?.definitions?.[m[1]]?.elements?.texts?.target
+    if (target) return target
+  }
+  return null
+}
+
+module.exports = class CsvAllowlistChecker {
+
+  check(csvNames, fullCsn, mtxConfig) {
+    // no restriction if no allowlist is configured or no data is uploaded
+    if (!Object.keys(mtxConfig ?? {}).length) return []
+    if (!csvNames || !csvNames.length) return []
+
+    const allowList = new Allowlist(mtxConfig, fullCsn)
+    const messages = []
+
+    for (const csvName of csvNames) {
+      // ignore hidden/metadata files (e.g. macOS AppleDouble '._*' created by tar);
+      // these are never valid entity data files
+      if (!csvName || csvName.startsWith('.')) continue
+
+      const name = entityNameFromCsvFile(csvName, fullCsn)
+
+      // unknown entity (not resolvable in the model) -> cannot be on the allowlist -> block
+      if (!name) {
+        messages.push(this._createWarning(csvName, allowList.getList('entity')))
+        continue
+      }
+
+      // built-in namespaces stay allowed, consistent with model extension checks
+      if (isBuiltIn(name)) continue
+
+      const kind = fullCsn?.definitions?.[name]?.kind ?? 'entity'
+      if (!allowList.isAllowed(kind, name)) {
+        messages.push(this._createWarning(name, allowList.getList('entity')))
+      }
+    }
+
+    return messages
+  }
+
+  _createWarning(entityName, allowlist = {}) {
+    const list = Object.keys(allowlist ?? {})
+    const message =
+      `Data upload for entity '${entityName}' is not allowed` +
+      `. Check entity allowlist: ${list.length > 0 ? list : '<empty list>'}`
+    return new LinterMessage(message, { name: entityName })
+  }
+}

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/index.js

@@ -4,6 +4,7 @@ const { deduplicateMessages } = require('@sap/cds-compiler')
 const NamespaceChecker = require('./namespace')
 const AnnotationsChecker = require('./annotations')
 const AllowlistChecker = require('./allowlist')
+const CsvAllowlistChecker = require('./csv-allowlist')
 const ProtectedNamespaceChecker = require('./protected-namespace')
 
 const customLinters = []
@@ -27,7 +28,7 @@ module.exports.legacyCheck = (env = cds.env) => {
   }
 }
 
-module.exports.lint = (extCsn, fullCsn, env = cds.env, cloneExt = false) => {
+module.exports.lint = (extCsn, fullCsn, env = cds.env, cloneExt = false, csvNames = []) => {
   const conf = env.requires[EXT_SERVICE_NAME] || env.requires.extensibility || env.mtx || {}
   const linter_options = {}
   let x
@@ -43,7 +44,8 @@ module.exports.lint = (extCsn, fullCsn, env = cds.env, cloneExt = false) => {
     ...new ProtectedNamespaceChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options),
     ...new NamespaceChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options),
     ...new AnnotationsChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options, extCsn),
-    ...new AllowlistChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options)
+    ...new AllowlistChecker().check(reflectedCsn, reflectedFullCsn, compileBaseDir, linter_options),
+    ...new CsvAllowlistChecker().check(csvNames, reflectedFullCsn, linter_options)
   ]
 
   for (const linter of customLinters) {

package/node_modules/@sap/cds-mtxs/srv/extensibility/linter/protected-namespace.js

@@ -1,11 +1,23 @@
 const LinterMessage = require('./message')
-const { PROTECTED_NAMESPACES } = require('./config')
+const { PROTECTED_NAMESPACES, isBuiltIn } = require('./config')
+
+const EXTENSION_ALLOWLIST = 'extension-allowlist'
 
 function _protectedNamespaceOf(name) {
   if (!name) return null
   return PROTECTED_NAMESPACES.find(ns => name === ns || name.startsWith(`${ns}.`)) ?? null
 }
 
+// Collects all names explicitly listed in the extension-allowlist, so they are
+// allowed even if they fall into a protected namespace.
+function _allowlistedNames(mtxConfig) {
+  const names = new Set()
+  for (const permission of mtxConfig?.[EXTENSION_ALLOWLIST] ?? []) {
+    for (const name of permission.for ?? []) names.add(name)
+  }
+  return names
+}
+
 function locationString(element) {
   const loc = element?.$location
   if (!loc) return ''
@@ -13,23 +25,67 @@ function locationString(element) {
   return loc.col ? `${loc.file}:${line}${loc.col}:` : `${loc.file}:${line}`
 }
 
-// Rejects defining, extending or annotating artifacts in a protected namespace (e.g. 'cds.xt').
+// Collects all source targets (fully-qualified names) referenced in a query's
+// `from` clause, recursing into joins (`from.args`) and sub-queries
+// (`from.SELECT` / `from.SET.args`).
+function _collectFromTargets(from, acc = []) {
+  if (!from || typeof from !== 'object') return acc
+
+  if (Array.isArray(from.ref) && from.ref.length) {
+    const seg = from.ref[0]
+    const name = typeof seg === 'string' ? seg : seg?.id
+    if (name) acc.push(name)
+  }
+
+  // joins: from.args is an array of froms
+  if (Array.isArray(from.args)) {
+    for (const arg of from.args) _collectFromTargets(arg, acc)
+  }
+
+  // sub-query: from.SELECT is itself a query body with its own from
+  if (from.SELECT) _collectFromTargets(from.SELECT.from, acc)
+
+  // set operation sub-query: from.SET.args is an array of query bodies
+  if (from.SET && Array.isArray(from.SET.args)) {
+    for (const arg of from.SET.args) _collectFromTargets(arg.SELECT?.from, acc)
+  }
+
+  return acc
+}
+
+// Rejects defining, extending or annotating artifacts in a protected namespace (e.g. 'cds.xt'),
+// as well as projections/views that read from an artifact in a protected namespace.
 // Runs unconditionally, independent of linter configuration.
 module.exports = class ProtectedNamespaceChecker {
 
   // eslint-disable-next-line no-unused-vars
   check(reflectedCsn, fullCsn, compileDir, mtxConfig) {
     const messages = []
+    const allowlisted = _allowlistedNames(mtxConfig)
 
     for (const name of Object.keys(reflectedCsn.definitions ?? {})) {
-      if (_protectedNamespaceOf(name)) {
-        messages.push(this._createWarning(name, reflectedCsn.definitions[name]))
+      const def = reflectedCsn.definitions[name]
+
+      // name in a protected namespace (built-ins + allowlisted names excluded)
+      if (!isBuiltIn(name) && !allowlisted.has(name) && _protectedNamespaceOf(name)) {
+        messages.push(this._createWarning(name, def))
+        continue // avoid double-counting: name-based block already fired
+      }
+
+      // projection/view reading from a protected artifact (allowlist override only, no isBuiltIn)
+      const queryBody = def.query?.SELECT ?? def.projection
+      if (queryBody) {
+        for (const target of _collectFromTargets(queryBody.from)) {
+          if (!allowlisted.has(target) && _protectedNamespaceOf(target)) {
+            messages.push(this._createExpositionWarning(target, def))
+          }
+        }
       }
     }
 
     for (const extension of reflectedCsn.extensions ?? []) {
       const target = extension.extend ?? extension.annotate
-      if (_protectedNamespaceOf(target)) {
+      if (!allowlisted.has(target) && _protectedNamespaceOf(target)) {
         messages.push(this._createWarning(target, extension))
       }
     }
@@ -42,4 +98,10 @@ module.exports = class ProtectedNamespaceChecker {
     const message = `Extending, annotating or defining '${name}' in the protected namespace '${namespace}' is not supported in extensions`
     return new LinterMessage(locationString(element) + message, element)
   }
+
+  _createExpositionWarning(name, element) {
+    const namespace = _protectedNamespaceOf(name)
+    const message = `Exposing '${name}' from the protected namespace '${namespace}' via a projection/view is not supported in extensions`
+    return new LinterMessage(locationString(element) + message, element)
+  }
 }

package/node_modules/@sap/cds-mtxs/srv/extensibility-service.js

@@ -2,7 +2,8 @@ const express = require('express')
 const cds = require('@sap/cds/lib')
 const { SELECT, DELETE } = cds.ql
 const { fs, path, tar, rimraf, read, readdir, mkdirp, write } = cds.utils
-const { token: authToken, authUrl } = require('../lib/utils')
+const utils = require('../lib/utils')
+const { token: authToken, authUrl, iasAuthorizeUrl, iasTokenUrl, IAS_AUTHORIZE_PATH, IAS_TOKEN_PATH, safeUntar, readDataCsv } = utils
 const main = require('./config')
 const linter = require('./extensibility/linter')
 
@@ -18,7 +19,7 @@ const ACTIVE = 2, DRAFT = 1, INACTIVE = 0
 
 // determine appid for separation of extensions
 //const packageJson = require(main.root + '/package.json');
-const APPID = require('../lib/utils').getAppId()
+const APPID = utils.getAppId()
 
 const conf = () => ({ ...main.env.requires.extensibility, ...cds.env.requires['cds.xt.ExtensibilityService'] })
 
@@ -152,7 +153,12 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
       // REVISIT: string ?
       const sources = typeof extension === 'string' ? Buffer.from(extension, 'base64') : extension
       const root = await fs.promises.mkdtemp(`${TEMP_DIR}${path.sep}extension-`)
-      await tar.xvz(sources).to(root)
+      try {
+        await safeUntar(sources, root)
+      } catch (e) {
+        await rimraf(root)
+        throw e
+      }
       return { root, archive: sources }
     }
 
@@ -306,7 +312,9 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
         // verify edmx
         cds.compile.to.edmx(extFullCsn, { service: 'all', version: cds.env.odata?.version ?? 'v4' })
 
-        messages = linter.lint(extCsn, extFullCsn, cds.env, /* clone */ true)
+        const csvNames = await _readExtensionCsvNames(req.data.ID)
+
+        messages = linter.lint(extCsn, extFullCsn, cds.env, /* clone */ true, csvNames)
       } catch (error) {
         let validationError = error
         if (error.code === 'ERR_CDS_COMPILATION_FAILURE') messages = error.messages
@@ -318,6 +326,35 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
       }
     })
 
+    // reads the CSV data file names of the (not yet activated) extension with the given tag.
+    // used to validate uploaded data against the entity allowlist.
+    async function _readExtensionCsvNames(tag) {
+      // CSV deployment globally disabled -> nothing to gate here
+      if (conf().activate?.['skip-csv']) return []
+
+      let entry
+      try {
+        // mirror the selection in activateExtension: the inactive entry for this tag.
+        // tag may be null (untagged push) -> translates to 'tag IS NULL'
+        entry = await SELECT.one('sources')
+          .from('cds.xt.Extensions')
+          .where({ tag: tag ?? null, activated: { '!=': 'database' } })
+          .orderBy('timestamp desc')
+      } catch (e) {
+        DEBUG?.('could not read extension sources for csv validation', tag, e)
+        return []
+      }
+      if (!entry?.sources) return []
+
+      const root = await fs.promises.mkdtemp(`${TEMP_DIR}${path.sep}extension-`)
+      try {
+        const { csvs } = await readDataCsv(entry.sources, root)
+        return Object.keys(csvs ?? {})
+      } finally {
+        await rimraf(root)
+      }
+    }
+
     this.on('discard', async req => {
       const tenant = _tenant(req)
       if (tenant) cds.context = { tenant }
@@ -406,21 +443,15 @@ module.exports = class ExtensibilityService extends cds.ApplicationService {
     cds.on('served', () => {
       cds.app?.post('/-/cds/login/grant', express.urlencoded({ extended: false }), async (req, res) => {
         try {
-          const cred = cds.env.requires.auth.credentials || {}
-          if (!cred.clientid) throw cds.error('missing authentication service binding', { status: 500 })
-
           const query = req.body || {}
+          const meta = _isIas() ? await _iasMetadata(query) : undefined
+           if (!meta && _isIas() && typeof query.authorization_code === 'string') {
+            throw cds.error('IAS login metadata is unavailable', { status: 503 })
+          }
+          const cred = meta ? cds.env.requires.auth.credentials : _xsuaaCredentials()
+          if (!cred.clientid) throw cds.error('missing authentication service binding', { status: 500 })
 
-          // Endpoint accepts only passcode and refresh_token grant requests.
-          const refresh_token = typeof query.refresh_token === 'string' ? query.refresh_token : undefined
-          const passcode = typeof query.passcode === 'string' ? query.passcode : undefined
-          if (!refresh_token && !passcode)
-            throw cds.error('missing passcode or refresh_token', { status: 400 })
-
-          const form = refresh_token ? { grant_type: 'refresh_token', refresh_token } :
-                                       { grant_type: 'password', passcode }
-          form.scope = `${cred.xsappname}.cds.ExtensionDeveloper`
-          const raw = await authToken(cred, { form, subdomain: query.subdomain })
+          const raw = meta ? await _iasGrant(cred, query, meta) : await _xsuaaGrant(cred, query)
           const data = JSON.parse(raw)
           if (data.error) return res.status(401).json(data)
           res.json(data)
@@ -509,10 +540,159 @@ function _passcodeUrl(c, sub) {
   return authUrl(c.url, sub, '/passcode').toString()
 }
 
-function authMeta(req, res) {
+// True if the configured authentication kind is SAP Cloud Identity Services (IAS).
+function _isIas() {
+  return cds.env.requires?.auth?.kind === 'ias'
+}
+
+function _xsuaaCredentials() {
+  const auth = cds.env.requires?.auth
+  const cred = _isIas() ? cds.env.requires[auth.xsuaa || 'xsuaa']?.credentials : auth?.credentials
+  if (!cred) throw cds.error('missing XSUAA service binding', { status: 500 })
+  return cred
+}
+
+// XSUAA login: exchange passcode or refresh_token for a token with the
+// `<xsappname>.cds.ExtensionDeveloper` scope.
+async function _xsuaaGrant(cred, query) {
+  const refresh_token = typeof query.refresh_token === 'string' ? query.refresh_token : undefined
+  const passcode = typeof query.passcode === 'string' ? query.passcode : undefined
+  if (!refresh_token && !passcode)
+    throw cds.error('missing passcode or refresh_token', { status: 400 })
+
+  const form = refresh_token ? { grant_type: 'refresh_token', refresh_token } :
+                               { grant_type: 'password', passcode }
+  form.scope = `${cred.xsappname}.cds.ExtensionDeveloper`
+  return authToken(cred, { form, subdomain: query.subdomain })
+}
+
+// A requested subscriber must have its own IAS tenant; never substitute the provider.
+// Without a subdomain, use the explicit app_tid or provider binding.
+async function _iasLoginTarget(cred, query = {}) {
+  const subdomain = typeof query.subdomain === 'string' ? query.subdomain : undefined
+  const tenant = subdomain ? await _subscriberTenant(subdomain, cred) : undefined
+  if (subdomain && (!tenant?.app_tid || !tenant?.tenantHost)) return {}
+  const app_tid =
+    (typeof query.app_tid === 'string' && query.app_tid) ||
+    tenant?.app_tid ||
+    cred.app_tid || cred.appTid || cred.zone_uuid // provider tenant
+  return { app_tid, tenantHost: tenant?.tenantHost }
+}
+
+// Single DNS label; also prevents LIKE wildcards / JSON quotes leaking into the pattern.
+const SUBDOMAIN_RE = /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/i
+
+// Extracts subdomain/app_tid/tenantHost from registry metadata (nested under `subscriber`
+// or top-level), tolerating JSON key-order / whitespace variations.
+function _subscriberInfo(meta) {
+  const s = meta?.subscriber ?? meta
+  const subdomain = s?.subaccountSubdomain ?? s?.subscribedSubdomain ?? meta?.subscribedSubdomain
+  const app_tid = s?.app_tid ?? meta?.app_tid ?? meta?.subscribedTenantId
+  const tenantHost = s?.tenantHost ?? meta?.tenantHost
+  return { subdomain, app_tid, tenantHost }
+}
+
+// Looks up a subscribed tenant by subdomain in `cds.xt.Tenants`. Non-fatal; only when
+// multitenancy is configured. Falls back to the IAS `tenantLoginInfo` endpoint (derived
+// from the auth binding) when the registry has no match.
+async function _subscriberTenant(subdomain, cred) {
+  if (!cds.env.requires?.multitenancy) return undefined
+  if (!SUBDOMAIN_RE.test(subdomain)) return undefined
+  try {
+    // Pre-filter on the raw subdomain value (robust to JSON formatting); confirm in JS.
+    const like = `%"${subdomain}"%`
+    const rows = await utils.t0_(
+      SELECT.from('cds.xt.Tenants').columns('ID', 'metadata').where('metadata like', like)
+    )
+    let match
+    for (const { ID, metadata } of rows || []) {
+      let meta
+      try { meta = metadata ? JSON.parse(metadata) : undefined } catch { /* ignore */ }
+      const info = _subscriberInfo(meta)
+      if (info.subdomain === subdomain) {
+        match = { app_tid: info.app_tid || ID, tenantHost: info.tenantHost }
+        break
+      }
+    }
+    DEBUG?.('Resolving subscriber tenant:', { requested_subdomain: subdomain, resolved_app_tid: match?.app_tid, tenant_host: match?.tenantHost, candidates: rows?.length ?? 0 })
+    if (match) return match
+  } catch (err) {
+    DEBUG?.('Failed to resolve subscriber tenant for subdomain from tenant table', subdomain, '-', err.message)
+  }
+  // Fallback: ask the IAS landscape endpoint for the subscriber's login info.
+  DEBUG?.('Trying fallback via tenantLoginInfo')
+  const apiHost = utils.tenantLoginInfoHost(cred)
+  const info = apiHost && await utils.tenantLoginInfo(apiHost, subdomain)
+  if (info) {
+    DEBUG?.('Resolved subscriber tenant via tenantLoginInfo:', { requested_subdomain: subdomain, resolved_app_tid: info.app_tid, tenant_host: info.tenantHost, api_host: apiHost })
+    return info
+  }
+  return undefined
+}
+
+// IAS login: exchange the authorization_code (browser PKCE flow) or a refresh_token
+// for a token. Authorization as `cds.ExtensionDeveloper` comes from AMS policies, not scopes.
+async function _iasGrant(cred, query, meta) {
+  const refresh_token = typeof query.refresh_token === 'string' ? query.refresh_token : undefined
+  const code = typeof query.authorization_code === 'string' ? query.authorization_code : undefined
+  if (!refresh_token && !code)
+    throw cds.error('missing authorization_code or refresh_token', { status: 400 })
+
+  const { app_tid, token_endpoint } = meta
+
+  const form = refresh_token
+    ? { grant_type: 'refresh_token', refresh_token }
+    : {
+        grant_type: 'authorization_code',
+        code,
+        ...(typeof query.code_verifier === 'string' && { code_verifier: query.code_verifier }),
+        ...(typeof query.redirect_uri === 'string' && { redirect_uri: query.redirect_uri })
+      }
+  if (app_tid) form.app_tid = app_tid
+
+  return authToken(cred, { form, endpoint: token_endpoint })
+}
+
+async function _iasMetadata(query = {}) {
   const cred = cds.env.requires?.auth?.credentials || {}
   try {
-    res.send({ passcode_url: _passcodeUrl(cred, req.query?.subdomain) })
+    const { app_tid, tenantHost } = await _iasLoginTarget(cred, query)
+    if (typeof cred.clientid !== 'string' || !cred.clientid.trim() ||
+        typeof app_tid !== 'string' || !app_tid.trim()) return undefined
+    const meta = {
+      flow: 'authorization_code',
+      pkce: true,
+      client_id: cred.clientid,
+      scope: 'openid',
+      authorization_endpoint: tenantHost ? `https://${tenantHost}${IAS_AUTHORIZE_PATH}` : iasAuthorizeUrl(cred),
+      token_endpoint: tenantHost ? `https://${tenantHost}${IAS_TOKEN_PATH}` : iasTokenUrl(cred),
+      app_tid // sent on both authorize and token
+    }
+    for (const endpoint of [meta.authorization_endpoint, meta.token_endpoint]) {
+      if (new URL(endpoint).protocol !== 'https:') return undefined
+    }
+    DEBUG?.('IAS login metadata:', {
+      client_id: meta.client_id,
+      requested_subdomain: query.subdomain,
+      app_tid: meta.app_tid,
+      binding_app_tid: cred.app_tid || cred.appTid || cred.zone_uuid,
+      tenant_host: tenantHost,
+      authorization_endpoint: meta.authorization_endpoint,
+      token_endpoint: meta.token_endpoint,
+      binding_url: cred.url,
+      binding_certurl: cred.certurl
+    })
+    return meta
+  } catch (err) {
+    DEBUG?.('Failed to resolve IAS login metadata; falling back to XSUAA:', err.message)
+    return undefined
+  }
+}
+
+async function authMeta(req, res) {
+  try {
+    const meta = _isIas() ? await _iasMetadata(req.query || {}) : undefined
+    res.send(meta || { passcode_url: _passcodeUrl(_xsuaaCredentials(), req.query?.subdomain) })
   } catch (err) {
     res.status(err.status || err.statusCode || 500).json({ error: err.message })
   }