@sap/cds-dk 6.2.3 → 6.3.1

package/CHANGELOG.md

@@ -7,6 +7,42 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
+## Version 6.3.1 - 2022-11-04
+
+### Changed
+
+- `cds init` uses latest Maven Java archetype version 1.29.0 for creating Java projects.
+- Use `@sap/cds` 6.3.1
+- Use `@sap/cds-mtxs` 1.3.1
+
+### Fixed
+
+- MTX Client no longer reports 'Request failed with status code 401' when sending a passcode to old MTX server.
+
+## Version 6.3.0 - 2022-11-02
+
+### Added
+
+- `cds deploy --to h2 --dry` to create drop/create DDL for H2. Full deployment (w/o `--dry`) is not yet supported, though.
+- `cds push <file>|<URL>` to specify a custom extension archive by local path or download URL.
+
+### Changed
+
+- `cds add` support for classic Java projects is now removed.
+- `cds import` now adds the annotation `@cds.external` for all the definitions in the CSN along with the service.
+- `cds import` now adds `notNull` entry for all the parameters and properties in the CSN.
+- MTX Client now trims a passcode entered via prompt for convenience when pasting
+
+### Fixed
+
+- MTX Client now ignores a username potentially saved for the current project, if a passcode is given
+- MTX Client now treats keytar as optional unless explicitly running `cds login`
+- `cds import` now caputres the documentation properly for all the EntitySet referring to same EntityType.
+- `cds deploy --to sql` now produces 'plain' SQL again, suitable for e.g. H2.  In 6.2 it produced 'sqlite' dialect, erroneously.
+- `cds compile --to openapi` now fixes the duplication of fields in `required` section.
+- `cds lint` now recognizes ESLint configurations from _package.json_.
+
+
 ## Version 6.2.3 - 2022-10-21
 
 ### Changed
@@ -28,6 +64,9 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/).
 
 - `cds deploy --to sql` now honors the `cds.sql.dialect` configuration to specify SQL dialects like `postgres`.
 
+### Removed
+- `cds add notebook` removed in favor of custom notebooks in VS Code (now part of the CDS Editor)
+
 ## Version 6.2.1 - 2022-10-10
 
 ### Fixed

package/bin/bind.js

@@ -89,7 +89,7 @@ async function cds_bind(args, options, logger = LOG) {
         throw new Error(`The option '--kind' cannot be specified together with multiple targets ('--to') services. Use one service per call or omit the '--kind' option.`);
     }
 
-    const spinner = new Spinner(logger);
+    const spinner = new Spinner();
 
     let on;
     if (options.on === 'k8s' || options.on === 'kubernetes') {
@@ -139,7 +139,7 @@ async function cds_bind(args, options, logger = LOG) {
         const kindText = kind && `with kind ${highlight(kind)}`;
         const nameText = !isJavaProject && name && highlight(name);
 
-        logger.log(['Binding', nameText, 'to', platformText(binding), bindingText(binding, highlight), kindText].filter(t => t).join(' '));
+        logger.info(['Binding', nameText, 'to', platformText(binding), bindingText(binding, highlight), kindText].filter(t => t).join(' '));
 
         if (!resolvedService.name) {
             const { binding } = resolvedService;
@@ -156,8 +156,8 @@ async function cds_bind(args, options, logger = LOG) {
         logger
     });
 
-    logger.log();
-    logger.log(`${info('TIP:')} Run with cloud bindings: ${bold(runCmd(options, isJavaProject))}`);
+    logger.info();
+    logger.info(`${info('TIP:')} Run with cloud bindings: ${bold(runCmd(options, isJavaProject))}`);
 }
 
 async function cds_bind_exec(command) { // eslint-disable-lint

package/bin/deploy/to-h2.js

@@ -0,0 +1,4 @@
+exports.deploy = function deploy_to_sql (model, db, options) {
+    options.dialect = 'h2'
+    return require('./to-sql') .deploy (model, db, options)
+}

package/bin/deploy/to-sqlite.js

@@ -6,10 +6,12 @@ exports.deploy = function deploy_to_sqlite (_model, _db, options) {
     const model = _model || conf.model || cds.resolve(!fts ? '*' : ['*',fts], false)
     const file = _database4 (_db, _dbrl, conf)
 
-    const dialect = _dbrl && _dbrl.match(/^(\w+)/) && RegExp.$1
-    if (dialect)  options.dialect = (dialect === 'sql')
-        ? conf.dialect || cds.env.sql.dialect
-        : dialect
+    // current 'sqlite' default is bad, as we want to default to 'plain', so ignore it
+    const env_dialect = cds.env.sql.dialect !== 'sqlite' ? cds.env.sql.dialect : 'plain'
+    const to_dialect = _dbrl && _dbrl.match(/^(\w+)/) && RegExp.$1
+    if (to_dialect)  options.dialect = (to_dialect === 'sql')
+        ? conf.dialect || env_dialect
+        : to_dialect
     if (options.dialect === 'postgres' && !options.dry)  console.error('\nDeploying to PostgreSQL is not yet supported\n')
 
     return cds.deploy(model) .to ('sqlite:'+file, options)

package/bin/help.js

@@ -10,7 +10,7 @@ module.exports = exports = Object.assign (help, {help:`
 
     *i* | *init*       jump-start cds-based projects
     *a* | *add*        add a feature to an existing project
-    *y* | *bind*       [beta] bind a service to a hana instance
+    *y* | *bind*       bind application to remote services
     *m* | *import*     add models from external sources
     *c* | *compile*    compile cds models to different outputs
     *p* | *parse*      parses given cds models

package/bin/login.js

@@ -82,6 +82,7 @@ module.exports = Object.assign(login, {
 
         For security reasons, username will only be saved for app URLs that look like localhost.
         The same is true for an empty password. Non-empty passwords will never be saved.
+        If saved, a username will be associated with the project folder, not with the (potentially ambiguous) URL.
         
         Note: Productive secrets should not be specified on a command line, since this might expose them to
         unauthorized users on the same machine!

package/bin/push.js

@@ -5,25 +5,29 @@ module.exports = Object.assign(push, {
     help: `
 # SYNOPSIS
 
-    *cds push* [ <extension-project-directory> ]
+    *cds push* [ <extension-project-directory> | <extension-archive> | <extension-url> ]
 
     Push your extension to the SaaS app in order to enable or update it.
 
+    You may specify a project directory or a custom extension archive, either as a
+    local file or as a URL to download it from.
+    A download URL may contain Basic-Auth credentials as in 'https://user:pass@host'.
+    
     By default, the current working directory is used as project directory.
 
-    Authentication data will not be saved.
+    Any authentication data will not be saved.
 
 
 # OPTIONS
 
     *--to* <url>
 
-        Specify the URL of the extensible SaaS app. By default, it is determined from
-        the current user's active CDS or Cloud Foundry login.
+        Specify the URL of the extensible SaaS app. Determined from the current user's active
+        CDS or Cloud Foundry login by default.
 
     *-s* | *--subdomain* <tenant-subdomain>
 
-        Specify your tenant's subdomain. By default, it's determined from project settings.
+        The tenant subdomain. Determined from project settings by default.
 
     *-p* | *--passcode* <passcode>
 
@@ -37,6 +41,7 @@ module.exports = Object.assign(push, {
 
         Client ID and optionally Client Secret for authentication.
 
+
 # SEE ALSO
 
     *cds pull* to get the CDS model of the SaaS app.
@@ -47,17 +52,34 @@ module.exports = Object.assign(push, {
 
 
 async function push([projectFolder], options = {}) {
+    const { statSync } = require('fs');
+    const { resolve } = require('path');
+    function isDir(dir) {
+        return statSync(resolve(dir), { throwIfNoEntry: false })?.isDirectory();
+    }
+
     const [username, password] = options.user?.split(':') ?? [];
     delete options.user;
     const [clientid, clientsecret] = options.client?.split(':') ?? [];
     delete options.client;
 
-    await require('../lib/client/push').run({
+    let extArchive;
+    if (projectFolder && !isDir(projectFolder)) {
+        extArchive = projectFolder;
+        projectFolder = undefined;
+    }
+
+    const args = [{
         ...options,
         projectFolder,
         username,
         password,
         clientid,
         clientsecret
-    })
+    }];
+    if (extArchive) {
+        args.push({ extArchive });
+    }
+
+    await require('../lib/client/push').run(...args);
 }

package/lib/bind/userCdsrcJsonStorageProvider.js

@@ -47,7 +47,7 @@ class UserCdsrcJsonStorageProvider {
             }
         }
 
-        logger.log(`adding entry '${file}' to ${GIT_IGNORE_FILE}.`);
+        logger.info(`adding entry '${file}' to ${GIT_IGNORE_FILE}.`);
         let gitignore = await this.readFileSafely(GIT_IGNORE_FILE);
         gitignore = gitignore + `
 # added by cds bind
@@ -80,7 +80,7 @@ ${file}
         // if (options['save-credentials'] && services.find(service => service.credentials) && process.stdin.isTTY) {
         //     const answer = await this.askBooleanQuestion(warn(`IF YOU CONTINUE, SENSITIVE DATA WILL BE WRITTEN TO AN UNENCRYPTED FILE [${jsonPath}]! Do you want to continue [y/N] ?`));
         //     if (!answer) {
-        //         options.logger.log(`aborting cds bind; not writing any sensitive data to file [${jsonPath}]`);
+        //         options.logger.info(`aborting cds bind; not writing any sensitive data to file [${jsonPath}]`);
         //         return;
         //     }
         // }
@@ -115,9 +115,9 @@ ${file}
 
         await this.writeJsonFile(jsonPath, jsonObject, options.logger);
         if (options.profile) {
-            options.logger.log(`Saving bindings to ${highlight(jsonPath)} in profile ${highlight(options.profile)}`);
+            options.logger.info(`Saving bindings to ${highlight(jsonPath)} in profile ${highlight(options.profile)}`);
         } else {
-            options.logger.log(`Saving bindings to ${highlight(jsonPath)}`);
+            options.logger.info(`Saving bindings to ${highlight(jsonPath)}`);
         }
     }
 

package/lib/client/activate.js

@@ -66,7 +66,7 @@ module.exports = class Activate extends BaseCommand {
                 await this.runCustomFileUpload(params);
             }
         } catch (error) {
-            await this.handleHttpError(error, params);
+            this.handleHttpError(error, params);
         }
     }
 

package/lib/client/base_command.js

@@ -15,20 +15,20 @@ module.exports = class BaseCommand {
         return exists;
     }
 
-    static async handleHttpError(error, params) {
-        if (!('isAxiosError' in error)) {
-            throw error;
-        }
-
-        switch (error.response && error.response.status) {
+    static handleHttpError(error, params, url) {
+        url = url ?? params.get('appUrl');
+        const prefix = `Request to ${url} failed`;
+        switch (error.response?.status) {
             case 401:
-                throw new CliError('Request failed: authorization might have expired. Please retry with valid passcode' +
-                    (params.has('passcodeUrl') ? ` from ${params.get('passcodeUrl')}` : ''), error);
+                throw new CliError(prefix + ': invalid authentication. Retry with valid passcode' +
+                    params.has('passcodeUrl') ? ` from ${params.get('passcodeUrl')}` : '', error);
+            case 403:
+                throw new CliError(prefix + ': insufficient authorization. Ensure client has all necessary roles', error);
             case 404:
-                throw new CliError(`Request failed. Please check application URL ${params.get('appUrl')}`, error);
+                throw new CliError(prefix + ': resource not found.');
             case 422:
                 // Compilation or native-extension error.
-                throw new CliError(undefined, error);
+                throw new CliError(prefix, error);
             default:
                 // Unexpected error should be transparent to user.
                 throw error;

package/lib/client/helper/dependency_helper.js

@@ -15,7 +15,7 @@ function globalModulesDir() {
     return cachedDir;
 }
 
-module.exports = function requireGlobal(packageId) {
+function requireGlobal(packageId) {
     try {
         const packagePath = require.resolve(packageId, { paths: [globalModulesDir()] });
         return require(packagePath);
@@ -24,3 +24,12 @@ module.exports = function requireGlobal(packageId) {
         log.debug(`Failed to find module '${packageId}' in ${globalModulesDir()}`, error);
     }
 }
+
+function resetCache() {
+    cachedDir = undefined;
+}
+
+module.exports = {
+    requireGlobal,
+    resetCache
+}

package/lib/client/helper/logging.js

@@ -2,7 +2,7 @@
 
 function debug(debugText, error) {
     if (process.env.DEBUG) {
-        console.error(getMessage(debugText, error));
+        console.log(getMessage(debugText, error));
     }
 }
 
@@ -11,7 +11,11 @@ function getMessage(errorText, error) {
     if (!error) {
         return message;
     }
-    message += '\n' + (error.response?.data?.error?.message || error.message);
+    message += '\n' + (
+           error.response?.data?.message        // response body == error
+        || error.response?.data?.error?.message // response body == { error }
+        || error.message                        // no response attached
+    );
     if (process.env.DEBUG && error.stack) {
         message += '\n' + error.stack;
     }

package/lib/client/pull.js

@@ -7,13 +7,13 @@ const axios = require('axios');
 
 const { login } = require('./auth_manager');
 const BaseCommand = require('./base_command');
+const { CliError } = require('./helper/errors');
 
 module.exports = class Pull extends BaseCommand {
 
     static async run(paramValues) {
         if (!tar) {
-            console.error(`cds pull requires @sap/cds version >= 6.2. Current version is ${cds.version}\n`);
-            return process.exitCode = 1;
+            throw new CliError(`cds pull requires @sap/cds version >= 6.2. Current version is ${cds.version}\n`);
         }
 
         const params = await login(paramValues);
@@ -26,8 +26,8 @@ module.exports = class Pull extends BaseCommand {
         fs.rmSync(target, { force: true, recursive: true });
         fs.mkdirSync(target, { recursive: true });
 
-        const tgzBuffer = Buffer.from(await this.getTgz(params));
-        return tar.xz(tgzBuffer).to(target);
+        const baseModelTgz = await this.getTgz(params);
+        return tar.xz(baseModelTgz).to(target);
     }
 
     static getAppPackageName(projectFolder) {
@@ -40,7 +40,7 @@ module.exports = class Pull extends BaseCommand {
         const options = { ...params.get('reqAuth'), responseType: 'arraybuffer' };
 
         return axios.post(pullUrl, {}, options)
-            .then(response => response.data)
-            .catch(error => this.handleHttpError(error, params));
+            .then(response => Buffer.from(response.data))
+            .catch(error => this.handleHttpError(error, params, pullUrl));
     }
 }

package/lib/client/push.js

@@ -5,26 +5,45 @@ const axios = require('axios');
 
 const { login } = require('./auth_manager');
 const BaseCommand = require('./base_command');
-const { CliError } = require('./helper/errors'); // REVISIT: add and use a this.error() method instead
+const { CliError } = require('./helper/errors');
+const { schemaRegex } = require('./helper/url_helper');
 
 module.exports = class Push extends BaseCommand {
 
-    static async run(paramValues) {
+    static async run(paramValues, pushOptions) {
         const params = await login(paramValues);
-        const projectFolder = params.get('projectFolder');
-        const tar = join(projectFolder, 'gen', 'extension.tgz')
-        const url = params.get('appUrl')
-        const subdomain = params.get('subdomain') // REVISIT: Why are subdomains not transparently encoded in URLs?
-        const target = { url }; if (subdomain) target.subdomain = subdomain
-        const source = { src: local(tar) }
-        console.log(`\nPushing extension from`, source, 'to', target);
-
-        const tgz = fs.readFileSync(tar, { encoding: 'base64' });
-        const extensionName = this.getExtensionName(projectFolder);
-        await this.pushTgz(params, tgz, extensionName);
+
+        const { src, content } = await this.readSource(params, pushOptions);
+
+        const extensionName = this.getExtensionName(params.get('projectFolder'));
+        const url = params.get('appUrl');
+        const subdomain = params.get('subdomain');
+        const target = Object.assign({ url }, subdomain && { subdomain });
+        console.log(`\nPushing extension '${extensionName}' from`, { src }, 'to', target);
+
+        await this.pushTgz(params, content, extensionName);
         console.log ('Activation succeeded.\n')
     }
 
+    static async readSource(params, pushOptions) {
+        let src = pushOptions?.extArchive ?? join(params.get('projectFolder'), 'gen', 'extension.tgz');
+        let content;
+        if (fs.existsSync(src)) {
+            content = fs.readFileSync(src, { encoding: 'base64' });
+            src = local(src);
+        } else {
+            if (!schemaRegex.test(src)) {
+                throw new CliError(`Nonexistent path: ${src}`);
+            }
+            try {
+                content = (await axios.get(src, { responseEncoding: 'base64' })).data;
+            } catch (error) {
+                this.handleHttpError(error, params, src);
+            }
+        }
+        return { src, content };
+    }
+
     static getExtensionName(projectFolder) {
         try {
             return require(join(projectFolder, 'package.json')).name;
@@ -41,6 +60,6 @@ module.exports = class Push extends BaseCommand {
             extension: tgz,
             tag: extensionName
         }, options)
-            .catch(error => this.handleHttpError(error, params));
+            .catch(error => this.handleHttpError(error, params, pushUrl));
     }
 }

package/lib/client/settings_manager.js

@@ -3,8 +3,8 @@ const os = require('os');
 const path = require('path');
 const axios = require('axios');
 
-const requireGlobal = require('./helper/dependency_helper');
-const keytar = requireGlobal('keytar');
+const { requireGlobal } = require('./helper/dependency_helper');
+let keytar;
 
 const log = require('./helper/logging');
 const { getAppFromSuggestions, getAppName, getSubdomain } = require('./helper/cf_helper');
@@ -115,7 +115,7 @@ async function getTokenBaseUrl(params, renewUrl) {
             existingPath = path;
             break;
         } catch (error) {
-            if (error.response?.status === 404) {
+            if ([401, 404].includes(error.response?.status)) {
                 continue;
             }
             throw error;
@@ -159,13 +159,15 @@ class SettingsManager {
         log.debug(`Saving settings for project ${params.get('projectFolder')}`);
 
         const paramsMap = params.toValueMap(Persistence.setting);
-        if (localhostRegex.test(params.get('appUrl'))) {
-            console.log(`Saving username${(params.get('isEmptyPassword') ? ' and empty-password hint' : '')} with project settings.`);
-        } else {
-            // Save only against localhost for security reasons.
-            log.debug('Not saving username because app is not recognized to run on localhost.');
-            delete paramsMap.username;
-            delete paramsMap.isEmptyPassword;
+        if (params.has('username')) {
+            // Save username only for localhost for security reasons.
+            if (localhostRegex.test(params.get('appUrl'))) {
+                console.log(`Saving username${(params.get('isEmptyPassword') ? ' and empty-password hint' : '')} with project settings.`);
+            } else {
+                log.debug('Not saving username because app is not recognized to run on localhost.');
+                delete paramsMap.username;
+                delete paramsMap.isEmptyPassword;
+            }
         }
         await this._saveToFile(params.get('projectFolder'), paramsMap);
 
@@ -196,6 +198,12 @@ class SettingsManager {
         log.debug(`Loaded project settings for ${params.get('projectFolder')}: ${loadedSettings.format()}`);
         const loadedAppUrl = loadedSettings.get('appUrl');
 
+        if (params.has('passcode') && loadedSettings.has('username')) {
+            console.log(`Unsetting username${(loadedSettings.has('isEmptyPassword') ? ' and empty-password hint' : '')}`);
+            loadedSettings.delete('username');
+            loadedSettings.delete('isEmptyPassword');
+        }
+
         params.mergeLower(loadedSettings);
 
         await this.updateUrls(params, logout, loadedAppUrl);
@@ -206,6 +214,12 @@ class SettingsManager {
 
     static async updateUrls(params, logout, loadedAppUrl) {
         async function addAppUrlAndSubdomain() {
+            function needsSubdomain() {
+                // Subdomain needed for token retrieval.
+                return params.has('appUrl') && !localhostRegex.test(params.get('appUrl')) && !params.has('username');
+            }
+
+            // Prefix URL schema
             if (params.has('appUrl')) {
                 const appUrl = params.get('appUrl');
                 if (!schemaRegex.test(appUrl)) {
@@ -217,11 +231,16 @@ class SettingsManager {
                     log.debug(`Added schema to app URL: ${params.get('appUrl')}`);
                 }
             }
+
             if (!logout) {
+                // Get appUrl from CF
                 if (!params.has('appUrl')) {
                     log.debug('App URL not given');
                     await getAppUrlAndSubdomainFromSuggestions(params);
-                } else if (!params.has('subdomain') && !localhostRegex.test(params.get('appUrl'))) {
+                }
+
+                // Get subdomain from CF
+                if (!params.has('subdomain') && needsSubdomain()) {
                     log.debug('Subdomain not given');
                     const appName = await getAppName(params.get('appUrl'));
                     if (appName) {
@@ -229,10 +248,14 @@ class SettingsManager {
                     }
                 }
             }
+
+            // Check required param: appUrl
             if (!params.has('appUrl')) {
                 throw new CliError('App URL not given. Please specify it or log in to Cloud Foundry and repeat this command.');
             }
-            if (!params.has('subdomain') && !params.has('username')) {
+
+            // Check required param: subdomain
+            if (!params.has('subdomain') && needsSubdomain()) {
                 const subdomain = extractSubdomain(params.get('appUrl'));
                 if (!subdomain) {
                     throw new CliError('Subdomain not given');
@@ -263,16 +286,25 @@ class SettingsManager {
             }
             return;
         }
-        if (params.get('username') || keytar) {
+        if (params.get('username')) {
             return;
         }
-        if (params.get('tokenStorage') === 'keyring') {
+        keytar = requireGlobal('keytar');
+        if (keytar) {
+            return;
+        }
+        // keytar missing
+
+        if (params.get('tokenStorage') === 'keyring' && params.get('saveData')) {
+            // Explicit login w/o plain-text storage enabled
             throw new CliError(capitalize(TOKEN_STORAGE_DESC.keyring) + ' requested but keytar not installed. ' +
                 'Run `npm install -g keytar` or switch to ' + TOKEN_STORAGE_DESC.plain + ' by adding `--plain` (discouraged).');
         }
-        if (params.get('renewLogin') || logout) {
-            console.log('Disabling', TOKEN_STORAGE_DESC.keyring, 'functionality: `keytar` module not found. Run `npm install -g keytar` to install it.');
-        }
+
+        const doLog = params.get('saveData') || logout
+            ? console.log.bind(console) // Explicit login/logout call
+            : log.debug;
+        doLog(`Disabling ${TOKEN_STORAGE_DESC.keyring} functionality: keytar not found. Run \`npm install -g keytar\` to install it.`);
     }
 
     static async addAuth(params, logout) {
@@ -293,7 +325,7 @@ class SettingsManager {
         }
         async function addPasscode() {
             const prompt = `Passcode${params.get('passcodeUrl') ? ' (visit ' + params.get('passcodeUrl') + ' to generate)' : ''}: `;
-            params.set('passcode', await Question.askQuestion(prompt, undefined, true));
+            params.set('passcode', (await Question.askQuestion(prompt, undefined, true)).trim());
             console.log();
             if (params.get('passcode') === '') {
                 throw new CliError('Passcode cannot be empty');
@@ -337,11 +369,10 @@ class SettingsManager {
             }
             if (params.get('password') === '') {
                 params.set('isEmptyPassword', true);
-                // TODO check password only in production env
-                // throw new CliError('Password cannot be empty');
             } else {
                 params.delete('isEmptyPassword');
             }
+            log.debug('Ignoring any saved authentication data because username is given');
             return;
         } else {
             params.delete('isEmptyPassword');
@@ -358,7 +389,7 @@ class SettingsManager {
 
         setRelevantAuth(auth);
 
-        if (!params.has('token') && !params.has('passcode') && !params.has('clientsecret') && !logout) {
+        if (!logout && !params.has('token') && !params.has('passcode') && !params.has('clientsecret')) {
             await addPasscode();
         }
     }
@@ -368,7 +399,7 @@ class SettingsManager {
         await this.loadAndMergeSettings(allParams, true);
 
         const target = `URL ${allParams.get('appUrl')}, subdomain '${allParams.get('subdomain')}'`;
-        let fromStorage = fromOtherStorage && other(params.get('tokenStorage'))
+        let fromStorage = fromOtherStorage && other(params.get('tokenStorage'));
         const deleteBoth = !fromStorage && allParams.get('tokenStorage') && allParams.get('clearOtherTokenStorage');
 
         log.debug(`Deleting authentication data${fromOtherStorage ? ' from other storage' : ''} for ${target}`);

package/lib/compile/openapi/csdl2openapi.js

@@ -1830,7 +1830,7 @@ see [Expand](http://docs.oasis-open.org/odata/odata/v4.01/odata-v4.01-part1-prot
             schemas[schemaName].properties = schemaProperties;
 
         if (suffix === SUFFIX.create && required.length > 0)
-            schemas[schemaName].required = required;
+            schemas[schemaName].required = [...new Set(required)];
 
         const description = type[voc.Core.Description];
         if (description) {

package/lib/compile/to-xsuaa.js

@@ -3,7 +3,7 @@ const fs = require('fs')
 const path = require('path')
 
 const hardcoded = {
-  Scopes: ['system-user', 'authenticated-user', 'registered-user', 'identified-user', 'internal-user', 'any'],
+  Scopes: ['system-user', 'authenticated-user', 'registered-user', 'identified-user', 'internal-user', 'privileged-user', 'any'],
   Attributes: ['id', 'tenant', 'ext_attr']
 }