@sap/cds 5.9.6 → 6.0.1

package/libx/_runtime/common/generic/input.js

@@ -1,5 +1,5 @@
 /*
- * input handler on ApplicationService level
+ * Input handler on application service layer
  *
  * - remove readonly fields
  * - remove immutable fields on update
@@ -8,15 +8,15 @@
  */
 
 const cds = require('../../cds')
+const LOG = cds.log('app')
 const { enrichDataWithKeysFromWhere } = require('../utils/keys')
 const { DRAFT_COLUMNS_MAP } = require('../../common/constants/draft')
-const { checkInputConstraints, checkIfAssocDeep } = require('../../cds-services/util/assert')
+const { checkInputConstraints, assertTargets } = require('../../cds-services/util/assert')
 const getTemplate = require('../utils/template')
 const templateProcessor = require('../utils/templateProcessor')
 const { getDataFromCQN, setDataFromCQN } = require('../utils/data')
-const { isMandatory, isReadOnly } = require('../aspects/utils')
 
-const shouldSuppressErrorPropagation = ({ event, value }) => {
+const _shouldSuppressErrorPropagation = (event, value) => {
   return (
     event === 'NEW' ||
     event === 'PATCH' ||
@@ -25,7 +25,7 @@ const shouldSuppressErrorPropagation = ({ event, value }) => {
   )
 }
 
-const getSimpleCategory = category => {
+const _getSimpleCategory = category => {
   if (typeof category === 'object') {
     category = category.category
   }
@@ -33,7 +33,7 @@ const getSimpleCategory = category => {
   return category
 }
 
-const rowKeysGenerator = eventName => {
+const _rowKeysGenerator = eventName => {
   if (eventName === 'UPDATE') return
   return (keyNames, row, template) => {
     for (const keyName of keyNames) {
@@ -69,8 +69,62 @@ const _getMediaTypeValue = req =>
   !req._.req.headers['content-type'].match(/json|multipart/i) &&
   req._.req.headers['content-type']
 
-const _processCategory = ({ row, key, category, isRoot, event, value, req, element }) => {
-  category = getSimpleCategory(category)
+const _preProcessAssertTarget = (assocInfo, assertMap) => {
+  const { element: assoc, row } = assocInfo
+  const assocTarget = assoc._target
+
+  // it is expected that the associated entities be defined in the same service
+  if (assoc.parent._service !== assocTarget._service) {
+    LOG._warn && LOG.warn('Cross-service checks for the @assert.target constraint are not supported.')
+    return
+  }
+
+  const foreignKeys = assoc._foreignKeys
+  let mapKey = `${assocTarget.name}(`
+  const hasOwn = Object.prototype.hasOwnProperty
+  const parentKeys = []
+
+  foreignKeys.forEach(keyMap => {
+    const { childElement, parentElement } = keyMap
+
+    // don't assert target if the foreign key isn't in the payload
+    if (!hasOwn.call(row, parentElement.name)) return
+
+    const foreignKeyValue = row[parentElement.name]
+
+    // don't assert target if the foreign key value is null
+    if (foreignKeyValue === null) return
+
+    mapKey += `${childElement.name}=${foreignKeyValue},`
+    parentKeys.push({
+      [childElement.name]: foreignKeyValue
+    })
+  })
+  mapKey += `)`
+
+  if (parentKeys.length === 0) return
+
+  foreignKeys.forEach(keyMap => {
+    const clonedAssocInfo = Object.assign({}, assocInfo, { pathSegments: assocInfo.pathSegments.slice(0) })
+    const target = {
+      key: mapKey,
+      entity: assocTarget,
+      keys: parentKeys,
+      assocInfo: clonedAssocInfo,
+      foreignKey: keyMap.parentElement
+    }
+
+    if (!assertMap.targets.has(mapKey)) {
+      assertMap.targets.set(mapKey, target)
+    }
+
+    assertMap.allTargets.push(target)
+  })
+}
+
+const _processCategory = (req, category, value, elementInfo, assertMap) => {
+  const { row, key, element, isRoot } = elementInfo
+  category = _getSimpleCategory(category)
 
   // remember mandatory
   if (category === 'mandatory') {
@@ -78,6 +132,8 @@ const _processCategory = ({ row, key, category, isRoot, event, value, req, eleme
     return
   }
 
+  const event = req.event
+
   // remove readonly & immutable (can also be complex, so do first)
   if (category === 'readonly' || (category === 'immutable' && event === 'UPDATE')) {
     if (_isDraftCoreComputed(req, element, event)) {
@@ -95,11 +151,9 @@ const _processCategory = ({ row, key, category, isRoot, event, value, req, eleme
     value.val = row[key] = cds.utils.uuid()
   }
 
-  // check for forbidden deep operations for association
-  if (category === 'associationEffective' && (event === 'UPDATE' || event === 'CREATE')) {
-    if (shouldSuppressErrorPropagation({ event, value })) return
-    // REVISIT: remove delay_assert_deep_assoc with cds^6
-    if (!cds.env.features.delay_assert_deep_assoc) checkIfAssocDeep(element, value.val, req)
+  // @assert.target
+  if ((event === 'UPDATE' || event === 'CREATE') && category === '@assert.target') {
+    _preProcessAssertTarget(elementInfo, assertMap)
   }
 
   // set media type from content-type header if streaming
@@ -108,28 +162,26 @@ const _processCategory = ({ row, key, category, isRoot, event, value, req, eleme
   if (category === 'stream' && isStreaming && mtValue) row[key] = mtValue
 }
 
-const processorFn = (errors, req) => {
-  const { event } = req
+const _getProcessorFn = (req, errors, assertMap) => {
+  const event = req.event
 
-  return ({ row, key, element, plain, isRoot, path }) => {
-    const categories = plain.categories
+  return elementInfo => {
+    const { row, key, element, plain, pathSegments } = elementInfo
     // ugly pointer passing for sonar
     const value = { mandatory: false, val: row && row[key] }
 
-    for (const category of categories) {
-      _processCategory({ row, key, category, isRoot, event, value, req, element })
+    for (const category of plain.categories) {
+      _processCategory(req, category, value, elementInfo, assertMap)
     }
 
-    if (shouldSuppressErrorPropagation({ event, value })) {
-      return
-    }
+    if (_shouldSuppressErrorPropagation(event, value)) return
 
     // REVISIT: Convert checkInputConstraints to template mechanism
-    checkInputConstraints({ element, value: value.val, errors, path, event })
+    checkInputConstraints({ element, value: value.val, errors, pathSegments, event })
   }
 }
 
-// params: element, target, parent, templateElements
+// params: element, target, parent
 const _pick = element => {
   // collect actions to apply
   const categories = []
@@ -151,25 +203,27 @@ const _pick = element => {
     categories.push('immutable')
   }
 
-  if (element._isAssociationEffective && !element._target._hasPersistenceSkip) {
-    categories.push('associationEffective')
-  }
-
   if (element.key && !DRAFT_COLUMNS_MAP[element.name] && element.isUUID) {
     categories.push('uuid')
   }
 
   if (element['@Core.IsMediaType']) categories.push('stream')
 
+  if (
+    element._isAssociationStrict &&
+    !element.on && // managed assoc
+    element.is2one &&
+    element['@assert.target'] === true
+  ) {
+    categories.push('@assert.target')
+  }
+
   if (categories.length) return { categories }
 }
 
 const _callError = (req, errors) => {
-  if (errors.length !== 0) {
-    for (const error of errors) {
-      req.error(error)
-    }
-  }
+  if (errors.length === 0) return
+  for (const error of errors) req.error(error)
 }
 
 const _isBoundAction = req => !!(req.getUriInfo && req.getUriInfo().getLastSegment().getKind() === 'BOUND.ACTION')
@@ -183,7 +237,7 @@ const _getBoundActionBindingParameter = req => {
   return (actions && actions[action] && actions[action]['@cds.odata.bindingparameter.name']) || 'in'
 }
 
-function _handler(req) {
+async function _handler(req) {
   if (!req.query) return // FIXME: the code below expects req.query to be defined
   if (!req.target) return
 
@@ -191,41 +245,44 @@ function _handler(req) {
   if (template.elements.size === 0) return
 
   const errors = []
-  const args = {
-    processFn: processorFn(errors, req),
-    template,
-    pathOptions: {
-      rowKeysGenerator: rowKeysGenerator(req.event),
-      includeKeyValues: true,
-      path: []
-    }
+  const assertMap = {
+    targets: new Map(),
+    allTargets: []
+  }
+
+  const pathOptions = {
+    rowKeysGenerator: _rowKeysGenerator(req.event),
+    includeKeyValues: true,
+    pathSegments: []
   }
+
   if (_isBoundAction(req)) {
     const pathSegment = _getBoundActionBindingParameter(req)
     const keys = req._ && req._.params && req._.params[0]
-    if (pathSegment) {
-      args.pathOptions.path.push({ key: pathSegment, url: pathSegment })
-    }
+    if (pathSegment) pathOptions.pathSegments.push(pathSegment)
 
     if (keys && 'IsActiveEntity' in keys) {
-      args.pathOptions.extraKeys = { IsActiveEntity: keys.IsActiveEntity }
+      pathOptions.extraKeys = { IsActiveEntity: keys.IsActiveEntity }
     }
   }
 
   const data = getDataFromCQN(req.query) // REVISIT: req.data should point into req.query
-
   enrichDataWithKeysFromWhere(data, req, this)
-
   const arrayData = Array.isArray(data) ? data : [data]
+
   for (const row of arrayData) {
-    templateProcessor(Object.assign(args, { row }))
+    templateProcessor({ processFn: _getProcessorFn(req, errors, assertMap), row, template, pathOptions })
+  }
+
+  if (assertMap.targets.size > 0) {
+    await assertTargets(assertMap, errors)
   }
 
   setDataFromCQN(req) // REVISIT: req.data should point into req.query
   _callError(req, errors)
 }
 
-const processorFnForActionsFunctions =
+const _getProcessorFnForActionsFunctions =
   (errors, opName) =>
   ({ row, key, element }) => {
     const value = row && row[key]
@@ -236,6 +293,7 @@ const processorFnForActionsFunctions =
 
 const _processActionFunctionRow = (row, param, key, errors, event, service) => {
   const values = Array.isArray(row[key]) ? row[key] : [row[key]]
+
   // unstructured
   for (const value of values) {
     checkInputConstraints({ element: param, value, errors, key })
@@ -245,9 +303,10 @@ const _processActionFunctionRow = (row, param, key, errors, event, service) => {
   const template = getTemplate('app-input-operation', service, param, {
     pick: _pick
   })
+
   if (template && template.elements.size) {
     for (const value of values) {
-      const args = { processFn: processorFnForActionsFunctions(errors, key), row: value, template }
+      const args = { processFn: _getProcessorFnForActionsFunctions(errors, key), row: value, template }
       templateProcessor(args)
     }
   }
@@ -256,6 +315,7 @@ const _processActionFunctionRow = (row, param, key, errors, event, service) => {
 const _processActionFunction = (row, eventParams, errors, event, service) => {
   for (const key in eventParams) {
     let param = eventParams[key]
+
     // .type of action/function behaves different to .type of other csn elements
     const _type = param.type
     if (!_type && param.items) param = param.items
@@ -281,27 +341,29 @@ function _actionFunctionHandler(req) {
   const eventParams = _getEventParameters(req, this)
   if (!eventParams) return
 
-  // REVISIT: find better solution
+  // REVISIT: find better solution -> this obviously was because params were not linked in the past
   // attach aspects, if not yet done
-  for (const param of Object.values(eventParams)) {
-    if ('_isMandatory' in param) continue
-    param._isMandatory = isMandatory(param)
-    param._isReadOnly = isReadOnly(param)
-  }
+  // for (const param of Object.values(eventParams)) {
+  //   if ('_isMandatory' in param) continue
+  //   param._isMandatory = isMandatory(param)
+  //   param._isReadOnly = isReadOnly(param)
+  // }
 
-  // REVISIT: find better solution, maybe compiler?
+  // REVISIT: find better solution, maybe compiler? -> this obviously was because params were not linked in the past
   // resolve enums like format, range, etc.
-  for (const param of Object.values(eventParams)) {
-    // .type of action/function behaves different to .type of other csn elements
-    const _type = param.type && this.model && this.model.definitions[param.type]
-    if (_type) {
-      param.enum = _type.enum
-    }
-  }
+  // for (const param of Object.values(eventParams)) {
+  //   // .type of action/function behaves different to .type of other csn elements
+  //   const _type = param.type && this.model && this.model.definitions[param.type]
+  //
+  //   if (_type) {
+  //     param.enum = _type.enum
+  //   }
+  // }
 
   const errors = []
   const data = req.data
   const arrayData = Array.isArray(data) ? data : [data]
+
   for (const row of arrayData) {
     _processActionFunction(row, eventParams, errors, req.event, this)
   }
@@ -314,8 +376,8 @@ _actionFunctionHandler._initial = true
 
 module.exports = cds.service.impl(function () {
   this.before(['CREATE', 'UPDATE', 'NEW', 'PATCH'], '*', _handler)
-
   const operationNames = []
+
   for (const operation of this.operations) {
     operationNames.push(operation.name.substring(this.name.length + 1))
   }

package/libx/_runtime/common/generic/paging.js

@@ -8,10 +8,16 @@ const _handler = function (req) {
   // target === null if view with parameters
   if (!req.target || !req.query.SELECT || req.query.SELECT.one) return
 
-  let { rows, offset } = req.query.SELECT.limit || {}
-  rows = rows && 'val' in rows ? rows.val : getDefaultPageSize(req.target)
+  _addPaging(req.query, req.target)
+}
+
+const _addPaging = function (query, target) {
+  let { rows, offset } = query.SELECT.limit || {}
+  rows = rows && 'val' in rows ? rows.val : getDefaultPageSize(target)
   offset = offset && 'val' in offset ? offset.val : 0
-  req.query.limit(...[Math.min(rows, getMaxPageSize(req.target)), offset])
+  query.limit(...[Math.min(rows, getMaxPageSize(target)), offset])
+  //Handle nested limits
+  if (query.SELECT.from.SELECT) _addPaging(query.SELECT.from, target)
 }
 
 /**

package/libx/_runtime/common/generic/put.js

@@ -23,7 +23,7 @@ const _fillStructure = (row, parts, element, category, args) => {
   }
 }
 
-const processorFn = req => {
+const _getProcessorFn = req => {
   const REST = req.constructor.name === 'RestRequest'
 
   return ({ row, key, element, plain }) => {
@@ -73,7 +73,7 @@ function _handler(req) {
   const arrayData = Array.isArray(data) ? data : [data]
   for (const row of arrayData) {
     const args = {
-      processFn: processorFn(req),
+      processFn: _getProcessorFn(req),
       row,
       template
     }

package/libx/_runtime/common/generic/sorting.js

@@ -15,8 +15,7 @@ const _getStaticOrders = req => {
 
   const ordersFromKeys = []
 
-  // implicit sorting?
-  if (cds.env.features.implicit_sorting !== false && (req.target._isSingleton || query.SELECT.limit)) {
+  if (req.target._isSingleton || query.SELECT.limit) {
     const keys = getAllKeys(entity, true)
     for (const key of keys) {
       if (!(key in DRAFT_COLUMNS_MAP) && !defaultOrders.some(o => o.by['='] === key)) {
@@ -27,7 +26,10 @@ const _getStaticOrders = req => {
 
   if (entity.query && entity.query.SELECT && entity.query.SELECT.orderBy) {
     const orderBy = entity.query.SELECT.orderBy
-    const ordersFromView = orderBy.map(keyName => ({ by: { '=': keyName.ref[0] }, desc: keyName.sort === 'desc' }))
+    const ordersFromView = orderBy.map(keyName => ({
+      by: { '=': keyName.ref[keyName.ref.length - 1] },
+      desc: keyName.sort === 'desc'
+    }))
     return [...ordersFromView, ...defaultOrders, ...ordersFromKeys]
   }
 
@@ -44,13 +46,18 @@ const _getStaticOrders = req => {
 const _handler = function (req) {
   if (!req.query || !req.query.SELECT || req.query.SELECT.one) return
 
-  const select = req.query.SELECT
+  let select = req.query.SELECT
 
   // do not sort for /$count queries or queries only using aggregations
   if (select.columns && select.columns.length && select.columns.every(col => col.func)) {
     return
   }
 
+  // apply default sort to bottom-most sub-query
+  if (select.from && select.from.SELECT) {
+    while (select.from.SELECT) select = select.from.SELECT
+  }
+
   // "static orders" = the orders not from the query options
   let staticOrders = _getStaticOrders(req)
 

package/libx/_runtime/common/generic/temporal.js

@@ -48,11 +48,6 @@ const _handler = function (req) {
   // REVISIT: stable access
   const _ = (req.context && req.context._) || req._
 
-  if (_isWarningRequired(cds._deprecationWarningForTemporal, _queryOptions)) {
-    LOG._warn && LOG.warn('query options "sap-valid-from" and "sap-valid-to" are deprecated and will be removed.')
-    cds._deprecationWarningForTemporal = true
-  }
-
   // make sure the env vars are reset
   _['VALID-FROM'] = null
   _['VALID-TO'] = null

package/libx/_runtime/common/i18n/messages.properties

@@ -46,6 +46,7 @@ ASSERT_DATA_TYPE=Value {0} is invalid according to type definition "{1}"
 ASSERT_ENUM=Value {0} is invalid according to enum declaration {{1}}
 ASSERT_NOT_NULL=Value is required
 ASSERT_REFERENCE_INTEGRITY=Reference integrity is violated for association "{0}"
+ASSERT_TARGET="Value doesn't exist"
 ASSERT_DEEP_ASSOCIATION=It is not allowed to modify sub documents in {0} Association "{1}"
 
 # persistence
@@ -70,7 +71,7 @@ DELETABLE=deletable
 ENTITY_IS_INSERT_ONLY=Entity "{0}" is insert-only
 ENTITY_IS_READ_ONLY=Entity "{0}" is read-only
 ENTITY_IS_NOT_CRUD=Entity "{0}" is not {1}
-ENTITY_IS_NOT_CRUD_VIA_NAVIGATION=Entity "{0}" is not {1} via association "{2}"
+ENTITY_IS_NOT_CRUD_VIA_NAVIGATION=Entity "{0}" is not {1} via navigation "{2}"
 ENTITY_IS_AUTOEXPOSED=Entity "{0}" is not explicitly exposed as part of the service
 EXPAND_IS_RESTRICTED=Navigation property "{0}" is not allowed for expand operation
 EXPAND_COUNT_UNSUPPORTED="$count" is not supported for expand operation

package/libx/_runtime/common/utils/binary.js

@@ -0,0 +1,69 @@
+const getTemplate = require('./template')
+const templateProcessor = require('./templateProcessor')
+
+const BASE64 = /^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{4}|[A-Za-z0-9+/]{3}={0,1}|[A-Za-z0-9+/]{2}={0,2})$/
+
+// convert the standard base64 encoding to the URL-safe variant
+const toBase64url = value =>
+  (Buffer.isBuffer(value) ? value.toString('base64') : value).replace(/\//g, '_').replace(/\+/g, '-')
+
+const normalizeBase64string = value => {
+  if (typeof value !== 'string') return value
+  // add last byte(s) and '=' padding in case of shortend base64
+  return Buffer.from(value, 'base64').toString('base64')
+}
+
+const isInvalidBase64string = value => {
+  if (Buffer.isBuffer(value)) return // ok
+
+  // convert to standard base64 string; let it crash if typeof value !== 'string'
+  const base64 = value.replace(/_/g, '/').replace(/-/g, '+')
+  const normalized = normalizeBase64string(value)
+
+  // example of invalid base64 string --> 'WTGTdDsD/k21LnFRb+uNcAi=' <-- '...i=' must be '...g='
+  // see https://datatracker.ietf.org/doc/html/rfc4648#section-4
+  return !base64.match(BASE64) || base64.replace(/=/g, '') !== normalized.replace(/=/g, '')
+}
+
+const _picker = element => {
+  const categories = {}
+  if (Array.isArray(element)) return
+  if (element.type !== 'cds.Binary' && element.type !== 'cds.LargeBinary') return
+  categories['convert_binary'] = true
+  return categories
+}
+
+const _processorFn =
+  toBuffer =>
+  ({ row, key, plain: categories }) => {
+    if (categories['convert_binary'] && row[key] != null) {
+      if (toBuffer && typeof row[key] === 'string') row[key] = Buffer.from(row[key], 'base64')
+      if (!toBuffer && Buffer.isBuffer(row[key])) row[key] = row[key].toString('base64')
+    }
+  }
+
+const _processBinaryData = (data, srv, definition, toBuffer) => {
+  const template = getTemplate('rest-payload', srv, definition, { pick: _picker })
+  if (template && template.elements.size) {
+    const rows = Array.isArray(data) ? data : [data]
+    for (const row of rows) {
+      templateProcessor({ processFn: _processorFn(toBuffer), row, template })
+    }
+  }
+}
+
+const base64ToBuffer = (data, srv, definition) => {
+  _processBinaryData(data, srv, definition, true)
+}
+
+const bufferToBase64 = (data, srv, definition) => {
+  _processBinaryData(data, srv, definition, false)
+}
+
+module.exports = {
+  normalizeBase64string,
+  isInvalidBase64string,
+  toBase64url,
+  base64ToBuffer,
+  bufferToBase64
+}

package/libx/_runtime/common/utils/cqn.js

@@ -1,3 +1,7 @@
+const cds = require('../../cds')
+const { SELECT } = cds.ql
+const { setEntityContained } = require('./csn')
+
 const getEntityNameFromDeleteCQN = cqn => {
   let from
   if (cqn && cqn.DELETE && cqn.DELETE.from) {
@@ -17,8 +21,7 @@ const getEntityNameFromUpdateCQN = cqn => {
 }
 
 // scope: simple wheres à la "[{ ref: ['foo'] }, '=', { val: 'bar' }, 'and', ... ]"
-function where2obj(where, target = null) {
-  const data = {}
+function where2obj(where, target = null, data = {}) {
   for (let i = 0; i < where.length; i++) {
     const whereEl = where[i]
 
@@ -39,20 +42,34 @@ function where2obj(where, target = null) {
   return data
 }
 
-function targetFromPath(path, model) {
-  const { definitions } = model
-  let current
-  for (const r of path) {
-    if (r.id) {
-      current = current
-        ? definitions[current.elements[r.id].target]
-        : definitions[r.id] || definitions[r.id.replace(/_drafts$/, '')]
+function targetFromPath(from, model) {
+  const fromRef = from ? from.ref || [from] : []
+  let last = fromRef.length ? model.definitions : {}
+  const path = []
+  let target
+  let isContained
+  for (let r of fromRef) {
+    isContained = undefined
+    path.push(r.operation || r)
+    r = (r.id && r.id.replace(/_drafts$/, '')) || r
+    if (r.operation) {
+      if (last && last.actions) last = last.actions[r.operation]
+      else last = last[r.operation]
+    } else if (last.elements) {
+      last = last.elements[r]
+      if (last.isAssociation) {
+        isContained = last._isContained && last.target !== last.parent.name
+        last = model.definitions[last.target]
+      }
     } else {
-      const next = current ? current.elements[r] : definitions[r]
-      current = next.isAssociation ? definitions[next.target] : next
+      last = last[r]
+    }
+    if (last.kind === 'entity') {
+      target = last
+      setEntityContained(target, model, isContained)
     }
   }
-  return current
+  return { last, path, target, isTargetComposition: isContained }
 }
 
 function isPathToDraft(path, model) {
@@ -80,10 +97,18 @@ function isPathToDraft(path, model) {
   return draft
 }
 
+const resolveFromSelect = query => {
+  const __protoSelect = Object.getPrototypeOf(SELECT())
+  if (!(query instanceof __protoSelect.constructor)) Object.setPrototypeOf(query, __protoSelect)
+  const { from } = query.SELECT
+  return from.SELECT ? resolveFromSelect(from) : from
+}
+
 module.exports = {
   getEntityNameFromDeleteCQN,
   getEntityNameFromUpdateCQN,
   where2obj,
   targetFromPath,
-  isPathToDraft
+  isPathToDraft,
+  resolveFromSelect
 }