@sap/cds-dk 9.9.4 → 9.9.5

package/CHANGELOG.md

@@ -6,6 +6,12 @@ This project adheres to [Semantic Versioning](https://semver.org/).
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/).
 
+## Version 9.9.5 - 2026-08-24
+
+### Changed
+
+- `cds login` now uses the renamed login endpoints `/-/cds/login/grant` and `/-/cds/login/grant-metadata` with a legacy fallback, and updates saved legacy token URLs.
+
 ## Version 9.9.4 - 2026-07-31
 
 ### Changed

package/lib/mtx/auth_manager.js

@@ -1,5 +1,5 @@
 const cds = require('../cds');
-const { SettingsManager } = require('./settings_manager');
+const { SettingsManager, OAUTH_PATH, OAUTH_PATH_LEGACY_TOKEN } = require('./settings_manager');
 const { ParamCollection } = require('./params');
 const { getMessage } = require('./util/logging');
 const { buildResponseError, buildNetworkError, parseResponseBody } = require('./util/request');
@@ -63,6 +63,32 @@ function reqParams(method, params) {
         : { url: `${url}?${data}`, data: undefined, ignored };
 }
 
+async function postTokenTo(url, data, method, params) {
+    DEBUG?.(`Getting authentication token from ${method.toUpperCase()} ${params.obfuscateQueryParams(url)}`);
+    const response = await fetch(url, {
+        method: method.toUpperCase(),
+        body: data,
+        headers: { 'content-type': 'application/x-www-form-urlencoded' }
+    });
+    if (!response.ok) {
+        throw await buildResponseError(method, url, response);
+    }
+    return parseResponseBody(response);
+}
+
+async function postToken(params, url, data, method) {
+    try {
+        return await postTokenTo(url, data, method, params);
+    } catch (e) {
+        if (e.status !== 404 || !url.includes(OAUTH_PATH)) {
+            throw e;
+        }
+        const legacyUrl = url.replace(OAUTH_PATH, OAUTH_PATH_LEGACY_TOKEN);
+        DEBUG?.(`Token endpoint not found, retrying against legacy path ${params.obfuscateQueryParams(legacyUrl)}`);
+        return postTokenTo(legacyUrl, data, method, params);
+    }
+}
+
 async function fetchToken(params) {
     if (params.has('token') || !(params.has('refreshToken') || params.has('passcode') || params.has('clientid') || !params.has('passcodeUrl'))) {
         return;
@@ -75,25 +101,12 @@ async function fetchToken(params) {
         if (Object.keys(ignored).length) {
             console.log(`Ignoring parameters for fetching token: ${Object.entries(ignored).map(([param, reason]) => `${param} (${reason})`).join(', ')}.`);
         }
-        DEBUG?.(`Getting authentication token from ${method.toUpperCase()} ${params.obfuscateQueryParams(url)}`);
         error = undefined;
         try {
-            const response = await fetch(url, {
-                method: method.toUpperCase(),
-                body: data,
-                headers: { 'content-type': 'application/x-www-form-urlencoded' }
-            });
-            if (!response.ok) {
-                throw await buildResponseError(method, url, response);
-            }
-            responseData = await parseResponseBody(response);
+            responseData = await postToken(params, url, data, method);
             break;
         } catch (e) {
-            if (e.status) {
-                error = e;
-            } else {
-                error = buildNetworkError(method, url, e);
-            }
+            error = e.status ? e : buildNetworkError(method, url, e);
             DEBUG?.(`HTTP status ${error.status}`);
             if (params.has('refreshToken')) {
                 DEBUG?.('Discarding invalid refresh token');
@@ -122,7 +135,7 @@ async function fetchToken(params) {
                 message += `. Ensure the client credentials are correct`;
             }
         } else {
-            message = 'error on token request';
+            message = 'token request failed';
         }
         throw new Error(message + '.', { cause: error });
     }

package/lib/mtx/settings_manager.js

@@ -35,8 +35,9 @@ const KEYRING_DESC = {
 
 const MTX_FULLY_QUALIFIED = 'com.sap.cds.mtx';
 const OAUTH_PATH_LEGACY = '/mtx/v1/oauth/token';
-const OAUTH_PATH = '/-/cds/login/token';
-const OAUTH_META_PATH = '/-/cds/login/authorization-metadata';
+const OAUTH_PATH_LEGACY_TOKEN = '/-/cds/login/token';
+const OAUTH_PATH = '/-/cds/login/grant';
+const OAUTH_META_PATH = '/-/cds/login/grant-metadata';
 
 const SETTINGS_DIR = path.join(os.homedir(), CONFIG_SUBDIRS[os.platform()] || '', MTX_FULLY_QUALIFIED);
 const SETTINGS_FILE = 'projects.json';
@@ -295,7 +296,7 @@ class SettingsManager {
         async function updateTokenUrl() {
             const tokenUrl = secure(params.get('tokenUrl'), 'token URL');
             const renewUrl = !logout && !params.get('skipToken')
-                && (!tokenUrl || tokenUrl.includes('//-/cds') || tokenUrl.includes(OAUTH_PATH_LEGACY)
+                && (!tokenUrl || tokenUrl.includes('//-/cds') || tokenUrl.includes(OAUTH_PATH_LEGACY) || tokenUrl.includes(OAUTH_PATH_LEGACY_TOKEN)
                     || params.get('appUrl') !== loadedSettings.get('appUrl')
                     || params.get('subdomain') !== loadedSettings.get('subdomain'));
             if (renewUrl) {
@@ -719,5 +720,7 @@ class SettingsManager {
 module.exports = {
     SettingsManager,
     other,
-    notifyLogin
+    notifyLogin,
+    OAUTH_PATH,
+    OAUTH_PATH_LEGACY_TOKEN
 };

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@sap/cds-dk",
-  "version": "9.9.4",
+  "version": "9.9.5",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@sap/cds-dk",
-      "version": "9.9.4",
+      "version": "9.9.5",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@cap-js/asyncapi": "^1.0.0",
@@ -53,8 +53,8 @@
       }
     },
     "node_modules/@cap-js/openapi": {
-      "version": "1.5.0",
-      "integrity": "sha512-JDzENNC80vnP9W31Skz6PfgPnpaxNTgIP8CtDK3bJ0FCbr5sXshRqes1pc17kNMXDbJAtEshS0dN7GYBW2THWA==",
+      "version": "1.6.0",
+      "integrity": "sha512-1Knrn9dU3CBAlKRlhTzZTlzbg1IULbUV39mvhcuDZrgMhSWhJ3OuJVcNWtMClq+VkUeYTkMYpysbPqrMRoeEdw==",
       "license": "Apache-2.0",
       "dependencies": {
         "pluralize": "^8.0.0"
@@ -151,8 +151,8 @@
       }
     },
     "node_modules/@sap/cds-mtxs": {
-      "version": "3.9.5",
-      "integrity": "sha512-R7SLGJ5eCIGiR5uX6QWBG+SVDvCj3OpjxhpcHF1NwhJ0mqMHC3FCrHrutIpX4slc0ZTYyoJnEyL7gaPhrjK50g==",
+      "version": "3.9.6",
+      "integrity": "sha512-/eTldcrM9nc5orKJxqdrAiWvO5WcFoZWb1WH0DczWxX3abPJvD+0otHDeA9Uc5XP4ecFQ51bc4ZjR01lfXW1ew==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "@sap/hdi-deploy": "^5"
@@ -217,8 +217,8 @@
       }
     },
     "node_modules/@sap/xsenv": {
-      "version": "6.2.1",
-      "integrity": "sha512-R1p7VdD3N3jvdkL8av4vLqF+cTQihTz9mCqqF+oa9rVZvgLaCb4ODyZ1dln5/fBgg1OSuch0ESxu3AqZrXVknw==",
+      "version": "6.2.2",
+      "integrity": "sha512-SGn+yaVKeXND/rQaQhqTZC+M6g5ASW1YnqAdQiZqNL74E1T1kUsDHttgOjQNkLObMZ0fsxgQxRPMnuVcAgIODg==",
       "license": "SEE LICENSE IN LICENSE",
       "dependencies": {
         "debug": "4.4.3",
@@ -332,8 +332,8 @@
       }
     },
     "node_modules/body-parser/node_modules/content-type": {
-      "version": "2.0.0",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "version": "2.1.0",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -841,8 +841,8 @@
       }
     },
     "node_modules/hdb": {
-      "version": "2.29.5",
-      "integrity": "sha512-3DFwpAdURCKz7mI4Ahsu12dVUCev4Epd+OfgR6L13K36c0yyU3Tf7i9Q1bZt9wN9sBczpmUf0hHnshqygtBIsw==",
+      "version": "2.29.6",
+      "integrity": "sha512-I9AQxpTn6OKm66rzzNWbJeKnxn1ylJinzSsq0J1O0HOwxv3VNuwQttKem2/DG/Sv/yRIU20dBiqZTqXjqs6Eog==",
       "license": "Apache-2.0",
       "dependencies": {
         "iconv-lite": "0.7.0"
@@ -1630,8 +1630,8 @@
       }
     },
     "node_modules/type-is/node_modules/content-type": {
-      "version": "2.0.0",
-      "integrity": "sha512-j/O/d7GcZCyNl7/hwZAb606rzqkyvaDctLmckbxLzHvFBzTJHuGEdodATcP3yIRoDrLHkIATJuvzbFlp/ki2cQ==",
+      "version": "2.1.0",
+      "integrity": "sha512-mj7UPXE0jaqaOsukNZRUEfEi2AcL7C/vwmwcHV0O97eO1E1pxBZuyjlZrx5seTaNBg1U6+o35wpa35Qfcc+7ag==",
       "license": "MIT",
       "engines": {
         "node": ">=18"
@@ -1699,8 +1699,8 @@
       "license": "ISC"
     },
     "node_modules/ws": {
-      "version": "8.21.1",
-      "integrity": "sha512-+0NTnW77fFN/DjQi6k/Sq/Yvk4Sgajw7urW8V+asjXnRgDs9gyGkdb7EzgfhA4goXsRIZKE28fzIXBHEzhuiWw==",
+      "version": "8.21.3",
+      "integrity": "sha512-201TZ/kPWxoPr/OKWjquZR1SWKXcvxdH+e1xrx89b3YbmzLMFCLfnaG1HFIgWzJOEWZ7MvpK++odZufgYR50Rw==",
       "license": "MIT",
       "engines": {
         "node": ">=10.0.0"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds-dk",
-  "version": "9.9.4",
+  "version": "9.9.5",
   "description": "Command line client and development toolkit for the SAP Cloud Application Programming Model",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [