@sap/cds-dk 8.5.1 → 8.6.1

package/lib/init/template/http/index.js

@@ -225,20 +225,22 @@ module.exports = class HttpTemplate extends require('../../plugin') {
       // Later: differentiate between CF and Kyma
       const env = await cf.getEnv(app)
       if (!cds.cli.options.dry)   console.error('Fetching credentials from Cloud Foundry app \'' + app + '\'...')
-      this.hostname = `https://${env.application_env_json.VCAP_APPLICATION.application_uris[0]}`
-      const xsuaaCredentials = env.system_env_json.VCAP_SERVICES?.xsuaa[0]?.credentials ?? {}
-      const { url, clientid, clientsecret, certurl, certificate, key } = xsuaaCredentials
-      if (!url) throw new Error('No XSUAA service found in the environment of ' + app)
+      const hostname = `https://${env.application_env_json.VCAP_APPLICATION.application_uris[0]}`
+      const { xsuaa, identity } = env.system_env_json.VCAP_SERVICES ?? {}
+      const credentials = (xsuaa?.[0] ?? identity?.[0])?.credentials ?? {}
+      const { url, clientid, clientsecret, certurl, certificate, key } = credentials
+      if (!url) throw new Error('No authentication service found in the environment of ' + app)
 
       const auth = certificate ? { maxRedirects: 0, httpsAgent: new https.Agent({ cert: certificate, key }) }
-                              : { auth: { username: clientid, password: clientsecret } }
-      const authUrl = `${certurl ?? url}/oauth/token`
+                               : { auth: { username: clientid, password: clientsecret } }
+      const suffix = xsuaa ? 'oauth/token' : 'oauth2/token'
+      const authUrl = `${certurl ?? url}/${suffix}`
       const data = `grant_type=client_credentials&client_id=${encodeURI(clientid)}`
       const config = { method: 'POST', timeout: 5000, data, ...auth }
       const { access_token } = (await axios(authUrl, config)).data
-      this.approuterAuth = `x-approuter-authorization: bearer ${access_token}`
+      const approuterAuth = `x-approuter-authorization: bearer ${access_token}`
+      return [hostname, approuterAuth]
     }
-    return [this.hostname, this.approuterAuth]
   }
 
   /**

package/lib/init/template/ias/files/Chart.yaml.hbs

@@ -0,0 +1,4 @@
+dependencies:
+  - name: service-instance
+    alias: identity
+    version: ">0.0.0"

package/lib/init/template/ias/files/manifest.yml.hbs

@@ -0,0 +1,8 @@
+---
+applications:
+  - name: {{appName}}-srv
+    services:
+      - name: {{appName}}-auth
+        parameters:
+          credential-type: X509_GENERATED
+          app-identifier: srv

package/lib/init/template/ias/files/mta.yaml.hbs

@@ -0,0 +1,61 @@
+modules:
+  - name: {{appName}}-srv
+    type: {{language}}
+    path: {{& srvPath}}
+    requires:
+      - name: {{appName}}-auth
+        parameters:
+          config:
+            credential-type: X509_GENERATED
+            app-identifier: srv
+
+  - name: {{appName}}
+    type: approuter.nodejs
+    path: app/router
+    requires:
+      - name: {{appName}}-auth
+        parameters:
+          config:
+            credential-type: X509_GENERATED
+            app-identifier: approuter
+
+  - name: {{appName}}-mtx
+    type: nodejs
+    path: gen/mtx/sidecar
+    requires:
+      - name: {{appName}}-auth
+        parameters:
+          config:
+            credential-type: X509_GENERATED
+            app-identifier: mtx
+
+resources:
+  - name: {{appName}}-auth
+    type: org.cloudfoundry.managed-service
+    {{#hasApprouter}}
+    requires:
+      - name: app-api
+    {{/hasApprouter}}
+    parameters:
+      service: identity
+      service-name: {{appName}}-auth
+      service-plan: application
+      config:
+        display-name: {{appName}}
+        {{#hasApprouter}}
+        oauth2-configuration:
+          redirect-uris:
+            - ~{app-api/app-protocol}://~{app-api/app-uri}/login/callback
+          post-logout-redirect-uris:
+            - ~{app-api/app-protocol}://~{app-api/app-uri}/*/logout.html
+        {{/hasApprouter}}
+        {{#hasAms}}
+        authorization:
+          enabled: true
+        {{/hasAms}}
+        {{#hasMultitenancy}}
+        multi-tenant: true
+        {{/hasMultitenancy}}
+        {{#hasXsuaa}}
+        xsuaa-cross-consumption: true
+        {{/hasXsuaa}}

package/lib/init/template/ias/files/package.json.hbs

@@ -0,0 +1,22 @@
+{
+  {{#isNodejs}}
+  "dependencies": {
+    "@sap/xssec": "^4"
+  },
+  "cds": {
+  {{/isNodejs}}
+    "requires": {
+      {{#profile}}
+      "[{{profile}}]": {
+      {{/profile}}
+        "auth": {
+          "kind": "ias"
+        }
+      {{#profile}}
+      }
+      {{/profile}}
+    }
+  {{#isNodejs}}
+  }
+  {{/isNodejs}}
+}

package/lib/init/template/ias/files/services-manifest.yml.hbs

@@ -0,0 +1,6 @@
+---
+create-services:
+  - name: {{appName}}-auth
+    broker: identity
+    plan: application
+    parameters: "{ \"display-name\": \"{{appName}}\"{{#hasAms}}, \"authorization\": { \"enabled\": true }{{/hasAms}}{{#hasMultitenancy}}, \"multi-tenant\": true {{/hasMultitenancy}}}"

package/lib/init/template/ias/files/values.yaml.hbs

@@ -0,0 +1,52 @@
+{{#hasMultitenancy}}
+sidecar:
+    bindings:
+        auth:
+            serviceInstanceName: identity
+            parameters:
+                credential-type: X509_GENERATED
+                app-identifier: mtx
+{{/hasMultitenancy}}
+{{#hasApprouter}}
+approuter:
+    bindings:
+        auth:
+            serviceInstanceName: identity
+            parameters:
+                credential-type: X509_GENERATED
+                app-identifier: approuter
+{{/hasApprouter}}
+srv:
+    bindings:
+        auth:
+            serviceInstanceName: identity
+            parameters:
+                credential-type: X509_GENERATED
+                app-identifier: srv
+
+identity:
+    serviceOfferingName: identity
+    servicePlanName: application
+    parameters:
+        display-name: {{appName}}
+        {{#hasAms}}
+        authorization:
+            enabled: true
+        {{/hasAms}}
+        {{#hasMultitenancy}}
+        multi-tenant: true
+        {{/hasMultitenancy}}
+        {{#hasXsuaa}}
+        xsuaa-cross-consumption: true
+        {{/hasXsuaa}}
+        {{#hasApprouter}}
+        oauth2-configuration:
+            redirect-uris:
+                {{=<% %>=}}
+                - https://*.{{ tpl .Values.global.domain . }}/login/callback
+                <%={{ }}=%>
+            post-logout-redirect-uris:
+                {{=<% %>=}}
+                - https://*.{{ tpl .Values.global.domain . }}/*/logout.html
+                <%={{ }}=%>
+        {{/hasApprouter}}

package/lib/init/template/ias/index.js

@@ -0,0 +1,71 @@
+const { readProject } = require('../../projectReader')
+const { merge } = require('../../merge')
+const { srv4, approuter, mtxSidecar4 } = require('../../registries/mta')
+const cds = require('../../../cds')
+// const mvn = require('../../mvn')
+
+module.exports = class IasTemplate extends require('../../plugin') {
+
+    static help() {
+        return 'authentication via IAS'
+    }
+
+    static hasInProduction(env) {
+        // REVISIT: Ugly, find more generic solution
+        return env.requires?.auth?.kind === 'ias' ||
+               cds.cli.argv?.[0]?.includes('ias') || cds.cli.argv?.[0]?.includes('ams') ||
+               cds.cli.options?.add?.has('ias') || cds.cli.options?.add?.has('ams') || false
+    }
+
+    async run() {
+        const project = readProject()
+        const { configFile } = project
+        await merge(__dirname, 'files/package.json.hbs').into(configFile, { project, forceOverwrite: true })
+        if (project.hasMultitenancy) {
+            await merge(__dirname, 'files/package.json.hbs').into('mtx/sidecar/package.json', { project, forceOverwrite: true })
+        }
+        // if (project.isJava) await mvn.add('ias')
+    }
+
+    async combine() {
+        const project = readProject()
+        const { isJava, hasMta, hasCfManifest, hasHelm, hasHelmUnifiedRuntime, hasApprouter, hasMultitenancy, srvPath } = project
+
+        if (hasMta) {
+            const srv = srv4(srvPath)
+            const identity = { in: 'resources', where: { 'parameters.service': 'identity' } }
+            const srvIdentityBinding = { in: [srv, 'requires'], where: { 'parameters.config.app-identifier': 'srv' } }
+            const additions = [srv, identity, srvIdentityBinding]
+            if (hasApprouter) {
+                const approuterIdentityBinding = { in: [approuter, 'requires'], where: { 'parameters.config.app-identifier': 'approuter' } }
+                additions.push(approuter, approuterIdentityBinding)
+            }
+            if (hasMultitenancy) {
+                const mtxSidecar = mtxSidecar4(isJava ? 'mtx/sidecar' : 'gen/mtx/sidecar')
+                const mtxIdentityBinding = { in: [mtxSidecar, 'requires'], where: { 'parameters.config.app-identifier': 'mtx' } }
+                additions.push(mtxSidecar, mtxIdentityBinding)
+            }
+            await merge(__dirname, 'files/mta.yaml.hbs').into('mta.yaml', { project, additions })
+        }
+
+        if (hasHelm || hasHelmUnifiedRuntime) {
+            const identity = { in: 'dependencies', where: { 'alias': 'identity' } }
+            await merge(__dirname, 'files/Chart.yaml.hbs').into('chart/Chart.yaml', { project, additions: [identity] })
+            await merge(__dirname, 'files/values.yaml.hbs').into('chart/values.yaml', { project })
+            // TODO: MTX, approuter
+        }
+
+        if (hasCfManifest) {
+            await this.#combineWithCfManifest(project) // REVISIT: we shouldn't overly promote cf-manifest
+        }
+    }
+
+    async #combineWithCfManifest(project) {
+        const srv = { in: 'applications', where: { 'name': `${project.appName}-srv` } }
+        const identityBinding = { in: 'services', where: { 'parameters.app-identifier': project.appName } }
+        await merge(__dirname, 'files/manifest.yml.hbs').into('manifest.yml', { project, additions: [srv, identityBinding] })
+
+        const identity = { in: 'create-services', where: { 'broker': 'identity' } }
+        await merge(__dirname, 'files/services-manifest.yml.hbs').into('services-manifest.yml', { project, additions: [identity] })
+    }
+}

package/lib/init/template/mta/files/mta.yaml.hbs

@@ -22,6 +22,11 @@ modules:
       buildpack: nodejs_buildpack
       readiness-health-check-type: http
       readiness-health-check-http-endpoint: /health
+      {{#hasIas}}
+      routes:
+        - route: "${default-url}"
+        - route: "${default-host}.cert.${default-domain}"
+      {{/hasIas}}
     build-parameters:
       builder: npm
 {{/isNodejs}}
@@ -30,6 +35,11 @@ modules:
       buildpack: sap_java_buildpack_jakarta
       readiness-health-check-type: http
       readiness-health-check-http-endpoint: /actuator/health/readiness
+      {{#hasIas}}
+      routes:
+        - route: "${default-url}"
+        - route: "${default-host}.cert.${default-domain}"
+      {{/hasIas}}
     properties:
       SPRING_PROFILES_ACTIVE: cloud,sandbox
       JBP_CONFIG_COMPONENTS: "jres: ['com.sap.xs.java.buildpack.jre.SAPMachineJRE']"
@@ -43,5 +53,9 @@ modules:
     provides:
       - name: srv-api # required by consumers of CAP services (e.g. approuter)
         properties:
-          srv-url: ${default-url}
+          srv-url: ${default-url}{{#hasIas}}
+          srv-cert-url: '${protocol}://${default-host}.cert.${default-domain}'{{/hasIas}}
     requires: []
+
+resources:
+  []

package/lib/init/template/multitenancy/files/mta.yaml.hbs

@@ -14,6 +14,7 @@ modules:
       - name: srv-api # required by consumers of CAP services (e.g. approuter)
         properties:
           srv-url: ${default-url}
+          {{#hasIas}}srv-cert-url: ${protocol}://${default-host}.cert.${default-domain}{{/hasIas}}
 
   - name: {{appName}}-mtx
     type: nodejs
@@ -33,17 +34,20 @@ modules:
     {{/isJava}}
     parameters:
       memory: 256M
-      disk-quota: 512M
+      disk-quota: 512M{{#hasIas}}
+      routes:
+        - route: "${default-url}"
+        - route: "${default-host}.cert.${default-domain}"{{/hasIas}}
     provides:
       - name: mtx-api
         properties:
-          mtx-url: ${default-url}
-    {{#hasXsuaa}}
+          mtx-url: ${default-url}{{#hasIas}}
+          mtx-cert-url: ${protocol}://${default-host}.cert.${default-domain}{{/hasIas}}
     requires:
-      - name: {{appName}}-auth
-    {{/hasXsuaa}}
+      []
 
 resources:
+  {{#hasXsuaa}}
   - name: {{appName}}-registry
     type: org.cloudfoundry.managed-service
     requires:
@@ -75,3 +79,32 @@ resources:
           onUnSubscriptionAsync: true
           onUpdateDependenciesAsync: true
           callbackTimeoutMillis: 300000 # Increase if your deployments are taking longer than that
+  {{/hasXsuaa}}
+
+  {{#hasIas}}
+  - name: {{appName}}-sms
+    type: org.cloudfoundry.managed-service
+    parameters:
+      service: subscription-manager
+      service-plan: provider
+      config:
+        applicationType: application
+        appName: {{appName}}-${org}-${space}
+        appCallbacks:
+            dependenciesCallbacks:
+              url: ~{mtx-api/mtx-cert-url}/-/cds/sms-provisioning/dependencies/{app_tid}
+            subscriptionCallbacks:
+              url: ~{mtx-api/mtx-cert-url}/-/cds/sms-provisioning/tenant/{app_tid}
+              async:
+                subscribeEnable: true
+                unSubscribeEnable: true
+                timeoutInMillis: 300000 # Increase if your deployments are taking longer than that
+        displayName: {{appName}}
+        description: Description for {{appName}}
+        category: Category
+        iasServiceInstanceName: {{appName}}-auth{{#hasXsuaa}}
+        saasManagerServiceInstanceName: {{appName}}-registry{{/hasXsuaa}}
+    requires:
+      - name: mtx-api
+    {{#hasXsuaa}}processed-after: [{{appName}}-registry, {{appName}}-auth]{{/hasXsuaa}}
+  {{/hasIas}}

package/lib/init/template/multitenancy/files/package.sidecar.json.hbs

@@ -15,7 +15,10 @@
     "build": "cds build ../.. --for mtx-sidecar --production && npm ci --prefix gen"{{/isJava}}
   },
   "cds": {
-    {{#isJava}}"profiles": ["mtx-sidecar", "java"]{{/isJava}}
-    {{#isNodejs}}"profile": "mtx-sidecar"{{/isNodejs}}
+    {{#isJava}}"profiles": ["mtx-sidecar", "java"{{#hasIas}}, "subscription-manager"{{/hasIas}}]{{/isJava}}
+    {{#isNodejs}}
+      {{^hasIas}}"profile": "mtx-sidecar"{{/hasIas}}
+      {{#hasIas}}"profiles": ["mtx-sidecar", "subscription-manager"]{{/hasIas}}
+    {{/isNodejs}}
   }
 }

package/lib/init/template/multitenancy/index.js

@@ -8,8 +8,8 @@ const { copyRenderedJSON } = require('../../../util/fs')
 const {
   srv4, // Server
   mtxSidecar4, // Additional Modules
-  saasRegistry, // BTP Services
-  srvApi4, providedMtxApiSidecar4, requiredMtxSidecarApi4 // APIs
+  saasRegistry, subscriptionManager, // BTP Services
+  srvApi4, providedMtxApiSidecar4, requiredMtxSidecarApi4, // APIs
 } = require('../../registries/mta')
 
 module.exports = class MultitenancyTemplate extends require('../../plugin') {
@@ -40,60 +40,70 @@ module.exports = class MultitenancyTemplate extends require('../../plugin') {
 
   async combine() {
     const project = readProject()
-    const { isNodejs, isJava, hasMta, hasHelm, hasHelmUnifiedRuntime, hasXsuaa, hasHana, hasContainerize, srvPath, hasApprouter } = project
+    const {
+      isNodejs, isJava, hasMta, hasHelm, hasHelmUnifiedRuntime,
+      hasXsuaa, hasIas, hasHana, hasContainerize, hasApprouter,
+      srvPath, appName
+    } = project
 
     if (hasMta) {
       const srv = srv4(srvPath)
       const mtxSidecar = mtxSidecar4(isJava ? 'mtx/sidecar' : 'gen/mtx/sidecar')
       const modules = [srv, mtxSidecar]
-      const services = [saasRegistry]
+      const services = []
+      if (hasIas) services.push(subscriptionManager)
+      if (!hasIas || hasXsuaa) services.push(saasRegistry)
       const apis = [srvApi4(srv), providedMtxApiSidecar4(mtxSidecar)]
       if (isJava) apis.push(requiredMtxSidecarApi4(srv))
       const additions = [...modules, ...services, ...apis]
-      const relationships =  [{
-        insert: [saasRegistry, 'name'],
-        into: [isJava ? srv : mtxSidecar, 'requires', 'name']
-      }]
+      const relationships = []
+      if (hasXsuaa) {
+        relationships.push({
+          insert: [saasRegistry, 'name'],
+          into: [isJava ? srv : mtxSidecar, 'requires', 'name']
+        })
+      }
+      if (hasIas) {
+        relationships.push({
+          insert: [subscriptionManager, 'name'],
+          into: [isJava ? srv : mtxSidecar, 'requires', 'name']
+        })
+      }
       if (isJava) {
         relationships.push({
           insert: [srv, 'name'],
           into: [mtxSidecar, 'build-parameters.requires', 'name']
         })
       }
-
       const templateMtaPath = join(__dirname, 'files/mta.yaml.hbs')
       await merge(templateMtaPath).into('mta.yaml', { with: project, additions, relationships })
     }
 
     if (hasHelm || hasHelmUnifiedRuntime) {
-
       await merge(__dirname, 'files/values.yaml.hbs').into('chart/values.yaml', { with: project })
-
       const domain = hasApprouter ? 'svc.cluster.local:8080' : '{{ .Values.global.domain }}'
       const applicationWorkload = hasApprouter ? 'approuter' : 'srv'
-      const serviceCommunicatingWithSaasReg = hasApprouter ? 'approuter' : isNodejs ? 'sidecar' : 'srv';
+      const serviceCommunicatingWithSaasReg = hasApprouter ? 'approuter' : isNodejs ? 'sidecar' : 'srv'
+      const prefix = `https://{{ .Release.Name }}-${serviceCommunicatingWithSaasReg}-{{ .Release.Namespace }}.{{ .Values.global.domain }}`
+      const getDependencies = `${prefix}${isNodejs ? '/-/cds/saas-provisioning' : '/mt/v1.0/subscriptions'}/dependencies`
+      const onSubscription = `${prefix}${isNodejs ? '/-/cds/saas-provisioning/tenant/{tenantId}' : '/mt/v1.0/subscriptions/tenants/{tenantId}'}`
       await merge({
         'saas-registry': {
-          'parameters': {
-            xsappname: `${project.appName}-{{ .Release.Namespace }}`,
-            appName: `${project.appName}-{{ .Release.Namespace }}`,
+          parameters: {
+            xsappname: `${appName}-{{ .Release.Namespace }}`,
+            appName: `${appName}-{{ .Release.Namespace }}`,
             appUrls: {
-              getDependencies: `https://{{ .Release.Name }}-${serviceCommunicatingWithSaasReg}-{{ .Release.Namespace }}.{{ .Values.global.domain }}${isNodejs ? '/-/cds/saas-provisioning' : '/mt/v1.0/subscriptions'}/dependencies`,
-              onSubscription: `https://{{ .Release.Name }}-${serviceCommunicatingWithSaasReg}-{{ .Release.Namespace }}.{{ .Values.global.domain }}${isNodejs ? '/-/cds/saas-provisioning/tenant/{tenantId}' : '/mt/v1.0/subscriptions/tenants/{tenantId}'}`,
+              getDependencies, onSubscription
             }
           }
         },
-        ...(isNodejs) && { sidecar: {
-          env: {
-            SUBSCRIPTION_URL: `https://\${tenant_subdomain}-{{ .Release.Name }}-${applicationWorkload}-{{ .Release.Namespace }}.{{ .Values.global.domain }}`
-          }
-        }},
-        ...(isJava) && { srv: {
-          env: {
-            CDS_MULTITENANCY_APPUI_URL: `https://{{ .Release.Name }}-${applicationWorkload}-{{ .Release.Namespace }}.{{ .Values.global.domain }}`,
-            CDS_MULTITENANCY_SIDECAR_URL: `http${hasApprouter ? '' : 's'}://{{ .Release.Name }}-sidecar${hasApprouter ? '.' : '-'}{{ .Release.Namespace }}.${domain}`
-          }
-        }}
+        ...(isNodejs) && { sidecar: { env: {
+          SUBSCRIPTION_URL: `https://\${tenant_subdomain}-{{ .Release.Name }}-${applicationWorkload}-{{ .Release.Namespace }}.{{ .Values.global.domain }}`
+        }}},
+        ...(isJava) && { srv: { env: {
+          CDS_MULTITENANCY_APPUI_URL: `https://{{ .Release.Name }}-${applicationWorkload}-{{ .Release.Namespace }}.{{ .Values.global.domain }}`,
+          CDS_MULTITENANCY_SIDECAR_URL: `http${hasApprouter ? '' : 's'}://{{ .Release.Name }}-sidecar${hasApprouter ? '.' : '-'}{{ .Release.Namespace }}.${domain}`
+        }}}
       }).into('chart/values.yaml',{ forceOverwrite: true })
     }
 
@@ -103,14 +113,13 @@ module.exports = class MultitenancyTemplate extends require('../../plugin') {
         deletions.push({
           item: {
             in: 'modules',
-            where: { name: `${project.appName}-hana-deployer` }
+            where: { name: `${appName}-hana-deployer` }
           }
         })
       }
-
       const additions = [{
         in: 'modules',
-        where: { name: `${project.appName}-sidecar` }
+        where: { name: `${appName}-sidecar` }
       }]
       await merge(__dirname, '/files/containerize.yaml.hbs').into('containerize.yaml', { with: project, additions, deletions })
     }

package/lib/init/template/xsuaa/index.js

@@ -11,7 +11,7 @@ module.exports = class XsuaaTemplate extends require('../../plugin') {
     }
 
     static hasInProduction(env) {
-        return env.requires?.auth?.kind === 'xsuaa'
+        return env.requires?.auth?.kind === 'xsuaa' || cds.cli.options?.add?.has('xsuaa') || false
     }
 
     async run() {

package/lib/util/cf.js

@@ -218,7 +218,7 @@ Deployment will stop in the near future for Cloud Foundry client versions < ${CF
     }
 
     async getService(serviceName, showMessage = true) {
-        showMessage && console.log(`Getting service ${bold(serviceName)}`);
+        showMessage && console.log(`getting service ${bold(serviceName)}`);
         const spaceInfo = await this.getCfSpaceInfo();
 
         let counter = POLL_COUNTER;
@@ -263,7 +263,7 @@ Deployment will stop in the near future for Cloud Foundry client versions < ${CF
 
         const probeService = await this.getService(serviceName, false);
         if (probeService) {
-            console.log(`Getting service ${bold(serviceName)}`);
+            console.log(`getting service ${bold(serviceName)}`);
             return probeService;
         }
 
@@ -318,7 +318,7 @@ Deployment will stop in the near future for Cloud Foundry client versions < ${CF
     }
 
     async _getServiceKey(serviceInstance, serviceKeyName, showMessage = true) {
-        showMessage && console.log(`Getting service key ${bold(serviceKeyName)}`);
+        showMessage && console.log(`getting service key ${bold(serviceKeyName)}`);
 
         let counter = POLL_COUNTER;
         while (counter > 0) {
@@ -358,7 +358,7 @@ Deployment will stop in the near future for Cloud Foundry client versions < ${CF
     async getOrCreateServiceKey(serviceInstance, serviceKeyName, parameters, { silent = false, create = true } = {}) {
         const serviceKey = await this._getServiceKey(serviceInstance, serviceKeyName, false);
         if (serviceKey || !create) {
-            if (serviceKey && !silent) console.log(`Getting service key ${bold(serviceKeyName)}`);
+            if (serviceKey && !silent) console.log(`getting service key ${bold(serviceKeyName)}`);
             return serviceKey;
         }
 

package/lib/util/command.js

@@ -20,7 +20,7 @@ class CommandUtil {
      * @returns Promise
      */
     async spawnCommand(cmd, args, options = {}, collectResult = false, showOutput = true) {
-        args = this._sanitizeArgs(args);
+        args = args.map(arg => arg.replace(/[&;|]/g, '')); // sanitize args
         return new Promise((resolve, reject) => {
             DEBUG?.(`[spawn] ${cmd} ${args.join(' ')}`);
 
@@ -84,14 +84,6 @@ class CommandUtil {
         });
     }
 
-    _sanitizeArgs(args) {
-        const result = [];
-        for (const arg of args) {
-            result.push(arg.replace(/[&;|]/g, ''));
-        }
-        return result;
-    }
-
 }
 
 class LogBuffer {