@sap/cds 5.6.4 → 5.7.1

package/libx/_runtime/fiori/generic/activate.js

@@ -147,6 +147,7 @@ const _handler = async function (req) {
   r.getUriInfo = () => req.getUriInfo()
   r.getUrlObject = () => req.getUrlObject()
   r._.params = req.params
+  r._.query = req.query
 
   // use finally to preserve r.messages in success or error case
   let result

package/libx/_runtime/fiori/generic/before.js

@@ -190,8 +190,9 @@ module.exports = cds.service.impl(function () {
   _new._initial = true
   _patchUpdate._initial = true
   _deleteCancel._initial = true
+  const entities = Object.values(this.entities).filter(e => e._isDraftEnabled)
 
-  for (const entity of Object.values(this.entities).filter(e => e._isDraftEnabled)) {
+  for (const entity of entities) {
     this.before('NEW', entity, _new)
     this.before(['PATCH', 'UPDATE'], entity, _patchUpdate)
     this.before(['DELETE', 'CANCEL'], entity, _deleteCancel)

package/libx/_runtime/fiori/generic/edit.js

@@ -130,6 +130,7 @@ const _handler = async function (req) {
   const lockAndSelectCQNs = [lockRecordCQN, draftExistsCQN, ...selectCQNs]
 
   const dbtx = cds.tx(req)
+  // REVISIT: Use service.read with expand **
   const [, draftExists, ...results] = await _select(lockAndSelectCQNs, req, dbtx)
 
   if (!results[0].length) {

package/libx/_runtime/fiori/generic/patch.js

@@ -62,7 +62,7 @@ const _getUpdateDraftCQN = ({ query, target: { name } }, keysCondition) => {
  * @param req
  */
 const _handler = async function (req) {
-  if (req.data.IsActiveEntity === 'true') req.reject(400)
+  if (req.data.IsActiveEntity === 'true') req.reject(400, 'Patch can only be applied to a draft entity')
 
   const keysCondition = getKeysCondition(req.target, req.data)
 

package/libx/_runtime/fiori/generic/read.js

@@ -1,7 +1,7 @@
 const cds = require('../../cds')
 const { SELECT } = cds.ql
 
-const { cqn2cqn4sql } = require('../../common/utils/cqn2cqn4sql')
+const { cqn2cqn4sql, convertWhereExists } = require('../../common/utils/cqn2cqn4sql')
 const { getElementDeep } = require('../../common/utils/csn')
 
 const { DRAFT_COLUMNS, DRAFT_COLUMNS_MAP, SCENARIO } = require('../../common/constants/draft')
@@ -21,26 +21,51 @@ const { deleteCondition, readAndDeleteKeywords, removeIsActiveEntityRecursively
 
 const { getColumns } = require('../../cds-services/services/utils/columns')
 
+const _findRootSubSelectFor = query => {
+  if (query.SELECT.where) {
+    const subSelect = query.SELECT.where.find((e, i) => e.SELECT && query.SELECT.where[i - 1] === 'exists')
+    return subSelect ? _findRootSubSelectFor(subSelect) : query
+  }
+  return query
+}
+
 // append where with clauses from @restrict
 const _getWhereWithAppendedDraftRestrictions = (where = [], req, scenarioAlias, model) => {
   if (req.query._draftRestrictions) {
     for (const each of req.query._draftRestrictions) {
-      if (where.length) where.push('and')
-
-      // REVISIT: remove with cds^6
-      // adjust alias of @restrict where "exists (select ...)"
-      if (scenarioAlias && model)
-        each
-          .filter(e => e.SELECT && e.SELECT.from && e.SELECT.where)
-          .forEach(e => {
-            const entity = model.definitions[e.SELECT.from.ref[0]]
-            e.SELECT.where = e.SELECT.where.map(w => {
-              if (w.ref && w.ref.length === 1 && !entity.elements[w.ref[0]]) w.ref.unshift(scenarioAlias)
-              return w
+      const xpr = each._xpr
+      if (each.target.name === ensureUnlocalized(req.target.name)) {
+        // > restriction directly on child
+        // REVISIT: remove support for selects in restriction with cds^6
+        // adjust alias of @restrict where "exists (select ...)"
+        if (scenarioAlias && model)
+          xpr
+            .filter(e => e.SELECT && e.SELECT.from && e.SELECT.where)
+            .forEach(e => {
+              const entity = model.definitions[e.SELECT.from.ref[0]]
+              e.SELECT.where = e.SELECT.where.map(w => {
+                if (w.ref && w.ref.length === 1 && !entity.elements[w.ref[0]]) w.ref.unshift(scenarioAlias)
+                return w
+              })
             })
-          })
 
-      where.push(...each)
+        if (where.length) where.push('and')
+        where.push(...xpr)
+      } else {
+        // > restriction inherited from parent via autoexposure
+        // find inner most sub select if available and append restriction to where clause
+        const rootSubSelect = _findRootSubSelectFor({ SELECT: { where } })
+        if (rootSubSelect && rootSubSelect.SELECT.from) {
+          if (rootSubSelect.SELECT.where && rootSubSelect.SELECT.where.length) rootSubSelect.SELECT.where.push('and')
+          const tableAlias = rootSubSelect.SELECT.from.as
+          rootSubSelect.SELECT.where.push(
+            ...xpr.map(e => {
+              if (e.ref) return tableAlias ? { ref: [tableAlias, ...e.ref] } : { ref: [...e.ref] }
+              return e
+            })
+          )
+        }
+      }
     }
   }
   return where
@@ -299,21 +324,24 @@ const _allInactive = (req, columns) => {
     _getDefaultDraftProperties({ hasDraft: false, isActive: false, withDraftUUID: false })
   )
 
-  const ids = filterKeys(req.target.keys)
   const isCount = columns.some(element => element.func === 'count')
 
+  // ensure only own drafts are read
   const cqn = SELECT.from(table)
+    .join('DRAFT.DraftAdministrativeData', 'filterAdmin')
+    .on([
+      { ref: [table.as, 'DraftAdministrativeData_DraftUUID'] },
+      '=',
+      {
+        ref: ['filterAdmin', 'DraftUUID']
+      }
+    ])
+    .where(_inProcessByUserWhere(req.user.id))
 
   if (isCount) {
     cqn.columns(...outerMostColumns)
   } else {
     cqn.columns(...outerMostColumns.filter(o => o.as !== 'HasActiveEntity'), { ref: ['HasActiveEntity'] })
-    cqn.leftJoin(ensureNoDraftsSuffix(table.ref[0]) + ' as active').on(`${table.as}.${ids[0]} = active.${ids[0]}`)
-
-    for (let i = 1; i < ids.length; i++) {
-      // REVISIT: this is extremely expensive as it repeatedly invokes the compiler's cds.parse.expr -> better extend plain CQN yourself here
-      cqn.and(`${table.as}.${ids[i]} = active.${ids[i]}`)
-    }
   }
 
   cqn.where(req.query.SELECT.where)
@@ -507,11 +535,11 @@ const _activeWithDraftInProcess = (req, draftWhere, columns, isLocked) => {
     subSelect
   )
 
-  subSelect.SELECT.where = _getWhereWithAppendedDraftRestrictions(subSelect.SELECT.where, req)
-
   const outerMostColumns = _getOuterMostColumns(columns, draftColumns)
 
-  const cqn = SELECT.from(active.table).columns(outerMostColumns).where(['exists', subSelect])
+  const cqn = SELECT.from(active.table).columns(outerMostColumns)
+  cqn.where(_getWhereWithAppendedDraftRestrictions([], req))
+  cqn.where(['exists', subSelect])
 
   return { cqn: getEnrichedCQN(cqn, req.query.SELECT, draftWhere), scenario: SCENARIO.DRAFT_IN_PROCESS }
 }
@@ -598,13 +626,21 @@ const _getWhereForActive = where => {
   return activeWhere
 }
 
-const _siblingEntity = ({ query, target, nav, params }, columns, model, draftAdminAlias, parentQuery, siblingIndex) => {
+const _siblingEntity = (
+  { query, target, nav, params },
+  columns,
+  model,
+  draftAdminAlias,
+  parentQuery,
+  siblingIndex,
+  req
+) => {
   const parentLinks = parentQuery ? _findJoinInQuery(query, parentQuery.SELECT.from.as) : []
   const keys = (nav[siblingIndex + 1].where && (params[siblingIndex] || params[0])) || {}
   const siblingQuery = query.SELECT.where[query.SELECT.where.indexOf('exists') + 1]
   const onCond = _findJoinInQuery(siblingQuery, target.as)
   const siblingAlias = siblingQuery.SELECT.from.as
-  const subScenario = _siblingSubScenario(nav, siblingIndex, siblingQuery, target, params, model, onCond)
+  const subScenario = _siblingSubScenario(nav, siblingIndex, siblingQuery, target, params, model, onCond, req)
   const isSiblingDraft = subScenario
     ? subScenario.isSiblingActive || subScenario.scenario === 'ACTIVE' || subScenario.scenario === 'ALL_ACTIVE'
     : keys.IsActiveEntity && keys.IsActiveEntity !== 'false'
@@ -652,12 +688,17 @@ const _siblingEntity = ({ query, target, nav, params }, columns, model, draftAdm
   return { cqn, scenario: SCENARIO.SIBLING_ENTITY, isSiblingActive: !isSiblingDraft }
 }
 
-function _siblingSubScenario(nav, siblingIndex, siblingQuery, target, params, model, onCond) {
+function _siblingSubScenario(nav, siblingIndex, siblingQuery, target, params, model, onCond, req) {
   if (nav[siblingIndex + 1].where) return
   let subScenario
   const subNav = nav.slice(siblingIndex + 1)
   const subSiblingIndex = subNav.indexOf('SiblingEntity')
-  const subReq = { query: siblingQuery, target: model.definitions[target.name], params: [...params].reverse() }
+  const subReq = {
+    query: siblingQuery,
+    target: model.definitions[target.name],
+    params: [...params].reverse(),
+    user: req.user
+  }
   if (subSiblingIndex > -1) {
     subScenario = _getSiblingScenario(subReq, [{ val: 1 }], model, subSiblingIndex, subNav, params)
     if (subSiblingIndex > 0) {
@@ -670,8 +711,8 @@ function _siblingSubScenario(nav, siblingIndex, siblingQuery, target, params, mo
     subReq.query = SELECT.from(siblingQuery.SELECT.from).columns([{ val: 1 }])
     const existsIdx = siblingQuery.SELECT.where.indexOf('exists')
     if (existsIdx > -1) subReq.query.where(siblingQuery.SELECT.where.slice(existsIdx, existsIdx + 2))
-    const subReqOrig = { query: { SELECT: { from: { ref: [...subNav].reverse() } } } }
-    subScenario = _generateCQN(subReqOrig, subReq, [{ val: 1 }], model)
+    const subOrigFrom = { ref: [...subNav].reverse() }
+    subScenario = _generateCQN(subOrigFrom, subReq, [{ val: 1 }], model)
     subScenario.cqn.where(onCond)
   }
   return subScenario
@@ -688,7 +729,15 @@ const _getSiblingScenario = (req, columns, model, siblingIndex, nav) => {
       }
     }
     const target = { name: query.SELECT.from.ref[0].id || query.SELECT.from.ref[0], as: query.SELECT.from.as }
-    return _siblingEntity({ query, target, params, nav }, columns, model, draftAdminAlias, parentQuery, siblingIndex)
+    return _siblingEntity(
+      { query, target, params, nav },
+      columns,
+      model,
+      draftAdminAlias,
+      parentQuery,
+      siblingIndex,
+      req
+    )
   }
   return _getSiblingQueryFromWhere(req.query, siblingIndex)
 }
@@ -731,7 +780,7 @@ const _getDraftDoc = (req, draftName, draftWhere) => {
 
 const _getOrderByEnrichedColumns = (orderBy, columns) => {
   const enrichedCol = []
-  if (orderBy.length > 1) {
+  if (orderBy && orderBy.length > 1) {
     const colNames = columns.map(el => el.ref[el.ref.length - 1])
     // REVISIT: GET Books?$select=title&$expand=NotBooks($select=pages)&$orderby=NotBooks/title - what's then?
     for (const el of orderBy) {
@@ -757,10 +806,13 @@ const _replaceDraftAlias = where => {
 
 const _poorMansAlias4 = xpr => '_' + xpr.ref.join('_') + '_'
 
-const _getUnionCQN = (req, draftName, columns, subSelect, draftWhere) => {
+const _getUnionCQN = (req, draftName, columns, subSelect, draftWhere, model) => {
   const draftActiveWhere = _getWhereForActive(draftWhere)
   const activeDocs = getEnrichedCQN(SELECT.from(req.target), req.query.SELECT, draftActiveWhere, undefined, false)
+  activeDocs.where(_getWhereWithAppendedDraftRestrictions([], req))
+  convertWhereExists(activeDocs, model, {})
 
+  // @restrict.where not applicable for drafts (I can ALWAYS read mine)
   _replaceDraftAlias(draftWhere)
   const draftDocs = _getDraftDoc(req, draftName, draftWhere)
 
@@ -846,7 +898,7 @@ const _getUnionCQN = (req, draftName, columns, subSelect, draftWhere) => {
     .columns(..._filterDraftColumnsBySelected(DRAFT_COLUMNS_CASTED, req.query.SELECT.columns))
 }
 
-const _excludeActiveDraftExists = (req, draftWhere, columns) => {
+const _excludeActiveDraftExists = (req, draftWhere, columns, model) => {
   const { table, name } = _getTableName(req, true)
   const draftName = table.ref[0]
 
@@ -865,10 +917,8 @@ const _excludeActiveDraftExists = (req, draftWhere, columns) => {
     subSelect.where([{ ref: [ensureNoDraftsSuffix(req.target.name), key] }, '=', { ref: [draftName, key] }])
   }
 
-  draftWhere = _getWhereWithAppendedDraftRestrictions(draftWhere, req)
-
   draftWhere = removeIsActiveEntityRecursively(draftWhere)
-  const cqn = _getUnionCQN(req, draftName, columns, subSelect, draftWhere)
+  const cqn = _getUnionCQN(req, draftName, columns, subSelect, draftWhere, model)
   cqn.SELECT.from.as = name
 
   if (cqn.SELECT.orderBy) {
@@ -900,13 +950,13 @@ const _validatedActiveWithoutDraft = (req, draftWhere, draftParameters, columns)
   _isValidActiveWithoutDraft(draftParameters.isActiveEntity, draftParameters.hasDraftEntity) &&
   _activeWithoutDraft(req, draftWhere, columns)
 
-const _validatedWithSiblingInProcess = (req, draftWhere, draftParameters, columns) => {
+const _validatedWithSiblingInProcess = (req, draftWhere, draftParameters, columns, model) => {
   const { isActiveEntity, siblingIsActive, draftInProcessByUser } = draftParameters
   if (
     !draftInProcessByUser &&
     _isValidExcludeActiveDraftExists(draftParameters.isActiveEntity, draftParameters.siblingIsActive)
   )
-    return _excludeActiveDraftExists(req, draftWhere, columns)
+    return _excludeActiveDraftExists(req, draftWhere, columns, model)
   if (
     draftInProcessByUser.op === '!=' &&
     _isValidWithDraftLocked(isActiveEntity, siblingIsActive, draftInProcessByUser)
@@ -925,9 +975,7 @@ const _draftInSubSelect = (where, req) => {
     if (SELECT && SELECT.where) {
       const isActiveEntity = readAndDeleteKeywords(['IsActiveEntity'], SELECT.where, false)
       if (isActiveEntity) {
-        const isFalse = _isFalse(isActiveEntity.value.val)
-        if (isFalse) SELECT.where = _getWhereWithAppendedDraftRestrictions(SELECT.where, req)
-        return isFalse
+        return _isFalse(isActiveEntity.value.val)
       }
 
       return _draftInSubSelect(SELECT.where, req)
@@ -940,10 +988,16 @@ const _draftInSubSelect = (where, req) => {
 const _isDraftAdminScenario = req =>
   req.target.query && req.target.query._target && req.target.query._target.name === 'DRAFT.DraftAdministrativeData'
 
-// eslint-disable-next-line complexity
-const _generateCQN = (reqOriginal, req, columns, model) => {
-  const nav = [...reqOriginal.query.SELECT.from.ref].reverse() || []
-  const siblingIndex = nav.indexOf('SiblingEntity')
+const _generateCQN = (originalFrom, req, columns, model) => {
+  const nav = [...originalFrom.ref].reverse() || []
+  let siblingIndex = nav.indexOf('SiblingEntity')
+
+  // it can also be a property access (new parser), then we must shift it
+  if (siblingIndex === 1 && req.target.elements[nav[0]]) {
+    nav.shift()
+    siblingIndex = siblingIndex - 1
+  }
+
   let siblingScenario
   if (siblingIndex > -1) {
     siblingScenario = _getSiblingScenario(req, columns, model, siblingIndex, nav)
@@ -975,8 +1029,6 @@ const _generateCQN = (reqOriginal, req, columns, model) => {
   }
 
   if (!draftParameters.isActiveEntity) {
-    // _draftInSubSelect adds draft restrictions in case check is truthy
-    // -> not nice but works for now and we don't need to go in recursively again
     if (_draftInSubSelect(req.query.SELECT.where, req) || (siblingScenario && !siblingScenario.isSiblingActive)) {
       // this is only the case when navigating into tree
       return _allInactive(req, columns)
@@ -989,23 +1041,20 @@ const _generateCQN = (reqOriginal, req, columns, model) => {
   }
 
   if (draftParameters.siblingIsActive) {
-    return _validatedWithSiblingInProcess(req, req.query.SELECT.where, draftParameters, columns)
+    return _validatedWithSiblingInProcess(req, req.query.SELECT.where, draftParameters, columns, model)
   }
 
   return _validatedDraftOfWhichIAmOwner(req, req.query.SELECT.where, draftParameters, columns)
 }
 
-const _getColumns = ({ query: { SELECT } }, model) => {
+const _getColumns = ({ query: { SELECT }, target }, model) => {
   return SELECT.columns
     ? SELECT.columns.filter(
         col =>
           (col.ref && !DRAFT_COLUMNS.includes(col.ref[col.ref.length - 1])) ||
           (!col.ref && !DRAFT_COLUMNS.includes(col))
       )
-    : getColumns(model.definitions[ensureNoDraftsSuffix(SELECT.from.ref[0])], {
-        onlyNames: true,
-        removeIgnore: true
-      })
+    : getColumns(target, { onlyNames: true, removeIgnore: true })
 }
 
 const _isIsActiveEntity = element => element.ref && element.ref[element.ref.length - 1] === 'IsActiveEntity'
@@ -1136,6 +1185,13 @@ const _getLocalizedEntity = (model, target, user) => {
   return localizedEntity || model.definitions[`${prefix}.${target.name}`]
 }
 
+const _getLastSubQuery = query => (query.SELECT.from.SELECT ? _getLastSubQuery(query.SELECT.from) : query)
+const _setLastSubQuery = (query, last, prev = query) => {
+  if (query.SELECT.from.SELECT) return _setLastSubQuery(query.SELECT.from, last, query)
+  else prev.SELECT.from = _copyCQNPartial(last)
+  return prev
+}
+
 const _adaptDraftAdminExpand = cqn => {
   const draftAdminExpand =
     cqn.SELECT.columns && cqn.SELECT.columns.find(c => c.expand && c.ref[0] === 'DraftAdministrativeData')
@@ -1149,7 +1205,6 @@ const _adaptDraftAdminExpand = cqn => {
  *
  * @param req
  */
-// eslint-disable-next-line complexity
 const _handler = async function (req) {
   // handle localized here as it was previously handled for req.target
   req.target = _getLocalizedEntity(this.model, req.target, req.user) || req.target
@@ -1157,6 +1212,8 @@ const _handler = async function (req) {
   // REVISIT
   delete req.query._validationQuery
 
+  const originalFrom = _copyCQNPartial(req.query.SELECT.from)
+
   // REVISIT DRAFT HANDLING: cqn2cqn4sql must not be called here
   const sqlQuery = cqn2cqn4sql(req.query, this.model, { draft: true })
 
@@ -1171,8 +1228,17 @@ const _handler = async function (req) {
     reqClone.query._streaming = true
     return cds.tx(req).run(reqClone.query)
   }
+  let cqnScenario
 
-  const cqnScenario = _generateCQN(req, reqClone, _getColumns(reqClone, this.model), this.model)
+  // to replace scenario CQNs for queries with $apply SELECT chain (new odata2cqn parser)
+  // just to make existing tests working with new parser. not really tested, not needed to be supported
+  if (reqClone.query.SELECT.from.SELECT) {
+    const subQueryReq = { __proto__: req, query: _copyCQNPartial(_getLastSubQuery(reqClone.query)) }
+    cqnScenario = _generateCQN(originalFrom.SELECT.from, subQueryReq, _getColumns(subQueryReq, this.model), this.model)
+    cqnScenario.cqn = _setLastSubQuery(reqClone.query, cqnScenario.cqn)
+  } else {
+    cqnScenario = _generateCQN(originalFrom, reqClone, _getColumns(reqClone, this.model), this.model)
+  }
 
   if (!cqnScenario) {
     req.reject(400)

package/libx/_runtime/fiori/uiflex/index.js

@@ -29,7 +29,7 @@ module.exports = async () => {
       .before('READ', transformExtendedFieldsREAD)
       .after('READ', transformExtendedFieldsRESULT)
     if ('cds_r.ExtensibilityService' in cds.services) return
-    const model = require('path').join(__dirname, 'extensibility')
+    const model = require('path').join(__dirname, '../../../..', 'srv/flex.cds')
     return cds.serve(model, { silent: true }).to('odata').in(cds.app)
   })
 }

package/libx/_runtime/fiori/uiflex/{extensibility/index.js → service.js}

@@ -1,7 +1,7 @@
-const cds = require('../../../cds')
-const { ensureDraftsSuffix } = require('../../../common/utils/draft')
+const cds = require('../../cds')
+const { ensureDraftsSuffix } = require('../../common/utils/draft')
 
-const { EXT_BACK_PACK } = require('../utils')
+const { EXT_BACK_PACK } = require('./utils')
 
 const _getDraftTable = (view, cds) => {
   return cds.model.definitions[view]._isDraftEnabled ? ensureDraftsSuffix(view) : undefined

package/libx/_runtime/fiori/utils/delete.js

@@ -75,7 +75,13 @@ const deleteDraft = async (req, srv, includingActive = false) => {
   const delCQNs = []
 
   if (includingActive) {
-    delCQNs.push(DELETE.from(ensureNoDraftsSuffix(req.target.name)).where(keys.keyList))
+    const r = new cds.Request({ query: DELETE.from(ensureNoDraftsSuffix(req.target.name)).where(keys.keyList) })
+
+    // REVISIT: should not be necessary
+    r._ = Object.assign(r._, req._)
+    r._.query = req.query
+
+    await dbtx.dispatch(r)
   }
 
   if (draftResult.length !== 0) {

package/libx/_runtime/hana/Service.js

@@ -45,13 +45,6 @@ class HanaDatabase extends DatabaseService {
     this._run = this._queries.run(this._insert, this._read, this._update, this._delete, execute.cqn, execute.sql)
   }
 
-  set model(csn) {
-    const m = csn && 'definitions' in csn ? cds.linked(cds.compile.for.odata(csn)) : csn
-    // with compiler v2 we always need to localized the csn
-    cds.alpha_localized(m)
-    super.model = m
-  }
-
   init() {
     this._registerBeforeHandlers()
     this._registerOnHandlers()
@@ -134,7 +127,7 @@ class HanaDatabase extends DatabaseService {
   async acquire(arg) {
     // REVISIT: remove fallback arg.user.tenant with cds^6
     const tenant = (typeof arg === 'string' ? arg : arg.tenant || (arg.user && arg.user.tenant)) || 'anonymous'
-    const dbc = await pool.acquire(tenant, this.options.credentials)
+    const dbc = await pool.acquire(tenant, this)
 
     if (typeof arg !== 'string') {
       _setSessionContext(dbc, 'APPLICATIONUSER', arg.user.id || 'ANONYMOUS')

package/libx/_runtime/hana/customBuilder/CustomSelectBuilder.js

@@ -34,18 +34,9 @@ class CustomSelectBuilder extends SelectBuilder {
   }
 
   getParameters() {
-    // REVISIT: remove skipWithParameters after grace period
-    if (
-      (cds.env.features && cds.env.features.with_parameters === false) ||
-      (cds.env.runtime && cds.env.runtime.skipWithParameters)
-    ) {
-      return ''
-    }
-
-    // REVISIT: remove feature flag skip_with_parameters after grace period of at least two months (> June release)
-    if (cds.env.features && cds.env.features.skip_with_parameters === false) {
-      return this._options.locale ? `with parameters ('LOCALE' = '${this._options.locale}')` : ''
-    }
+    const { with_parameters: withParameters } = cds.env.features
+    if (withParameters === false || !this._options.locale) return ''
+    if (withParameters === true) return `with parameters ('LOCALE' = '${this._options.locale}')`
 
     // skip with parameters if all orderby columns are not strings
     let skip
@@ -78,9 +69,9 @@ class CustomSelectBuilder extends SelectBuilder {
         }
       }
     }
-    if (skip) return ''
 
-    return this._options.locale ? `with parameters ('LOCALE' = '${this._options.locale}')` : ''
+    if (skip) return ''
+    return `with parameters ('LOCALE' = '${this._options.locale}')`
   }
 }
 

package/libx/_runtime/hana/execute.js

@@ -7,7 +7,7 @@ const {
   getStructMapper,
   postProcess
 } = require('../db/data-conversion/post-processing')
-const { createJoinCQNFromExpanded, hasExpand, rawToExpanded } = require('../db/expand')
+const { createJoinCQNFromExpanded, hasExpand, rawToExpanded, expandV2 } = require('../db/expand')
 const {
   hasStreamInsert,
   hasStreamUpdate,
@@ -33,6 +33,8 @@ function _cqnToSQL(model, query, user, locale, txTimestamp) {
 const cds = require('../cds')
 const LOG = cds.log('hana|db|sql')
 
+const SANITIZE_VALUES = process.env.NODE_ENV === 'production' && cds.env.log.sanitize_values !== false
+
 function _getOutputParameters(stmt) {
   const result = {}
   const info = stmt.getParameterInfo()
@@ -50,7 +52,7 @@ function _executeAsPreparedStatement(dbc, sql, values, reject, resolve) {
   dbc.prepare(sql, function (err, stmt) {
     if (err) {
       err.query = sql
-      if (values) err.values = values
+      if (values) err.values = SANITIZE_VALUES ? ['***'] : values
       return reject(err)
     }
 
@@ -76,7 +78,7 @@ function _executeAsPreparedStatement(dbc, sql, values, reject, resolve) {
       if (err) {
         stmt.drop(() => {})
         err.query = sql
-        if (values) err.values = values
+        if (values) err.values = SANITIZE_VALUES ? ['***'] : values
         return reject(err)
       }
 
@@ -99,7 +101,7 @@ function _executeSimpleSQL(dbc, sql, values) {
   const res = sql.match(regex)
   if (res) sql = sql.replace(regex, '') + ' ' + res[0]
 
-  LOG._debug && LOG.debug(`${sql} ${values && values.length ? JSON.stringify(values) : ''}`)
+  LOG._debug && LOG.debug(sql, SANITIZE_VALUES ? ['***'] : values)
   return new Promise((resolve, reject) => {
     // hana-client only accepts arrays
     if (dbc.name !== 'hdb' && typeof values === 'object') {
@@ -149,6 +151,10 @@ function _processExpand(model, dbc, cqn, user, locale, txTimestamp) {
 
 function executeSelectCQN(model, dbc, query, user, locale, txTimestamp) {
   if (hasExpand(query)) {
+    // expand: '**' or '*3' is handled by new impl
+    if (query.SELECT.columns.some(c => c.expand && typeof c.expand === 'string' && /^\*{1}[\d|*]+/.test(c.expand))) {
+      return expandV2(model, dbc, query, user, locale, txTimestamp, executeSelectCQN)
+    }
     return _processExpand(model, dbc, query, user, locale, txTimestamp)
   }