@sap/cds-dk 8.5.1 → 8.6.1

package/lib/build/plugins/helm/files/subcharts/web-application/values.schema.json

@@ -1,5 +1,6 @@
 {
     "$schema": "http://json-schema.org/draft-07/schema",
+    "$id": "https://github.tools.sap/unified-runtime/web-application/blob/main/values.schema.json",
     "type": "object",
     "required": [
         "image",
@@ -19,27 +20,12 @@
                     "type": "object",
                     "properties": {
                         "name": {
+                            "default": "image-pull-secret",
                             "$ref": "#/definitions/KubernetesName"
                         },
                         "dockerconfigjson": {
                             "type": "string"
                         }
-                    },
-                    "dependencies": {
-                        "name": {
-                            "not": {
-                                "required": [
-                                    "dockerconfigjson"
-                                ]
-                            }
-                        },
-                        "dockerconfigjson": {
-                            "not": {
-                                "required": [
-                                    "name"
-                                ]
-                            }
-                        }
                     }
                 },
                 "image": {
@@ -352,41 +338,11 @@
             "properties": {
                 "liveness": {
                     "$id": "#/properties/health/properties/liveness",
-                    "type": "object",
-                    "additionalProperties": false,
-                    "properties": {
-                        "path": {
-                            "type": "string",
-                            "default": "/healthz"
-                        },
-                        "periodSeconds": {
-                            "type": "integer",
-                            "minimum": 1
-                        },
-                        "failureThreshold": {
-                            "type": "integer",
-                            "minimum": 1
-                        }
-                    }
+                    "$ref": "#/definitions/Probe"
                 },
                 "readiness": {
                     "$id": "#/properties/health/properties/readiness",
-                    "type": "object",
-                    "additionalProperties": false,
-                    "properties": {
-                        "path": {
-                            "type": "string",
-                            "default": "/healthz"
-                        },
-                        "periodSeconds": {
-                            "type": "integer",
-                            "minimum": 1
-                        },
-                        "failureThreshold": {
-                            "type": "integer",
-                            "minimum": 1
-                        }
-                    }
+                    "$ref": "#/definitions/Probe"
                 }
             }
         },
@@ -617,6 +573,13 @@
                     "$id": "#/properties/expose/properties/host",
                     "type": "string"
                 },
+                "hosts": {
+                    "$id": "#/properties/expose/properties/hosts",
+                    "type": "array",
+                    "items": {
+                        "type": "string"
+                    }
+                },
                 "enabled": {
                     "$id": "#/properties/expose/properties/enabled",
                     "type": "boolean",
@@ -631,6 +594,16 @@
                     "$id": "#/properties/expose/properties/gateway",
                     "type": "string"
                 },
+                "APIRule": {
+                    "$id": "#/properties/expose/properties/APIRule",
+                    "type": "object",
+                    "additionalProperties": false,
+                    "properties": {
+                        "experimental": {
+                            "type": "boolean"
+                        }
+                    }
+                },
                 "corsPolicy": {
                     "$id": "#/properties/expose/properties/corsPolicy",
                     "type": "object",
@@ -824,12 +797,19 @@
                                 "serviceInstanceFullname": {
                                     "type": "string"
                                 },
+                                "serviceInstanceNamespace": {
+                                    "type": "string"
+                                },
                                 "externalName": {
                                     "type": "string"
                                 },
                                 "secretName": {
                                     "type": "string"
                                 },
+                                "secretKey": {
+                                    "type": "string",
+                                    "default": "credentials"
+                                },
                                 "parameters": {
                                     "type": "object"
                                 },
@@ -1332,6 +1312,33 @@
             "title": "ImagePullPolicy",
             "type": "string",
             "enum": ["Always", "IfNotPresent", "Never"]
+        },
+        "Probe": {
+            "title": "Probe configuration",
+            "type": "object",
+            "additionalProperties": false,
+            "properties": {
+                "path": {
+                    "type": "string",
+                    "default": "/healthz"
+                },
+                "periodSeconds": {
+                    "type": "integer",
+                    "minimum": 1
+                },
+                "failureThreshold": {
+                    "type": "integer",
+                    "minimum": 1
+                },
+                "successThreshold": {
+                    "type": "integer",
+                    "minimum": 1
+                },
+                "timeoutSeconds": {
+                    "type": "integer",
+                    "minimum": 1
+                }
+            }
         }
     }
 }

package/lib/build/plugins/helm/files/subcharts/web-application/values.yaml

@@ -1,12 +1,11 @@
 # Helm global values, for more information, see https://helm.sh/docs/chart_template_guide/subcharts_and_globals/#global-chart-values
 global:
   # Image Pull Secret configuration, for more information, see https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
-  imagePullSecret: {}
-  ## Name of the Kubernetes Secret, used as an image pull secret (must be of type kubernetes.io/dockerconfigjson). Can't be used with the `dockerconfigjson` option.
-  # name: ""
-  ## The content for the dynamically generated Kubernetes Secret, which will be used as an image pull secret. Can't be used with the `name` option.
-  # dockerconfigjson: ""
-  # Either name or repository is required.
+  imagePullSecret:
+    ## Name of the Kubernetes Secret, used as an image pull secret (must be of type kubernetes.io/dockerconfigjson).
+    name: image-pull-secret
+    ## The content for the dynamically generated Kubernetes Secret, which will be used as an image pull secret.
+    # dockerconfigjson: ""
   image: {}
   ## Setting the imagePullPolicy, see https://kubernetes.io/docs/concepts/containers/images/#image-pull-policy
   # imagePullPolicy: Always
@@ -15,7 +14,7 @@ global:
     _internal:
       web-application:
         versions:
-          1.17.2: true
+          1.20.0: true
 ## Will be used instead of the `.Chart.Name`, e.g. when generating the Deployment name.
 # nameOverride: name
 
@@ -103,6 +102,10 @@ health:
     # periodSeconds: 3
     ## Number of probes to fail in a row, in order to consider the check failed.
     # failureThreshold: 5
+    ## Number of probes to succeed in a row, in order to consider the check successful.
+    # successThreshold: 1
+    ## Connection timeout
+    # timeoutSeconds: 1
   # Readiness-probe configuration.
   readiness:
     # HTTP path used by Kubernetes, to perform readiness-probe calls.
@@ -111,6 +114,10 @@ health:
     # periodSeconds: 3
     ## Number of probes to fail in a row, in order to consider the check failed.
     # failureThreshold: 5
+    ## Number of probes to succeed in a row, in order to consider the check successful.
+    # successThreshold: 1
+    ## Connection timeout
+    # timeoutSeconds: 1
 # Initial timeout in seconds, during which the app must start giving the response to the liveness-probe.
 startupTimeoutSeconds: 30
 ## Use read only filesystem for the Deployment.
@@ -145,8 +152,12 @@ envFrom: []
 #     name: my-secret-ref1
 
 expose:
+  APIRule: {}
+  #   experimental: true
   ## Specifies the service's dns name for inbound external traffic. If it doesn't contain a dot, the default cluster domain will be appended.
   # host: ""
+  ## Since v2alpha1, multiple hosts can be configured
+  # hosts: []
 
   # Expose the application to the internet.
   enabled: true
@@ -226,6 +237,7 @@ rbac: {}
 #     verbs: ["get", "watch", "list"]
 bindings:
   defaultProperties:
+    secretKey: credentials
     credentialsRotationPolicy:
       enabled: false
       rotationFrequency: "720h"

package/lib/build/util.js

@@ -4,7 +4,7 @@ const cds = require('../cds')
 const cp = require('child_process');
 const execAsync = require('util').promisify(cp.exec)
 const IS_WIN = require('os').platform() === 'win32'
-const { SEVERITY_ERROR, FILE_EXT_CDS } = require('./constants');
+const { SEVERITY_ERROR, FILE_EXT_CDS, NODEJS_MODEL_EXCLUDE_LIST } = require('./constants');
 const DEBUG = cds.debug('cli|build')
 const SECRETS = /(passw)|(cert)|(ca)|(secret)|(key)/i
 const WS_MAX_DEPTH = 2
@@ -140,6 +140,8 @@ async function getDefaultModelOptions(ws = false, filter) {
             cds.root = root
             cds.env = env
         }
+        // exclude redundant built-in models starting with workspace path, e.g. 'books/@sap/cds-mtxs/srv/bootstrap'
+        paths = paths.filter(p => NODEJS_MODEL_EXCLUDE_LIST.includes(p) || !NODEJS_MODEL_EXCLUDE_LIST.some(ex => p.endsWith(ex)))
     }
     return paths
 }

package/lib/import/common.js

@@ -17,7 +17,7 @@ let optionsMapping = {
 };
 
 let apiOptions = ['includeNamespaces', 'keepNamespace', 'beta'];
-let commonOptions = ['no_copy', 'no_save', 'out', 'dry', 'as', 'from', 'force', 'config', 'destination', 'name'];
+let commonOptions = ['no_copy', 'no_save', 'out', 'dry', 'as', 'from', 'force', 'config', 'destination', 'group', 'name'];
 
 async function generateEDMX2JSON(edmx) {
     let cjson = convert.xml2json(edmx, {
@@ -344,7 +344,7 @@ async function _updatePackageJson(dest, services, kind, cwd, config, destination
     if (!config && destination) {
         config = { "[production]": { credentials: { destination } } };
     }
-    
+
     let package_json_updated = false;
     for (let service of services) {
         // existing service configuration data can be updated, e.g. in case of delta imports

package/lib/init/constants.js

@@ -5,7 +5,7 @@ module.exports = {
     COMMAND_ADD: 'add',
 
     JAVA_LTS_VERSIONS: [17, 21],
-    MAVEN_ARCHETYPE_VERSION: '3.5.0',
+    MAVEN_ARCHETYPE_VERSION: '3.6.0',
 
     OPTIONS: Object.freeze({
         COMPLETION: 'completion',
@@ -31,6 +31,8 @@ module.exports = {
         SIDE_BY_SIDE_EXTENSIBILITY: 'side-by-side-extensibility',
         MTX: 'mtx',
         XSUAA: 'xsuaa',
+        IAS: 'ias',
+        AMS: 'ams',
         HANA: 'hana',
         POSTGRES: 'postgres',
         SQLITE: 'sqlite',

package/lib/init/index.js

@@ -5,6 +5,7 @@ const validate = require('./validate')
 const { OPTIONS, COMMAND_INIT, PROJECT_FILES } = require('./constants')
 const { readdirSync } = require('fs')
 const { join } = require('path')
+const cmd = require('../util/command')
 const { NODEJS, JAVA } = OPTIONS
 
 const cds = require('..'), { exists } = cds.utils
@@ -107,6 +108,10 @@ module.exports = class CDSGenerator {
     }
 
     _initialize(projectName) {
+        // avoid config files to be created in the home dir
+        if (cds.cli.command === COMMAND_INIT && !projectName && process.cwd() === require('os').homedir()) {
+            throw `In your home directory, use 'cds init <project>'`
+        }
         const { options } = cds.cli
         this.cwd = options.cwd || process.cwd();
         cds.root = path.resolve(this.cwd, projectName || '.');
@@ -151,6 +156,11 @@ module.exports = class CDSGenerator {
             await template.combineSupported();
         }
 
+        if (cds.env['project-nature'] === 'java') {
+            console.log('Updating frozen dependencies in package-lock.json...')
+            await cmd.spawnCommand('npm' , ['i', '--package-lock-only'], { cwd:cds.root })
+        }
+
         if (cds.cli.command === COMMAND_INIT) {
             const relativeProjectPath = path.relative(this.cwd, cds.root)
             let message = 'Successfully created project.'

package/lib/init/registries/mta.js

@@ -100,6 +100,11 @@ const saasRegistry = {
     where: { type: 'org.cloudfoundry.managed-service', 'parameters.service': 'saas-registry' }
 }
 
+const subscriptionManager = {
+    in: 'resources',
+    where: { type: 'org.cloudfoundry.managed-service', 'parameters.service': 'subscription-manager' }
+}
+
 const srvApi4 = srv => ({
     in: [srv, 'provides'],
     where: { name: 'srv-api', 'properties.srv-url': '${default-url}' }
@@ -127,7 +132,7 @@ const providedAppApi = {
 
 const requiredAppApi4 = module => ({
     in: [module, 'requires'],
-    where: { name: 'app-api', 'properties.SUBSCRIPTION_URL': '~{app-protocol}://\\${tenant_subdomain}-~{app-uri}' }
+    where: { name: 'app-api' }
 })
 
 const requiredMtxSidecarApi4 = srv => ({
@@ -202,6 +207,7 @@ module.exports = {
     postgres,
     postgresDeployer,
     saasRegistry,
+    subscriptionManager,
     redis,
     srvApi4,
     mtxSidecar4,

package/lib/init/template/ams/files/Chart.yaml.hbs

@@ -0,0 +1,4 @@
+dependencies:
+  - name: content-deployment
+    alias: ams-policies-deployer
+    version: ">0.0.0"

package/lib/init/template/ams/files/containerize.yaml.hbs

@@ -0,0 +1,20 @@
+modules:
+  - name: {{appName}}-ams-policies-deployer
+    build-parameters:
+      buildpack:
+        {{#hasHelmUnifiedRuntime}}
+        builder: proxy-unified-runtime-dmz.int.repositories.cloud.sap/builder/noble
+        {{/hasHelmUnifiedRuntime}}
+        {{^hasHelmUnifiedRuntime}}
+        type: nodejs
+        builder: builder-jammy-base
+        {{/hasHelmUnifiedRuntime}}
+        {{#isJava}}
+        path: srv/src/gen/policies
+        {{/isJava}}
+        {{^isJava}}
+        path: gen/policies
+        {{/isJava}}
+        env:
+          BP_NODE_RUN_SCRIPTS: ""
+

package/lib/init/template/ams/files/manifest.yml.hbs

@@ -0,0 +1,24 @@
+---
+applications:
+  - name: {{appName}}-srv
+    env:
+      AMS_DCL_ROOT: ams/dcl
+
+  - name: {{appName}}-ams-policies-deployer
+    {{#isJava}}
+    path: srv/src/gen/policies
+    {{/isJava}}
+    {{^isJava}}
+    path: gen/policies
+    {{/isJava}}
+    no-route: true
+    health-check-type: none
+    memory: 256M
+    instances: 1
+    buildpack: nodejs_buildpack
+    command: (npm start && echo "This application may now be stopped to free resources." || echo "AMS Policy Deployment unsuccessful.") && sleep infinity
+    services:
+      - name: {{appName}}-auth
+        parameters:
+          credential-type: X509_GENERATED
+          app-identifier: ams-policy-deployer

package/lib/init/template/ams/files/mta.yaml.hbs

@@ -0,0 +1,31 @@
+modules:
+  - name: {{appName}}-srv
+    type: {{language}}
+    path: {{& srvPath}}
+    deployed-after:
+      - {{appName}}-ams-policies-deployer
+    properties:
+      AMS_DCL_ROOT: ams/dcl
+
+  - name: {{appName}}-ams-policies-deployer
+    type: javascript.nodejs
+    {{#isJava}}
+    path: srv/src/gen/policies
+    {{/isJava}}
+    {{^isJava}}
+    path: gen/policies
+    {{/isJava}}
+    parameters:
+      buildpack: nodejs_buildpack
+      no-route: true
+      no-start: true
+      tasks:
+        - name: deploy-dcl
+          command: npm start
+          memory: 512M
+    requires:
+      - name: {{appName}}-auth
+        parameters:
+          config:
+            credential-type: X509_GENERATED
+            app-identifier: ams-policy-deployer

package/lib/init/template/ams/files/package.json.hbs

@@ -0,0 +1,10 @@
+{
+  {{#isNodejs}}
+  "dependencies": {
+    "@sap/ams": "^2"
+  },
+  "devDependencies": {
+    "@sap/ams-dev": "^2"
+  }
+  {{/isNodejs}}
+}

package/lib/init/template/ams/files/values.yaml.hbs

@@ -0,0 +1,13 @@
+srv:
+    env:
+        AMS_DCL_ROOT: ams/dcl
+
+ams-policies-deployer:
+    image:
+        repository: {{appName}}-ams-policies-deployer
+    bindings:
+        identity:
+            serviceInstanceName: identity
+            parameters:
+                credential-type: X509_GENERATED
+                app-identifier: ams-policy-deployer

package/lib/init/template/ams/index.js

@@ -0,0 +1,80 @@
+const cds = require('../../../cds')
+const { readProject } = require('../../projectReader')
+const { merge, sort } = require('../../merge')
+const { srv4 } = require('../../registries/mta')
+const mvn = require('../../mvn')
+
+module.exports = class AmsTemplate extends require('../../plugin') {
+
+    static help() {
+        return 'authorization via AMS'
+    }
+
+    requires() {
+        return ['ias']
+    }
+
+    static hasInProduction(env) {
+        return env.requires?.auth?.ams || cds.cli.options?.add?.has('ams') || cds.cli.argv?.some(arg => arg?.match?.(/(^|,)ams(,|$)/))
+    }
+
+    async run() {
+        const project = readProject()
+        await merge(__dirname, 'files/package.json.hbs').into('package.json', { project, forceOverwrite: true })
+        project.isNodejs && await sort('package.json', 'dependencies')
+        await sort('package.json', 'devDependencies')
+        if (project.isJava) await mvn.add('ams')
+    }
+
+    async combine() {
+        const project = readProject()
+        const { hasMta, hasCfManifest, hasHelm, hasHelmUnifiedRuntime, hasContainerize } = project
+
+        if (hasMta) {
+            await this.#combineWithMta(project)
+        }
+
+        if (hasCfManifest) {
+            await this.#combineWithCfManifest(project)
+        }
+
+        if (hasHelm || hasHelmUnifiedRuntime) {
+            await this.#combineWithHelm(project)
+        }
+
+        if (hasContainerize) {
+            await this.#combineWithContainerize(project)
+        }
+    }
+
+    async #combineWithMta(project) {
+        const srv = srv4(project.srvPath)
+        const amsPoliciesDeployer = {
+            in: 'modules',
+            where: { 'name': `${project.appName}-ams-policies-deployer` }
+        }
+        await merge(__dirname, 'files/mta.yaml.hbs').into('mta.yaml', { project, additions: [srv, amsPoliciesDeployer] })
+    }
+
+    async #combineWithCfManifest(project) {
+        const amsPoliciesDeployer = {
+            in: 'applications',
+            where: { 'name': `${project.appName}-ams-policies-deployer` }
+        }
+        await merge(__dirname, 'files/manifest.yml.hbs').into('manifest.yml', { project, additions: [amsPoliciesDeployer] })
+    }
+
+    async #combineWithHelm(project) {
+        const amsPoliciesDeployer = {
+            in: 'dependencies',
+            where: { 'alias': 'ams-policies-deployer' }
+        }
+        await merge(__dirname, 'files/Chart.yaml.hbs').into('chart/Chart.yaml', { project, additions: [amsPoliciesDeployer] })
+        await merge(__dirname, 'files/values.yaml.hbs').into('chart/values.yaml', { project })
+    }
+
+    async #combineWithContainerize(project) {
+        const amsDeployer = { in: 'modules', where: { 'name': `${project.appName}-ams-policies-deployer` } }
+        await merge(__dirname, 'files/containerize.yaml.hbs').into('containerize.yaml', { project, additions: [amsDeployer] })
+    }
+}

package/lib/init/template/approuter/files/mta.yaml.hbs

@@ -33,8 +33,10 @@ modules:
         group: destinations
         properties:
           name: srv-api # must be used in xs-app.json as well
-          url: ~{srv-url}
-          forwardAuthToken: true
+          url: {{#hasIas}}~{srv-cert-url}{{/hasIas}}{{^hasIas}}~{srv-url}{{/hasIas}}
+          forwardAuthToken: true{{#hasIas}}
+          forwardAuthCertificates: true
+          strictSSL: true{{/hasIas}}
       {{#hasMultitenancy}}
       - name: mtx-api
         group: destinations
@@ -42,7 +44,6 @@ modules:
           name: mtx-api # must be used in xs-app.json as well
           url: ~{mtx-url}
       {{/hasMultitenancy}}
-    {{#hasMultitenancy}}
     {{#isNodejs}}
     provides:
       - name: app-api
@@ -50,11 +51,12 @@ modules:
           app-protocol: ${protocol}
           app-uri: ${default-uri}
     {{/isNodejs}}
-    {{/hasMultitenancy}}
     {{#isJava}}
     provides:
       - name: app-api
         properties:
+          app-protocol: ${protocol}
+          app-uri: ${default-uri}
           url: ${default-url}
     {{/isJava}}
 

package/lib/init/template/approuter/files/package.json

@@ -1,7 +1,7 @@
 {
   "name": "approuter",
   "dependencies": {
-    "@sap/approuter": "^17.0.0"
+    "@sap/approuter": "^18.0.0"
   },
   "engines": {
     "node": "^20"