@sap/cds-dk 9.9.2 → 10.0.3

package/node_modules/@sap/cds/lib/srv/cds.Service.js

@@ -0,0 +1,214 @@
+const CoreService = require('./srv-dispatch')
+const Request = require('../req/request')
+const Event = require('../req/event')
+const cds = require('../index')
+
+
+/**
+ * This class constitutes the API used by service consumers to send requests, and emit events.
+ *
+ * - `dispatch()` - is the central method ultimately called by all the other methods below.
+ * - `emit()` - is the central method of the **Messaging API** to emit asynchronous event messages.
+ * - `send()` - is the central method of the **Request API** to send synchronous requests.
+ * - `run()` - is the central method of the **Querying API** to execute queries.
+ *
+ * The other methods, like `read`, `create`, `update`, `delete`, are **CRUD-style** syntactical
+ * sugar variants provided for convenience, or **REST-style** like `get`, `put`, `post`, `patch`.
+ */
+class ConsumptionAPI extends CoreService {
+
+  emit (event, data, headers) {
+    if (is_object(event)) return this.dispatch (event instanceof Event ? event : new Event(event))
+    else return this.dispatch (new Event ({ event, data, headers }))
+  }
+
+  send (...args) {
+    const req = _req4 (...args)
+    return this.dispatch (req)
+  }
+
+  schedule (...args) {
+    const req = _req4 (...args), { ms4, cron } = cds.utils;
+    (req.queue ??= {}).task = req.event
+    return {
+      after (t,u) { (req.queue ??= {}).after = ms4(t,u);            return this },
+      every (t,u) { (req.queue ??= {}).every = cron(t) ?? ms4(t,u); return this },
+      as    (t)   { (req.queue ??= {}).task  = t ?? req.event;      return this },
+      then: (r,e) => cds.queued(this).send(req).then(r,e)
+    }
+  }
+  unschedule (task) { return cds.queued(this)._unschedule(task) }
+
+  get    (...args) { return is_rest(args[0]) ? this.send('GET',   ...args) : this.read   (...args) }
+  put    (...args) { return is_rest(args[0]) ? this.send('PUT',   ...args) : this.update (...args) }
+  post   (...args) { return is_rest(args[0]) ? this.send('POST',  ...args) : this.create (...args) }
+  patch  (...args) { return is_rest(args[0]) ? this.send('PATCH', ...args) : this.update (...args) }
+  delete (...args) { return is_rest(args[0]) ? this.send('DELETE',...args) : DELETE.from (...args).bind(this) }
+
+  /**
+   * Queries can be passed as one of the following:
+   * - a CQL tagged template string, which is converted into an instance of `cds.ql.Query`
+   * - a CQN object, or an array of such
+   * - a native SQL string, with binging parameters in the second argument `data`
+   */
+  run (query, data) {
+    if (query.raw) [ query, data ] = [ cds.ql (...arguments) ]
+    const req = new Request ({ query, data })
+    return this.dispatch (req)
+  }
+  read   (...args) { return is_query(args[0]) ? this.run(...args) : SELECT.read(...args).bind(this) }
+  insert (...args) { return INSERT(...args).bind(this) }
+  create (...args) { return INSERT.into(...args).bind(this) }
+  update (...args) { return UPDATE.entity(...args).bind(this) }
+  upsert (...args) { return UPSERT(...args).bind(this) }
+  exists (...args) { return SELECT.one([1]).from(...args).bind(this) }
+
+  /**
+   * Streaming API variant of .run(). Subclasses should override this to support real streaming.
+   */
+  foreach (query, data, callback) {
+    if (!callback)  [ data, callback ] = [ undefined, data ]
+    return this.run (query, data) .then (rows => rows.forEach(callback) || rows)
+  }
+
+  // Internal-only API to free resources when tenants offboard
+  /** @protected */ disconnect(tenant) {} // eslint-disable-line no-unused-vars
+}
+
+
+/**
+ * This class provides API used by service providers to reflect
+ * their service definitions from a given model.
+ */
+class ReflectionAPI extends ConsumptionAPI {
+
+  /** @param {import('../core/linked-csn').LinkedCSN} csn */
+  set model (csn) {
+    super.model = csn ? cds.compile.for.nodejs(csn) : undefined
+  }
+
+  /** @type import('../core/classes').service */
+  get definition() {
+    const defs = this.model?.definitions; if (!defs) return super.definition = undefined
+    return super.definition = defs[this.options.service] || defs[this.name]
+  }
+  get namespace()  {
+    return super.namespace  = this.definition?.name
+    || this.model?.namespace
+    || !this.isDatabaseService && !/\W/.test(this.name) && this.name
+    || undefined
+  }
+  get entities()   {
+    const filter = cds.env.features.compat_texts_entities ? d => d.kind === 'entity' : d => d.kind === 'entity' && !d.name.endsWith('.texts')
+    return super.entities = this.reflect('entities', filter)
+  }
+  get events()     {
+    return super.events = this.reflect('events', d => d.kind === 'event')
+  }
+  get types()      {
+    return super.types = this.reflect('types', d => !d.kind || d.kind === 'type')
+  }
+  get actions()    {
+    return super.actions = this.reflect('actions', d => d.kind === 'action' || d.kind === 'function')
+  }
+  reflect (property, filter) {
+    if (typeof property === 'function') filter = property
+    return this.model?.childrenOf (this.namespace, filter) || []
+  }
+}
+
+// REVISIT: remove opt-in for deprecated function API with cds^11
+if (cds.env.features.compat_srv_getters) ReflectionAPI.prototype.reflect = function (property, filter) {
+  const children = this.model?.childrenOf (this.namespace, filter) || []
+  const fn = ns => !ns || ns === this.namespace ? children : this.model[property]?.(ns) || {}
+  const fx = cds.utils.deprecated (fn, {
+    kind: 'property',
+    old: `srv.${property}()`,
+    use: property === 'entities' ? `cds.entities()` : undefined
+  })
+  Object.setPrototypeOf (fx, children)
+  Object.assign (fx, children)
+  return fx
+}
+
+
+/**
+ * This class provides the API used by service providers to add event handlers.
+ * It inherits the ConsumptionAPI and ReflectionAPI.
+ */
+class Service extends ReflectionAPI {
+
+  /**
+   * @param {string} name
+   * @param {import('../core/linked-csn').LinkedCSN} model
+   */
+  constructor (name, model, options) { super()
+    if (typeof name === 'object') [ model, options, name = _service_in(model) ] = [ name, model ]
+    this.name = name || new.target.name // i.e. when called without any arguments
+    this.options = options ??= {}
+    if (options.kind) this.kind = options.kind // shortcut, e.g. for 'sqlite', ...
+    if (model) this.model = model
+    this.decorate()
+  }
+  init(){ return this } //> essentially a constructor without arguments
+
+  // Handler registration API
+  prepend (fn) { this.handlers.prepend(this,fn); return this }
+  /** @typedef {( event, entity?, handler:(req:import('../req/request'))=>{})=> Service} boa */
+  /** @type boa */ before (...args) { return this.handlers.register (this, 'before', ...args) }
+  /** @type boa */ on     (...args) { return this.handlers.register (this, 'on',     ...args) }
+  /** @type boa */ after  (...args) { return this.handlers.register (this, 'after',  ...args) }
+  reject (e, path) { return this.handlers.register (this, 'before', e, path,
+    r => r.reject (405, `Event "${r.event}" not allowed for entity "${r.path}".`)
+  )}
+
+   // Overrriding `srv.run()` to additionally allow running a function in a managed transaction.
+  run (fn) {
+    if (typeof fn !== 'function') return super.run (...arguments)
+    if (this.context) return fn(this)                       // if this is already a tx -> run fn with this
+    const ctx = cds.context, tx = ctx?.tx                   // is there an (open) outer tx? ...
+    if (!tx || tx._done === 'committed') return this.tx(fn) // no -> run fn with root tx
+    if (tx._done !== 'rolled back') return fn(this.tx(ctx)) // yes -> run fn with nested tx
+    else throw this.tx._is_done (tx._done)                  // throw if outer tx was rolled back
+  }
+
+  // Inofficial APIs - for internal use only
+  /** @protected */ static _is_service_class = true //> for factory
+  /** @protected */ get endpoints() { return super.endpoints = cds.service.protocols.endpoints4(this) }
+  /** @protected */ set endpoints(p) { super.endpoints = p }
+  /** @protected */ get path() { return super.path = cds.service.protocols.path4(this) }
+  /** @protected */ set path(p) { super.path = p }
+
+  // Deprecated APIs - kept for backwards compatibility
+  /** @deprecated */ get _handlers() { return this.handlers }
+  /** @deprecated */ get operations() { return this.actions }
+  /** @deprecated */ get transaction() { return this.tx }
+  /** @deprecated */ get isExtensible() { return this.model === cds.model && !this.name?.startsWith('cds.xt.') }
+
+  get resolve() {
+    return super.resolve = new Resolver(this)
+  }
+}
+
+Service.prototype.tx = require('./srv-tx')
+Service.prototype.decorate = require('./srv-methods')
+
+const Resolver = require('./srv-resolve')
+
+const is_object = x => typeof x === 'object'
+const is_query = x => x?.bind || Array.isArray(x) && !x.raw
+const is_rest = x => typeof x === 'string' && x[0] === '/'
+const _service_in = m => cds.linked(m).services?.[0]?.name
+|| cds.error.expected `${{model:m}} to be a CSN with a single service definition`
+
+const _req4 = (event, path, data, headers) => {
+  if (is_query(event)) return new Request({ query: event, data: path, headers })
+  if (is_object(event)) return event instanceof Request ? event : new Request(event)
+  if (is_object(path)) return new Request (path.is_linked //...
+    ? { method:event, entity:path, data, headers }
+    : { method:event, data:path, headers:data })
+  else return new Request({ method:event, path, data, headers })
+}
+
+exports = module.exports = Service
+exports.Service = Service

package/node_modules/@sap/cds/lib/srv/factory.js

@@ -0,0 +1,78 @@
+const cds = require('..'), { path, isfile } = cds.utils
+/**
+ * NOTE: Need this typed helper variable to be able to use IntelliSense for calls with new keyword.
+ * @import Service from './cds.Service'
+ * @type new() => Service & Promise<Service>
+ */
+const factory = ServiceFactory
+module.exports = exports = factory
+
+
+function ServiceFactory (name, model, options) {
+
+  const o = { ...options } // avoid changing shared options
+  const def = model?.definitions[name] || {}
+  const remote = o.external && (o.credentials || !o.mocked)
+
+  return _use (remote ? o.impl : o.with || def['@impl'] || _sibling(def) || o.impl || _kind())
+  async function _use (impl) { switch (typeof impl) {
+    case 'function':
+      if (impl._is_service_class) return new impl (name, model, o)
+      return _use (_kind(), /*with:*/ o.impl = _legacy(impl) || impl)
+    case 'object':
+      return _use (impl[name] || impl.default || _kind())
+    case 'string':
+      if (impl.startsWith('@sap/cds/')) impl = cds.home + impl.slice(8)  //> for local tests in @sap/cds dev
+      if (impl.startsWith('./')) impl = path.join (_source4(def) || 'x', '.'+impl)
+      try { var resolved = require.resolve (path.join (cds.root, impl)) } catch (e) {       // fetch local paths
+        try { resolved = require.resolve (impl, {paths:[ cds.root, cds.home ]}) } catch {  // fetch in node_modules
+          throw cds.error(`Failed loading service implementation from ` + impl, { cause: e })
+        }
+      }
+      impl = await cds.utils.import (resolved)
+      impl = await _use (impl)
+      impl._source = resolved
+      return impl
+    default: throw cds.error`Invalid service implementation for ${name}: ${impl}`
+  }}
+
+  function _kind (kind = o.kind ??= def['@kind'] || 'app-service') {
+    const {impl} = cds.requires[kind] || cds.requires.kinds[kind] || cds.error `No configuration found for 'cds.requires.${kind}'`
+    return impl || cds.error `No 'impl' configured for 'cds.requires.kinds.${kind}'`
+  }
+}
+
+
+const exts = process.env.CDS_TYPESCRIPT ? ['.ts','.js','.mjs'] : ['.js','.mjs']
+const _source4 = d => d['@source'] || d.$location?.file
+const _sibling = d => {
+  let file = _source4(d); if (!file) return
+  let { dir, name } = path.parse (file); if (!dir) dir = '.'
+  for (let subdir of ['/', '/lib/', '/handlers/']) {
+    for (let ext of exts) try {
+      const impl = dir + subdir + name + ext
+      return isfile(impl) || require.resolve (impl, {paths:[ cds.root, cds.home ]})
+    } catch(e) {
+      if (e.code !== 'MODULE_NOT_FOUND') throw e
+    }
+  }
+}
+const _legacy = impl => { // legacy hello-world style class
+  if (impl.prototype && /^class\b/.test(impl)) return function() {
+    const legacy = new impl
+    for (let k of Reflect.ownKeys(impl.prototype))
+      k === 'constructor' || k === 'prototype' || this.on(k, legacy[k].bind(legacy))
+  }
+}
+
+
+/**
+ * @protected Called by cds.connect() and cds.serve() for cds.service.impl-style implementations.
+ * @param {Service} srv
+ */
+exports.init = async function (srv) {
+  const {impl} = srv.options; if (typeof impl === 'function' && !impl._is_service_class)
+    await impl.call(srv, srv)
+  await srv.init()
+  return srv
+}

package/node_modules/@sap/cds/lib/srv/middlewares/auth/basic-auth.js

@@ -0,0 +1,55 @@
+module.exports = function basic_auth (options) {
+
+  const cds = require ('../../../index')
+  const DEBUG = cds.debug('basic|auth')
+
+  // use configured mocked users
+  const users = require ('./mocked-users') (options) 
+
+  // determine if login is required based on options, environment, and multitenancy
+  const login_required = ( 
+    options.login_required || 
+    options.credentials && process.env.NODE_ENV === 'production' ||
+    cds.requires.multitenancy
+  )
+
+
+  /** 
+   * Authentication middleware for HTTP Basic Authentication with mock users. 
+   * Supports anonymous access, with logins triggered if required.
+   * Upon successful authentication, it sets:
+   * - `cds.context.user` with user id (same in `req.user`)
+   * - `cds.context.tenant` with the tenant id, if any
+   * - `cds.context.features` with the feature flags, if any
+   * @type { import('express').Handler } express_handler 
+   */
+  return async function basic_auth (req, res, next) {
+    req._login = login // allow subsequent code to request a user login
+    const auth = req.headers.authorization // get basic authorization header
+    // allow anonymous access unless login is required
+    if (!auth?.match(/^basic/i)) return login_required ? req._login() : next()
+    // decode user credentials from autorization header
+    const [id,pwd] = Buffer.from(auth.slice(6),'base64').toString().split(':')
+    // verify username and password
+    const u = await users.verify (id, pwd)
+    // re-request login in case of wrong credentials
+    if (u.failed) return req._login()
+    // user authenticated...
+    const {tenant} = u, {features} = req.headers || u
+    let ctx = cds.context; ctx.user = req.user = u
+    if (tenant) ctx.tenant = tenant
+    if (features) ctx.features = features
+    DEBUG?.('authenticated:', { user: u.id, tenant, features })
+    next()
+  }
+
+
+  /**
+   * Error middleware to trigger login from subsequent layers. 
+   * @this {import('express').Request}
+   */
+  function login() {
+    DEBUG?.(401, '> login required')
+    return this.res.set('WWW-Authenticate', `Basic realm="Users"`).sendStatus(401)
+  }
+}

package/node_modules/@sap/cds/lib/srv/middlewares/auth/dummy-auth.js

@@ -0,0 +1,8 @@
+const cds = require ('../../../index'), {privileged} = cds.User
+
+module.exports = function dummy_auth() {
+  return function dummy_auth (req, res, next) {
+    req.user = privileged
+    next()
+  }
+}

package/node_modules/@sap/cds/lib/srv/middlewares/auth/ias-auth.js

@@ -0,0 +1,167 @@
+const cds = require('../../../index.js')
+const LOG = cds.log('auth')
+
+const {
+  createSecurityContext,
+  Token,
+  IdentityService,
+  XsuaaService,
+  XsuaaToken,
+  errors: { ValidationError }
+} = require('./xssec')
+
+module.exports = function ias_auth(config) {
+  // cds.env.requires.auth.known_claims is not an official config!
+  const { kind, credentials, config: serviceConfig = {}, known_claims = KNOWN_CLAIMS, xsuaa = 'xsuaa' } = config
+  const skipped_attrs = known_claims.reduce((a, x) => ((a[x] = 1), a), {})
+
+  if (!credentials)
+    cds.error(`Authentication kind "${kind}" configured, but no IAS instance bound to application. ` +
+        'Either bind an IAS instance, or switch to an authentication kind that does not require a binding.')
+
+  // enable signature cache by default
+  serviceConfig.validation ??= {}
+  if (!('signatureCache' in serviceConfig.validation)) serviceConfig.validation.signatureCache = { enabled: true }
+  // activate decode cache if not already done or explicitely disabled by setting Token.decodeCache to false or undefined
+  if (Token.decodeCache === null) Token.enableDecodeCache()
+
+  const auth_service = new IdentityService(credentials, serviceConfig)
+  const user_factory = get_user_factory(credentials, skipped_attrs)
+
+  /*
+   * re validation:
+   *   if the request goes to the cert url, then we should validate the token.
+   *   however, this requires header "x-forwarded-client-cert" which requires additional configuration in the approuter ("forwardAuthCertificates: true").
+   *   also, we currently get the non-cert route attached to the application as well (-> adjust "cds add mta"?), for which validation would always fail.
+   *   by default, the approuter is configured to use the non-cert route ("url: ~{srv-url}" instead of "url: ~{srv-cert-url}").
+   *   if the developer explicitely changes to the cert route, then we can expect him/her to also configure cert forwarding.
+   *   hence, if there is no explicit validation configuration by the app, we can and should create a service with validation enabled and use if for the cert route.
+   *   this way, we validate if possible with the least amount of custom configuration.
+   */
+
+  const should_validate =
+    process.env.VCAP_APPLICATION &&
+    JSON.parse(process.env.VCAP_APPLICATION).application_uris?.some(uri => uri.match(/\.cert\.|\.mesh\.cf\./))
+  const validation_configured = serviceConfig.validation?.x5t?.enabled != null || serviceConfig.validation?.proofToken?.enabled != null
+
+  let validating_auth_service
+  if (should_validate && !validation_configured) {
+    const _serviceConfig = { ...serviceConfig }
+    _serviceConfig.validation = { x5t: { enabled: true }, proofToken: { enabled: true } }
+    validating_auth_service = new IdentityService(credentials, _serviceConfig)
+  }
+
+  // xsuaa fallback allows to also accept XSUAA tokens during migration to IAS
+  // automatically enabled if xsuaa credentials are available
+  let xsuaa_service, xsuaa_user_factory
+  if (cds.env.requires[xsuaa]?.credentials) {
+    const { credentials: xsuaa_credentials, config: xsuaa_serviceConfig = {} } = cds.env.requires[xsuaa]
+    xsuaa_service = new XsuaaService(xsuaa_credentials, xsuaa_serviceConfig)
+    const get_xsuaa_user_factory = require('./jwt-auth')._get_user_factory
+    xsuaa_user_factory = get_xsuaa_user_factory(xsuaa_credentials, xsuaa_credentials.xsappname, 'xsuaa')
+  }
+
+  return async function ias_auth(req, _, next) {
+    if (!req.headers.authorization) return next()
+
+    try {
+      const _auth_service =
+        validating_auth_service && req.hostname.match(/\.cert\.|\.mesh\.cf\./) ? validating_auth_service : auth_service
+      const securityContext = await createSecurityContext(xsuaa_service ? [_auth_service, xsuaa_service] : _auth_service, { req })
+      const ctx = cds.context
+      ctx.user = securityContext.token instanceof XsuaaToken ? xsuaa_user_factory(securityContext) : user_factory(securityContext)
+      ctx.tenant = securityContext.token.getZoneId()
+    } catch (e) {
+      if (e instanceof ValidationError) {
+        if (e.token?.payload) e.token_payload = e.token.payload
+        LOG.warn('Unauthenticated request:', e)
+        return next(401)
+      }
+      LOG.error('Error while authenticating user:', e)
+      return next(500)
+    }
+
+    next()
+  }
+}
+
+function get_user_factory(credentials, skipped_attrs) {
+  return function user_factory(securityContext) {
+    const tokenInfo = securityContext.token
+    const payload = tokenInfo.getPayload()
+
+    /*
+     * NOTE:
+     *  for easier migration, xssec will offer IAS without policies via so-called XsuaaFallback.
+     *  in that case, we would need to add the roles here based on the tokenInfo (similar to xsuaa-auth).
+     *  however, it is not yet clear where the roles will be stored in IAS' tokenInfo object.
+     *  further, stakeholders would need to configure the "extension" programmatically (e.g., in a custom server.js).
+     */
+
+    const clientid = tokenInfo.getClientId()
+    if (clientid === payload.sub) {
+      //> grant_type === client_credentials or x509
+      const roles = { 'system-user': 1 }
+      if (Array.isArray(payload.ias_apis)) payload.ias_apis.forEach(r => (roles[r] = 1))
+      if (clientid === credentials.clientid) roles['internal-user'] = 1
+      else delete roles['internal-user']
+
+      const user = new cds.User({ id: 'system', roles, authInfo: securityContext })
+      return user
+    }
+
+    // add all unknown attributes to req.user.attr in order to keep public API small
+    const attr = {}
+    for (const key in payload) {
+      if (key in skipped_attrs)
+        continue // REVISIT: Why do we need to do that?
+      else attr[key] = payload[key]
+    }
+
+    // REVISIT: just don't such things, please! -> We're just piling up tech dept through tons of unoficcial long tail APIs like that!
+    // REVISIT: looks like wrong direction to me, btw
+    // same api as xsuaa-auth for easier migration
+    if (attr.user_name) attr.logonName = attr.user_name
+    if (attr.given_name) attr.givenName = attr.given_name
+    if (attr.family_name) attr.familyName = attr.family_name
+
+    const user = new cds.User({ id: payload.sub, attr, authInfo: securityContext })
+    return user
+  }
+}
+
+// REVISIT: Why do we need to know and do that?
+const KNOWN_CLAIMS = Object.values({
+  /*
+   * JWT claims (https://datatracker.ietf.org/doc/html/rfc7519#section-4)
+   */
+  ISSUER: 'iss',
+  SUBJECT: 'sub',
+  AUDIENCE: 'aud',
+  EXPIRATION_TIME: 'exp',
+  NOT_BEFORE: 'nbf',
+  ISSUED_AT: 'iat',
+  JWT_ID: 'jti',
+  /*
+   * TokenClaims (com.sap.cloud.security.token.TokenClaims)
+   */
+  // ISSUER: "iss", //> already in JWT claims
+  IAS_ISSUER: 'ias_iss',
+  // EXPIRATION: "exp", //> already in JWT claims
+  // AUDIENCE: "aud", //> already in JWT claims
+  // NOT_BEFORE: "nbf", //> already in JWT claims
+  // SUBJECT: "sub", //> already in JWT claims
+  // USER_NAME: 'user_name', //> do not exclude
+  // GIVEN_NAME: 'given_name', //> do not exclude
+  // FAMILY_NAME: 'family_name', //> do not exclude
+  // EMAIL: 'email', //> do not exclude
+  SAP_GLOBAL_SCIM_ID: 'scim_id',
+  SAP_GLOBAL_USER_ID: 'user_uuid', //> exclude for now
+  SAP_GLOBAL_ZONE_ID: 'zone_uuid',
+  // GROUPS: 'groups', //> do not exclude
+  AUTHORIZATION_PARTY: 'azp',
+  CNF: 'cnf',
+  CNF_X5T: 'x5t#S256',
+  // own
+  APP_TENANT_ID: 'app_tid'
+})

package/node_modules/@sap/cds/lib/srv/middlewares/auth/index.js

@@ -0,0 +1,53 @@
+const cds = require ('../../../index.js')
+
+const _builtin = {
+  mocked: 'basic-auth',
+  basic:  'basic-auth',
+  ias:    'ias-auth',
+  jwt:    'jwt-auth',
+  xsuaa:  'jwt-auth',
+  dummy:  'dummy-auth',
+}
+for (let b in _builtin)  _builtin[b+'-auth'] = _builtin[b]
+
+
+/**
+ * Constructs auth middlewares as configured
+ */
+module.exports = function auth_factory (o) {
+
+  // prepare options
+  const options = { ...cds.requires.auth, ...o }
+  let { kind, impl } = options
+
+  // if no impl is given, it's a built-in strategy
+  if (!impl) impl = __dirname + '/' + _builtin[kind]
+  else if (kind in _builtin) kind = 'custom'
+  // NOTE:                   ^^^^^^^^^^^^^^^
+  // This is a workaround to avoid displaying kind:'mocked-auth'
+  // from [development] defaults with impl: './custom-auth'
+  // from cds.requires.auth in the log or error output below.
+
+  // try resolving the impl, throw if not found
+  const config = { kind }
+  try { impl = require.resolve (impl, {paths:[cds.root]}) } catch {
+    try { impl = require.resolve ('./'+impl, {paths:[cds.root]}) } catch {
+      throw cds.error `Didn't find auth implementation for ${config}`
+    }
+  }
+
+  // load the auth middleware from the resolved path
+  const builtin = cds.utils.path.join (cds.home,'lib')
+  if (!impl.match(builtin)) config.impl = cds.utils.local(impl)
+  cds.log().info ('using auth strategy', config)
+  let auth = require (impl)
+
+  // default export of ESM / .ts auth
+  if (auth?.default) auth = auth.default
+
+  // if auth is a factory itself, call it to get the middleware
+  if (typeof auth === 'function' && auth.length < 3) auth = auth(options)
+
+  // return the auth middleware followed by a middleware to fill in cds.context
+  return auth
+}

package/node_modules/@sap/cds/lib/srv/middlewares/auth/jwt-auth.js

@@ -0,0 +1,89 @@
+const cds = require('../../../index.js')
+const LOG = cds.log('auth')
+
+const {
+  createSecurityContext,
+  Token,
+  XsuaaService,
+  XsaService,
+  errors: { ValidationError }
+} = require('./xssec')
+
+module.exports = function jwt_auth(config) {
+  const { kind, credentials, config: serviceConfig = {} } = config
+
+  if (!credentials)
+    throw new Error(
+      `Authentication kind "${kind}" configured, but no XSUAA instance bound to application. ` +
+        'Either bind an XSUAA instance, or switch to an authentication kind that does not require a binding.'
+    )
+
+  // enable signature cache by default
+  serviceConfig.validation ??= {}
+  if (!('signatureCache' in serviceConfig.validation)) serviceConfig.validation.signatureCache = { enabled: true }
+  // activate decode cache if not already done or explicitely disabled by setting Token.decodeCache to false or undefined
+  if (Token.decodeCache === null) Token.enableDecodeCache()
+
+  const auth_service = !credentials.uaadomain ? new XsaService(credentials, serviceConfig) : new XsuaaService(credentials, serviceConfig)
+  const user_factory = get_user_factory(credentials, credentials.xsappname, kind)
+
+  return async function jwt_auth(req, _, next) {
+    if (!req.headers.authorization) return next()
+
+    try {
+      const securityContext = await createSecurityContext(auth_service, { req })
+      const ctx = cds.context
+      ctx.user = user_factory(securityContext)
+      ctx.tenant = securityContext.token.getZoneId()
+    } catch (e) {
+      if (e instanceof ValidationError) {
+        if (e.token?.payload) e.token_payload = e.token.payload
+        LOG.warn('Unauthenticated request:', e)
+        return next(401)
+      }
+      LOG.error('Error while authenticating user:', e)
+      return next(500)
+    }
+
+    next()
+  }
+}
+
+function get_user_factory(credentials, xsappname, kind) {
+  xsappname = xsappname + '.'
+
+  return function user_factory(securityContext) {
+    const tokenInfo = securityContext.token
+    const payload = tokenInfo.getPayload()
+
+    let id = payload.user_name
+
+    const roles = {}
+    for (let scope of payload.scope) {
+      let role = scope.replace(xsappname, '') // Roles = scope names w/o xsappname...
+      if (role in { 'internal-user': 1, 'system-user': 1 })
+        continue // Disallow setting system roles from external
+      else roles[role] = 1
+    }
+
+    // Add system roles in case of client credentials flow
+    if (payload.grant_type in { client_credentials: 1, client_x509: 1 }) {
+      id = 'system'
+      roles['system-user'] = 1
+      if (tokenInfo.getClientId() === credentials.clientid) roles['internal-user'] = 1
+    }
+
+    const attr = { ...payload['xs.user.attributes'] }
+    if (kind === 'xsuaa') {
+      attr.logonName = payload.user_name
+      attr.givenName = payload.given_name
+      attr.familyName = payload.family_name
+      attr.email = payload.email
+    }
+
+    const user = new cds.User({ id, roles, attr, authInfo: securityContext })
+    return user
+  }
+}
+
+module.exports._get_user_factory = get_user_factory