@sap/cds 8.2.0 → 8.2.2

package/CHANGELOG.md

@@ -4,6 +4,24 @@
 - The format is based on [Keep a Changelog](http://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](http://semver.org/).
 
+## Version 8.2.2 - 2024-09-13
+
+### Fixed
+
+- Erroneous caching in `cds.validate`
+- Properly check `$filter` element types across navigations
+
+## Version 8.2.1 - 2024-09-04
+
+### Fixed
+
+- Date validation of legacy OData protocol adapter
+- Content-Length headers in multipart batch request body
+- Streaming requests with virtual properties
+- Bring back support for `x-correlationid`
+- Validation of inlined elements
+- multipart `$batch` parsing with _--_ as part of payload
+
 ## Version 8.2.0 - 2024-08-30
 
 ### Added

package/lib/linked/validate.js

@@ -56,13 +56,15 @@ class Validation {
 class ValidationErrors extends Array {
   add (error) {
     const err = Object.create (ValidationErrors.proto)
-    err.message = err.stack = error
+    err.message = error
     this.push (err)
     return err
   }
   static proto = Object.create (Error.prototype, {
     message: { writable:true, configurable:true },
-    stack: { writable:true, configurable:true, value: '<none>' },
+    stack: { configurable:true, get() { return this.message },
+      set(v) { Object.defineProperty (this, 'stack', { value:v, writable:true, configurable:true }) },
+    },
     code: { value: '400', writable:true }, // REVISIT: should be 'ASSERT_'... (i.e. msg) but we need to adjust all tests, and have a code catalogue
     statusCode: { value: 400 }, // REVISIT: should go into mappings in adapter's error handlers -> requires a code catalogue // REVISIT: .statusCode vs .status?
     numericSeverity: { value: 4, enumerable: true }, // REVISIT: that is OData-specific
@@ -90,38 +92,52 @@ const $any = class any {
    * this method for subsequent usages, with statically determined checks.
    */
   check_asserts (val, path, /** @type {Validation} */ ctx) {
-    // if (this['@cds.validate'] === false) return this.set ('check_asserts', ()=>{})
-    const asserts = []
-    const type_check = conf.strict && this.strict_check || this.type_check
-    if (type_check) {
-      asserts.push ((v,p,ctx) => v == null || type_check(v) || ctx.error ('ASSERT_DATA_TYPE', p, this.name, v, this ))
-    }
-    if (this._is_mandatory()) {
-      asserts.push ((v,p,ctx) => v != null && v.trim?.() !== '' || ctx.error ('ASSERT_NOT_NULL', p, this.name, v)) // ASSERT_NOT_NULL is misleading -> should be ASSERT_REQUIRED
-    }
-    if (this['@assert.format']) {
-      const format = new RegExp(this['@assert.format'],'u')
-      asserts.push ((v,p,ctx) => v == null || format.test(v) || ctx.error ('ASSERT_FORMAT', p, this.name, v, format))
-    }
-    if (this['@assert.range'] && !this.enum) {
-      const [ min, max ] = this['@assert.range']
-      asserts.push ((v,p,ctx) => v == null || min <= v && v <= max || ctx.error ('ASSERT_RANGE', p, this.name, v, min, max))
-    }
-    if (this['@assert.enum'] || this['@assert.range'] && this.enum) {
-      const vals = Object.entries(this.enum).map(([k,v]) => 'val' in v ? v.val : k)
-      const enums = vals.reduce((a,v) => (a[v]=true, a),{})
-      asserts.push ((v,p,ctx) => v == null || v in enums || vals.some(x => x == v) || ctx.error ('ASSERT_ENUM', p, this.name, typeof v === 'string' ? `"${v}"` : v, vals.join(', ')))
-    }
-    if (!asserts.length) return this.check_asserts = ()=>{} // nothing to do
-    this.set ('check_asserts', (v,p,ctx) => asserts.forEach (a => a(v,p,ctx)))
-    this.check_asserts (val, path, ctx) // call first time
+    // IMPORTANT: We need to use this.own() here as elements derived from reuse
+    // definitions or from elements of base entities might have different asserts
+    // than inherited ones.
+    const check_asserts = this.own('_check_asserts', () => {
+      const asserts = []
+      const type_check = conf.strict && this.strict_check || this.type_check
+      if (type_check) {
+        asserts.push ((v,p,ctx) => v == null || type_check(v) || ctx.error ('ASSERT_DATA_TYPE', p, this.name, v, this ))
+      }
+      if (this._is_mandatory()) {
+        asserts.push ((v,p,ctx) => v != null && v.trim?.() !== '' || ctx.error ('ASSERT_NOT_NULL', p, this.name, v)) // ASSERT_NOT_NULL is misleading -> should be ASSERT_REQUIRED
+      }
+      if (this['@assert.format']) {
+        const format = new RegExp(this['@assert.format'],'u')
+        asserts.push ((v,p,ctx) => v == null || format.test(v) || ctx.error ('ASSERT_FORMAT', p, this.name, v, format))
+      }
+      if (this['@assert.range'] && !this.enum) {
+        const [ min, max ] = this['@assert.range']
+        asserts.push ((v,p,ctx) => v == null || min <= v && v <= max || ctx.error ('ASSERT_RANGE', p, this.name, v, min, max))
+      }
+      if (this['@assert.enum'] || this['@assert.range'] && this.enum) {
+        const vals = Object.entries(this.enum).map(([k,v]) => 'val' in v ? v.val : k)
+        const enums = vals.reduce((a,v) => (a[v]=true, a),{})
+        asserts.push ((v,p,ctx) => v == null || v in enums || vals.some(x => x == v) || ctx.error ('ASSERT_ENUM', p, this.name, typeof v === 'string' ? `"${v}"` : v, vals.join(', ')))
+      }
+      if (!asserts.length) return ()=>{} // nothing to do
+      return (v,p,ctx) => asserts.forEach (a => a(v,p,ctx))
+    })
+    return check_asserts (val, path, ctx)
   }
 
   _is_mandatory (d=this) {
     return d.own('_mandatory', ()=> {
-      if (d['@readonly'])                                   return false // readonly -> not mandatory
-      if (d['@mandatory'])                                  return true
-      if (d['@Common.FieldControl']?.['#'] === 'Mandatory') return true
+      if (d._is_readonly()) return false // readonly annotations have precedence over mandatory ones
+      if (d['@mandatory'] || d['@Common.FieldControl']?.['#'] === 'Mandatory') {
+        const q = d.parent?.query?.SELECT
+        if (!q) return true // it's a regular entity's element marked as mandatory
+        if (!q.from?.ref) return false // join or union -> elements can't be mandatory
+        const c = q.columns?.find (c => alias4(c) === d.name)
+        if (!c) return true // * or foo.* -> can't tell whether d is joined
+        if (!c.ref) return false // calculated fields aren't mandatory
+        if (c.ref.length === 1) return true // SELECT from Foo { foo }
+        if (c.ref.length === 2 && c.ref[0] === alias4(q.from)) return true // SELECT from Foo as f { f.foo }
+        else return false // joined field which can't be mandatory, e.g. SELECT from Books { author.name as author }
+        function alias4 (x) { return x.as || x.ref?.at(-1) }
+      }
       else return false
     })
   }
@@ -143,17 +159,21 @@ const $any = class any {
    * This is the case if the row date does not contain all primary key elements of the target entity.
    */
   _is_insert (row) {
-    const entity = this._target || this
-    const keys = Object.keys (entity.keys||{})
-    if (!keys.length) return this.set('_is_insert', ()=> true), true
-    else this.set('_is_insert', data => typeof data === 'object' && !keys.every(k => k in data))
-    return this._is_insert (row)
+    // IMPORTANT: We need to use this.own() here as derived entities might have
+    // different keys and thus different insert checks.
+    const _is_insert = this.own('__is_insert', () => {
+      const entity = this._target || this
+      const keys = Object.keys (entity.keys||{})
+      if (!keys.length) return ()=> true
+      else return data => typeof data === 'object' && !keys.every(k => k in data)
+    })
+    return _is_insert(row)
   }
 
   _required (elements) {
-    const _required = Object.values(elements).filter(this._is_mandatory)
-    this.set('_required', ()=> _required)
-    return _required
+    // IMPORTANT: We need to use this.own() here as derived entities might have
+    // different elements or elements with different annotations than base entitites.
+    return this.own('__required', ()=> Object.values(elements).filter(this._is_mandatory))
   }
 
   /** Forward declaration for universal CSN */

package/lib/srv/middlewares/cds-context.js

@@ -1,5 +1,6 @@
 const cds = require ('../../index')
 const corr_id = 'x-correlation-id'
+const crippled_corr_id = 'x-correlationid'
 const req_id = 'x-request-id'
 const vr_id = 'x-vcap-request-id'
 const { uuid } = cds.utils
@@ -8,7 +9,7 @@ const { EventContext } = cds
 module.exports = () => {
   /** @type { import('express').Handler } */
   return function cds_context (req, res, next) {
-    const id = req.headers[corr_id] ??= req.headers[req_id] || req.headers[vr_id] || uuid()
+    const id = req.headers[corr_id] ??= req.headers[req_id] || req.headers[vr_id] || req.headers[crippled_corr_id] || uuid()
     const ctx = EventContext.for ({ id, http: { req, res } })
     res.set ('X-Correlation-ID', id) // Note: we use capitalized style here as that's common standard in HTTP world
     cds._context.run (ctx, next)

package/libx/_runtime/cds-services/adapter/odata-v4/okra/odata-commons/validator/ValueValidator.js

@@ -4,7 +4,7 @@ const { big } = require('@sap/cds-foss')
 const { isInvalidBase64string } = require('../../../../../../common/utils/binary')
 const IllegalArgumentError = require('../errors/IllegalArgumentError')
 
-const YEAR_RE = '(?:-?(?:(?:(?:0\\d{3})|(?:[1-9]\\d{3,}))))'
+const YEAR_RE = '(?:-?(?:(?:(?:0\\d{3})|(?:[1-9]\\d{3}))))'
 const MONTH_RE = '(?:(?:0[1-9])|(?:1[012]))'
 const DAY_RE = '(?:(?:0[1-9])|(?:[12]\\d)|(?:3[01]))'
 const HOURS_RE = '(?:(?:[01]\\d)|(?:2[0-3]))'

package/libx/_runtime/common/utils/streamProp.js

@@ -2,8 +2,10 @@ const cds = require('../../cds')
 const { ensureNoDraftsSuffix, ensureUnlocalized } = require('./draft')
 const { isDuplicate } = require('./rewriteAsterisks')
 
-const _addColumn = (name, type, columns, url) => {
-  const mediaType = typeof type === 'object' ? { ref: [type['='].replaceAll(/\./g, '_')] } : { val: type }
+const _addColumn = (name, type, columns, url, target) => {
+  let mediaType = typeof type === 'object' && type['=']
+  if (mediaType && target.elements[mediaType]?.virtual) return
+  mediaType = mediaType ? { ref: [mediaType.replaceAll(/\./g, '_')] } : { val: type }
   const col = {
     xpr: [
       'case',
@@ -34,8 +36,8 @@ const _addColumn = (name, type, columns, url) => {
 const _addColumns = (target, columns) => {
   for (const k in target.elements) {
     const el = target.elements[k]
-    if (el['@Core.MediaType']) {
-      _addColumn(el.name, el['@Core.MediaType'], columns, el['@Core.IsURL'] && el.type === 'cds.String')
+    if (el['@Core.MediaType'] && !el.virtual) {
+      _addColumn(el.name, el['@Core.MediaType'], columns, el['@Core.IsURL'] && el.type === 'cds.String', target)
     }
   }
 }
@@ -58,7 +60,7 @@ const handleStreamProperties = (target, columns, model) => {
       _addColumns(target, columns)
     } else if (col.ref && (type === 'cds.LargeBinary' || (mediaType && !ignoreMediaType))) {
       if (mediaType) {
-        _addColumn(name, mediaType, columns, element['@Core.IsURL'])
+        _addColumn(name, mediaType, columns, element['@Core.IsURL'], target)
         columns.splice(index, 1)
       } else if (!cds.env.features.stream_compat) {
         columns.splice(index, 1)

package/libx/odata/parse/afterburner.js

@@ -754,7 +754,7 @@ module.exports = (cqn, model, namespace, protocol) => {
   }
 
   if (cqn.SELECT.where) {
-    _processWhere(cqn.SELECT.where, root)
+    _processWhere(cqn.SELECT.where, target)
   }
 
   // one?

package/libx/odata/parse/multipartToJson.js

@@ -69,7 +69,9 @@ const parseStream = async function* (body, boundary) {
     const process = chunk => {
       let changed = chunk
         .toString()
-        .replace(/--(.*)$/gm, (_, g) => `HEAD /${g} HTTP/1.1${g.slice(-2) === '--' ? CRLF : ''}`)
+        .replace(/^--(.*)$/gm, (_, g) => `HEAD /${g} HTTP/1.1${g.slice(-2) === '--' ? CRLF : ''}`)
+        // correct content-length for non-HEAD requests is inserted below
+        .replace(/content-length: \d+\r\n/gim, '')
         .replace(/ \$/g, ' /$')
 
       // HACKS!!!

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "8.2.0",
+  "version": "8.2.2",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [