@sap/cds 5.9.7 → 6.0.2

package/libx/_runtime/auth/strategies/mock.js

@@ -1,57 +1,14 @@
 const cds = require('../../cds')
-
 const CHALLENGE = 'Basic realm="Users"'
 
-const _getUser = (users, id) => {
-  let user
-
-  for (const k in users) {
-    if (k === id || users[k].ID === id) {
-      user = users[k]
-      break
-    }
-  }
-
-  if (!user && users['*']) user = { id }
-
-  return user
-}
-
-const _getRoles = user => {
-  const _roles = ['any', 'identified-user', 'authenticated-user']
-
-  if (user.roles) {
-    _roles.push(...user.roles)
-  }
-
-  if (user.jwt) {
-    const scopes = user.jwt.scope || user.jwt.scopes || []
-    const aud = user.jwt.aud || []
-    _roles.push(
-      ...scopes.map(s => {
-        for (const each of aud) {
-          s = s.replace(`${each}.`, '')
-        }
-        return s
-      })
-    )
-  }
-
-  if (user.jwt && (user.jwt.grant_type === 'client_credentials' || user.jwt.grant_type === 'client_x509')) {
-    _roles.push('system-user')
-  }
-
-  return _roles
-}
-
 class MockStrategy {
-  constructor(users, name = 'mock') {
+  constructor({ users, tenants }, name = 'mock') {
     this.name = name
-    this.users = users || cds.env.requires.auth.users || {}
+    this.users = _init_users(users || cds.env.requires.auth.users || {}, tenants)
   }
 
   authenticate(req) {
-    const authorization = req.headers.authorization
+    const { authorization } = req.headers
     if (!authorization) return this.fail(CHALLENGE)
 
     const [scheme, base64] = authorization.split(' ')
@@ -59,18 +16,62 @@ class MockStrategy {
     if (!base64) return this.fail(CHALLENGE)
 
     const [id, password] = Buffer.from(base64, 'base64').toString().split(':')
-
-    let user = _getUser(this.users, id)
+    const user = this.users[id] || ('*' in this.users && { id })
     if (!user) return this.fail(CHALLENGE)
     if (user.password && user.password !== password) return this.fail(CHALLENGE)
 
-    const _roles = _getRoles(user)
-    const attr = Object.assign({}, user.userAttributes, user.jwt && user.jwt.userInfo, user.jwt && user.jwt.attributes)
-    const tenant = user.tenant || (user.jwt && user.jwt.zid) || null
+    const { features } = req.headers
+    this.success(new cds.User(features ? { ...user, features } : user))
+  }
+}
 
-    user = new cds.User({ id: user.ID || id, _roles, attr, tenant })
-    this.success(user)
+// eslint-disable-next-line complexity
+const _init_users = (users, tenants = {}) => {
+  if (!users._initialized) {
+    Object.defineProperty(users, '_initialized', { value: true })
+    for (let [id, user] of Object.entries(users)) {
+      if (id !== '*') user.id = user.ID || user.id || id // fill in user ids
+      if (id !== user.id) users[user.id] = user
+      if (user.jwt) {
+        let scopes = user.jwt.scope || user.jwt.scopes
+        if (scopes) {
+          const aud = user.jwt.aud
+          if (aud)
+            scopes = scopes.map(s => {
+              for (const each of aud) s = s.replace(`${each}.`, '')
+              return s
+            })
+          Array.isArray(user.roles) ? user.roles.push(...scopes) : (user.roles = scopes)
+        }
+        if (user.jwt.grant_type === 'client_credentials' || user.jwt.grant_type === 'client_x509') {
+          user.roles.push('system-user')
+        }
+        if (!user.tenant && user.jwt.zid) user.tenant = user.jwt.zid
+      }
+
+      // optimization:
+      if (user.roles)
+        user.roles = user.roles.reduce((p, n) => {
+          p[n] = 1
+          return p
+        }, {})
+
+      // apply tenant info if any
+      if (!user.features) {
+        const features = tenants[user.tenant]?.features
+        if (features) user.features = features
+      }
+
+      const attr = Object.assign(
+        {},
+        user.userAttributes,
+        user.jwt && user.jwt.userInfo,
+        user.jwt && user.jwt.attributes
+      )
+      if (Object.keys(attr).length > 0) user.attr = attr
+    }
   }
+  return users
 }
 
 module.exports = MockStrategy

package/libx/_runtime/auth/strategies/xssecUtils.js

@@ -25,10 +25,9 @@ const getRoles = (roles, info, credentials) => {
 
   if (info && info.checkLocalScope && typeof info.checkLocalScope === 'function') {
     // > xssec v3
-    const _roles = roles
-    roles = new Proxy(_roles, {
-      get: function (_, role) {
-        return role in _roles ? _roles[role] : info.checkLocalScope(role)
+    roles = new Proxy(roles, {
+      get: function (t, role) {
+        return role in t ? t[role] : info.checkLocalScope(role)
       }
     })
   }

package/libx/_runtime/auth/strategies/xsuaa.js

@@ -22,10 +22,11 @@ class XSUAAStrategy extends JS {
       // create cds.User
       user = new cds.User({
         id: xssecUtils.getUserId(user, info),
-        tenant: xssecUtils.getTenant(info) || null,
-        _roles: xssecUtils.getRoles(['any', 'identified-user'], info, credentials),
+        roles: xssecUtils.getRoles(['any', 'identified-user'], info, credentials),
         attr: xssecUtils.getAttrForXSSEC(info)
       })
+      const tenant = xssecUtils.getTenant(info)
+      if (tenant) user.tenant = tenant
       // call "super.success"
       _success(user, info)
     }

package/libx/_runtime/auth/utils.js

@@ -1,25 +1,12 @@
-const cds = require('../cds')
-
 const UNAUTHORIZED = { statusCode: 401, code: '401', message: 'Unauthorized' }
 const FORBIDDEN = { statusCode: 403, code: '403', message: 'Forbidden' }
 
 const getRequiresAsArray = definition => {
-  const requires = []
-
-  if (definition['@requires']) {
-    if (Array.isArray(definition['@requires'])) requires.push(...definition['@requires'])
-    else requires.push(definition['@requires'])
-  }
-
-  const { restrict_all_services: restrictAllServices } = cds.env.requires.auth || {}
-  if (!requires.length && definition.kind === 'service' && restrictAllServices) requires.push('authenticated-user')
-
-  return requires
+  const requires = definition['@requires']
+  if (requires) return Array.isArray(requires) ? requires : [requires]
 }
 
 const isRestricted = srv => {
-  const envAuth = cds.env.requires.auth
-  if (envAuth && envAuth.restrict_all_services) return true
   if (srv.definition['@requires']) return true
 
   const entities = srv.entities

package/libx/_runtime/cds-services/adapter/odata-v4/Dispatcher.js

@@ -1,12 +1,13 @@
 const cds = require('../../../cds')
 const LOG = cds.log('odata')
-const { BASE_TENANT, channelName } = require('../../../common/utils/extensibilityUtils')
-
-const { SYSTEM_SERVICES, createOdataService, createNewService, getModelHash } = require('./utils/dispatcherUtils')
 
 const { normalizeError } = require('../../../common/error/frontend')
 
-class Dispatcher {
+const _run4 = (tenant, query) => (tenant ? cds.tx({ tenant }, tx => tx.run(query)) : query)
+const getError = require('../../../common/error')
+
+// REVISIT: this is always active, even without mtx -> do that better
+module.exports = class Dispatcher {
   /**
    * Constructs an Dispatcher for cds service.
    * New OData services will be created.
@@ -18,24 +19,43 @@ class Dispatcher {
     this._options = service.options
 
     this._extMap = new Map()
-    this._extMap.set(getModelHash(BASE_TENANT, []), createOdataService(service))
-
-    if (cds.requires.extensibility && !SYSTEM_SERVICES.includes(this._serviceName)) {
-      cds.services['mtx-messaging'].on(channelName(), async msg => {
-        const tenant = msg.data.tenant
-        const hash = getModelHash(tenant, [])
-        for (const entry of this._extMap.entries()) {
-          if (entry[0].startsWith(hash)) {
-            this._extMap.delete(entry[0])
-          }
-        }
+    this._extMap.set(getModelHash(), createOdataService(service))
+    this._intervalMap = new Map()
+    this._intervalMap.set(undefined, Date.now())
+
+    if (cds.mtx) {
+      cds.mtx._nodejs_models = {}
+      cds.mtx.eventEmitter.on(cds.mtx.events.TENANT_UPDATED, async tenant => {
+        this._extMap.delete(getModelHash(tenant))
+        delete cds.mtx._nodejs_models[tenant]
       })
     }
 
-    if (cds._mtxEnabled) {
-      cds.mtx.eventEmitter.on(cds.mtx.events.TENANT_UPDATED, async hash => {
-        this._extMap.delete(hash)
-      })
+    this._tenantCheckInterval = cds.requires.extensibility && cds.requires.extensibility.tenantCheckInterval
+  }
+
+  _deleteService(tenant) {
+    const hash = getModelHash(tenant)
+    for (const entry of this._extMap.entries()) {
+      if (entry[0].startsWith(hash)) {
+        this._extMap.delete(entry[0])
+      }
+    }
+    this._intervalMap.delete(tenant)
+  }
+
+  async _checkTenantExt(tenant, last) {
+    try {
+      const rs = await _run4(tenant, SELECT(1).from('cds.xt.Extensions').where('timestamp >=', last))
+      if (!this._mps) this._mps = await cds.connect.to('cds.xt.ModelProviderService')
+      if (rs.length) {
+        this._deleteService(tenant)
+        this._mps.invalidateCache(tenant)
+      } else {
+        this._intervalMap.set(tenant, Date.now())
+      }
+    } catch (_) {
+      this._deleteService(tenant)
     }
   }
 
@@ -45,42 +65,46 @@ class Dispatcher {
     const isExtended = await cds.mtx.isExtended(tenant) // REVISIT: avoid await
     if (!isExtended) return false
 
-    const csn = await cds.mtx.getCsn(tenant)
-    const model = cds.compile.for.nodejs(csn)
+    let model = cds.mtx._nodejs_models[tenant]
+    if (!model) {
+      const raw = await cds.mtx.getCsn(tenant)
+      model = cds.mtx._nodejs_models[tenant] = cds.compile.for.nodejs(raw)
+    }
+
     const service = await createNewService(this._serviceName, model, this._options)
     service._cdsService._isExtended = true
     return service
   }
 
   async _getService4(tenant, features) {
-    const csn = await this._mps.getCsn(tenant, features || [], 'nodejs')
-    const model = cds.compile.for.nodejs(csn)
+    const model = await this._mps.getCsn(tenant, features || [], 'nodejs')
     return createNewService(this._serviceName, model, this._options)
   }
 
   async _getService(tenant, features, hash, req) {
-    if (cds._mtxEnabled) {
+    if (cds.mtx) {
       const service = await this._getService4Tenant(req)
 
       if (service) return service
 
-      return this._extMap.get(getModelHash(BASE_TENANT, []))
+      return this._extMap.get(getModelHash())
     }
 
-    if (!this._mps) this._mps = await cds.connect.to('cds_r.ModelProviderService')
-    const hashBase = getModelHash(BASE_TENANT, features)
-    if (tenant && tenant !== BASE_TENANT && hash !== hashBase) {
+    if (!this._mps) this._mps = await cds.connect.to('cds.xt.ModelProviderService')
+    const hashBase = getModelHash(undefined, features)
+    if (tenant && tenant !== undefined && hash !== hashBase) {
       const isExtended = cds.requires.extensibility && (await this._mps.isExtended(tenant))
       if (isExtended) {
         return this._getService4(tenant, features)
       } else {
         if (!this._extMap.has(hashBase)) {
-          this._extMap.set(hashBase, this._getService4(BASE_TENANT, features))
+          this._extMap.set(hashBase, this._getService4(undefined, features))
+          this._intervalMap.set(tenant, Date.now())
         }
         return this._extMap.get(hashBase)
       }
     } else {
-      return this._getService4(BASE_TENANT, features)
+      return this._getService4(undefined, features)
     }
   }
 
@@ -92,11 +116,16 @@ class Dispatcher {
     // clear map entry
     this._extMap.delete(hash)
     // return 503 to client
-    const { error } = normalizeError(Object.assign(err, { statusCode: 503 }), req)
+    err = getError(Object.assign(err, { statusCode: 503 }))
+    const { error } = normalizeError(err, req)
 
     return res.status(503).send({ error })
   }
 
+  _hasModelProvider() {
+    return 'cds.xt.ModelProviderService' in cds.services || 'cds.xt.ModelProviderService' in cds.requires
+  }
+
   /**
    * Dispatch request in case of extensibility to other odata adapters.
    *
@@ -107,26 +136,34 @@ class Dispatcher {
    */
   async dispatch(req, res) {
     // here, req is express' req -> req.tenant not available
+    // REVISIT: rethink authentication
     const tenant = req.user && req.user.tenant
 
-    if (SYSTEM_SERVICES.includes(this._serviceName) || (!tenant && !cds._mpsEnabled)) {
-      const service = this._extMap.get(getModelHash(BASE_TENANT, []))
+    // single tenant w/o features
+    if (!cds.mtx && !this._hasModelProvider()) {
+      const service = this._extMap.get(getModelHash())
       return service.process(req, res)
     }
 
-    // ensure features is an array (some stakeholders set req.features themselves)
-    const features = req.features
-      ? Array.isArray(req.features)
-        ? req.features
-        : Object.keys(req.features)
-            .filter(k => req.features[k])
-            .sort()
-      : []
+    // old mtx does not support feature toggles
+    const features = cds.mtx ? [] : _features4(req.features || req.user.features)
     const hash = getModelHash(tenant, features)
 
+    // check for extensions
+    if (cds.requires.extensibility && !this._inCheckTenant) {
+      this._inCheckTenant = true
+      if (this._intervalMap.has(tenant)) {
+        const last = this._intervalMap.get(tenant)
+        if (Date.now() - last > this._tenantCheckInterval)
+          await this._checkTenantExt(tenant, new Date(last).toISOString())
+      }
+      this._inCheckTenant = false
+    }
+
     // set promise into the map to avoid conflicts
     if (!this._extMap.has(hash)) {
       this._extMap.set(hash, this._getService(tenant, features, hash, req))
+      this._intervalMap.set(tenant, Date.now())
     }
 
     let service
@@ -151,4 +188,53 @@ class Dispatcher {
   }
 }
 
-module.exports = Dispatcher
+// -----------------------------------------------------
+// Private utils...
+
+const OData = require('./OData')
+const DEBUG = cds.debug('extensibility')
+
+const { alias2ref } = require('../../../common/utils/csn')
+
+function createOdataService(service) {
+  const name = (service.definition && service.definition.name) || service.name
+  const edm = cds.compile.to.edm(service.model, { service: name })
+  alias2ref(service, edm)
+
+  const odataService = new OData(edm, service.model, service.options)
+  odataService.addCDSServiceToChannel(service)
+
+  return odataService
+}
+
+async function createNewService(name, model, options) {
+  const { constructor: Service, path } = cds.services[name]
+  const service = new Service(name, model, { ...options }) // cloning options to be safe
+  if (service.init) await service.prepend(service.init)
+  if (options.impl) await service.prepend(options.impl)
+  if (path) service.path = path
+  DEBUG &&
+    DEBUG('Created tenant-specific service:', service.name, '= new', Service.name, {
+      _handlers: {
+        on: service._handlers.on.map(h => ({ on: h.on, handler: () => {} }))
+      }
+    })
+  return createOdataService(service)
+}
+
+const getModelHash = (tenant, features) => {
+  // ignore tenant in single tenant mode - use default (undefined) hash
+  const hash = cds.requires.multitenancy ? `${tenant}:` : 'undefined:'
+  return !features ? hash : hash + features.join(';')
+}
+
+const _features4 = features => {
+  // ensure features is an array
+  if (!features) return []
+  if (Array.isArray(features)) return features
+  if (typeof features === 'string') return features.split(',')
+  if (typeof features === 'object')
+    return Object.keys(features)
+      .filter(k => features[k])
+      .sort()
+}

package/libx/_runtime/cds-services/adapter/odata-v4/OData.js

@@ -27,7 +27,6 @@ const _delete = require('./handlers/delete')
 const _read = require('./handlers/read')
 const _action = require('./handlers/action')
 const { normalizeError, isClientError } = require('../../../common/error/frontend')
-
 const { getErrorMessage } = require('../../../common/error/utils')
 
 function _log(level, arg) {
@@ -51,7 +50,6 @@ function _log(level, arg) {
     // reduce 4xx to warning
     if (isClientError(obj)) {
       if (!LOG._warn) {
-        // restore
         return
       }
       level = 'warn'
@@ -264,8 +262,13 @@ class OData {
 
     // this._startPerfMeasurementOData(req)
     this._odataService.process(req, res).catch(err => {
+      LOG.warn(err)
       // REVISIT: use i18n
-      res.status(500).send({ error: { code: 'null', message: err.message } })
+      //do not reply with error, if response already processed (streaming)
+      if (!res.headersSent) {
+        const { error, statusCode } = normalizeError(err, req)
+        res.status(statusCode).send({ error })
+      }
     })
   }
 }

package/libx/_runtime/cds-services/adapter/odata-v4/ODataRequest.js

@@ -11,11 +11,10 @@ const {
 } = require('./okra/odata-server')
 
 const { findCsnTargetFor } = require('../../../common/utils/csn')
-
+const metaInfo = require('./utils/metaInfo')
 const odataToCQN = require('./odata-to-cqn')
 const { getData, getParams } = require('./utils/data')
 const { isCustomOperation } = require('./utils/request')
-const { flattenDeepToOneAssociations } = require('../../services/utils/handlerUtils')
 
 function _isCorrectCallToViewWithParams(csdlStructuredType) {
   return (
@@ -55,6 +54,12 @@ function _getTarget(service, segments) {
   return _getTarget(service, segments)
 }
 
+function _add4Odata(query) {
+  if (Array.isArray(query))
+    for (let i = 0; i < query.length; i++) Object.defineProperty(query[i].SELECT, '_4odata', { value: true })
+  else Object.defineProperty(query.SELECT, '_4odata', { value: true })
+}
+
 /**
  * Class representing an OData request.
  * @extends cds.Request
@@ -71,86 +76,101 @@ class ODataRequest extends cds.Request {
       : odataReq.getIncomingRequest()
     const res = req.res
 
-    /*
-     * target
-     */
-    const target = _getTarget(service, [...odataReq.getUriInfo().getPathSegments()])
-
-    /*
-     * data
-     */
-    const data = getData(type, odataReq, service, target)
-
-    /*
-     * query
-     */
-    const operation = isCustomOperation(odataReq.getUriInfo().getPathSegments())
-      ? odataReq.getUriInfo().getLastSegment().getKind()
-      : type
-    const query = odataToCQN(operation, service, target, data, odataReq, upsert)
-
-    /*
-     * event
-     */
-    let event = type
+    if (cds.env.features.odata_new_parser) {
+      // REVISIT need to resolve target after replacing okra <= maybe just take one from afterburner?
+      const target = _getTarget(service, [...odataReq.getUriInfo().getPathSegments()])
+      // REVISIT payload after replacing okra
+      const data = getData(type, odataReq, service, target)
+      const query = odataToCQN(type, service, target, data, odataReq, upsert)
+      const headers = Object.assign({}, req.headers, odataReq.getHeaders())
+      // REVISIT needed in case of $batch, replace after removing okra
+      const method = odataReq.getIncomingRequest().method
+      const { user } = req
+      const info = metaInfo(query, type, service, data, req, upsert)
+      const { event, unbound } = info
+      if (event === 'READ') _add4Odata(query)
+      const _queryOptions = odataReq.getQueryOptions()
+      super({ event, target, data, query: unbound ? {} : query, user, method, headers, req, res, _queryOptions })
+      this._metaInfo = info.metadata
+    } else {
+      /*
+       * target
+       */
+      const target = _getTarget(service, [...odataReq.getUriInfo().getPathSegments()])
+
+      /*
+       * data
+       */
+      const data = getData(type, odataReq, service, target)
+
+      /*
+       * query
+       */
+      const operation = isCustomOperation(odataReq.getUriInfo().getPathSegments())
+        ? odataReq.getUriInfo().getLastSegment().getKind()
+        : type
+      const query = odataToCQN(operation, service, target, data, odataReq, upsert)
+
+      /*
+       * event
+       */
+      let event = type
+
+      // actions & functions
+      const uriInfoLastSegment = odataReq.getUriInfo().getLastSegment()
+
+      switch (uriInfoLastSegment && uriInfoLastSegment.getKind()) {
+        case 'BOUND.ACTION':
+          event = uriInfoLastSegment.getAction().getName()
+          break
+
+        case 'ACTION.IMPORT':
+          event = uriInfoLastSegment.getActionImport().getName()
+          break
+
+        case 'BOUND.FUNCTION':
+          event = uriInfoLastSegment.getFunction().getName()
+          break
+
+        case 'FUNCTION.IMPORT':
+          event = uriInfoLastSegment.getFunctionImport().getName()
+          break
+
+        // no default
+      }
 
-    // actions & functions
-    const uriInfoLastSegment = odataReq.getUriInfo().getLastSegment()
+      // draft
+      if (target && target._isDraftEnabled) {
+        if (type === 'CREATE') event = 'NEW'
+        else if (event === 'draftEdit') event = 'EDIT'
+        else if (type === 'UPDATE') event = 'PATCH'
+        else if (type === 'DELETE' && data.IsActiveEntity !== true) event = 'CANCEL'
+      }
 
-    switch (uriInfoLastSegment && uriInfoLastSegment.getKind()) {
-      case 'BOUND.ACTION':
-        event = uriInfoLastSegment.getAction().getName()
-        break
+      // mark query as for an OData READ
+      if (event === 'READ') Object.defineProperty(query.SELECT, '_4odata', { value: true })
 
-      case 'ACTION.IMPORT':
-        event = uriInfoLastSegment.getActionImport().getName()
-        break
+      /*
+       * method, headers
+       */
+      const method = odataReq.getMethod()
 
-      case 'BOUND.FUNCTION':
-        event = uriInfoLastSegment.getFunction().getName()
-        break
+      // REVISIT: Why do we mix headers of $batch and batched request headers??
+      const headers = Object.assign({}, req.headers, odataReq.getHeaders())
 
-      case 'FUNCTION.IMPORT':
-        event = uriInfoLastSegment.getFunctionImport().getName()
-        break
+      /*
+       * super
+       */
+      const { user } = req
 
-      // no default
-    }
+      // REVISIT: _model should not be necessary
+      const _model = service.model
 
-    // draft
-    if (target && target._isDraftEnabled) {
-      if (type === 'CREATE') event = 'NEW'
-      else if (event === 'draftEdit') event = 'EDIT'
-      else if (type === 'UPDATE') event = 'PATCH'
-      else if (type === 'DELETE' && data.IsActiveEntity !== 'true') event = 'CANCEL'
+      // REVISIT: public API for query options (express style req.query already in use)?
+      const _queryOptions = odataReq.getQueryOptions()
+      super({ event, target, data, query, user, method, headers, req, res, _model, _queryOptions })
     }
 
-    // mark query as for an OData READ
-    if (event === 'READ') Object.defineProperty(query.SELECT, '_4odata', { value: true })
-
-    /*
-     * method, headers
-     */
-    const method = odataReq.getMethod()
-
-    // REVISIT: Why do we mix headers of $batch and batched request headers??
-    const headers = Object.assign({}, req.headers, odataReq.getHeaders())
-
-    /*
-     * super
-     */
-    const { user } = req
-
-    // REVISIT: _model should not be necessary
-    const _model = service.model
-
-    // REVISIT: public API for query options (express style req.query already in use)?
-    const _queryOptions = odataReq.getQueryOptions()
-    super({ event, target, data, query, user, method, headers, req, res, _model, _queryOptions })
-
-    // REVISIT: validate associations for deep insert
-    flattenDeepToOneAssociations(this, this.model)
-
     /*
      * req.run
      */