@sap/cds-dk 6.0.4 → 6.1.3

package/lib/client/extend.js

@@ -7,6 +7,7 @@ const BaseCommand = require('./base_command');
 const { normalizePath, isParent } = require('./helper/fs_helper');
 const Logger = require('./helper/logging');
 const Question = require('./helper/question');
+const { CliError } = require('./helper/errors');
 
 const COMMAND_URL_SUFFIX = 'content';
 const CUSTOM_FILE_FOLDERS = ['wsdl'];
@@ -71,7 +72,7 @@ module.exports = class Extend extends BaseCommand {
 
     static async run(paramValues) {
         try {
-            const params = await AuthManager.loginAndUpdateSettings(paramValues);
+            const params = await AuthManager.login(paramValues);
 
             if (process.env.DEBUG) {
                 Logger.log(`\n\nCreating extension project with parameters ${JSON.stringify({
@@ -88,7 +89,7 @@ module.exports = class Extend extends BaseCommand {
 
             const runOnExistingProject = await Extend.checkProject(params.get('projectFolder'));
             if (runOnExistingProject && !(params.get('force') || params.get('templates'))) {
-                throw new Error(folderExists(params.get('projectFolder')));
+                throw new CliError(folderExists(params.get('projectFolder')));
             }
 
             try {

package/lib/client/helper/cf_helper.js

@@ -33,6 +33,7 @@ select one by entering a number or leave empty to quit:
 ${formatObjectsFixedWidth(apps, ['name', 'url'], 3, { numbering: true })}
 
 Your choice: `);
+        console.log();
 
         if (!choice) {
             Logger.debug('No app URL selected');

package/lib/client/helper/errors.js

@@ -0,0 +1,11 @@
+const Logger = require('./logging');
+class CliError extends Error {
+    stack = '';
+    constructor(message, error) {
+        super(Logger.getMessage(message, error));
+    }
+}
+
+module.exports = {
+    CliError
+};

package/lib/client/helper/logging.js

@@ -17,20 +17,13 @@ module.exports = class Logger {
     }
 
     static getMessage(errorText, error) {
-        let message = errorText && errorText + '\n' || '';
+        let message = errorText ? errorText + '\n' : '';
         if (!error) {
             return message;
         }
-        if (process.env.DEBUG) {
-            if ('response' in error && error.response.data) {
-                const body = error.response.data;
-                if (body.error && body.error.message) {
-                    message += body.error.message + '\n';
-                }
-            }
+        message += error.response?.data?.error?.message || error.message;
+        if (process.env.DEBUG && error.stack) {
             message += '\n' + error.stack;
-        } else {
-            message += error.message;
         }
         return message;
     }

package/lib/client/helper/url_helper.js

@@ -1,10 +1,12 @@
 const IP_ADDR = /^[1-9][0-9]{0,2}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$/;
 const schemaRegex = /^https?:\/\//;
-const defaultSchema = 'https://';
+const localhostRegex = /^(https?:\/\/)?(localhost|127\.0\.0\.1|\[?::1]?)\b/;
+const httpSchema = 'http://';
+const httpsSchema = 'https://';
 
 function extractSubdomain(url) {
     const hostname = new URL(url).hostname;
-    if (hostname === 'localhost' || IP_ADDR.test(hostname)) {
+    if (localhostRegex.test(hostname) || IP_ADDR.test(hostname)) {
         return undefined;
     }
     return hostname.split('.')[0];
@@ -12,6 +14,8 @@ function extractSubdomain(url) {
 
 module.exports = {
     schemaRegex,
-    defaultSchema,
+    localhostRegex,
+    httpSchema,
+    httpsSchema,
     extractSubdomain
 };

package/lib/client/index.js

@@ -7,7 +7,7 @@ const { SettingsManager } = require('./settings_manager');
 module.exports = {
     extend: Extend.run,
     activate: Activate.run,
-    login: AuthManager.loginAndUpdateSettings,
+    login: AuthManager.login,
     logout: AuthManager.logout,
     question: Question,
     config: SettingsManager.config

package/lib/client/params.js

@@ -1,5 +1,6 @@
 const Logger = require('./helper/logging');
 const { escapeRegex } = require('./helper/string_helper');
+const { CliError } = require('./helper/errors');
 
 
 // PARAM BASE TYPES
@@ -104,10 +105,10 @@ class Param {
             expectedType = typeof this.allowedValues[0];
         }
         if (typeof val !== expectedType) {
-            throw new Error(`Failed to set '${(this.name)}' = ${JSON.stringify(val)}: expected value of type ${expectedType}`);
+            throw new CliError(`Failed to set '${(this.name)}' = ${JSON.stringify(val)}: expected value of type ${expectedType}`);
         }
         if (this.allowedValues && !(this.allowedValues).includes(val)) {
-            throw new Error(`Failed to set '${(this.name)}' = ${JSON.stringify(val)}: expected one of ${JSON.stringify(this.allowedValues)}`);
+            throw new CliError(`Failed to set '${(this.name)}' = ${JSON.stringify(val)}: expected one of ${JSON.stringify(this.allowedValues)}`);
         }
     }
 
@@ -163,11 +164,13 @@ class BasicParams {
 
         // - auth-related
         this.passcode               = new Param('passcode',               '', { obfuscate: ObfuscationLevel.partial });
-        this.tokenStorage           = new Param('tokenStorage', undefined, { allowedValues: ['plain', 'keyring'] });
+        this.tokenStorage           = new Param('tokenStorage',           undefined, { allowedValues: ['plain', 'keyring'] });
         this.plain                  = new Param('plain',                  false, { internal: true }); // for backward compatibility - ignored
+        this.saveData               = new Param('saveData',               false, { internal: true });
         this.renewLogin             = new Param('renewLogin',             false);
-        this.username               = new Param('username',               '');
+        this.username               = new Param('username',               '', { persist: Persistence.setting }); // only saved against localhost (non-productive); as setting due to ambiguous app URL
         this.password               = new Param('password',               '', { obfuscate: ObfuscationLevel.full });
+        this.isEmptyPassword        = new Param('isEmptyPassword',        false, { internal: true, persist: Persistence.setting }); // extra param so we can ensure we never save a password
         this.clientid               = new Param('clientid',               '');
         this.clientsecret           = new Param('clientsecret',           '', { obfuscate: ObfuscationLevel.partial });
 
@@ -244,7 +247,7 @@ class ParamCollection {
      */
     checkFrozen() {
         if (this.isFrozen) {
-            throw new Error('cannot modify read-only parameter collection');
+            throw new CliError('cannot modify read-only parameter collection');
         }
     }
 
@@ -265,7 +268,7 @@ class ParamCollection {
     static mainName(name) {
         const paramDef = ParamDefs[name];
         if (!paramDef) {
-            throw new Error(`Unknown parameter: '${name}'`);
+            throw new CliError(`Unknown parameter: '${name}'`);
         }
         return paramDef.mainName;
     }

package/lib/client/pull.js

@@ -0,0 +1,48 @@
+const fs = require('fs');
+const { join } = require('path');
+const axios = require('axios');
+
+const { unpackTarArchive } = require('@sap/cds/lib/utils/resources');
+
+const { login } = require('./auth_manager');
+const BaseCommand = require('./base_command');
+const Logger = require('./helper/logging');
+const { CliError } = require('./helper/errors');
+
+module.exports = class Pull extends BaseCommand {
+
+    static async run(paramValues) {
+        try {
+            const params = await login(paramValues);
+            Logger.log(`Pulling base model from ${params.get('appUrl')}, for subdomain '${params.get('subdomain')}', to project folder '${params.get('projectFolder')}'`);
+
+            const projectFolder = params.get('projectFolder');
+            const targetDir = join(projectFolder, 'node_modules', this.getAppPackageName(projectFolder));
+            fs.rmSync(targetDir, { force: true, recursive: true });
+            fs.mkdirSync(targetDir, { recursive: true });
+
+            const tgzBuffer = Buffer.from(await this.getTgz(params));
+            return unpackTarArchive(tgzBuffer, targetDir, false);
+
+        } catch (error) {
+            throw new CliError(undefined, error);
+        }
+    }
+
+    static getAppPackageName(projectFolder) {
+        try {
+            return require(join(projectFolder, 'package.json')).cds.extends;
+        } catch (error) {
+            return '_base';
+        }
+    }
+
+    static async getTgz(params) {
+        const pullUrl = `${(params.get('appUrl'))}/-/cds/extensibility/pull`;
+        const options = { ...params.get('reqAuth'), responseType: 'arraybuffer' };
+
+        return axios.post(pullUrl, {}, options)
+            .then(response => response.data)
+            .catch(error => this.handleHttpError(error, params));
+    }
+}

package/lib/client/push.js

@@ -0,0 +1,45 @@
+const fs = require('fs');
+const { join } = require('path');
+const axios = require('axios');
+
+const { login } = require('./auth_manager');
+const BaseCommand = require('./base_command');
+const Logger = require('./helper/logging');
+const { CliError } = require('./helper/errors');
+
+module.exports = class Push extends BaseCommand {
+
+    static async run(paramValues) {
+        try {
+            const params = await login(paramValues);
+            const projectFolder = params.get('projectFolder');
+            Logger.log(`Pushing extension from project folder '${projectFolder}', for subdomain '${params.get('subdomain')}', to app URL ${params.get('appUrl')}`);
+
+            const tgz = fs.readFileSync(join(projectFolder, 'gen', 'extension.tgz'), { encoding: 'base64' });
+            const extensionName = this.getExtensionName(projectFolder);
+            return this.pushTgz(params, tgz, extensionName);
+
+        } catch (error) {
+            throw new CliError(undefined, error);
+        }
+    }
+
+    static getExtensionName(projectFolder) {
+        try {
+            return require(join(projectFolder, 'package.json')).name;
+        } catch (error) {
+            throw new CliError(`Extension project at ${projectFolder} is missing package.json`);
+        }
+    }
+
+    static async pushTgz(params, tgz, extensionName) {
+        const pushUrl = `${params.get('appUrl')}/-/cds/extensibility/push`;
+        const options = { ...params.get('reqAuth') };
+
+        return axios.post(pushUrl, {
+            extension: tgz,
+            tag: extensionName
+        }, options)
+            .catch(error => this.handleHttpError(error, params));
+    }
+}

package/lib/client/settings_manager.js

@@ -9,9 +9,11 @@ const { getAppFromSuggestions, getAppName, getSubdomain } = require('./helper/cf
 const isBas = require('./helper/env_helper');
 const Logger = require('./helper/logging');
 const Question = require('./helper/question');
-const { defaultSchema, extractSubdomain, schemaRegex } = require('./helper/url_helper');
+const { CliError } = require('./helper/errors');
+const { httpSchema, httpsSchema, extractSubdomain, schemaRegex, localhostRegex } = require('./helper/url_helper');
 const { ParamCollection, Persistence } = require('./params');
 const { capitalize } = require('./helper/string_helper');
+const axios = require('axios');
 
 const CONFIG_SUBDIRS = {
     linux: '.config',
@@ -31,7 +33,8 @@ const KEYRING_DESC = {
 }
 
 const MTX_FULLY_QUALIFIED = 'com.sap.cds.mtx';
-const OAUTH_PATH = '/mtx/v1/oauth/token';
+const OAUTH_PATH_OLD_MTX = '/mtx/v1/oauth/token';
+const OAUTH_PATH_STREAMLINED_MTX = '/-/cds/login/token';
 
 const SETTINGS_DIR = path.join(os.homedir(), CONFIG_SUBDIRS[os.platform()] || '', MTX_FULLY_QUALIFIED);
 const SETTINGS_FILE = 'projects.json';
@@ -88,16 +91,38 @@ async function getSubdomainFromCfAndNotify(appName) {
     return subdomain;
 }
 
-function getTokenBaseUrl(params, renewUrl) {
+async function getTokenBaseUrl(params, renewUrl) {
     if (params.has('tokenUrl') && !renewUrl) {
         return params.get('tokenUrl');
     }
     if (!params.has('appUrl')) {
-        throw new Error('Failed to determine token URL: app URL not given');
+        throw new CliError('Failed to determine token URL: app URL not given');
     }
     const baseUrl = new URL(params.get('appUrl'));
-    baseUrl.pathname = baseUrl.pathname.replace(/\/?$/, OAUTH_PATH);
-    return baseUrl.toString();
+    const cleanPathname = pathname => baseUrl.pathname.replace(/\/?$/, pathname);
+    const getBaseUrl = pathname => {
+        const url = new URL(baseUrl.toString());
+        url.pathname = cleanPathname(pathname);
+        return url;
+    };
+
+    let existingPath;
+    const oauthPaths = [OAUTH_PATH_STREAMLINED_MTX/*, OAUTH_PATH_OLD_MTX*/]; // The old MTX does not support HEAD requests
+    for (const path of oauthPaths) {
+        try {
+            await axios.head(getBaseUrl(path).toString());
+            existingPath = path;
+            break;
+        } catch (e) {
+            if (e.response?.status === 404) {
+                continue;
+            } else {
+                throw new CliError(`Failed with root cause ${e.message}`);
+            }
+        }
+    }
+    existingPath = existingPath ?? OAUTH_PATH_OLD_MTX;
+    return getBaseUrl(existingPath).toString();
 }
 
 function getKeyringAccountName(params) {
@@ -134,7 +159,16 @@ class SettingsManager {
     static async saveSettings(params) {
         Logger.debug(`Saving settings for project ${params.get('projectFolder')}`);
 
-        await this._saveToFile(params.get('projectFolder'), params.toValueMap(Persistence.setting));
+        const paramsMap = params.toValueMap(Persistence.setting);
+        if (localhostRegex.test(params.get('appUrl'))) {
+            Logger.log(`Saving username${(params.get('isEmptyPassword') ? ' and empty-password hint' : '')} with project settings.`);
+        } else {
+            // Save only against localhost for security reasons.
+            Logger.debug('Not saving username because app is not recognized to run on localhost.');
+            delete paramsMap.username;
+            delete paramsMap.isEmptyPassword;
+        }
+        await this._saveToFile(params.get('projectFolder'), paramsMap);
 
         if (!params.has('token')) {
             return;
@@ -173,15 +207,22 @@ class SettingsManager {
 
     static async updateUrls(params, logout, loadedAppUrl) {
         async function addAppUrlAndSubdomain() {
-            if (params.has('appUrl') && !schemaRegex.test(params.get('appUrl'))) {
-                params.set('appUrl', defaultSchema + params.get('appUrl'));
-                Logger.debug(`Added schema to app URL: ${params.get('appUrl')}`);
+            if (params.has('appUrl')) {
+                const appUrl = params.get('appUrl');
+                if (!schemaRegex.test(appUrl)) {
+                    if (localhostRegex.test(appUrl)) {
+                        params.set('appUrl', httpSchema + appUrl);
+                    } else {
+                        params.set('appUrl', httpsSchema + appUrl);
+                    }
+                    Logger.debug(`Added schema to app URL: ${params.get('appUrl')}`);
+                }
             }
             if (!logout) {
                 if (!params.has('appUrl')) {
                     Logger.debug('App URL not given');
                     await getAppUrlAndSubdomainFromSuggestions(params);
-                } else if (!params.has('subdomain')) {
+                } else if (!params.has('subdomain') && !localhostRegex.test(params.get('appUrl'))) {
                     Logger.debug('Subdomain not given');
                     const appName = await getAppName(params.get('appUrl'));
                     if (appName) {
@@ -190,27 +231,28 @@ class SettingsManager {
                 }
             }
             if (!params.has('appUrl')) {
-                throw new Error('App URL not given. Please specify it or log in to Cloud Foundry and repeat this command.');
+                throw new CliError('App URL not given. Please specify it or log in to Cloud Foundry and repeat this command.');
             }
             if (!params.has('subdomain')) {
-                params.set('subdomain', extractSubdomain(params.get('appUrl')));
-                if (!params.has('subdomain')) {
-                    throw new Error('Subdomain not given');
+                const subdomain = extractSubdomain(params.get('appUrl'));
+                if (!subdomain) {
+                    throw new CliError('Subdomain not given');
                 }
-                Logger.log(`Subdomain determined from app URL: ${params.get('subdomain')}`);
+                params.set('subdomain', subdomain);
+                Logger.log(`Subdomain determined from app URL: ${subdomain}`);
             }
         }
-        function renewTokenUrl() {
+        async function renewTokenUrl() {
             const renewUrl = params.get('appUrl') !== loadedAppUrl;
             if (!params.get('tokenUrl') || renewUrl) {
-                params.set('tokenUrl', getTokenBaseUrl(params, renewUrl));
+                params.set('tokenUrl', await getTokenBaseUrl(params, renewUrl));
             }
         }
 
         await addAppUrlAndSubdomain();
 
         if (!logout) {
-            renewTokenUrl();
+            await renewTokenUrl();
         }
     }
 
@@ -226,7 +268,7 @@ class SettingsManager {
             return;
         }
         if (params.get('tokenStorage') === 'keyring') {
-            throw new Error(`${capitalize(TOKEN_STORAGE_DESC.keyring)} requested but keytar not installed. Run 'npm install -g keytar' or ` +
+            throw new CliError(`${capitalize(TOKEN_STORAGE_DESC.keyring)} requested but keytar not installed. Run 'npm install -g keytar' or ` +
                 `switch to ${TOKEN_STORAGE_DESC.plain} by adding '--plain' (discouraged).`);
         }
         if (params.get('renewLogin') || logout) {
@@ -236,23 +278,26 @@ class SettingsManager {
 
     static async addAuth(params, logout) {
         async function addPassword() {
-            params.set('password', await Question.askQuestion('Password: ', undefined, true));
-            if (params.get('password') === '') {
-                throw new Error('Password cannot be empty');
+            if (params.get('isEmptyPassword')) {
+                params.set('password', '');
+            } else {
+                params.set('password', await Question.askQuestion('Password: ', undefined, true));
+                console.log();
             }
         }
         async function addClientSecret() {
             params.set('clientsecret', await Question.askQuestion('clientsecret: ', undefined, true));
+            console.log();
             if (params.get('clientsecret') === '') {
-                throw new Error('clientsecret cannot be empty');
+                throw new CliError('clientsecret cannot be empty');
             }
         }
         async function addPasscode() {
             const prompt = `Passcode${params.get('passcodeUrl') ? ' (visit ' + params.get('passcodeUrl') + ' to generate)' : ''}: `;
             params.set('passcode', await Question.askQuestion(prompt, undefined, true));
-            console.log(); // DON'T: process.stdout.write('\n');
+            console.log();
             if (params.get('passcode') === '') {
-                throw new Error('Passcode cannot be empty');
+                throw new CliError('Passcode cannot be empty');
             }
         }
         function setRelevantAuth(auth) {
@@ -288,10 +333,19 @@ class SettingsManager {
         }
 
         if (params.has('username')) {
-            if (!params.get('password') && !logout) {
+            if (!params.has('password') && !logout) {
                 await addPassword();
             }
+            if (params.get('password') === '') {
+                params.set('isEmptyPassword', true);
+                // TODO check password only in production env
+                // throw new CliError('Password cannot be empty');
+            } else {
+                params.delete('isEmptyPassword');
+            }
             return;
+        } else {
+            params.delete('isEmptyPassword');
         }
 
         if (params.get('clientid') && !params.get('clientsecret') && !logout) {