@sap/cds 5.9.6 → 6.0.1

package/server.js

@@ -20,13 +20,12 @@ const express = require('express')
  * @param {express.Application} options.app - filenames of models to load; default: '*'
  * @param {express.Handler} options.index - custom handler for /
  * @param {express.Handler} options.favicon - custom handler for /favicon.ico
- * @param {express.Handler} options.logger - custom request logger middleware
  * @returns Promise resolving to a Node.js http server as returned by express' `app.listen()`.
  */
 module.exports = async function cds_server (options) {
 
   const _in_prod = process.env.NODE_ENV === 'production'
-  const o = cds.options = { ...options, __proto__:defaults }
+  const o = { ...options, __proto__:defaults }
 
   const app = cds.app = o.app || express()
   app.serve = _app_serve                          //> app.serve allows delegating to sub modules
@@ -38,27 +37,21 @@ module.exports = async function cds_server (options) {
   if (o.favicon)   app.use ('/favicon.ico', o.favicon)  //> if none in ./app
   if (o.index)     app.get ('/',o.index)                //> if none in ./app
   if (o.correlate) app.use (o.correlate)                //> request correlation
-  if (o.logger)    app.use (o.logger)                   //> basic request logging
-  if (o.toggler)   app.use (o.toggler)                  //> feature toggler
 
   // load specified models or all in project
   const csn = await cds.load(o.from||'*',o) .then (cds.minify) //> separate csn for _init_db
   cds.model = cds.compile.for.nodejs(csn)
 
   // connect to essential framework services if required
-  if (cds.requires.extensibility)  await _extensibility() //> has to go first
   if (cds.requires.db)    cds.db = await cds.connect.to ('db') .then (_init)
   if (cds.requires.messaging)      await cds.connect.to ('messaging')
-  if (cds.requires.multitenancy)   await _multitenancy()
-  if (cds.requires.toggles)        await _model_provider()
 
   // serve all services declared in models
-  if (features.graphql) serve_graphql(app)
   await cds.serve (o.service,o) .in (app)
   await cds.emit ('served', cds.services) //> hook for listeners
 
   // start http server
-  const port = (o.port !== undefined) ? o.port : (process.env.PORT || 4004)
+  const port = (o.port !== undefined) ? o.port : (process.env.PORT || cds.env.server?.port || 4004)
   return app.listen (port)
 
   // bootstrap in-memory db
@@ -71,12 +64,6 @@ module.exports = async function cds_server (options) {
 
 }
 
-// REVISIT: Move these out of here...
-const _model_provider = () => require('./libx/_runtime/extensibility/mps')
-const _extensibility = () => require('./libx/_runtime/extensibility/uiflex')
-const _multitenancy = () => features.streamlined_mtx ? _model_provider() : cds.mtx.in (cds.app)
-
-
 
 // -------------------------------------------------------------------------
 // Default handlers, which can be overidden by options passed to the server
@@ -97,25 +84,7 @@ const defaults = {
   get favicon() {
     const favicon = require.resolve ('./app/favicon.ico')
     return express.static (favicon, {maxAge:'14d'})
-  },
-
-  // default request logger
-  get logger() {
-    const LOG = cds.log(), DEBUG = cds.debug('server')
-    return (req,_,next) => {
-      LOG && LOG (req.method, decodeURI(req.url), req.body||'')
-      if (/\$batch/.test(req.url))  req.on ('dispatch', (req) => {
-        LOG && LOG ('>', req.event, decodeURI(req._path), req._query||'')
-        if (DEBUG && req.query) DEBUG (req.query)
-      })
-      next()
-    }
-  },
-
-  // feature toggler
-  get toggler() {
-    return require('./libx/_runtime/common/toggles/handler')(cds)
-  }
+  }  
 }
 
 
@@ -130,16 +99,6 @@ const _app_serve = function (endpoint) { return {
 }}
 
 
-// register graphql router on served event
-function serve_graphql (app) {
-  cds.on('served', services => {
-    const GraphQLAdapter = require('./libx/gql/GraphQLAdapter')
-    app.use(new GraphQLAdapter(services, { graphiql: true }))
-    cds.log()("serving GraphQL endpoint for all services { at: '/graphql' }")
-  })
-}
-
-
 function cors (req, res, next) {
   const { origin } = req.headers
   if (origin) res.set('access-control-allow-origin', origin)

package/srv/extensibility-service.cds

@@ -0,0 +1,56 @@
+using { cds.xt.Extensions } from './extensions';
+using { cds.xt.TAR } from './model-provider';
+
+@protocol: 'rest'
+@(requires : 'authenticated-user')
+service cds.xt.ExtensibilityService @(path:'/-/cds/extensibility') {
+  // TODO: allow-lists - custom before('add') handler
+  // TODO: async jobs
+
+  type ActivationLevel : Extensions:activated;
+  type CSN: String; // REVISIT: should reuse cds.xt.CSN
+  type CSN_OR_CDL: String;
+
+  // UIFLEX API
+   @(requires : ['cds.UIFlexDeveloper', 'cds.ExtensionDeveloper'])
+  action addExtension(extensions : array of CSN);  // REVISIT: change to array of CSN extensions
+
+  // Experimantal API
+  @(requires : ['cds.ExtensionDeveloper', 'internal-user'])
+  action add(
+    extension  : CSN_OR_CDL,
+    tag        : Extensions:tag, // optional
+    activate   : ActivationLevel, // optional, default = 'database'
+    tenant     : String // optional, for internal-user only
+  );
+
+  // Experimantal API
+  @(requires : ['cds.ExtensionDeveloper', 'internal-user'])
+  action promote(
+    tag       : Extensions:tag, // optional
+    activate  : ActivationLevel, // optional, default = 'database'
+    tenant    : String // optional, for internal-user only
+  );
+
+  // REVISIT: consider implementing delete
+  // action delete(tenant: String, tag: Extensions:tag);
+
+  // EXTENSION PROJECT
+  // deprecated - mimics current cds extend returning TAR (w/o features)
+  // only features configured for tenant
+  @(requires : ['cds.ExtensionDeveloper'])
+  function base() returns TAR;
+
+  @(requires : ['cds.ExtensionDeveloper'])
+  action push (
+    extension : TAR // TODO: i18n, csv
+    // tag       : Extensions:tag,
+    // activate  : ActivationLevel
+  );
+
+  // REVISIT: separate action for transport -> later
+
+  event tenantUpdated {
+    tenant: String;
+  }
+}

package/srv/extensibility-service.js

@@ -0,0 +1 @@
+module.exports = require('../libx/_runtime/extensibility/service')

package/srv/extensions.cds

@@ -0,0 +1,8 @@
+entity cds.xt.Extensions {
+  key ID    : UUID;
+  tag       : String;       //> e.g.: uiflex, custom, ...
+  csn       : String;
+  sources   : LargeBinary; // TAR
+  activated : String enum { propertyBag; database };
+  timestamp : Timestamp @cds.on.insert:$now @cds.on.update:$now; // to support invalidation of models
+}

package/srv/model-provider.cds

@@ -0,0 +1,59 @@
+context cds.xt { // IMPORTANT: we don't use namespaces to avoid issues with cds.db default namespace
+
+  @open type CSN {};
+  type TAR : LargeBinary;
+  type XML : LargeString;
+  type Locale : String;
+  type TenantID : String;
+  type CSNConsumer : String enum { nodejs; java; };
+
+
+  /**
+   * Used by CAP runtimes to retrieve tenant-specific variants of
+   * deployed models used to serve requests.
+   */
+  @protocol: 'rest'
+  @requires: [ 'internal-user' ] //> we check that ourselves programmatically in production only
+  service ModelProviderService @(path:'/-/cds/model-provider', impl:'@sap/cds/srv/model-provider.js') {
+
+    action getCsn(
+      tenant  : TenantID,
+      toggles : array of String,
+      for     : CSNConsumer @cds.java.name: 'runtime',
+    ) returns CSN;
+
+    action getExtCsn(
+      tenant  : TenantID,
+      toggles : array of String,
+      for     : CSNConsumer @cds.java.name: 'runtime',
+    ) returns CSN;
+
+    action getEdmx(
+      tenant  : TenantID,
+      toggles : array of String,
+      service : String,
+      locale  : Locale,
+      flavor  : String,
+      for     : CSNConsumer @cds.java.name: 'runtime',
+    ) returns XML;
+
+    action isExtended(
+      tenant  : TenantID,
+    ) returns Boolean;
+
+    action getExtensions(
+      tenant  : TenantID,
+    ) returns CSN;
+
+    action getResources () returns TAR;
+    action getExtResources() returns TAR;
+
+    // -------------------------------
+    // Later, possibly:
+    // function GET csn(...)
+    // function GET edmx(...)
+    // function GET extended(...)
+    // function GET resources(...)
+  }
+
+}

package/srv/model-provider.js

@@ -0,0 +1,163 @@
+/* eslint-disable no-console */
+const fs = require('fs')
+const path = require('path')
+
+const cds = require('../libx/_runtime/cds')
+const DEBUG = cds.debug('mtx')
+
+const { packTarArchive, unpackTarArchive } = require('../lib/utils/resources')
+const { collectFiles } = require('../libx/_runtime/extensibility/utils')
+
+
+const TEMP_DIR = fs.realpathSync(require('os').tmpdir())
+
+module.exports = class ModelProviderService extends cds.Service {
+
+  get _add_stub_methods(){ return true }
+  init() {
+
+    // REVISIT: We should do the enforcement only in production
+    // let requires = this.definition['@requires_']
+    // if (requires && process.env.NODE_ENV === 'production') this.before ('*', req => {
+    //   if (!cds.context?.http) return //> not called from external
+    //   if (req.user._is_anonymous) return req.reject({ code:401 })
+    //   if (!requires.some(r => req.user.is(r))) return req.reject({ code:403 })
+    // })
+
+    this.on('getCsn', req => _getCsn(req, false, this._nodejs_models))
+    this.on('getExtCsn', req => _getExtCsn(req, this._nodejs_models))
+    this.on('getEdmx', async req => {
+      const { service, locale, flavor } = req.data
+      const csn = await _getCsn(req, false, this._nodejs_models)
+      const edmx = cds.compile.to.edmx(csn, { service, flavor })
+      const {res} = req._; if (res) res.set('Content-Type', 'application/xml')
+      return cds.localize(csn, locale, edmx)
+    })
+
+    this.on('getResources', async req => {
+      if (req._.res) req._.res.set('content-type', 'application/octet-stream; charset=binary')
+      // REVISIT: Works only w/o encoding parameter. Default encoding is 'utf8'.
+      // try { return await cds.utils.read('resources.tgz') }
+      // root is defined in cds.requires, in case of the sidecar scenario it is set to "_main"
+      try { return await require('fs').promises.readFile(require('path').resolve(cds.root, conf?.root || '', 'resources.tgz')) }
+      catch(e) { if (e.code !== 'ENOENT') throw e }
+      const files = Object.keys(await cds.deploy.resources(['*', cds.env.features.folders]))
+      if (!files.length) return req.reject(404)
+      if (req._.res) req._.res.set('content-type', 'application/octet-stream; charset=binary')
+      return packTarArchive(files, cds.root)
+    })
+
+    this.on('getExtResources', async req => {
+      if (!cds.requires.extensibility) return req.reject(400, 'Missing extensibility parameter')
+      const rs = await run4 (req.data.tenant, SELECT('sources').from('cds.xt.Extensions'))
+      if (!rs.length) return req.reject(404, 'Missing extensions')
+      if (rs.every(row => row.sources === null)) return req.reject(404, 'Extension resources not found')
+      if (req._.res) req._.res.set('content-type', 'application/octet-stream; charset=binary')
+      const temp = await fs.promises.mkdtemp(`${TEMP_DIR}${path.sep}tar-`)
+      try {
+        await Promise.all (rs.map (row => unpackTarArchive(Buffer.from(JSON.parse(row.sources)), temp, false)))
+        return await packTarArchive(collectFiles(temp, ['.csv', '.properties']), temp)
+      } finally {
+        await (fs.promises.rm || fs.promises.rmdir)(temp, { recursive: true, force: true }).catch(()=>{})
+      }
+    })
+
+    this.on('isExtended', async req => _isExtended(req.data.tenant))
+
+    this.on('getExtensions', async req => {
+      if (!cds.requires.extensibility) return req.reject(400, 'Missing extensibility parameter')
+      const exts = await run4 (req.data.tenant, SELECT('csn').from('cds.xt.Extensions'))
+      if (!exts.length) return req.reject(404, 'Missing extensions')
+
+      const csn = { extensions: [], definitions: {} }
+      exts.forEach(ext => {
+        const extCsn = JSON.parse(ext.csn)
+        csn.extensions.push(...extCsn.extensions)
+        if (extCsn.definitions) csn.definitions = Object.assign(extCsn.definitions, csn.definitions)
+      })
+
+      return csn
+    })
+
+    this.invalidateCache = tenant => {
+      for (const key in this._nodejs_models) {
+        if (key.startsWith( `${tenant}:`)) {
+          delete this._nodejs_models[key]
+        }
+      }
+    }
+
+    // Conf vars required by getCsn ------------------------------------------
+    // eslint-disable-next-line one-var
+    const conf = cds.env.requires['cds.xt.ModelProviderService'] || cds.env.requires.kinds['cds.xt.ModelProviderService']
+    DEBUG && DEBUG ('ModelProviderService options:', conf)
+    const options = {}
+    if (conf.root) {
+      options.root = path.resolve (cds.root, conf.root)
+      options.env = cds.env.for('cds', options.root)
+      options.cache = {}
+    }
+    const fts = cds.env.features.folders
+    if (conf.kind !== 'in-sidecar') this._nodejs_models = {}
+
+    /** The implementation for getCsn */
+    async function _getCsn (req, checkExt, cache) {
+      const { toggles, for:javaornode } = req.data
+      const features = !toggles ? [] : toggles === '*' || toggles.includes('*') ? [fts] : toggles.map (f => fts.replace('*',f))
+      const isExtended = await _isExtended(req.data.tenant)
+      if (checkExt && !isExtended) req.reject(404, 'Missing extensions')
+      const hash = `${isExtended ? req.data.tenant : undefined}:${features.join(',')}`
+      if (javaornode && cache && cache[hash]) return cache[hash]
+
+      const models = cds.resolve(['*',...features], options)
+      if (!models) return
+
+      DEBUG && DEBUG ('loading models from', models)
+      let csn = await cds.load(models).then(cds.minify)
+      if (isExtended) csn = await _addExtensions(csn, req.data.tenant)
+      if (javaornode) csn = cds.compile.for[javaornode](csn)
+
+      // Dirty hack for cds.localize in Node sidecar setup
+      Object.defineProperty(csn,'$sources',{ value:csn.$sources, enumerable:true })
+
+      if (javaornode && cache) cache[hash] = csn
+
+      return csn
+    }
+
+    async function _getExtCsn (req, cache) {
+      if (!cds.requires.extensibility) return req.reject(400, 'Missing extensibility parameter')
+      return _getCsn (req, true, cache)
+    }   
+  }
+}
+
+
+const run4 = (t,q) => t ? cds.tx({tenant:t}, tx => tx.run(q)) : q
+
+/** Add extensions if applicable and exist */
+const _addExtensions = async (csn, tenant) => {  
+  const exts = await run4 (tenant, SELECT('csn').from('cds.xt.Extensions'))
+  if (!exts.length) return csn
+
+  const all = { definitions: {}, extensions: [] }
+  for (const each of exts) {
+    const ext = JSON.parse(each.csn)
+    if (ext.definitions) Object.assign(all.definitions, ext.definitions)
+    if (ext.extensions) all.extensions.push(...ext.extensions)
+  }
+  const extended = cds.compile({
+    'base.csn': cds.compile.to.json(csn),
+    'ext.csn': cds.compile.to.json(all)
+  })
+  extended.$sources = csn.$sources // required to load resources like i18n later on
+
+  return extended
+}
+
+async function _isExtended (tenant) {
+  if (!cds.requires.extensibility) return false
+  if (!tenant && cds.requires.multitenancy) return false
+  const one = await run4 (tenant, SELECT.one(1).from('cds.xt.Extensions'))
+  return !!one
+}

package/srv/mtx.cds

@@ -0,0 +1,2 @@
+/** Dummy service for bootstrapping MTX services */
+@protocol:'none' service cds.xt.MTXServices {}

package/srv/mtx.js

@@ -0,0 +1,22 @@
+const cds = require ('../lib')
+class MTXServices extends cds.Service { async init(){
+  if (cds.mtx) return cds.mtx?.in (cds.app) // old mtx
+  // else...
+  let sources = []
+  if (cds.requires.multitenancy) {
+    if (!('cds.xt.DeploymentService' in cds.requires)) {
+      sources.push('@sap/cds-mtxs/srv/deployment-service')
+      if (!('cds.xt.SaasProvisioningService' in cds.requires)) sources.push('@sap/cds-mtxs/srv/cf/saas-provisioning-service')
+    }
+  }
+  if (cds.requires.extensibility) {
+    if (!('cds.xt.ExtensibilityService' in cds.requires)) sources.push('@sap/cds/srv/extensibility-service')
+  }
+  if (cds.requires.toggles) {
+    if (!('cds.xt.ModelProviderService' in cds.requires)) sources.push('@sap/cds/srv/model-provider')
+  }
+  let models = cds.resolve(sources); if (!models) return
+  let base = cds.model.$sources; models = models.filter(m => !base.includes(m))
+  if (models.length) return cds.serve(models).in(cds.app)
+}}
+module.exports = MTXServices

package/srv/outbox.cds

@@ -8,4 +8,6 @@ entity Messages : cuid {
   msg: LargeString;
   attempts: Integer default 0;
   partition: Integer default 0;
+  lastError: LargeString;
+  lastAttemptTimestamp: Timestamp @cds.on.update : $now;
 }

package/tasks/enterprise-messaging-deploy.js

@@ -26,18 +26,25 @@ const oa2 = {
 const main = async () => {
   // use authorizedRequest to fire against deploy endpoint
   // (use credentials of XSUAA)
-  const { body } = await authorizedRequest({
-    method: 'POST',
-    uri: optionsApp.appURL,
-    path: '/messaging/enterprise-messaging/deploy',
-    dataObj: { tenants: ['all'] },
-    oa2,
-    attemptInfo: () => LOG._info && LOG.info('Deploy all tenants'),
-    errMsg: 'Deployment failed',
-    target: { kind: 'DEPLOYMENT' },
-    tokenStore
-  })
-  LOG._info && LOG.info('Deployment complete:', body)
+  LOG._info && LOG.info('Deploy all tenants')
+  try {
+    const { body } = await authorizedRequest({
+      method: 'POST',
+      uri: optionsApp.appURL,
+      path: '/messaging/enterprise-messaging/deploy',
+      dataObj: { tenants: ['all'] },
+      oa2,
+      tokenStore
+    })
+    LOG._info && LOG.info('Deployment complete:', body)
+  } catch (e) {
+    const error = new Error(`Deployment failed`)
+    error.code = 'DEPLOY_FAILED'
+    error.target = { kind: 'DEPLOYMENT' }
+    error.reason = e
+    this.LOG.error(error)
+    throw error
+  }
 }
 
 main()

package/lib/serve/Service-compat.js

@@ -1,36 +0,0 @@
-
-// Compatibility with srv.emit() used for sync events...
-
-const sync_events = {
-  CREATE: 1,
-  READ: 1,
-  UPDATE: 1,
-  DELETE: 1,
-  INSERT: 1,
-  GET: 1,
-  PUT: 1,
-  POST: 1,
-  PATCH: 1,
-  BEGIN: 1,
-  COMMIT: 1,
-  ROLLBACK: 1,
-}
-
-const sync_emit = (srv, req) => {
-  // eslint-disable-next-line no-console
-  console.trace(`\n
-    [Deprecated] - srv.emit() used to send synchronous '${req.event}' request.
-    Please change this to use srv.send() instead.
-  `)
-  return srv.dispatch(req)
-}
-
-const {cds} = global
-module.exports = function (event, data, headers) {
-  if (event instanceof cds.Request)
-    return sync_emit (this, event)
-  if (event in sync_events)
-    return sync_emit (this, new cds.Request({ event, data, headers }))
-  if ((typeof event === 'object' && event.query) || (event.event || event.method) in sync_events)
-    return sync_emit (this, new cds.Request(event))
-}

package/libx/_runtime/audit/generic/personal/constants.js

@@ -1,4 +0,0 @@
-module.exports = {
-  ASPECTS: { CREATE: '_auditCreate', READ: '_auditRead', UPDATE: '_auditUpdate', DELETE: '_auditDelete' },
-  WRITE: { CREATE: 1, UPDATE: 1, DELETE: 1 }
-}

package/libx/_runtime/auth/strategies/dwc.js

@@ -1,45 +0,0 @@
-const cds = require('../../cds')
-const LOG = cds.log()
-
-function decode(req, header, encoded) {
-  if (!req.headers[header]) return
-  if (encoded) return JSON.parse(Buffer.from(req.headers[header], 'base64').toString('utf-8'))
-  return req.headers[header]
-}
-
-class DwcStrategy {
-  constructor() {
-    this.name = 'dwc'
-  }
-
-  authenticate(req) {
-    let tenant, usr, scopes, attr
-
-    try {
-      tenant = decode(req, 'dwc-tenant')
-      usr = decode(req, 'dwc-user', true)
-      scopes = decode(req, 'dwc-scopes') || ''
-      attr = decode(req, 'dwc-xsuaa-attributes', true) || {}
-    } catch (e) {
-      LOG._debug && LOG.debug('Error while parsing HTTP headers for DWC authentication:', e)
-      return this.fail()
-    }
-
-    if (!tenant || !usr) return this.fail()
-
-    // make scopes app-local
-    const xsappname = decode(req, 'dwc-xsuaa-xsappname') || ''
-    scopes = scopes.split(' ').map(s => (s.startsWith(xsappname + '.') ? s.replace(xsappname + '.', '') : s))
-
-    const user = new cds.User({
-      id: usr.logonName,
-      tenant,
-      _roles: ['any', 'authenticated-user', ...scopes],
-      attr: Object.assign(attr, usr)
-    })
-
-    this.success(user)
-  }
-}
-
-module.exports = DwcStrategy

package/libx/_runtime/cds-services/adapter/odata-v4/utils/dispatcherUtils.js

@@ -1,56 +0,0 @@
-const cds = require('../../../../cds')
-const OData = require('../OData')
-const DEBUG = cds.debug('extensibility')
-
-const { alias2ref } = require('../../../../common/utils/csn')
-const { BASE_TENANT } = require('../../../../common/utils/extensibilityUtils')
-
-const SYSTEM_SERVICES = ['cds_r.ExtensibilityService', 'cds_r.ModelProviderService']
-
-function createOdataService(service) {
-  const name = (service.definition && service.definition.name) || service.name
-  const edm = cds.compile.to.edm(service.model, { service: name })
-  alias2ref(service, edm)
-
-  const odataService = new OData(edm, service.model, service.options)
-  odataService.addCDSServiceToChannel(service)
-
-  return odataService
-}
-
-async function createNewService(name, model, options) {
-  const { constructor: Service, path } = cds.services[name]
-  const service = new Service(name, model, { ...options }) // cloning options to be safe
-  if (service.init) await service.prepend(service.init)
-  if (options.impl) await service.prepend(options.impl)
-  if (path) service.path = path
-  DEBUG &&
-    DEBUG('Created tenant-specific service:', service.name, '= new', Service.name, {
-      _handlers: {
-        on: service._handlers.on.map(h => ({ on: h.on, handler: () => {} }))
-      }
-    })
-  return createOdataService(service)
-}
-
-const getModelHash = (tenant, features) => {
-  if (!features) features = []
-
-  let hash
-  if (cds.requires.multitenancy && tenant) {
-    hash = tenant
-  } else {
-    hash = BASE_TENANT
-  }
-
-  hash += ':' + features.join(';')
-
-  return hash
-}
-
-module.exports = {
-  SYSTEM_SERVICES,
-  createOdataService,
-  createNewService,
-  getModelHash
-}