@sap/cds 5.9.6 → 6.0.1

package/libx/_runtime/common/error/frontend.js

@@ -5,10 +5,8 @@
  *   [...]
  *   Error responses MAY contain annotations in any of its JSON objects.
  */
-
 const localeFrom = require('../../../../lib/req/locale')
 const { getErrorMessage } = require('./utils')
-
 let _i18n
 const i18n = (...args) => {
   if (!_i18n) _i18n = require('../i18n')
@@ -24,16 +22,12 @@ const {
 } = require('./constants')
 const ADDITIONAL_MSG_PROPERTIES = Object.keys(ADDITIONAL_MSG_PROPERTIES_MAP)
 
-const SKIP_SANITIZATION = '@cds.skip_sanitization'
-
 const _getFiltered = err => {
   const error = {}
 
   Object.keys(err)
     .concat(['message'])
     .forEach(k => {
-      // REVISIT: do not remove innererror with cds^6
-      if (k === 'innererror' && process.env.NODE_ENV === 'production' && !err[SKIP_SANITIZATION]) return
       if (k in ALLOWED_PROPERTIES_MAP || k.startsWith('@')) {
         error[k] = err[k]
       } else if (k === 'numericSeverity') {
@@ -44,10 +38,10 @@ const _getFiltered = err => {
   return error
 }
 
-const _rewrite = error => {
+const _rewriteDBError = error => {
   // REVISIT: db stuff probably shouldn't be here
   if (error.code === 'SQLITE_ERROR') {
-    error.code = '500'
+    error.code = 'null'
   } else if (
     (error.code.startsWith('SQLITE_CONSTRAINT') && error.message.match(/COMMIT/)) ||
     (error.code.startsWith('SQLITE_CONSTRAINT') && error.message.match(/FOREIGN KEY/)) ||
@@ -72,7 +66,7 @@ const _normalize = (err, locale, inner = false) => {
   error.code = String(error.code || 'null')
 
   // REVISIT: code and message rewriting
-  _rewrite(error)
+  _rewriteDBError(error)
 
   let statusCode = err.status || err.statusCode || (_isAllowedError(error.code) && error.code)
 
@@ -87,8 +81,8 @@ const _normalize = (err, locale, inner = false) => {
     statusCode = statusCode || _statusCodeFromDetails(childErrorCodes)
   }
 
-  // make sure it's a number, if it's an inner error don't set to 500, as will be set on root level if no other inner error has a statusCode
-  statusCode = statusCode ? Number(statusCode) : inner ? undefined : 500
+  // make sure it's a number if set, otherwise will be assigned as 500 in normalizeError
+  statusCode = statusCode ? Number(statusCode) : undefined
 
   return { error, statusCode }
 }
@@ -100,25 +94,25 @@ const _isAllowedError = errorCode => {
 // - for one unique value, we use it
 // - if at least one 5xx exists, we use 500
 // - else if at least one 4xx exists, we use 400
-// - else we use 500
 const _statusCodeFromDetails = uniqueStatusCodes => {
   if (uniqueStatusCodes.size === 1) return uniqueStatusCodes.values().next().value
   if ([...uniqueStatusCodes].some(s => s >= 500)) return 500
   if ([...uniqueStatusCodes].some(s => s >= 400)) return 400
-  return 500
 }
 
 const normalizeError = (err, req) => {
   const locale = req.locale || (req.locale = localeFrom(req))
-  const { error, statusCode } = _normalize(err, locale)
+  let { error, statusCode } = _normalize(err, locale)
 
-  // REVISIT: make === 500 in cds^6
-  // error[SKIP_SANITIZATION] is not an official API!!!
-  if (statusCode >= 500 && process.env.NODE_ENV === 'production' && !error[SKIP_SANITIZATION]) {
+  if ((!statusCode || (statusCode >= 500 && err._thrownByFramework)) && process.env.NODE_ENV === 'production') {
     // > return sanitized error to client
-    return { error: { code: `${statusCode}`, message: i18n(statusCode, locale) }, statusCode }
+    return {
+      error: { code: statusCode ? `${statusCode}` : '500', message: i18n(statusCode || 500, locale) },
+      statusCode: Number(statusCode) || 500
+    }
   }
-  delete error[SKIP_SANITIZATION]
+
+  if (!statusCode) statusCode = 500
 
   // no top level null codes
   if (error.code === 'null') {

package/libx/_runtime/common/error/index.js

@@ -1,7 +1,12 @@
 const entry = require('./entry')
 
 module.exports = (...args) => {
-  const e = entry(...args)
-  if (e instanceof Error) return e
-  return Object.assign(new Error(e.message), e)
+  let e = entry(...args)
+  if (!(e instanceof Error)) e = Object.assign(new Error(e.message), e)
+  // _thrownByFramework shouldn't be logged
+  Object.defineProperty(e, '_thrownByFramework', {
+    value: true,
+    enumerable: false
+  })
+  return e
 }

package/libx/_runtime/common/generic/auth/capabilities.js

@@ -2,7 +2,7 @@ const { cqnFrom } = require('./utils')
 const { RESTRICTIONS } = require('./constants')
 
 const _isRestricted = (req, capability, capabilityReadByKey) => {
-  if (capabilityReadByKey !== undefined && req.query.SELECT.one) {
+  if (capabilityReadByKey !== undefined && req.query.SELECT && req.query.SELECT.one) {
     return capabilityReadByKey === false
   }
   return capability === false
@@ -29,6 +29,7 @@ const _localName = entity => entity.name.replace(entity._service.name + '.', '')
 function handler(req) {
   // TODO: Determine auth-relevant entity
   const annotation = RESTRICTIONS[req.event]
+
   if (!req.target || !annotation) return
 
   const action = annotation.split('.').pop().toUpperCase()

package/libx/_runtime/common/generic/auth/constants.js

@@ -1,7 +1,4 @@
-const MOD_EVENTS = { UPDATE: 1, DELETE: 1, EDIT: 1 }
-const WRITE_EVENTS = Object.assign({ CREATE: 1, NEW: 1, PATCH: 1, CANCEL: 1 }, MOD_EVENTS)
-const CRUD_EVENTS = Object.assign({ READ: 1 }, WRITE_EVENTS)
-const DRAFT_EVENTS = { PATCH: 1, CANCEL: 1, draftActivate: 1, draftPrepare: 1 }
+const { MOD_EVENTS, WRITE_EVENTS, CRUD_EVENTS, DRAFT_EVENTS } = require('../../constants/events')
 
 const RESTRICTIONS = {
   CREATE: 'InsertRestrictions.Insertable',

package/libx/_runtime/common/generic/auth/requires.js

@@ -24,7 +24,7 @@ function handler(req) {
   if (!definition) return
 
   const requires = getRequiresAsArray(definition)
-  if (!requires.length || requires.some(role => req.user.is(role))) return
+  if (!requires || requires.some(role => req.user.is(role))) return
 
   reject(req, getRejectReason(req, '@requires', definition))
 }

package/libx/_runtime/common/generic/auth/restrict.js

@@ -25,7 +25,11 @@ const _getResolvedApplicables = (applicables, req) => {
           (!resolved.where || resolved.where === restrict.where)
       )
     ) {
-      if (resolved.where) resolved._xpr = cds.parse.expr(resolved.where).xpr
+      if (resolved.where) {
+        resolved._xpr = cds.parse.expr(resolved.where).xpr
+        if (!resolved._xpr)
+          req.reject(400, `Exists predicate is missing in the association path "${resolved.where}" in @restrict.where`)
+      }
       resolvedApplicables.push(resolved)
     }
   }
@@ -49,6 +53,7 @@ const _evalStatic = (op, vals) => {
     case '=':
       return vals[0] === vals[1]
     case '!=':
+    case '<>':
       return vals[0] !== vals[1]
     case '<':
       return vals[0] < vals[1]
@@ -79,9 +84,11 @@ const _handleStaticAuth = (resolvedApplicables, req) => {
 const _getMergedWhere = restricts => {
   const xprs = []
   restricts.forEach(ele => {
-    xprs.push('(', ...ele._xpr, ')', 'or')
+    if (xprs.length) {
+      xprs.push('or')
+    }
+    xprs.push({ xpr: [...ele._xpr] })
   })
-  xprs.pop()
   return xprs
 }
 
@@ -111,9 +118,7 @@ const _addWheresToRef = (ref, model, resolvedApplicables) => {
       if (!newIdentifier.where) newIdentifier.where = []
 
       if (newIdentifier.where && newIdentifier.where.length) {
-        newIdentifier.where.unshift('(')
-        newIdentifier.where.push(')')
-        newIdentifier.where.push('and')
+        newIdentifier.where = [{ xpr: newIdentifier.where }, 'and']
       }
 
       newIdentifier.where.push(..._getMergedWhere(applicablesForEntity))
@@ -148,33 +153,12 @@ const _addRestrictionsToRead = async (req, model, resolvedApplicables) => {
   const restrictionForTarget = _getRestrictionForTarget(resolvedApplicables, req.target)
   if (!restrictionForTarget) return
 
-  // adjust free subselects, if necessary
-  if (resolvedApplicables.some(ra => ra.where.match(/\s*exists\s*\(\s*select\s*1\s*/i))) {
-    for (const ele of restrictionForTarget) {
-      if (typeof ele !== 'object' || !ele.SELECT || !ele.SELECT.where) continue
-
-      for (const w of ele.SELECT.where) {
-        if (w.ref && w.ref.length > 2) {
-          let path = w.ref[0]
-          if (!model.definitions[path]) continue
-          let i = 1
-
-          for (; i < w.ref.length; i++) {
-            if (model.definitions[`${path}.${w.ref[i]}`]) path += `.${w.ref[i]}`
-            else break
-          }
-
-          w.ref = [path, ...w.ref.slice(i)]
-        }
-      }
-    }
-  }
-
   // apply restriction
   req.query.where(restrictionForTarget)
 }
 
 const _getFromWithIsActiveEntityRemoved = from => {
+  if (!from.ref) return from
   for (const element of from.ref) {
     if (element.where && isActiveEntityRequested(element.where)) {
       element.where = removeIsActiveEntityRecursively(element.where)

package/libx/_runtime/common/generic/auth/restrictions.js

@@ -36,12 +36,15 @@ const _addNormalizedRestrict = (restrict, restricts, definition) => {
   restrict.grant.forEach(grant => _addNormalizedRestrictPerGrant(grant, where, restrict, restricts, definition))
 }
 
-const getNormalizedRestrictions = (definition, definitions, event) => {
+const getNormalizedRestrictions = (definition, definitions) => {
   const restricts = []
+  let isRestricted = false
 
   // own
-  definition['@restrict'] &&
+  if (definition['@restrict']) {
+    isRestricted = true
     definition['@restrict'].forEach(restrict => _addNormalizedRestrict(restrict, restricts, definition))
+  }
 
   // bounds
   const actions = definition.actions
@@ -51,15 +54,20 @@ const getNormalizedRestrictions = (definition, definitions, event) => {
       const action = actions[k]
 
       if (action['@restrict']) {
-        restricts.push(...getNormalizedRestrictions(action, definitions))
+        const restrictions = getNormalizedRestrictions(action, definitions)
+        if (restrictions) {
+          isRestricted = true
+          restricts.push(...restrictions)
+        }
       } else if (!definition['@restrict']) {
         // > no entity-level restrictions => unrestricted action
+        isRestricted = true
         restricts.push({ grant: action.name, to: ['any'], target: action.parent })
       }
     }
   }
 
-  return restricts
+  return isRestricted ? restricts : null
 }
 
 const _isGrantAccessAllowed = (eventName, restrict) => restrict.grant === '*' || restrict.grant === eventName

package/libx/_runtime/common/generic/auth/utils.js

@@ -141,7 +141,8 @@ const resolveUserAttrs = (restrict, req) => {
       attr = parts.shift()
     }
 
-    if (!skip) restrict.where = restrict.where.replace(next[0], val === undefined ? null : val)
+    if (!skip)
+      restrict.where = restrict.where.replace(next[0], val === undefined ? null : val).replace('in null', 'is null')
     next = _getNext(restrict.where)
   }
 

package/libx/_runtime/common/generic/crud.js

@@ -1,14 +1,12 @@
 const cds = require('../../cds')
 const { SELECT } = cds.ql
 
-const getTemplate = require('../utils/template')
-const templateProcessor = require('../utils/templateProcessor')
-const replaceManagedData = require('../utils/dollar')
 const { deepCopyArray } = require('../utils/copy')
 
-const onlyKeysRemain = require('../utils/onlyKeysRemain')
 const { getColumns } = require('../../cds-services/services/utils/columns')
 
+const getError = require('../error')
+
 const _targetEntityDoesNotExist = async req => {
   const { query } = req
   const cqn = SELECT.from(query.UPDATE.entity, [1])
@@ -26,58 +24,19 @@ const _targetEntityDoesNotExist = async req => {
   return exists.length === 0
 }
 
-const _processorFn = req => {
-  const { event, user, timestamp } = req
-  const ts = new Date(timestamp).toISOString()
-
-  return ({ row, key, plain, isRoot }) => {
-    for (const category of plain.categories) {
-      if (event === 'CREATE' && category === '@cds.on.insert') {
-        replaceManagedData(row, key, user, ts)
-      } else if (category === '@cds.on.update') {
-        if (isRoot) replaceManagedData(row, key, user, ts)
-        else if (row[key] === '$user' || row[key] === '$now') delete row[key]
-      }
-    }
-  }
-}
-
-// params: element, target, parent, templateElements
-const _pick = element => {
-  // collect actions to apply
-  const categories = []
-
-  if (element['@cds.on.insert']) categories.push('@cds.on.insert')
-  if (element['@cds.on.update']) categories.push('@cds.on.update')
-
-  if (categories.length) return { categories }
-}
-
-const _updateReqData = (req, that) => {
-  const template = getTemplate('app-output', that, req.target, { pick: _pick })
-
-  if (template.elements.size > 0) {
-    const arrayData = Array.isArray(req.data) ? req.data : [req.data]
-    for (const row of arrayData) {
-      const args = {
-        processFn: _processorFn(req),
-        row,
-        template
-      }
-      templateProcessor(args)
-    }
-  }
-}
-
-module.exports = cds.service.impl(function () {
+exports.impl = cds.service.impl(function () {
   // eslint-disable-next-line complexity
   this.on(['CREATE', 'READ', 'UPDATE', 'DELETE'], '*', async function (req) {
     if (typeof req.query !== 'string' && req.target && req.target._hasPersistenceSkip) {
-      req.reject(501, 'PERSISTENCE_SKIP_NO_GENERIC_CRUD', [req.target.name])
+      throw getError({
+        code: 501,
+        message: 'PERSISTENCE_SKIP_NO_GENERIC_CRUD',
+        args: [req.target.name]
+      })
     }
 
     // REVISIT: error message
-    if (!cds.db) req.reject(501, 'NO_DATABASE_CONNECTION')
+    if (!cds.db) req.reject('NO_DATABASE_CONNECTION')
 
     let result
 
@@ -94,13 +53,6 @@ module.exports = cds.service.impl(function () {
       if (res.length === 0) req.reject(404)
     }
 
-    // REVISIT: remove block with cds^6 (i.e., update_managed_properties is always true)
-    // no changes, no op (otherwise, @cds.on.update gets new values), but we need to check existence
-    if (cds.env.features.update_managed_properties === false && req.event === 'UPDATE' && onlyKeysRemain(req)) {
-      if (await _targetEntityDoesNotExist(req)) req.reject(404)
-      result = req.data
-    }
-
     if (req.event in { DELETE: 1, UPDATE: 1 } && req.target && req.target._isSingleton) {
       if (req.event === 'DELETE' && !req.target['@odata.singleton.nullable']) req.reject(400, 'SINGLETON_NOT_NULLABLE')
       const keyColumns = getColumns(req.target, { onlyNames: true, keysOnly: true })
@@ -136,9 +88,6 @@ module.exports = cds.service.impl(function () {
     // flag to trigger read after write in protocol adapter
     req._.readAfterWrite = true
 
-    // update req.data
-    _updateReqData(req, this)
-
     return req.data
   })
 })

package/libx/_runtime/common/generic/etag.js

@@ -5,6 +5,7 @@ const { SELECT } = cds.ql
 const { isActiveEntityRequested } = require('../../fiori/utils/where')
 const { ensureDraftsSuffix } = require('../../fiori/utils/handler')
 const { cqn2cqn4sql } = require('../../common/utils/cqn2cqn4sql')
+const { isAsteriskColumn } = require('../../common/utils/rewriteAsterisks')
 const ODataRequest = require('../../cds-services/adapter/odata-v4/ODataRequest')
 
 const C_U_ = {
@@ -25,12 +26,44 @@ const getSelectCQN = (query, target, model) => {
 
   const targetName = isActiveEntityRequested(requestTarget.ref[0].where) ? target.name : ensureDraftsSuffix(target.name)
   const cqn = cqn2cqn4sql(SELECT.from(requestTarget), model)
-  cqn.columns([target._etag])
+  cqn.columns([target._etag.name])
   cqn.SELECT.from.ref[0] = targetName
 
   return cqn
 }
 
+/**
+Recursively adds etag columns if a manual list of columns is specified.
+If asterisk columns or no columns are given, the database layer will
+add the etag columns anyway.
+*/
+const _addEtagColumns = (columns, entity) => {
+  if (!columns || !Array.isArray(columns)) return
+  if (
+    entity._etag &&
+    !columns.some(c => isAsteriskColumn(c)) &&
+    !(columns.length === 1 && columns[0].func === 'count') &&
+    !columns.some(c => c.ref && c.ref[c.ref.length - 1] === entity._etag.name)
+  ) {
+    columns.push({ ref: [entity._etag.name] })
+  }
+  const expands = columns.filter(c => c.expand)
+  for (const expand of expands) {
+    const refName = expand.ref[expand.ref.length - 1]
+    const targetEntity = refName && entity.elements[refName] && entity.elements[refName]._target
+    if (targetEntity) {
+      _addEtagColumns(expand.expand, targetEntity)
+    }
+  }
+}
+
+const _isConcurrentODataReq = req => {
+  const isReadAfterDraftAction =
+    req.event === 'READ' && req.target._isDraftEnabled && req.context.event in { draftActivate: 1, EDIT: 1 }
+  const _req = isReadAfterDraftAction ? req.context : req
+  return _req instanceof ODataRequest && _req.isConcurrentResource
+}
+
 /**
  * Generic handler for @odata.etag-enabled entities
  *
@@ -39,8 +72,12 @@ const getSelectCQN = (query, target, model) => {
 const _handler = async function (req) {
   // REVISIT: The check for ODataRequest should be removed after etag logic is moved
   // from okra to commons and etag handling is also allowed for rest.
-  if (req instanceof ODataRequest && req.isConcurrentResource) {
-    const etagElement = req.target.elements[req.target._etag]
+
+  if (_isConcurrentODataReq(req)) {
+    const etagElement = req.target.elements[req.target._etag.name]
+
+    // automatically add etag columns if not already there
+    if (req.query.SELECT) _addEtagColumns(req.query.SELECT.columns, req.target)
 
     // validate
     if (req.isConditional && !req.query.INSERT) {
@@ -72,10 +109,7 @@ module.exports = cds.service.impl(function () {
   for (const k in this.entities) {
     const entity = this.entities[k]
 
-    if (!Object.values(entity.elements).some(ele => ele['@odata.etag'])) {
-      // entity not @odata.etag-enabled
-      continue
-    }
+    if (!entity._etag) continue
 
     // handler for CREATE is registered for backwards compatibility w.r.t. ETag generation
     let events = ['CREATE', 'READ', 'UPDATE', 'DELETE']