@sap/cds 7.7.0 → 7.7.1

package/CHANGELOG.md

@@ -4,6 +4,16 @@
 - The format is based on [Keep a Changelog](http://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](http://semver.org/).
 
+## Version 7.7.1 - 2024-03-06
+
+### Fixed
+
+- JWT authentication for Event Mesh endpoints
+- `cds.log`'s json formatter: ensure `type` is set (required on kubernetes until CLS defaults this)
+- Erroneously generated foreign keys in `req.data` for UPDATE using path expressions
+- `INSERT.columns.rows` for multiple nested composition of aspects
+- Paths passed to `tar` on Windows are now normalized to use forward slashes.
+
 ## Version 7.7.0 - 2024-02-26
 
 ### Added

package/lib/log/format/json.js

@@ -86,6 +86,9 @@ module.exports = function format(module, level, ...args) {
   // append remaining args via util.format()
   if (args.length) toLog.msg = toLog.msg ? util.format(toLog.msg, ...args) : util.format(...args)
 
+  // ensure type (required on kubernetes if logs are pulled instead of pushed through binding)
+  toLog.type ??= 'log'
+
   // REVISIT: should not be necessary with new protocol adapters
   // 4xx: lower to warning (if error)
   if (toLog.level && toLog.level.match(/error/i) && _is4xx(toLog)) toLog.level = 'warn'

package/lib/utils/tar.js

@@ -11,7 +11,7 @@ const _resolve = (...x) => path.resolve (cds.root,...x)
 // tar does not work properly on Windows (by npm/jest tests) w/o this change
 const win = path => {
   if (!path) return path
-  if (typeof path === 'string') return path.replace('C:', '//localhost/c$')
+  if (typeof path === 'string') return path.replace('C:', '//localhost/c$').replace(/\\+/g, '/')
   if (Array.isArray(path)) return path.map(el => win(el))
 }
 

package/libx/_runtime/common/utils/cqn.js

@@ -37,7 +37,7 @@ function where2obj(where, target = null, data = {}) {
     // optional validation if target is passed
     if (target) {
       const colEl = target.elements[colName]
-      if (!colEl || !(colEl.key || colEl.__foreignKey4)) continue
+      if (!colEl || !colEl.key) continue
     }
     const opWhere = where[i + 1]
     const valWhere = where[i + 2]

package/libx/_runtime/db/expand/expandCQNToJoin.js

@@ -803,7 +803,7 @@ class JoinCQNFromExpanded {
       return 'DRAFT.DraftAdministrativeData'
     }
 
-    if (isActiveRequired && !defaultLanguage) {
+    if (this._SELECT.localized !== false && isActiveRequired && !defaultLanguage) {
       const locale = this._locale ? `${this._locale}.` : ''
       const localized = `localized.${locale}${target}`
       if (this._csn.definitions[localized]) {

package/libx/_runtime/db/sql-builder/InsertBuilder.js

@@ -243,7 +243,7 @@ class InsertBuilder extends BaseBuilder {
     if (this.uuidKeys) {
       for (const key of this.uuidKeys) {
         if (!flattenColumnMap.get(key)) {
-          columns.push(...this.uuidKeys.map(key => this._quoteElement(key)))
+          columns.push(this._quoteElement(key))
         }
       }
     }

package/libx/_runtime/messaging/enterprise-messaging-utils/registerEndpoints.js

@@ -17,15 +17,15 @@ class EndpointRegistry {
     if (isSecured()) {
       if (cds.requires.auth.impl) {
         if (cds.env.requires.middlewares !== false) {
-          paths.forEach(path => cds.app.use(path, cds.middlewares.before)) // contains auth, trace, context
+          cds.app.use(basePath, cds.middlewares.before) // contains auth, trace, context
         } else {
           const impl = _require(cds.resolve(cds.requires.auth.impl))
-          paths.forEach(path => cds.app.use(path, impl))
+          cds.app.use(basePath, impl)
         }
       } else {
         if (cds.env.requires.middlewares !== false) {
           const jwt_auth = require('../../../../lib/auth/jwt-auth.js')
-          paths.forEach(path => cds.app.use(path, jwt_auth(cds.requires.auth)))
+          cds.app.use(basePath, jwt_auth(cds.requires.auth))
         } else {
           const JWTStrategy = require('../../auth/strategies/JWT.js')
           // eslint-disable-next-line cds/no-missing-dependencies -- needs to be added by app dev
@@ -33,28 +33,22 @@ class EndpointRegistry {
           // REVISIT: It's unclear if the credentials from cds.requires.auth need to be used here.
           //          In principle, user-facing endpoints might differ from messaging ones.
           passport.use(new JWTStrategy(cds.requires.auth.credentials))
-          paths.forEach(path => {
-            cds.app.use(path, passport.initialize())
-            cds.app.use(path, passport.authenticate('JWT', { session: false }))
-          })
+          cds.app.use(basePath, passport.initialize())
+          cds.app.use(basePath, passport.authenticate('JWT', { session: false }))
         }
       }
       // unsuccessful auth doesn't automatically reject!
-      paths.forEach(path => {
-        cds.app.use(path, (req, res, next) => {
-          // REVISIT: we should probably pass an error into next so that a (custom) error middleware can handle it
-          if (!req.user) res.status(401).json({ error: ODATA_UNAUTHORIZED })
-          next()
-        })
+      cds.app.use(basePath, (req, res, next) => {
+        // REVISIT: we should probably pass an error into next so that a (custom) error middleware can handle it
+        if (!req.user) res.status(401).json({ error: ODATA_UNAUTHORIZED })
+        next()
       })
     } else if (process.env.NODE_ENV === 'production') {
       LOG.warn('Messaging endpoints not secured')
     }
-    paths.forEach(path => {
-      cds.app.use(path, express.json({ type: 'application/*+json' }))
-      cds.app.use(path, express.json())
-      cds.app.use(path, express.urlencoded({ extended: true }))
-    })
+    cds.app.use(basePath, express.json({ type: 'application/*+json' }))
+    cds.app.use(basePath, express.json())
+    cds.app.use(basePath, express.urlencoded({ extended: true }))
     LOG._debug && LOG.debug('Register inbound endpoint', { basePath, method: 'OPTIONS' })
 
     // Clear cds.context as it would interfere with subsequent transactions
@@ -62,10 +56,6 @@ class EndpointRegistry {
       cds.context = undefined
       next()
     })
-    cds.app.use(deployPath, (_req, _res, next) => {
-      cds.context = undefined
-      next()
-    })
 
     cds.app.options(basePath, (req, res) => {
       try {

package/libx/odata/utils/index.js

@@ -295,9 +295,13 @@ const getKeysFromPath = (from, srv) => {
           const join = [...relation[0].xpr]
           while (join.length >= 3) {
             const [left, _, right] = join.splice(0, 4)
-            if (left.ref?.[0] === 'target') keys[left.ref[1]] = 'val' in right ? right.val : seg_keys[right.ref[1]]
-            else if (right.ref?.[0] === 'target') keys[right.ref[1]] = 'val' in left ? left.val : seg_keys[left.ref[1]]
-            else {
+            if (left.ref?.[0] === 'target') {
+              if (left.ref[1] in keys) break // we already added the foreign key for the last segment
+              keys[left.ref[1]] = 'val' in right ? right.val : seg_keys[right.ref[1]]
+            } else if (right.ref?.[0] === 'target') {
+              if (right.ref[1] in keys) break // we already added the foreign key for the last segment
+              keys[right.ref[1]] = 'val' in left ? left.val : seg_keys[left.ref[1]]
+            } else {
               // REVISIT: what to do here?
             }
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "7.7.0",
+  "version": "7.7.1",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [