@sap/cds 8.1.1 → 8.2.1

package/CHANGELOG.md

@@ -4,6 +4,58 @@
 - The format is based on [Keep a Changelog](http://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](http://semver.org/).
 
+## Version 8.2.1 - 2024-09-04
+
+### Fixed
+
+- Date validation of legacy OData protocol adapter
+- Content-Length headers in multipart batch request body
+- Streaming requests with virtual properties
+- Bring back support for `x-correlationid`
+- Validation of inlined elements
+- multipart `$batch` parsing with _--_ as part of payload
+
+## Version 8.2.0 - 2024-08-30
+
+### Added
+
+- Allow `cds.connect.to (SomeService)` where `SomeService` is a class
+- Lean draft: support CDS orderBy in `list status: all`
+- Support where not in as object in `cds.ql` expressions like: `where({ID:{not:{in:[...]}}})`
+- Unbound CDS functions now show up in the server's index page along with an exemplary call signature
+- `cds.log`'s JSON formatter:
+  + Field `w3c_traceparent` is filled based on request header `traceparent` (cf. W3C Trace Context) for improved correlation
+  + Custom fields `cds.env.log.cls_custom_fields` are filled if bound to an instance of SAP Cloud Logging
+  + Default `cds.env.log.als_custom_fields` enhanced by `{ reason: 3 }` (project config takes precedence)
+- Support for `cds.hana` types like `cds.hana.ST_POINT` in `cds.builtin`
+- Internal `cds.debug()` API now always returns a logger instance, which allows switching on debugging subsequently, e.g. by the like of `cds.log('sql','debug')`
+- New config flag `cds.server.shutdown_on_uncaught_errors` allows to control whether the server should shut down on uncaught errors. Default is `true`
+
+### Changed
+
+- Revert workaround from 8.1.0 for server startup message `WARNING: Package '@sap/cds' was loaded from different installations`. This is now addressed in `@sap/cds-mtxs` 2.0.5
+
+### Fixed
+
+- Resolving views with path expression renamings
+- Set content-type-header in batch for actions with 204 No Content
+- URI encoding of `@odata.nextLink` in OData response
+- Requests reading media data streams did not provide `req.params`
+- `cds.compile.to.hana` for legacy hana service with `@cap-js/sqlite` as dev dependency
+- Better redaction of debug output
+- Instance-based authorization using functions
+- Fixed flaws in `cds.connect.to()` that lead to deadlocks in case of errors due to invalid service configurations or initializations.
+- Navigation with backlink as key can now omit backlink keys for new OData adapter
+
+### Removed
+
+- Array methods `forEach`, `filter`, `find`, `map`, `some`, `every` from [`LinkedDefinitions`](https://cap.cloud.sap/docs/node.js/cds-reflect#iterable). Convert linked definitions into arrays before using these methods, for example:
+
+   ```js
+   [...linked.definitions].map(d => d.name)
+   ```
+
+
 ## Version 8.1.1 - 2024-08-08
 
 ### Fixed
@@ -58,6 +110,9 @@
 ### Fixed
 
 - Empty feature set by switched off feature toggles
+- Allow programmatic operations on draft-enabled entities (`NEW`, `CREATE`, `UPDATE`, `DELETE`)
+
+### Removed
 - Allow deviating response types for `$batch`, e. g. input `multipart` and output `json`
 
 ## Version 8.0.2 - 2024-07-09
@@ -330,6 +385,7 @@
 
 ### Changed
 
+- Optimized handling of large binaries (BLOBs) in case of drafts. Unchanged BLOBs are not copied into the draft entity. If those BLOBs from draft entities are requested, the unchanged BLOBs will be fetched from the corresponding active entity. Note that this change may require adjustment of custom logic, if large binaries from draft entities are requested (for example, using `ql.SELECT` statement). To restore previous behavior use `cds.features.binary_draft_compat`.
 - The index page now lists all service endpoints, which is important for services that are exposed through multiple protocols.
 - `cds.deploy` improves error diagnostics with deeper `Query` object inspection.
 - Slightly changed the default export for ESM compatibility. This fixed failing ESM imports in Vitest tests.

package/app/index.css

@@ -77,6 +77,9 @@ body #welcome li a, body #welcome li > span {
   color: #1d5985;
   transition: all 0.1s ease-in;
 }
+body #welcome li.operation span {
+  font-style: italic;
+}
 
 body #welcome li a span:hover {
   color: #f0faff;

package/app/index.js

@@ -14,7 +14,7 @@ module.exports = { get html(){
   .replace (/{{app}}/g, cds.env.folders.app.replace(/*trailing slash*/ /\/$/, ''))
   .replace ('{{style}}', css)
   .replace ('{{apps}}', _app_links().map(
-      html => `\n<li><a href="${html}"><span>/${html.replace(/^\//,'').replace('/index.html','')}</span></a></li>`
+      html => `<li><a href="${html}"><span>/${html.replace(/^\//,'').replace('/index.html','')}</span></a></li>`
     ).join('\n') || '— none —'
   )
   .replace ('{{services}}', cds.service.providers
@@ -25,14 +25,20 @@ module.exports = { get html(){
         <h3 class="header">
           <a href="${endpoint.path}"><span>${endpoint.path}</span></a>${metadata(endpoint)} ${_moreLinks(srv, endpoint, undefined, false)}
         </h3>
-        <ul>${_entities_in(srv).map (e => {
-          return `
+        <ul>${_entities_in(srv).map (e => `
           <li id="${asHtmlId(srv.name)}-${endpoint.kind}-${asHtmlId(e)}">
             <div>
               <a href="${endpoint.path}/${e.replace(/\./g, '_')}"><span>${e}</span></a>
             </div>
             ${_moreLinks(srv, endpoint, e)}
-          </li>`}).join('')}
+          </li>`).join('')}
+        </ul>
+        <ul>${_operations_in(srv).map (e => `
+          <li id="${asHtmlId(srv.name)}-${endpoint.kind}-${asHtmlId(e.name)}" class="operation">
+            <div>
+              <a href="${endpoint.path}/${e.name}${e.params}" title="${endpoint.path}/${e.name}${e.params}"><span>${e.name}()</span></a>
+            </div>
+          </li>`).join('')}
         </ul>
       </div>
   `).join(''))
@@ -63,6 +69,46 @@ function _entities_in (service) {
   return exposed
 }
 
+function _operations_in (service) {
+  const exposed=[], {operations} = service
+  for (let name in operations) {
+    const op = cds.model.definitions[service.name + '.' + name]
+    if (op?.kind === 'function') {
+      const params = '('+ Object.values(op.params||[]).map(p => {
+        let val = _sampleValue(p)
+        if (typeof val === 'string') val = encodeURIComponent(`'${val}'`)
+        else if (typeof val === 'object') val = encodeURIComponent(`'${JSON.stringify(val)}'`)
+        return `${p.name}=${val}`
+      }).join(',') + ')'
+      exposed.push ({ name, params })
+    }
+  }
+  return exposed
+}
+
+function _sampleValue (param) {
+  if (param.items) // many
+    return [ _sampleValue(param.items) ]
+  if (param.elements) { // structured
+    return Object.entries(param.elements).reduce((all,[n,p]) => {
+      all[n] = _sampleValue(p)
+      return all
+    },{})
+  }
+  // scalar
+  const type = param._type || param.type
+  if (type === 'cds.String') return 'hello'
+  if (type === 'cds.Boolean') return true
+  if (type === 'cds.Decimal'||type === 'cds.Double') return '4.2'
+  if (type === 'cds.Date') return '2021-12-31'
+  if (type === 'cds.Time') return '23:42:42'
+  if (type === 'cds.DateTime') return '2021-12-31T23:42:42Z'
+  if (type === 'cds.Timestamp') return '2021-12-31T23:42:42.123Z'
+  if (type === 'cds.UUID') return cds.utils.uuid()
+  if (type?.match(/cds\..*Int.*/i)) return 42
+  return type // fallback
+}
+
 function _moreLinks (srv, endpoint, entity, div=true) {
   return (srv.$linkProviders || [])
     .map (linkProv => linkProv(entity, endpoint))

package/bin/serve.js

@@ -212,7 +212,7 @@ async function serve (all=[], o={}) {
 
     const LOG = cds.log('cli|server')
     cds.shutdown = _shutdown //> for programmatic invocation
-    if (!cds.repl) {
+    if (cds.env.server.shutdown_on_uncaught_errors && !cds.repl) {
       process.on('unhandledRejection', e => _shutdown (e, cds.log().error('❗️Uncaught',e))) //> using std logger to have it labelled with [cds] - instead of [cli] -
       process.on('uncaughtException', e => _shutdown (e, cds.log().error('❗️Uncaught',e)))  //> using std logger to have it labelled with [cds] - instead of [cli] -
     }

package/lib/compile/cdsc.js

@@ -77,8 +77,8 @@ const _options = {for: Object.assign (_options4, {
       if (dialect) o.sqlDialect = dialect
     }
 
-    const legacy_sqlite = '@sap/cds/libx/_runtime/sqlite/Service.js'
-    if (_conf.impl === legacy_sqlite) {
+    const legacy = '@sap/cds/libx/_runtime/' // includes legacy sqlite and hana
+    if (_conf.impl.includes(legacy)) {
       o.betterSqliteSessionVariables = false
       o.fewerLocalizedViews = false
     }

package/lib/compile/etc/_localized.js

@@ -16,7 +16,7 @@ const _been_here = Symbol('is _localized')
 function unfold_ddl (ddl, csn, o={}) { // NOSONAR
 	const db = env.requires.db || env.requires.kinds.sql
 	const locales = db.impl === _legacy_sqlite && _locales_4sql[o.dialect]; if (!locales)  return ddl
-	const localized_views = ddl.filter (each => each.startsWith('CREATE VIEW localized_') || each.startsWith('DROP VIEW localized_'))
+	const localized_views = ddl.filter (each => /^(?:-- .+\n)*(?:CREATE|DROP) VIEW localized_/g.test(each))
 	for (const localized_view of localized_views) {
 		for (const locale of locales) ddl.push (localized_view
 			.replace (/localized_/g, `localized_${locale}_`)

package/lib/compile/for/lean_drafts.js

@@ -66,6 +66,7 @@ module.exports = function cds_compile_for_lean_drafts(csn) {
     }
     Object.defineProperty(model.definitions, _draftEntity, { value: draft })
     Object.defineProperty(active, 'drafts', { value: draft })
+    Object.defineProperty(active, 'actives', { value: active })
     Object.defineProperty(draft, 'actives', { value: active })
     Object.defineProperty(draft, 'isDraft', { value: true })
 

package/lib/compile/to/sql.js

@@ -31,8 +31,8 @@ function cds_compile_to_deltaSql (csn, o, beforeCsn) {
   const { afterImage, drops, createsAndAlters } = cdsc.to.deltaSql (csn, options, beforeCsn || {definitions: {}, $version: '2.0'} ); // FIXME: As default value in compiler API?
   return {
     afterImage,
-    drops: unfold_ddl(drops.map (each => each.replace(/^-- .+\n/,'')), csn, options),
-    createsAndAlters: unfold_ddl(createsAndAlters.map (each => each.replace(/^-- .+\n/,'')), csn, options)
+    drops: unfold_ddl(drops, csn, options),
+    createsAndAlters: unfold_ddl(createsAndAlters, csn, options)
   };
 }
 

package/lib/env/cds-requires.js

@@ -234,6 +234,12 @@ const _messaging = {
   "event-broker": {
     impl: `${_runtime}/messaging/event-broker.js`,
     format: 'cloudevents',
+    vcap: {
+      label: "event-broker"
+    }
+  },
+  "event-broker-internal": {
+    kind: "event-broker",
     vcap: {
       label: "eventmesh-sap2sap-internal"
     }

package/lib/env/defaults.js

@@ -39,6 +39,7 @@ const defaults = module.exports = {
   requires: require('./cds-requires'),
 
   server: {
+    shutdown_on_uncaught_errors: true,
     force_exit_timeout: 1111,
     body_parser: undefined, // Allows to configure all body parser options, e.g. limit
     cors:  !production, // CORS middleware is off in production
@@ -102,15 +103,25 @@ const defaults = module.exports = {
     // the rest is only applicable for the json formatter
     user: false,
     mask_headers: ['/authorization/i', '/cookie/i', '/cert/i', '/ssl/i'],
-    aspects: ['./aspects/cf', './aspects/als'], //> EXPERIMENTAL!!!
+    aspects: ['./aspects/cf', './aspects/als', './aspects/cls'], //> EXPERIMENTAL!!!
     // adds custom fields in kibana's error rendering (unknown fields are ignored); key: index
     // note: custom fields are a feature of Application Logging Service (ALS) and not Kibana per se
     als_custom_fields: {
       // sql
       query: 0,
       // generic validations
-      target: 1, details: 2
-    }
+      target: 1, details: 2,
+      // errors
+      reason: 3
+    },
+    cls_custom_fields: [
+      // sql
+      'query',
+      // generic validations
+      'target', 'details',
+      // errors
+      'reason'
+    ]
   },
 
   folders: { // IMPORTANT: order is significant for cds.load('*')

package/lib/env/plugins.js

@@ -1,34 +1,18 @@
 // REVISIT: we should have a real modular plugin technique for cds.env
 module.exports = function add_mtx_env (env) {
 
-  if (cds_load_mismatch())  return env
-
-  const mtx_env = _require('@sap/cds-mtxs/env')
+  const mtx_env = require('@sap/cds-mtxs/env')
   if (mtx_env) {
     const {requires} = env, {kinds} = requires
     Object.assign (env, mtx_env, {requires})
     Object.assign (requires, mtx_env.requires, {kinds})
     Object.assign (kinds, mtx_env.requires?.kinds)
   }
-  return env
-}
 
-function _require (id) {
-  try { return module.require(id) }
-  catch(e) { if (e.code !== 'MODULE_NOT_FOUND') throw e }
-}
+  function require (id) {
+    try { return module.require(id) }
+    catch(e) { if (e.code !== 'MODULE_NOT_FOUND') throw e }
+  }
 
-// Anticipates if loading mtxs would load a _different_ @sap/cds than this one, which we must avoid.
-// May happen in PNPM setups that add all global installs to NODE_PATH. Seen in BAS.
-function cds_load_mismatch() {
-  const cds = require('..')
-  try {
-    const mtxs = require.resolve('@sap/cds-mtxs')
-    const cds2 = require.resolve('@sap/cds/package.json', { paths:[mtxs] })
-    const csd2Home = cds.utils.path.resolve(cds2, '..')
-    if (csd2Home !== cds.home) {
-      return true
-    }
-    // console.log('home', cds.home, 'other', otherCdsHome)
-  } catch(e) { if (e.code !== 'MODULE_NOT_FOUND') throw e }
+  return env
 }

package/lib/linked/classes.js

@@ -184,22 +184,8 @@ class event extends aspect {}
 
 class LinkedDefinitions {
   *[Symbol.iterator](){ for (let e in this) yield this[e] }
-  forEach(f){ let i=0; for (let k in this) f(this[k],i++,this) }
-  filter(f){ let i=0, r=[]; for (let k in this) f(this[k],i++,this) && r.push(this[k]); return r }
-  find(f){ for (let k in this) if (f(this[k])) return this[k] }
-  map(f){ let i=0, r=[]; for (let k in this) r.push(f(this[k],i++,this)); return r }
-  some(f){ for (let k in this) if (f(this[k])) return true }
-  every(f){ for (let k in this) if (!f(this[k])) return false }
 }
 
-// Protect LinkedDefinitions methods from erroneously being used as linked definitions/elements
-Object.entries(Object.getOwnPropertyDescriptors(LinkedDefinitions.prototype)).forEach(([p,pd]) => p === 'constructor' || Object.defineProperties(pd.value, {
-  own: {get(){ throw new Error(`'${p}' is not a linked definition but a method inherited from LinkedDefinitions`) }},
-  name: {get(){ throw new Error(`'${p}' is not a linked definition but a method inherited from LinkedDefinitions`) }},
-  kind: {get(){ throw new Error(`'${p}' is not a linked definition but a method inherited from LinkedDefinitions`) }},
-  type: {get(){ throw new Error(`'${p}' is not a linked definition but a method inherited from LinkedDefinitions`) }},
-  _type: {get(){ throw new Error(`'${p}' is not a linked definition but a method inherited from LinkedDefinitions`) }},
-}))
 
 module.exports = {
 

package/lib/linked/types.js

@@ -20,6 +20,18 @@ Object.assign (protos, types.deprecated = {
 	'cds.Integer64': 		new classes.Int64,
 })
 
+Object.assign (protos, types.hana = {
+	'cds.hana.SMALLDECIMAL': new classes.Decimal,
+	'cds.hana.SMALLINT': new classes.Int16,
+	'cds.hana.TINYINT': new classes.UInt8,
+	'cds.hana.REAL': new classes.Double,
+	'cds.hana.CHAR': new classes.String,
+	'cds.hana.CLOB': new classes.LargeString,
+	'cds.hana.NCHAR': new classes.String,
+	'cds.hana.BINARY': new classes.String,
+	'cds.hana.ST_POINT': new classes.type,
+	'cds.hana.ST_GEOMETRY': new classes.type,
+})
 
 protos.service.set('is_service',true)
 protos.struct.set('is_struct',true)

package/lib/linked/validate.js

@@ -56,13 +56,15 @@ class Validation {
 class ValidationErrors extends Array {
   add (error) {
     const err = Object.create (ValidationErrors.proto)
-    err.message = err.stack = error
+    err.message = error
     this.push (err)
     return err
   }
   static proto = Object.create (Error.prototype, {
     message: { writable:true, configurable:true },
-    stack: { writable:true, configurable:true, value: '<none>' },
+    stack: { configurable:true, get() { return this.message },
+      set(v) { Object.defineProperty (this, 'stack', { value:v, writable:true, configurable:true }) },
+    },
     code: { value: '400', writable:true }, // REVISIT: should be 'ASSERT_'... (i.e. msg) but we need to adjust all tests, and have a code catalogue
     statusCode: { value: 400 }, // REVISIT: should go into mappings in adapter's error handlers -> requires a code catalogue // REVISIT: .statusCode vs .status?
     numericSeverity: { value: 4, enumerable: true }, // REVISIT: that is OData-specific
@@ -118,12 +120,15 @@ const $any = class any {
   }
 
   _is_mandatory (d=this) {
-    return d.own('_mandatory', ()=> {
-      if (d['@readonly'])                                   return false // readonly -> not mandatory
-      if (d['@mandatory'])                                  return true
-      if (d['@Common.FieldControl']?.['#'] === 'Mandatory') return true
-      else return false
-    })
+    return d.own('_mandatory', ()=> (
+      !d['@readonly'] // readonly -> not mandatory
+      && (d['@mandatory'] || d['@Common.FieldControl']?.['#'] === 'Mandatory')
+      && !d._is_flattened()
+    ))
+  }
+
+  _is_flattened (d=this) {
+    return d.parent?.query?.SELECT.columns?.some (c => c.ref?.length > 1 && d.name === (c.as || c.ref.at(-1)))
   }
 
   _is_readonly (d=this) {

package/lib/log/cds-log.js

@@ -71,9 +71,9 @@ function cds_log (module, options) { // NOSONAR
  */
 exports.debug = function cds_debug (id, options) {
   const L = cds_log (id, options)
-  if (L._debug) return Object.assign(L.debug, {
-    time:    label => console.time    (`[${id}] - ${label}`),
-    timeEnd: label => console.timeEnd (`[${id}] - ${label}`),
+  return Object.assign((..._) => L._debug && L.debug (..._), {
+    time:    label => L._debug && console.time    (`[${id}] - ${label}`),
+    timeEnd: label => L._debug && console.timeEnd (`[${id}] - ${label}`),
   })
 }
 

package/lib/log/format/aspects/als.js

@@ -1,42 +1,36 @@
 const cds = require('../../..')
 
-const $remove = Symbol('remove')
-
-const _is_custom_fields = (arg, custom_fields) => {
-  if (!Object.keys(arg).length) return false
-  for (const k in arg) if (!(k in custom_fields)) return false
-  return true
-}
-
-const _is_categories = arg => arg.categories && Array.isArray(arg.categories) && Object.keys(arg).length === 1
-
-function als_aspect(module, level, args, toLog) {
-  // REVISIT: kibana_custom_fields for backward compatibility. remove in cds^8.
+let _kibana_custom_fields_deprecation_logged = false
+const _get_als_custom_fields = () => {
   const { als_custom_fields, kibana_custom_fields } = cds.env.log
-  this._CUSTOM_FIELDS ??= kibana_custom_fields ? { ...kibana_custom_fields } : { ...als_custom_fields }
-  this._HAS_CUSTOM_FIELDS ??= Object.keys(this._CUSTOM_FIELDS).length > 0
-
-  // extract custom fields and categories from remaining args (while avoiding as many loops/ iterations as possible)
-  if (args.length) {
-    let filter4removed = false
-    for (let i = 0; i < args.length; i++) {
-      const arg = args[i]
-      if (typeof arg !== 'object') continue
-      if ((this._HAS_CUSTOM_FIELDS && _is_custom_fields(arg, this._CUSTOM_FIELDS)) || _is_categories(arg)) {
-        Object.assign(toLog, arg)
-        args[i] = $remove
-        filter4removed = true
-      }
+  if (kibana_custom_fields) {
+    if (!_kibana_custom_fields_deprecation_logged) {
+      _kibana_custom_fields_deprecation_logged = true
+      cds.utils.deprecated({ old: 'cds.env.log.kibana_custom_fields', use: 'cds.env.log.als_custom_fields' })
     }
-    if (filter4removed) args.sort((a, b) => (b === $remove) * -1).splice(args.lastIndexOf($remove))
+    return kibana_custom_fields
   }
+  return als_custom_fields
+}
+
+function als_aspect(module, level, args, toLog) {
+  this._ALS_CUSTOM_FIELDS ??= { ..._get_als_custom_fields() }
+  this._ALS_HAS_CUSTOM_FIELDS ??= Object.keys(this._ALS_CUSTOM_FIELDS).length > 0
 
   // ALS custom fields
-  if (this._HAS_CUSTOM_FIELDS) {
+  if (this._ALS_HAS_CUSTOM_FIELDS) {
     const cf = []
-    for (const k in this._CUSTOM_FIELDS) if (toLog[k]) cf.push({ k, v: toLog[k], i: this._CUSTOM_FIELDS[k] })
+    for (const k in this._ALS_CUSTOM_FIELDS) {
+      if (toLog[k]) {
+        const i = cf.findIndex(e => e.i === this._ALS_CUSTOM_FIELDS[k])
+        if (i > -1) cf[i] = { k, v: toLog[k], i: this._ALS_CUSTOM_FIELDS[k] }
+        else cf.push({ k, v: toLog[k], i: this._ALS_CUSTOM_FIELDS[k] })
+      }
+    }
     if (cf.length) toLog['#cf'] = { string: cf }
   }
 }
 
+als_aspect.cf = () => Object.keys({ ..._get_als_custom_fields() })
+
 module.exports = process.env.VCAP_SERVICES?.match(/"label":\s*"application-logs"/) ? als_aspect : () => {}

package/lib/log/format/aspects/cls.js

@@ -0,0 +1,9 @@
+const cds = require('../../..')
+
+function cls_aspect(/* module, level, args, toLog */) {
+  // actually nothing to do
+}
+
+cls_aspect.cf = () => [...cds.env.log.cls_custom_fields]
+
+module.exports = process.env.VCAP_SERVICES?.match(/"label":\s*"cloud-logging"/) ? cls_aspect : () => {}

package/lib/log/format/json.js

@@ -5,7 +5,8 @@ const util = require('util')
 const L2L = { 1: 'error', 2: 'warn', 3: 'info', 4: 'debug', 5: 'trace' }
 const HEADER_MAPPINGS = {
   x_vcap_request_id: 'request_id',
-  content_length: 'request_size_b'
+  content_length: 'request_size_b',
+  traceparent: 'w3c_traceparent'
 }
 
 const _is4xx = ele =>
@@ -13,6 +14,32 @@ const _is4xx = ele =>
   (ele.status >= 400 && ele.status < 500) ||
   (ele.statusCode >= 400 && ele.statusCode < 500)
 
+const $remove = Symbol('remove')
+
+const _is_custom_fields = (arg, custom_fields) => {
+  if (!Object.keys(arg).length) return false
+  for (const k in arg) if (!custom_fields.has(k)) return false
+  return true
+}
+
+const _is_categories = arg => arg.categories && Array.isArray(arg.categories) && Object.keys(arg).length === 1
+
+const _extract_custom_fields_and_categories = (args, toLog, custom_fields) => {
+  if (args.length) {
+    let filter4removed = false
+    for (let i = 0; i < args.length; i++) {
+      const arg = args[i]
+      if (typeof arg !== 'object') continue
+      if ((custom_fields.size && _is_custom_fields(arg, custom_fields)) || _is_categories(arg)) {
+        Object.assign(toLog, arg)
+        args[i] = $remove
+        filter4removed = true
+      }
+    }
+    if (filter4removed) args.sort((a, b) => (b === $remove) * -1).splice(args.lastIndexOf($remove))
+  }
+}
+
 const _getCircularReplacer = () => {
   const seen = new WeakSet()
   return (key, value) => {
@@ -51,13 +78,13 @@ module.exports = function format(module, level, ...args) {
     // log user id, if configured (data privacy)
     if (user && log_user) toLog.remote_user = user.id
     // if available, add headers (normalized to lowercase and with _ instead of -) with masking as configured and mappings applied
-    const req = cds.context._ && cds.context._.req
-    if (req && req.headers) {
-      for (const k in req.headers) {
+    const headers = cds.context.http?.req?.headers
+    if (headers) {
+      for (const k in headers) {
         const h = k.replace(/-/g, '_').toLowerCase()
         toLog[h] = (() => {
           if (this._MASK_HEADERS.some(m => k.match(m))) return '***'
-          return req.headers[k]
+          return headers[k]
         })()
         if (h in HEADER_MAPPINGS) toLog[HEADER_MAPPINGS[h]] = toLog[h]
       }
@@ -84,7 +111,16 @@ module.exports = function format(module, level, ...args) {
     Object.assign(toLog, err, { level: toLog.level })
   }
 
-  // apply aspects
+  /*
+   * apply aspects:
+   * 1. extract custom fields (provided by the aspects) and categories from remaining args
+   * 2. actually apply the aspects
+   */
+  if (!this._custom_fields) {
+    this._custom_fields = new Set()
+    for (const each of this._ASPECTS) if (each.cf) each.cf().forEach(v => this._custom_fields.add(v))
+  }
+  _extract_custom_fields_and_categories(args, toLog, this._custom_fields)
   for (const each of this._ASPECTS) each.call(this, module, level, args, toLog)
 
   // append remaining args via util.format()

package/lib/ql/Whereable.js

@@ -90,6 +90,10 @@ const _object_predicate = ([arg], _clause) => { // e.g. .where ({ID:4711, stock:
       pred.push('and', 'not', 'exists', typeof x === 'object' ? x : { ref: x.split('.') })
       continue
     }
+    if (k === 'in') {
+      pred.push('in', val(x))
+      continue
+    }
     else pred.push('and', parse.expr(k))
     if (!x || x==='*') pred.push('=', {val:x})
     else if (x.SELECT || x.list) pred.push('in', x)
@@ -98,7 +102,7 @@ const _object_predicate = ([arg], _clause) => { // e.g. .where ({ID:4711, stock:
     else if (x instanceof Buffer) pred.push('=', {val:x})
     else if (x instanceof RegExp) pred.push('like', {val:x})
     else if (x instanceof Date) pred.push('=', {val:x})
-    else if (typeof x === 'object') for (let op in x) pred.push(op, val(x[op]))
+    else if (typeof x === 'object') for (let op in x) x[op]?.in ? pred.push(op, ...predicate4([x[op]],_clause)) : pred.push(op, val(x[op])) // REVIST: Should always be proper recursion 
     else if (_clause === 'on' && typeof x === 'string') pred.push('=', { ref: x.split('.') })
     else pred.push('=', {val:x})
   }