@sap/cds 6.6.2 → 6.7.0

package/libx/_runtime/cds-services/adapter/odata-v4/utils/result.js

@@ -273,7 +273,7 @@ const _pick = options => (element, target) => {
 
   if (element['@odata.etag']) categories.push('@odata.etag')
   if (element._type === 'cds.Decimal') categories.push('@cds.Decimal')
-  if (cds.db?.kind === 'better-sqlite' && element._type === 'cds.Boolean') categories.push('@cds.Boolean')
+  if (cds.db?.cqn2sql && element._type === 'cds.Boolean') categories.push('@cds.Boolean') // REVISIT: violates modularization -> do we still need that?
 
   categories.push(..._assocs(element, target))
 

package/libx/_runtime/cds-services/services/Service.js

@@ -53,7 +53,7 @@ class ApplicationService extends cds.Service {
   }
 
   registerFioriHandlers() {
-    if (cds.env.features.lean_draft) {
+    if (cds.env.fiori.lean_draft) {
       const { onNew, onPrepare, onEdit, onCancel } = require('../../fiori/lean-draft')
 
       for (const each of this.entities)

package/libx/_runtime/cds-services/util/assert.js

@@ -1,5 +1,6 @@
 const cds = require('../../cds')
 const LOG = cds.log('app')
+const templatePathSerializer = require('../../common/utils/templateProcessorPathSerializer')
 
 // REVISIT: replace with cds.Request
 const getEntry = require('../../common/error/entry')
@@ -42,7 +43,7 @@ const _enumValues = element => {
 }
 
 // REVISIT: this needs a cleanup!
-const assertError = (code, element, value, key, pathSegments = []) => {
+const assertError = (code, element, value, key, path) => {
   let args
 
   if (typeof code === 'object') {
@@ -51,14 +52,12 @@ const assertError = (code, element, value, key, pathSegments = []) => {
   }
 
   const { name, type, precision, scale } = element
-  const path = `${pathSegments.join('/')}${pathSegments.length ? '/' : ''}${name || key}`
-
   const error = new Error()
   const errorEntry = {
     code,
     message: code,
-    target: path,
-    args: args || [name || key]
+    target: path ?? element.name ?? key,
+    args: args ?? [name ?? key]
   }
 
   const assertError = Object.assign(error, getEntry(errorEntry))
@@ -81,13 +80,9 @@ const assertError = (code, element, value, key, pathSegments = []) => {
   return assertError
 }
 
-const _checkString = value => {
-  return typeof value === 'string'
-}
+const _checkString = value => typeof value === 'string'
 
-const _checkNumber = value => {
-  return typeof value === 'number'
-}
+const _checkNumber = value => typeof value === 'number'
 
 const _checkDecimal = (value, element) => {
   const [left, right] = String(value).split('.')
@@ -98,38 +93,24 @@ const _checkDecimal = (value, element) => {
   )
 }
 
-const _checkInteger = value => {
-  return _checkNumber(value) && parseInt(value, 10) === value
-}
+const _checkInteger = value => _checkNumber(value) && parseInt(value, 10) === value
 
-const _checkBoolean = value => {
-  return typeof value === 'boolean'
-}
+const _checkBoolean = value => typeof value === 'boolean'
 
-const _checkBuffer = value => {
-  // REVISIT: Extension parameter in push is an object with buffer data
-  return Buffer.isBuffer(value) || value.type === 'Buffer'
-}
+// REVISIT: Extension parameter in push is an object with buffer data
+const _checkBuffer = value => Buffer.isBuffer(value) || value.type === 'Buffer'
 
 const _checkUUID = value => {
   return _checkString(value) && UUID_REGEX.test(value)
 }
 
-const _checkISODate = value => {
-  return (_checkString(value) && ISO_DATE_REGEX.test(value)) || value instanceof Date
-}
+const _checkISODate = value => (_checkString(value) && ISO_DATE_REGEX.test(value)) || value instanceof Date
 
-const _checkISOTime = value => {
-  return _checkString(value) && ISO_TIME_REGEX.test(value)
-}
+const _checkISOTime = value => _checkString(value) && ISO_TIME_REGEX.test(value)
 
-const _checkISODateTime = value => {
-  return (_checkString(value) && ISO_DATE_TIME_REGEX.test(value)) || value instanceof Date
-}
+const _checkISODateTime = value => (_checkString(value) && ISO_DATE_TIME_REGEX.test(value)) || value instanceof Date
 
-const _checkISOTimestamp = value => {
-  return (_checkString(value) && ISO_TIMESTAMP_REGEX.test(value)) || value instanceof Date
-}
+const _checkISOTimestamp = value => (_checkString(value) && ISO_TIMESTAMP_REGEX.test(value)) || value instanceof Date
 
 const _checkInRange = (val, range) => {
   return _checkISODate(val)
@@ -137,10 +118,9 @@ const _checkInRange = (val, range) => {
     : (val - range[0]) * (val - range[1]) <= 0
 }
 
-const _checkRegExpFormat = (val, format) => {
-  // process.env.CDS_ASSERT_FORMAT_FLAGS not official!
-  return _checkString(val) && val.match(new RegExp(format, process.env.CDS_ASSERT_FORMAT_FLAGS || 'u'))
-}
+// process.env.CDS_ASSERT_FORMAT_FLAGS not official!
+const _checkRegExpFormat = (val, format) =>
+  _checkString(val) && val.match(new RegExp(format, process.env.CDS_ASSERT_FORMAT_FLAGS || 'u'))
 
 const CDS_TYPE_CHECKS = {
   'cds.UUID': _checkUUID,
@@ -215,28 +195,23 @@ const checkStaticElementByKey = (definition, key, value, result = [], ignoreNonM
   return result
 }
 
-const _isNotFilled = value => {
-  return value === null || value === undefined || (typeof value === 'string' && value.trim() === '')
-}
+const _isNotFilled = value =>
+  value === null || value === undefined || (typeof value === 'string' && value.trim() === '')
 
-const _checkMandatoryElement = (element, value, errors, key, pathSegments) => {
+const _checkMandatoryElement = (element, value, errors, key, pathSegmentsInfo) => {
   if (element.parent?.query?.SELECT?.columns?.find(col => _isNavigationColumn(col, element.name))) return
   if (element._isMandatory && !element.default && _isNotFilled(value)) {
-    errors.push(assertError(ASSERT_NOT_NULL, element, value, key, pathSegments))
+    errors.push(assertError(ASSERT_NOT_NULL, element, value, key, pathSegmentsInfo))
   }
 }
 
-const _isNavigationColumn = (column, searched) => {
-  return (
-    column.ref && column.ref.length > 1 && (column.as === searched || column.ref[column.ref.length - 1] === searched)
-  )
-}
+const _isNavigationColumn = (column, searched) =>
+  column.ref?.length > 1 && (column.as === searched || column.ref[column.ref.length - 1] === searched)
 
-const _getEnumElement = element => {
-  return (element['@assert.range'] && element.enum) || element['@assert.enum'] ? element.enum : undefined
-}
+const _getEnumElement = element =>
+  (element['@assert.range'] && element.enum) || element['@assert.enum'] ? element.enum : undefined
 
-const _checkEnumElement = (element, value, errors, key, pathSegments) => {
+const _checkEnumElement = (element, value, errors, key, pathSegmentsInfo) => {
   const enumElements = _getEnumElement(element)
   const enumValues = enumElements && _enumValues(enumElements)
 
@@ -246,15 +221,15 @@ const _checkEnumElement = (element, value, errors, key, pathSegments) => {
         ? ['"' + value + '"', enumValues.map(ele => '"' + ele + '"').join(', ')]
         : [value, enumValues.join(', ')]
 
-    errors.push(assertError({ code: ASSERT_ENUM, args }, element, value, key, pathSegments))
+    errors.push(assertError({ code: ASSERT_ENUM, args }, element, value, key, pathSegmentsInfo))
   }
 }
 
-const _checkRangeElement = (element, value, errors, key, pathSegments) => {
+const _checkRangeElement = (element, value, errors, key, pathSegmentsInfo) => {
   const rangeElements = element['@assert.range'] && !_getEnumElement(element) ? element['@assert.range'] : undefined
   if (rangeElements && !_checkInRange(value, rangeElements)) {
     const args = [value, ...element['@assert.range']]
-    errors.push(assertError({ code: ASSERT_RANGE, args }, element, value, key, pathSegments))
+    errors.push(assertError({ code: ASSERT_RANGE, args }, element, value, key, pathSegmentsInfo))
   }
 }
 
@@ -268,19 +243,18 @@ const _checkFormatElement = (element, value, errors, key, pathSegments) => {
 /**
  * @param {import('../../types/api').InputConstraints} constraints
  */
-const checkInputConstraints = ({ element, value, errors, key, pathSegments }) => {
+const checkInputConstraints = ({ element, value, errors, key, pathSegmentsInfo }) => {
   if (!element) return errors
+  let path
 
-  _checkMandatoryElement(element, value, errors, key, pathSegments)
+  if (pathSegmentsInfo?.length) path = templatePathSerializer(element.name || key, pathSegmentsInfo)
+  _checkMandatoryElement(element, value, errors, key, path)
 
   if (value == null) return errors
 
-  _checkEnumElement(element, value, errors, key, pathSegments)
-
-  _checkRangeElement(element, value, errors, key, pathSegments)
-
-  _checkFormatElement(element, value, errors, key, pathSegments)
-
+  _checkEnumElement(element, value, errors, key, path)
+  _checkRangeElement(element, value, errors, key, path)
+  _checkFormatElement(element, value, errors, key, path)
   return errors
 }
 
@@ -323,7 +297,7 @@ const assertNotNullError = element => assertError(ASSERT_NOT_NULL, element)
  *
  * @param {import('../../types/api').assertTargetMap} assertMap
  * @param {array} errors An array to appends the possible errors.
- * @see {@link https://pages.github.tools.sap/cap/docs/guides/providing-services#assert-target @assert.target} for
+ * @see {@link https://cap.cloud.sap/docs/guides/providing-services#assert-target @assert.target} for
  * further information.
  */
 const assertTargets = async (assertMap, errors) => {
@@ -358,9 +332,11 @@ const assertTargets = async (assertMap, errors) => {
     allTargets
       .filter(t => t.key === target.key)
       .forEach(target => {
-        const { row, pathSegments } = target.assocInfo
+        const { row, pathSegmentsInfo } = target.assocInfo
         const key = target.foreignKey.name
-        const error = assertError('ASSERT_TARGET', target.foreignKey, row[key], key, pathSegments)
+        let path
+        if (pathSegmentsInfo?.length) path = templatePathSerializer(key, pathSegmentsInfo)
+        const error = assertError('ASSERT_TARGET', target.foreignKey, row[key], key, path)
         errors.push(error)
       })
   })

package/libx/_runtime/common/code-ext/WorkerPool.js

@@ -0,0 +1,90 @@
+const cds = require('../../cds')
+const os = require('os')
+const { Worker } = require('worker_threads')
+
+class ExtensionWorker extends Worker {
+  constructor(id, workerPath, options) {
+    super(workerPath, options)
+    this.id = id
+    this.tasksAssigned = 0
+  }
+}
+
+class WorkerPool {
+  static instances = []
+  constructor(workerPath, options) {
+    this.workerPath = workerPath
+    this.options = options
+    this.size = options.size ?? Math.max(os.cpus().length, 1)
+    this.idleWorkers = new Set()
+    this.workers = []
+    WorkerPool.instances.push(this)
+  }
+
+  #createWorker() {
+    const id = cds.utils.uuid()
+    const worker = new ExtensionWorker(id, this.workerPath, {
+      workerData: { id },
+      resourceLimits: this.options.resourceLimits
+    })
+    worker.on('exit', this.#onWorkerExit.bind(this, worker))
+    return worker
+  }
+
+  #onWorkerExit(worker) {
+    this.idleWorkers.delete(worker)
+    this.workers.splice(this.workers.indexOf(worker), 1)
+    worker.tasksAssigned = 0
+  }
+
+  adquire() {
+    if (this.idleWorkers.size === 0 && this.workers.length < this.size) {
+      const worker = this.#createWorker()
+      this.idleWorkers.add(worker)
+      this.workers.push(worker)
+    }
+
+    const worker = this.idleWorkers.values().next().value
+
+    if (worker) {
+      this.idleWorkers.delete(worker)
+      worker.tasksAssigned++
+      return worker
+    }
+
+    const randomWorkerIndex = Math.floor(Math.random() * this.workers.length)
+    const busyWorker = this.workers[randomWorkerIndex]
+    busyWorker.tasksAssigned++
+    return busyWorker
+  }
+
+  release(worker) {
+    if (worker.tasksAssigned === 0) return
+
+    worker.tasksAssigned--
+    if (worker.tasksAssigned === 0) {
+      this.idleWorkers.add(worker)
+    }
+  }
+
+  async destroy() {
+    if (this.workers.length === 0) return
+
+    const workers = Array.from(this.workers)
+    const iterable = workers.map(worker => {
+      worker.removeAllListeners()
+      return worker.terminate()
+    })
+
+    await Promise.all(iterable)
+    this.idleWorkers = new Set()
+    this.workers = []
+    WorkerPool.instances = []
+  }
+
+  static async destroyAll() {
+    for (const workerPool of WorkerPool.instances) await workerPool.destroy()
+  }
+}
+
+module.exports = WorkerPool

package/libx/_runtime/common/code-ext/WorkerReq.js

@@ -71,10 +71,6 @@ class WorkerReq {
       prop: 'reject',
       args
     })
-
-    let error = Responses.get(4, ...args)
-    if (!error.stack) Error.captureStackTrace((error = Object.assign(new Error(), error)), this.reject)
-    throw error
   }
 }
 

package/libx/_runtime/common/code-ext/execute.js

@@ -1,11 +1,12 @@
 const cds = require('../../cds')
-const { Worker } = require('worker_threads')
-const path = require('node:path')
+const path = require('path')
+const { AsyncResource } = require('async_hooks')
 const { timeout, resourceLimits } = require('./config')
+const WorkerPool = require('./WorkerPool')
 const workerPath = path.resolve(__dirname, 'worker.js')
+const workerPool = new WorkerPool(workerPath, { resourceLimits })
 const { Errors } = require('../../../../lib/req/response')
 const LOG = cds.log()
-
 const _getReqData = req => {
   return {
     data: req.data,
@@ -30,21 +31,20 @@ module.exports = async function executeCode(code, req) {
       // no default
     }
   }
-  const workerId = cds.utils.uuid()
-  const contextId = cds.utils.uuid()
-  const worker = new Worker(workerPath, {
-    workerData: { id: workerId },
-    resourceLimits
-  })
 
+  const worker = workerPool.adquire()
+  const workerId = worker.id
+  const contextId = cds.utils.uuid()
   const executePromise = new Promise(function executeCodePromiseExecutor(resolve, reject) {
-    worker.on('online', onStarted)
-    worker.on('message', onMessageReceived)
-    worker.on('error', onError)
-    worker.on('exit', onExit)
+    queueMicrotask(AsyncResource.bind(onStarted))
+    const onMessageReceivedProxy = AsyncResource.bind(onMessageReceived)
+    const onErrorProxy = AsyncResource.bind(onError)
+    const onExitProxy = AsyncResource.bind(onExit)
+    worker.on('message', onMessageReceivedProxy)
+    worker.on('error', onErrorProxy)
+    worker.on('exit', onExitProxy)
 
     let onStartTimeoutID
-
     function onStarted() {
       onStartTimeoutID = setTimeout(() => {
         worker.terminate()
@@ -53,8 +53,11 @@ module.exports = async function executeCode(code, req) {
     }
 
     function onMessageReceived(message) {
+      if (message.contextId !== contextId) return
+
       if (LOG._debug)
         LOG.debug(`Post message received on main thread (code-ext/execute.js) from worker thread`, message)
+
       switch (message.kind) {
         case 'run':
           run(message)
@@ -62,7 +65,6 @@ module.exports = async function executeCode(code, req) {
 
         case 'success':
           onSuccess(message)
-          cleanup()
           return
 
         case 'error':
@@ -77,15 +79,19 @@ module.exports = async function executeCode(code, req) {
       for (const m of message.postMessages) await run(m)
       req.data && Object.assign(req.data, message.req.data) // REVISIT: Why Object.assign(...) is a required?
       req.results = message.req.results
+      cleanup()
       resolve(req.results ?? message.result)
     }
 
     function onError(error) {
+      cleanup()
       reject(error)
     }
 
     function onExit(exitCode) {
-      if (exitCode !== 0) reject(new Error(`Worker thread stopped with exit code ${exitCode}`))
+      if (exitCode !== 0) {
+        reject(new Error(`Worker thread stopped with exit code ${exitCode}`))
+      }
     }
 
     async function run(message) {
@@ -95,14 +101,18 @@ module.exports = async function executeCode(code, req) {
         if (message.responseData) worker.postMessage({ id: message.id, kind: 'responseData', result })
       } catch (error) {
         if (LOG._debug) LOG.debug(`Calling ${message.target}.${message.prop}(...) throws an error.`, error)
-        worker.postMessage({ id: message.id, kind: 'cleanup' })
+        if (message.id) worker.postMessage({ id: message.id, kind: 'cleanup' })
+        cleanup()
         reject(error)
       }
     }
 
     function cleanup() {
       clearTimeout(onStartTimeoutID)
-      worker.terminate()
+      worker.removeListener('message', onMessageReceivedProxy)
+      worker.removeListener('error', onErrorProxy)
+      worker.removeListener('exit', onExitProxy)
+      workerPool.release(worker)
     }
   })
 

package/libx/_runtime/common/code-ext/handlers.js

@@ -1,6 +1,6 @@
 const cds = require('../../cds')
+const LOG = cds.log()
 const executeCode = require('./execute')
-
 const CODE_ANNOTATION = '@extension.code'
 
 module.exports = cds.service.impl(function () {
@@ -20,17 +20,18 @@ module.exports = cds.service.impl(function () {
     if (result == null) return // whether result is null or undefined
     const code = await getCodeFromAnnotation(req.target.name, req.event, 'after')
     if (!code) return
-    await executeCode.call(this, code, req)
+    await executeCode.call(this, code, req).catch(error => LOG._debug && LOG.debug(error))
   })
 
   this.before(['CREATE', 'UPDATE', 'DELETE'], async function (req) {
     const code = await getCodeFromAnnotation(req.target.name, req.event, 'before')
     if (!code) return
-    await executeCode.call(this, code, req)
+    await executeCode.call(this, code, req).catch(error => LOG._debug && LOG.debug(error))
   })
 
   this.on('*', async function (req, next) {
     if (this.name.startsWith('cds.xt')) return next()
+
     // REVISIT: req.target -> wait until implementation task finished
     let fqn = req.target?.actions?.[`${req.event}`] // check for bound action/function
     if (!fqn) {
@@ -43,7 +44,7 @@ module.exports = cds.service.impl(function () {
     if (fqn.kind === 'action' || fqn.kind === 'function' || req.constructor.name === 'EventMessage') {
       const code = await getCodeFromAnnotation(req?.target?.name ?? fqn.name, req.event, 'on')
       if (!code) return next()
-      return await executeCode.call(this, code, req)
+      return await executeCode.call(this, code, req).catch(error => LOG._debug && LOG.debug(error))
     }
   })
 })

package/libx/_runtime/common/code-ext/worker.js

@@ -1,18 +1,60 @@
 const cds = require('../../cds')
 const LOG = cds.log()
 const { parentPort, workerData } = require('worker_threads')
-const { WorkerSELECT, WorkerINSERT, WorkerUPSERT, WorkerUPDATE, WorkerDELETE } = require('./workerQuery')
+const SELECT = require('../../../../lib/ql/SELECT')
+const INSERT = require('../../../../lib/ql/INSERT')
+const UPSERT = require('../../../../lib/ql/UPSERT')
+const UPDATE = require('../../../../lib/ql/UPDATE')
+const DELETE = require('../../../../lib/ql/DELETE')
+const queryExecutor = require('./workerQueryExecutor')
 const WorkerReq = require('./WorkerReq')
 const { timeout } = require('./config')
 
-parentPort.once('message', function onWorkerMessageReceived(message) {
+parentPort.on('message', function onWorkerMessageReceived(message) {
   const { contextId, workerId, kind, code, reqData } = message
-  if (LOG._debug) LOG.debug(`Post message received on worker thread (worker.js) from main thread`, message)
   if (kind !== 'start' || workerId !== workerData.id) return
+  if (LOG._debug) LOG.debug(`Post message received on worker thread (worker.js) from main thread`, message)
 
   // eslint-disable-next-line cds/no-missing-dependencies
   const { VM } = require('vm2')
   const workerReq = new WorkerReq(contextId, reqData)
+
+  class WorkerSELECT extends SELECT {
+    then(r, e) {
+      return new Promise(queryExecutor.bind(this, contextId)).then(r, e)
+    }
+  }
+
+  class WorkerINSERT extends INSERT {
+    then(r, e) {
+      return new Promise(queryExecutor.bind(this, contextId)).then(r, e)
+    }
+  }
+
+  class WorkerUPSERT extends UPSERT {
+    then(r, e) {
+      return new Promise(queryExecutor.bind(this, contextId)).then(r, e)
+    }
+  }
+
+  class WorkerUPDATE extends UPDATE {
+    then(r, e) {
+      return new Promise(queryExecutor.bind(this, contextId)).then(r, e)
+    }
+  }
+
+  class WorkerDELETE extends DELETE {
+    then(r, e) {
+      return new Promise(queryExecutor.bind(this, contextId)).then(r, e)
+    }
+  }
+
+  Object.defineProperty(WorkerSELECT.prototype, 'cmd', { value: 'SELECT' })
+  Object.defineProperty(WorkerINSERT.prototype, 'cmd', { value: 'INSERT' })
+  Object.defineProperty(WorkerUPSERT.prototype, 'cmd', { value: 'UPSERT' })
+  Object.defineProperty(WorkerUPDATE.prototype, 'cmd', { value: 'UPDATE' })
+  Object.defineProperty(WorkerDELETE.prototype, 'cmd', { value: 'DELETE' })
+
   const vm = new VM({
     console: 'inherit',
     timeout, // specifies the number of milliseconds to execute code before terminating execution

package/libx/_runtime/common/code-ext/workerQueryExecutor.js

@@ -1,30 +1,31 @@
 const cds = require('../../cds')
 const LOG = cds.log()
 const { parentPort } = require('worker_threads')
-const executorCallbackMap = new Map()
+const executionContextMap = new Map()
 
 parentPort.on('message', function onWorkerMessageReceived(message) {
   const { id, kind, result } = message
+  if (!executionContextMap.has(id)) return
   if (LOG._debug) LOG.debug(`Post message received on worker thread (workerQueryExecutor.js) from main thread`, message)
-  if (!executorCallbackMap.has(id)) return
 
   switch (kind) {
     case 'responseData':
-      executorCallbackMap.get(id)(result)
-      executorCallbackMap.delete(id)
+      executionContextMap.get(id)(result)
+      executionContextMap.delete(id)
       return
 
     case 'cleanup':
-      executorCallbackMap.delete(id)
+      executionContextMap.delete(id)
       return
   }
 })
 
-function queryExecutor(resolve) {
+function queryExecutor(contextId, resolve) {
   const id = cds.utils.uuid()
-  executorCallbackMap.set(id, result => resolve(result))
+  executionContextMap.set(id, result => resolve(result))
   parentPort.postMessage({
     id,
+    contextId,
     kind: 'run',
     target: 'srv',
     prop: 'run',

package/libx/_runtime/common/composition/delete.js

@@ -230,7 +230,7 @@ const getSetNullParentForeignKeyCQNs = async (model, req, dbQuery) => {
   const cqns = []
   const query = dbQuery || req.query
   // REVISIT: req._tx should not be used like that!
-  const origQuery = (req.tx instanceof cds.DatabaseService && req._ && req._.query) || req.query
+  const origQuery = (req.tx.isDatabaseService && req._ && req._.query) || req.query
   if (!dbQuery && origQuery && origQuery.DELETE && origQuery.DELETE.from.ref && origQuery.DELETE.from.ref.length > 1) {
     // delete via 2one navigation => parent is known => no need to SELECT
     const ref = origQuery.DELETE.from.ref

package/libx/_runtime/common/composition/update.js

@@ -9,6 +9,7 @@ const { ensureNoDraftsSuffix } = require('../utils/draft')
 const { deepCopyObject } = require('../utils/copy')
 
 const getError = require('../../common/error')
+const { getEntityNameFromUpdateCQN } = require('../utils/cqn')
 
 const CHUNK_SIZE = cds.env.features.chunk_deep || Number.MAX_VALUE
 
@@ -264,9 +265,7 @@ const _addSubDeepUpdateCQN = async ({ model, compositionTree, data, selectData,
 
 const hasDeepUpdate = (model, cqn) => {
   if (cqn && cqn.UPDATE && cqn.UPDATE.entity && (cqn.UPDATE.data || cqn.UPDATE.with)) {
-    const updateEntity = cqn.UPDATE.entity
-    const entityName =
-      (updateEntity.ref && (updateEntity.ref[0].id || updateEntity.ref[0])) || updateEntity.name || updateEntity
+    const entityName = getEntityNameFromUpdateCQN(cqn)
     const entity = model.definitions[ensureNoDraftsSuffix(entityName)]
 
     if (entity) {
@@ -287,8 +286,7 @@ const getDeepUpdateCQNs = async (model, req, selectData) => {
   if (selectData.length > 1) throw getError('Deep update can only be performed on a single instance')
 
   const cqns = []
-  const from =
-    (query.UPDATE.entity.ref && query.UPDATE.entity.ref[0]) || query.UPDATE.entity.name || query.UPDATE.entity
+  const from = getEntityNameFromUpdateCQN(query)
   const entityName = ensureNoDraftsSuffix(from)
   const draft = entityName !== from
   const data = query.UPDATE.data ? deepCopyObject(query.UPDATE.data) : {}

package/libx/_runtime/common/generic/auth/expand.js

@@ -30,7 +30,7 @@ const _getRestrictedExpand = (columns, target, definitions) => {
         if (ref_) return ref_
       }
       // expand: '**' or '*3' is only possible within custom handler, no check needed
-      if (typeof col.expand === 'string' && /^\*{1}[\d|*]+/.test(col.expand)) {
+      if (typeof col.expand[0] === 'string' && /^\*{1}[\d|*]+/.test(col.expand[0])) {
         continue
       } else {
         const restricted = _getRestrictedExpand(col.expand, _getTarget(col.ref, target, definitions), definitions)

package/libx/_runtime/common/generic/auth/readOnly.js

@@ -1,3 +1,4 @@
+const cds = require('../../../cds')
 const { getAuthRelevantEntity } = require('./utils')
 const { WRITE_EVENTS } = require('./constants')
 
@@ -14,11 +15,11 @@ function handler(req) {
   }
 
   // @read-only
-  const entity = getAuthRelevantEntity(req, this.model, ['@readonly'])
+  let entity = getAuthRelevantEntity(req, this.model, ['@readonly'])
+  if (cds.env.fiori.lean_draft && (req.event === 'NEW' || req.event === 'UPDATE')) entity = entity?.actives
+
   if (!entity || !entity['@readonly']) return
-  if (entity['@readonly'] && req.event in WRITE_EVENTS) {
-    req.reject(405, 'ENTITY_IS_READ_ONLY', [entity.name])
-  }
+  if (entity['@readonly'] && req.event in WRITE_EVENTS) req.reject(405, 'ENTITY_IS_READ_ONLY', [entity.name])
 }
 
 handler._initial = true