@sap/cds 6.2.3 → 6.3.0

package/CHANGELOG.md

@@ -4,6 +4,52 @@
 - The format is based on [Keep a Changelog](http://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](http://semver.org/).
 
+## Version 6.3.0 - 2022-10-28
+
+### Added
+
+- Additional type signatures for service methods in the query API
+- In case of error in a batch request, the @Core.ContentID is added to the details of the error message
+- Extensibility: Use i18n files from extensions in edmx calculation
+- In messaging, you can listen to all messages in a queue by subscribing to `'*'`
+- Improved Log formatting for Cloud Foundry
+- In remote services: Correct OData type conversion when using an imported csn
+- Types for `SELECT.forUpdate({wait})`
+
+- `cds.ql` now provides a dedicated method `.alias()` to choose table aliases, e.g.:
+  ```js
+  SELECT.from(Authors).alias(a)
+  ```
+  > Note: unfortunately we can't use method `.as()` instead of `.alias()` for compatibility reasons
+
+- `cds.ql` now supports constructing queries with `where exists` clauses, e.g.:
+  ```js
+  SELECT.from(Authors).where({exists:'books'})
+  SELECT.from(Authors).where({'not exists':'books'})
+  SELECT.from(Authors).alias('a').where({ exists: // or 'not exists'
+    SELECT.from(Books).where({author_ID:{ref:['a','ID']}})
+  })
+  ```
+  > Note: last query is equivalent to first
+- `cds compile` and `cds deploy` now also support dialect `h2`
+- New (easier) `jwt` and `xsuaa` authentication middleware for pluggable middlewares
+
+### Changed
+
+- In `enterprise-messaging`, emitting CloudEvents messages sets the HTTP header `Content-Type: application/cloudevents+json`
+
+### Fixed
+
+- Change signature of cqn `SELECT.limit.offset` and `SELECT.limit.rows` to `val` instead of `number`
+- Parsing of store procedure SQL calls including the schema name. For example, `CALL "SCHEMA"."PROC"(?)` and `CALL SCHEMA.PROC(?)`
+- Add property name in the error message on validation of the value
+- Kibana and Cloud Foundry formatter: do not log cookie header value
+- Missing SQL aliases for `$search` queries combined with `$orderBy` query option
+- The return value of `cds.connect` is now correctly typed as a `Promise`
+- `req.data` is no longer modified for remote services in the case of `odata-v2` inserts
+- `cds.localize` no longer ignores i18n files defined within CDS model scope and outside project scope
+- Don't modify query in `fioriGenericRead` handler
+
 ## Version 6.2.3 - 2022-10-21
 
 ### Fixed
@@ -88,6 +134,8 @@
 - `cds deploy` and `cds run/serve/watch` no longer print terminal escape sequences (`x1b...`) if they run non-interactively.
 - Some fields in entities like `path` generated invalid sql
 
+### Removed
+
 ## Version 6.1.3 - 2022-09-13
 
 ### Added

package/apis/connect.d.ts

@@ -15,7 +15,7 @@ declare class cds {
 		 * Connects the primary datasource.
 		 * @see [capire](https://cap.cloud.sap/docs/node.js/api#cds-connect)
 		 */
-		(options?: string | ConnectOptions) : typeof cds  //> cds.connect(<options>)
+		(options?: string | ConnectOptions) : Promise<typeof cds>  //> cds.connect(<options>)
 	}
 
 	/**

package/apis/cqn.d.ts

@@ -11,7 +11,7 @@ export type SELECT = {SELECT:{
 	having? : predicate
 	groupBy? : expr[]
 	orderBy? : ordering_term[]
-	limit?: { rows:number, offset:number }
+	limit?: { rows:val, offset:val }
 }}
 
 export type INSERT = {INSERT:{

package/apis/internal/inference.d.ts

@@ -0,0 +1,14 @@
+// Types in this file are not part of the API.
+// They are merely meant as definitions that are used
+// in several places within the API.
+
+// any class (not value) of array to represent plural types used in cds-typer.
+// Mainly used as pattern match for SingularType
+//type ArrayConstructable = Constructable<Array<unknown>>
+export interface ArrayConstructable<T = any[]> {
+	new(...args: any[]): T[]
+}
+
+// concrete singular type.
+// `SingularType<Books>` == `Book`.
+export type SingularType<T extends ArrayConstructable<T>> = InstanceType<T>[number]

package/apis/ql.d.ts

@@ -1,5 +1,6 @@
 import {Definition} from "./csn"
 import * as CQN from "./cqn"
+import { ArrayConstructable, SingularType } from "./internal/inference"
 
 export type Query = CQN.Query
 
@@ -12,7 +13,7 @@ interface Constructable<T> {
 }
 
 export class cds_ql {
-	ql:QL & ((context:object) => QL)
+	ql:QL<any> & ((context:object) => QL<any>)
 }
 
 export type PK = number | string | object
@@ -48,25 +49,14 @@ type Proxy_<T> =  {
 	get: (path: string) => any // Proxy<unknown>
 } & QLExtensions
 
-type Proxy<T> = (T extends Subqueryable<infer U>
+export type Proxy<T> = (T extends Subqueryable<infer U>
 		? (Omit<T, ""> & Subqueryable<Proxy<U>>) // drop ((x: T) => T) in favour of (x: Proxy<T>) => Proxy<T>)
 		: (Proxy_<T>))
 	& QLExtensions
 
-// any class (not value) of array to represent plural types used in cds-typer.
-// Mainly used as pattern match for SingularType
-//type ArrayConstructable = Constructable<Array<unknown>>
-interface ArrayConstructable<T> {
-	new(...args: any[]): T
-}
-
-// concrete singular type.
-// `SingularType<Books>` == `Book`.
-type SingularType<T extends ArrayConstructable<T>> = InstanceType<T>[number]
-
 // Alias for projections
 // https://cap.cloud.sap/docs/node.js/cds-ql?q=projection#projection-functions
-type Projection<T> = (e:T)=>void
+export type Projection<T> = (e:T)=>void
 
 // Type for query pieces that can either be chained to build more complex queries or
 // awaited to materialise the result:
@@ -80,7 +70,7 @@ type Projection<T> = (e:T)=>void
 // `Awaitable<T> = T extends unknown<infer I> ? (T & Promise<I>) : never`
 // (at the time of writing, infering the first generic parameter of ANY type
 // does not seem to be possible.)
-type Awaitable<T, I> = T & Promise<I>
+export type Awaitable<T, I> = T & Promise<I>
 
 // all the functionality of an instance of SELECT, but directly callable:
 // new SELECT(...).(...) == SELECT(...)
@@ -91,7 +81,7 @@ export type StaticSELECT<T> = typeof SELECT
 	& SELECT_one // as it is not directly quantified, ...
 	& SELECT_from // ...we should expect both a scalar and a list
 
-declare class QL {
+declare class QL<T> {
 	SELECT : StaticSELECT<T>
 	INSERT : typeof INSERT 
 		& ((...entries:object[]) => INSERT<any>) & ((entries:object[]) => INSERT<any>)
@@ -107,7 +97,7 @@ declare class QL {
 // when run in strict mode.
 // This signature has to be added to a method as intersection type.
 // Defining overloads with it will override preceding signatures and the other way around.
-type TaggedTemplateQueryPart<T> = (strings: TemplateStringsArray, ...params?: unknown[]) => T
+type TaggedTemplateQueryPart<T> = (strings: TemplateStringsArray, ...params: unknown[]) => T
 
 export class SELECT<T> extends ConstructedQuery {
 	static one : SELECT_one & { from: SELECT_one }
@@ -134,19 +124,32 @@ export class SELECT<T> extends ConstructedQuery {
 		& ((...expr : string[]) => this)
 	limit: TaggedTemplateQueryPart<this>
 		& ((rows : number, offset? : number) => this)
-	forSharedLock () : this
-	forUpdate () : this
+	forShareLock () : this
+	forUpdate ({wait}? : {wait?: number}) : this
+
+// Not yet public
+	// fullJoin (other: string, as: string) : this
+	// leftJoin (other: string, as: string) : this
+  // 	rightJoin (other: string, as: string) : this
+  // 	innerJoin (other: string, as: string) : this
+  // 	join (other: string, as: string, kind?: string) : this
+	// on : TaggedTemplateQueryPart<this>
+	//   & ((...expr : string[]) => this)
+	//   & ((predicate:object) => this)
+
 	SELECT : CQN.SELECT
 }
 
 
 type SELECT_one =
+TaggedTemplateQueryPart<Awaitable<SELECT<unknown>, InstanceType<any>>>
+&
 // calling with class
-	(<T extends ArrayConstructable>
+	(<T extends ArrayConstructable<any>>
 	(entityType: T, projection?: Projection<Proxy<SingularType<T>>>)
 	=> Awaitable<SELECT<SingularType<T>>, SingularType<T>>)
 &
-	(<T extends ArrayConstructable>
+	(<T extends ArrayConstructable<any>>
 	(entityType: T, primaryKey : PK, projection?: Projection<Proxy<SingularType<T>>>)
 	=> Awaitable<SELECT<SingularType<T>>, SingularType<T>>)
 
@@ -158,14 +161,14 @@ type SELECT_one =
 
 type SELECT_from =
 // tagged template
-	TaggedTemplateQueryPart<Awaitable<SELECT<unknown>, InstanceType<unknown>>>
+	TaggedTemplateQueryPart<Awaitable<SELECT<unknown>, InstanceType<any>>>
 &
 // calling with class
-	(<T extends ArrayConstructable>
+	(<T extends ArrayConstructable<any>>
 	(entityType: T, projection?: Projection<Proxy<SingularType<T>>>)
 	=> Awaitable<SELECT<T>, InstanceType<T>>)
 &
-	(<T extends ArrayConstructable>
+	(<T extends ArrayConstructable<any>>
 	(entityType: T, primaryKey : PK, projection?: Projection<SingularType<T>>)
 	=> Awaitable<SELECT<T>, InstanceType<T>>)
 // calling with definition
@@ -176,16 +179,15 @@ type SELECT_from =
 
 
 export class INSERT<T> extends ConstructedQuery {
-	// cds-typer plural
-	static into <T extends ArrayConstructable> (entity:T, entries? : object | object[]) : INSERT<SingularType<T>>
-	into <T extends ArrayConstructable> (entity:T) : this
-
-	static into: TaggedTemplateQueryPart<INSERT<T>>
-	static into  (entity : Definition | string, entries? : object | object[]) : INSERT<any>
-	static into <T> (entity:Constructable<T>, entries? : object | object[]) : INSERT<T>
-	static into <T> (entity:T, entries? : T | object | object[]) : INSERT<T>
-	into: TaggedTemplateQueryPart<this>
-	into  (entity : Definition | string) : this
+	static into : (<T extends ArrayConstructable<any>> (entity:T, entries? : object | object[]) => INSERT<SingularType<T>>)
+		& (TaggedTemplateQueryPart<INSERT<unknown>>)
+		& ((entity : Definition | string, entries? : object | object[]) => INSERT<any>)
+		& (<T> (entity:Constructable<T>, entries? : object | object[]) => INSERT<T>)
+		& (<T> (entity:T, entries? : T | object | object[]) => INSERT<T>)
+	
+	into: (<T extends ArrayConstructable> (entity:T) => this) 
+		& TaggedTemplateQueryPart<this> 
+		& ((entity : Definition | string) => this)
 	data (block : (e:T)=>void) : this
 	entries (...entries : object[]) : this
 	columns (...col: string[]) : this
@@ -195,7 +197,9 @@ export class INSERT<T> extends ConstructedQuery {
 }
 
 export class DELETE<T> extends ConstructedQuery {
-	static from (entity : Definition | string | ArrayConstructable, primaryKey? : PK) : DELETE<any>
+	static from:
+		TaggedTemplateQueryPart<Awaitable<SELECT<unknown>, InstanceType<any>>>
+	 	& ((entity : Definition | string | ArrayConstructable, primaryKey? : PK) => DELETE<any>)
 	byKey (primaryKey? : PK) : this
 	where (predicate:object) : this
 	where (...expr : any[]) : this
@@ -206,7 +210,7 @@ export class DELETE<T> extends ConstructedQuery {
 
 export class UPDATE<T> extends ConstructedQuery {
 	// cds-typer plural
-	static entity <T extends ArrayConstructable> (entity:T, primaryKey? : PK) : UPDATE<SingularType<T>>
+	static entity <T extends ArrayConstructable<any>> (entity:T, primaryKey? : PK) : UPDATE<SingularType<T>>
 
 	static entity (entity : Definition | string, primaryKey? : PK) : UPDATE<any>
 	static entity <T> (entity:Constructable<T>, primaryKey? : PK) : UPDATE<T>

package/apis/services.d.ts

@@ -1,34 +1,50 @@
 import { SELECT, INSERT, UPDATE, DELETE, Query, ConstructedQuery } from './ql'
+import {  Projection, Proxy,  Awaitable } from './ql'
+import { SingularType, ArrayConstructable } from './internal/inference'
 import { LinkedModel, Definition, Definitions } from './reflect'
 import { csn, type } from "./csn"
 // import { Service } from './cds'
 
-
 export class QueryAPI {
 
 	/**
 	 * @see [docs](https://cap.cloud.sap/docs/node.js/services#srv-run)
 	 */
-	read <T>(entity : Definition | string, key?: any) : SELECT<T>
+	read: {
+		<T extends ArrayConstructable<any>>(entity : T, key?: any) : Awaitable<SELECT<T>, InstanceType<T>>
+		<T>(entity : Definition | string, key?: any) : SELECT<T>
+	}
 
 	/**
 	 * @see [docs](https://cap.cloud.sap/docs/node.js/services#srv-run)
 	 */
-	create <T>(entity : Definition | string, key?: any) : INSERT<T>
+	create: {
+		<T extends ArrayConstructable<any>>(entity : T, key?: any) : INSERT<T>
+		<T>(entity : Definition | string, key?: any) : INSERT<T>
+	} 
 
 	/**
 	 * @see [docs](https://cap.cloud.sap/docs/node.js/services#srv-run)
 	 */
-	insert <T>(data : object | object[]) : INSERT<T>
+	insert: {
+		<T extends ArrayConstructable<any>>(data : T) : INSERT<T>
+		<T>(data : object | object[]) : INSERT<T>
+	} 
 
 	/**
 	 * @see [docs](https://cap.cloud.sap/docs/node.js/services#srv-run)
 	 */
-	update <T>(entity : Definition | string, key?: any) : UPDATE<T>
+	update: {
+		<T extends ArrayConstructable<any>>(entity : T, key?: any) : UPDATE<T>
+		<T>(entity : Definition | string, key?: any) : UPDATE<T>
+	} 
 
 	/**
 	 * @see [docs](https://cap.cloud.sap/docs/node.js/services#srv-run)
 	 */
+	// as delete is the only one of the CRUD methods from QueryAPI
+	// that is extended in Service, we have to add the second signature down there
+	// (TS error 2425)
 	delete <T>(entity : Definition | string, key?: any) : DELETE<T>
 
 	/**
@@ -44,7 +60,7 @@ export class QueryAPI {
 	/**
 	 * @see [docs](https://cap.cloud.sap/docs/node.js/services#srv-run-sql)
 	 */
-	 run (query : string, args? : any[]|object) : Promise<ResultSet | any>
+	run (query : string, args? : any[]|object) : Promise<ResultSet | any>
 
 	 /**
 	 * @see [docs](https://cap.cloud.sap/docs/node.js/services#srv-run)
@@ -184,6 +200,7 @@ export class Service extends QueryAPI {
 	/**
 	 * @see [docs](https://cap.cloud.sap/docs/node.js/services#srv-run)
 	 */
+	delete <T extends ArrayConstructable<any>>(entity : T, key?: any): DELETE<T>
 	delete <T>(entity : Definition | string, key?: any) : DELETE<T>
 
 	 // The central method to dispatch events

package/bin/build/buildTaskHandler.js

@@ -117,7 +117,7 @@ class BuildTaskHandler {
                         // relative to build task's destination path
                         dest = path.resolve(this.task.dest, dest)
                     }
-                    this._pushFile(dest)
+                    this.pushFile(dest)
                     if (this._hasBuildOption(BUILD_OPTION_OUTPUT_MODE, OUTPUT_MODE_DEFAULT)) {
                         await fs.mkdir(path.dirname(dest), { recursive: true })
                         await fs.writeFile(dest, typeof data === "object" && !Buffer.isBuffer(data) ? JSON.stringify(data, null, 2) : data)
@@ -151,7 +151,7 @@ class BuildTaskHandler {
                         // relative to build task's destination path
                         dest = path.resolve(this.task.dest, dest)
                     }
-                    this._pushFile(dest)
+                    this.pushFile(dest)
                     if (this._hasBuildOption(BUILD_OPTION_OUTPUT_MODE, OUTPUT_MODE_DEFAULT)) {
                         if (fs.cp) { // Node.js >= 16.7
                             return fs.cp(src, dest, { recursive: true })
@@ -205,7 +205,7 @@ class BuildTaskHandler {
      * Adds the given fully qualified file path to the list of files that are written by this build task.
      * @param {string} filePath
      */
-    _pushFile(filePath) {
+    pushFile(filePath) {
         this._written.add(filePath)
     }
     /**

package/bin/build/provider/buildTaskHandlerEdmx.js

@@ -26,7 +26,7 @@ class BuildTaskHandlerEdmx extends BuildTaskHandlerFeatureToggles {
             const result = this.cds.compile.to.edmx(model, options)
 
             if (result) {
-                let langs = this.task.options.lang || this.cds.env.i18n.languages
+                let langs = this.task.options.lang || this.env.i18n.languages
                 if (langs.split) { // string to array
                     langs = langs.split(',')
                 }

package/bin/build/provider/buildTaskHandlerFeatureToggles.js

@@ -43,8 +43,9 @@ class FeatureToggleBuilder extends BuildTaskHandlerInternal {
     }
 
     async collectAllLanguageBundles(dictionary, paths, destBase, destFts) {
+        const i18nFolder = this.env.i18n.folders?.[0] || 'i18n'
         // create language bundle for base model
-        const i18n = await this.collectLanguageBundles(dictionary.base, destBase)
+        const i18n = await this.collectLanguageBundles(dictionary.base, path.join(destBase, i18nFolder))
         if (i18n) {
             this._result.languageBundles = i18n.bundles
         }
@@ -54,7 +55,7 @@ class FeatureToggleBuilder extends BuildTaskHandlerInternal {
             for (const ftName in dictionary.features) {
                 // attach the sources information for i18n location reference
                 dictionary.features[ftName]['$sources'] = paths.features[ftName]
-                await this.collectLanguageBundles(dictionary.features[ftName], path.join(destFts, this.ftsName, ftName))
+                await this.collectLanguageBundles(dictionary.features[ftName], path.join(destFts, this.ftsName, ftName, i18nFolder))
             }
         }
     }
@@ -108,7 +109,7 @@ class FeatureToggleBuilder extends BuildTaskHandlerInternal {
 
             // replace require paths by base model path to ensure precedence of feature annotations
             // see https://pages.github.tools.sap/cap/docs/cds/compiler-messages#anno-duplicate-unrelated-layer
-            ftCsn.requires = [path.join(path.relative(ftPath, destBase), DEFAULT_CSN_FILE_NAME).replace(/\\/g,'/')]
+            ftCsn.requires = [path.join(path.relative(ftPath, destBase), DEFAULT_CSN_FILE_NAME).replace(/\\/g, '/')]
 
             await this.compileToJson(ftCsn, path.join(ftPath, DEFAULT_CSN_FILE_NAME))
             await this._validateFeature(ftPath)

package/bin/build/provider/buildTaskHandlerInternal.js

@@ -204,8 +204,8 @@ class BuildTaskHandlerInternal extends BuildTaskHandler {
             bundles = {}
         }
         // copied from ../compile/i18n.js
-        const { folders = ['i18n'], file: base = 'i18n' } = this.env.i18n
-        const file = path.join(bundleDest, folders[0], base + '.json')
+        const { file: base = 'i18n' } = this.env.i18n
+        const file = path.join(bundleDest, base + '.json')
 
         // bundleDest might be null
         if (bundleDest && Object.keys(bundles).length > 0) {

package/bin/build/provider/java/index.js

@@ -48,7 +48,8 @@ class JavaModuleBuilder extends BuildTaskHandlerEdmx {
 
         if (this.hasBuildOption(CONTENT_LANGUAGE_BUNDLES, true)) {
             // collect and write language bundles into single i18n.json file
-            const i18n = await this.collectLanguageBundles(model, this.task.dest)
+            const i18nFolder = this.env.i18n.folders?.[0] || 'i18n'
+            const i18n = await this.collectLanguageBundles(model, path.join(this.task.dest, i18nFolder))
             if (i18n) {
                 this._result.languageBundles = i18n.bundles
             }

package/bin/build/provider/mtx/index.js

@@ -96,7 +96,8 @@ class ClassicMtxBuilder {
         }))
 
         // collect and write language bundles into single i18n.json file
-        const i18n = await this._handler.collectLanguageBundles(model, destSdc)
+        const i18nFolder = this._handler.env.i18n.folders?.[0] || 'i18n'
+        const i18n = await this._handler.collectLanguageBundles(model, path.join(destSdc, i18nFolder))
         if (i18n) {
             this._handler._result.languageBundles = i18n.bundles
         }

package/bin/build/provider/mtx/resourcesTarBuilder.js

@@ -15,16 +15,17 @@ class ResourcesTarBuilder {
     async createTar(dest, model) {
         const { root, files } = await this._getResources(model)
         if (files.length === 0) {
-            // packTarArchive failes otherwise
+            // packTarArchive fails otherwise
             this.handler.pushMessage("No deployment resources found - skip resources.tgz", WARNING)
             return
         }
         await this.writeTarFile(files, root, path.join(dest, DEFAULT_TAR_NAME))
     }
 
-    async writeTarFile(files, root, tarFile) { // REVISIT: eliminate this anti-pattern helper
+    async writeTarFile(files, root, tarFile) {
         const { tar } = require('../../../../lib').utils
         await tar.czfd (tarFile, root, files) // REVISIT: tar.czfd was created for this case only -> it ensures the target's dir exists
+        this.handler.pushFile(tarFile)
     }
 
     async _getResources(model) {

package/bin/build/provider/mtx-extension/index.js

@@ -33,7 +33,8 @@ class MtxExtensionModuleBuilder extends BuildTaskHandlerInternal {
         await this.compileToJson(extCsn, csnFile)
         allFiles.push(csnFile)
 
-        const i18n = await this.collectLanguageBundles(extCsn, destExt)
+        // static i18n folder name as runtime does not use the CDS config of the extension project
+        const i18n = await this.collectLanguageBundles(extCsn, path.join(destExt, 'i18n'))
         if (i18n) {
             allFiles.push(i18n.file)
         }

package/bin/build/provider/mtx-sidecar/index.js

@@ -44,9 +44,11 @@ class MtxSidecarModuleBuilder extends NodeCfModuleBuilder {
     async _buildNodeApp(sidecarEnv) {
         const destSidecar = this.task.dest
         const destSidecarSrc = path.join(destSidecar, this.env.folders.srv)
+        const i18nFolder = this.env.i18n.folders?.[0] || 'i18n'
         const model = this._compileSidecarSync(sidecarEnv)
         await this.compileToJson(model, path.join(destSidecarSrc, DEFAULT_CSN_FILE_NAME))
-        await this.collectLanguageBundles(model, destSidecarSrc)
+
+        await this.collectLanguageBundles(model, path.join(destSidecarSrc, i18nFolder))
         await this.copyProjectRootContent(this.task.src, destSidecar)
     }
 

package/lib/auth/index.js

@@ -25,7 +25,8 @@ module.exports = lazified (Object.assign (auth_factory, {
   basic:  require('./basic-auth'),
   dummy:  require('./dummy-auth'),
   ias:    require('./ias-auth'),
-  xsuaa:  require('./xsuaa-auth'),
+  jwt:    require('./jwt-auth'),
+  xsuaa:  require('./jwt-auth'),
 }))
 
 require = _require // eslint-disable-line no-global-assign

package/lib/auth/jwt-auth.js

@@ -1,3 +1,64 @@
-// TODO...
-console.trace ('JWT auth is not yet implemented')
-module.exports = ()=> (req,res,next)=> next()
+const cds = require('../')
+const _require = require('../../libx/_runtime/common/utils/require')
+// _require for better error message
+const express = _require('express')
+const passport = _require('passport')
+const { JWTStrategy } = _require('@sap/xssec')
+const LOG = cds.log('auth')
+
+module.exports = function jwt_auth(config) {
+  // warn if no credentials
+  if (!config.credentials) {
+    LOG._warn &&
+      LOG.warn(`
+       No XSUAA instance bound to application, but "${config.kind}" configured.
+       This is NOT recommended in production!
+       `)
+
+    return (req,res,next) => next()
+  }
+
+  passport.use(config.kind, new JWTStrategy(config.credentials))
+  return express
+    .Router()
+    .use(passport.authenticate(config.kind, { session: false }))
+    .use((req, res, next) => {
+      const payload = req.tokenInfo.getPayload()
+    
+      let id = req.user.id
+    
+      let roles = payload.scope.map(s => s.replace(new RegExp(`^(${config.credentials.xsappname + '.'})`), ''))
+      roles.push('identified-user')
+      if (payload.grant_type) {
+        // > not "weak"
+        roles.push('authenticated-user')
+    
+        const CLIENT = { client_credentials: 1, client_x509: 1 }
+        if (payload.grant_type in CLIENT) {
+          id = 'system'
+          roles.push('system-user')
+          if (req.tokenInfo.getClientId() === config.credentials.clientid) roles.push('internal-user')
+        }
+      }
+
+      let attr = req.authInfo.getAttributes() || {}
+      if (config.kind === 'xsuaa') {
+        attr.logonName = req.authInfo.getLogonName()
+        attr.givenName = req.authInfo.getGivenName()
+        attr.familyName = req.authInfo.getFamilyName()
+        attr.email = req.authInfo.getEmail()
+      }
+
+      req.user = new cds.User({ id, roles, attr })
+      req.tenant = req.tokenInfo.getZoneId?.()
+      next()
+    })
+    .use((err, req, res, next) => {
+      if (req.tokenInfo) {
+        LOG?.debug('error during token validation', req.tokenInfo.getErrorObject())
+      }
+      // REVISIT: reject request immediately as our other auth strategies do
+      // should we call next(err)? -> I don't think so; it's not an error, is it?
+      res.status(401).json({ code: '401', message: 'Unauthorized' }) // REVISIT: this is OData style?
+    })
+}

package/lib/auth/xsuaa-auth.js

@@ -1,3 +1,2 @@
-// TODO...
-console.trace ('XSUAA auth is not yet implemented')
-module.exports = ()=> (req,res,next)=> next()
+// REVISIT: "kind": "xsuaa-auth" does not work because cds.requires logic does not resolve it. Intentional?
+module.exports = require('./jwt-auth')

package/lib/compile/cdsc.js

@@ -103,6 +103,7 @@ const _options = {for: Object.assign (_options4, {
 
 /**
  * Return a derivate of cdsc, with the most prominent
+ * @type { import('@sap/cds-compiler') }
  */
 module.exports = exports = {__proto__:compile, _options,
   for: {__proto__: compile.for,

package/lib/compile/etc/_localized.js

@@ -2,6 +2,7 @@ const cds = require('../..'), {env} = cds
 const DEBUG = cds.debug('alpha|_localized')
 const _locales_4sql = {
 	sqlite : env.i18n.for_sqlite || env.i18n.for_sql || [],
+	h2 :     env.i18n.for_sql || [],
 	plain  : env.i18n.for_sql || [],
 }
 

package/lib/dbs/cds-deploy.js

@@ -143,7 +143,6 @@ exports.init = (db, csn=db.model, log=()=>{}) => db.run (async tx => {
       if (db.kind === 'better-sqlite') _add_missing_pks2(q)
       log (file,e)
       inits.push (tx.run(q) .catch (e => {
-        Error.captureStackTrace(e)
         throw Object.assign (e, { message: 'in cds.deploy(): ' + e.message +'\n'+ inspect(q) })
       }))
     }
@@ -232,11 +231,13 @@ const _entity4 = (file,csn) => {
 const INSERT_from_csv = (entity, csv) => {
   let [ cols, ...rows ] = cds.parse.csv (csv)
   if (rows.length > 0) return INSERT.into (entity) .columns (cols) .rows (rows)
+  // if (rows.length > 0) return UPSERT.into (entity) .columns (cols) .rows (rows)
 }
 
 const INSERT_from_json = (entity, json) => {
   let records = JSON.parse (json)
   if (records.length > 0) return INSERT.into (entity) .entries (records)
+  // if (records.length > 0) return UPSERT.into (entity) .entries (records)
 }
 
 const _from_csv_or_json = { '.json': INSERT_from_json, '.csv': INSERT_from_csv, }