@sap/cds 8.9.4 → 9.0.2

package/lib/srv/middlewares/auth/ias-auth.js

@@ -1,8 +1,106 @@
 const cds = require('../../../index.js')
 const LOG = cds.log('auth')
 
-let xssec = require('./xssec')
+const {
+  createSecurityContext,
+  IdentityService,
+  errors: { ValidationError }
+} = require('./xssec')
 
+module.exports = function ias_auth(config) {
+  // cds.env.requires.auth.known_claims is not an official config!
+  const { kind, credentials, config: serviceConfig = {}, known_claims = KNOWN_CLAIMS } = config
+  const skipped_attrs = known_claims.reduce((a, x) => ((a[x] = 1), a), {})
+
+  if (!credentials)
+    throw new Error(
+      `Authentication kind "${kind}" configured, but no IAS instance bound to application. ` +
+        'Either bind an IAS instance, or switch to an authentication kind that does not require a binding.'
+    )
+
+  const auth_service = new IdentityService(credentials, serviceConfig)
+  const user_factory = get_user_factory(credentials, skipped_attrs)
+
+  /*
+   * re validation:
+   *   if the request goes to the cert url, then we should validate the token.
+   *   however, this requires header "x-forwarded-client-cert" which requires additional configuration in the approuter ("forwardAuthCertificates: true").
+   *   also, we currently get the non-cert route attached to the application as well (-> adjust "cds add mta"?), for which validation would always fail.
+   *   by default, the approuter is configured to use the non-cert route ("url: ~{srv-url}" instead of "url: ~{srv-cert-url}").
+   *   if the developer explicitely changes to the cert route, then we can expect him/her to also configure cert forwarding.
+   *   hence, if there is no explicit validation configuration by the app, we can and should create a service with validation enabled and use if for the cert route.
+   *   this way, we validate if possible with the least amount of custom configuration.
+   */
+
+  const should_validate =
+    process.env.VCAP_APPLICATION &&
+    JSON.parse(process.env.VCAP_APPLICATION).application_uris?.some(uri => uri.match(/\.cert\./))
+  const validation_enabled = serviceConfig.validation?.x5t?.enabled || serviceConfig.validation?.proofToken?.enabled
+
+  let validating_auth_service
+  if (should_validate && !validation_enabled) {
+    const _serviceConfig = { ...serviceConfig }
+    _serviceConfig.validation = { x5t: { enabled: true }, proofToken: { enabled: true } }
+    validating_auth_service = new IdentityService(credentials, _serviceConfig)
+  }
+
+  return async function ias_auth(req, _, next) {
+    if (!req.headers.authorization) return next()
+
+    try {
+      const _auth_service =
+        validating_auth_service && req.host.match(/\.cert\./) ? validating_auth_service : auth_service
+      const securityContext = await createSecurityContext(_auth_service, { req })
+      const tokenInfo = securityContext.token
+      const ctx = cds.context
+      ctx.user = user_factory(tokenInfo)
+      ctx.tenant = tokenInfo.getZoneId()
+      req.authInfo = securityContext //> compat req.authInfo
+    } catch (e) {
+      if (e instanceof ValidationError) {
+        LOG.warn('Unauthenticated request: ', e)
+        return next(401)
+      }
+      LOG.error('Error while authenticating user: ', e)
+      return next(500)
+    }
+
+    next()
+  }
+}
+
+function get_user_factory(credentials, skipped_attrs) {
+  return function user_factory(tokenInfo) {
+    const payload = tokenInfo.getPayload()
+
+    const clientid = tokenInfo.getClientId()
+    if (clientid === payload.sub) {
+      //> grant_type === client_credentials or x509
+      const roles = { 'system-user': 1 }
+      if (Array.isArray(payload.ias_apis)) payload.ias_apis.forEach(r => (roles[r] = 1))
+      if (clientid === credentials.clientid) roles['internal-user'] = 1
+      else delete roles['internal-user']
+      return new cds.User({ id: 'system', roles, tokenInfo })
+    }
+
+    // add all unknown attributes to req.user.attr in order to keep public API small
+    const attr = {}
+    for (const key in payload) {
+      if (key in skipped_attrs)
+        continue // REVISIT: Why do we need to do that?
+      else attr[key] = payload[key]
+    }
+
+    // REVISIT: just don't such things, please! -> We're just piling up tech dept through tons of unoficcial long tail APIs like that!
+    // REVISIT: looks like wrong direction to me, btw
+    // same api as xsuaa-auth for easier migration
+    if (attr.user_name) attr.logonName = attr.user_name
+    if (attr.given_name) attr.givenName = attr.given_name
+    if (attr.family_name) attr.familyName = attr.family_name
+
+    return new cds.User({ id: payload.sub, attr, tokenInfo })
+  }
+}
 
 // REVISIT: Why do we need to know and do that?
 const KNOWN_CLAIMS = Object.values({
@@ -39,90 +137,3 @@ const KNOWN_CLAIMS = Object.values({
   // own
   APP_TENANT_ID: 'app_tid'
 })
-
-
-module.exports = function ias_auth(config) {
-  // cds.env.requires.auth.known_claims is not an official config!
-  const { kind, credentials, known_claims = KNOWN_CLAIMS } = config
-  const skipped_attrs = known_claims.reduce((a,x) => { a[x] = 1; return a }, {})
-
-  if (!credentials) throw new Error(
-    `Authentication kind "${kind}" configured, but no IAS instance bound to application. ` +
-    'Either bind an IAS instance, or switch to an authentication kind that does not require a binding.'
-  )
-
-  function getUser(tokenInfo) {
-    const payload = tokenInfo.getPayload()
-
-    const clientid = tokenInfo.getClientId()
-    if (clientid === payload.sub) { //> grant_type === client_credentials or x509
-      const roles = { 'system-user': 1 }
-      if (Array.isArray(payload.ias_apis)) payload.ias_apis.forEach(r => (roles[r] = 1))
-      if (clientid === credentials.clientid) roles['internal-user'] = 1
-      else delete roles['internal-user']
-      return new cds.User({ id: 'system', roles, tokenInfo })
-    }
-
-    // add all unknown attributes to req.user.attr in order to keep public API small
-    const attr = {}
-    for (const key in payload) {
-      if (key in skipped_attrs) continue // REVISIT: Why do we need to do that?
-      else attr[key] = payload[key]
-    }
-
-    // REVISIT: just don't such things, please! -> We're just piling up tech dept through tons of unoficcial long tail APIs like that!
-    // REVISIT: looks like wrong direction to me, btw
-    // same api as xsuaa-auth for easier migration
-    if (attr.user_name) attr.logonName = attr.user_name
-    if (attr.given_name) attr.givenName = attr.given_name
-    if (attr.family_name) attr.familyName = attr.family_name
-
-    return new cds.User({ id: payload.sub, attr, tokenInfo })
-  }
-
-  // NOTE: Use named function for better stack traces... for the actual middleware, of course, not that much for the factory!
-
-  if (xssec.v3 && cds.env.features.xssec_compat !== true) { // no official flag!
-    let { createSecurityContext, IdentityService, errors: { ValidationError } } = xssec
-    const authService = new IdentityService(credentials)
-
-    return async function ias_auth (req, _, next) {
-      if (!req.headers.authorization) return next()
-      try {
-        const secContext = await createSecurityContext(authService, { req })
-        const tokenInfo = secContext.token
-        const ctx = cds.context
-        ctx.user = getUser(tokenInfo)
-        ctx.tenant = tokenInfo.getZoneId()
-        req.authInfo = secContext //> compat req.authInfo
-      } catch(e) {
-        if (e instanceof ValidationError) {
-          LOG.warn("Unauthenticated request: ", e);
-          return next(401)
-        }
-        LOG.error("Error while authenticating user: ", e);
-        return next(500)
-      }
-      next()
-    }
-  } else { // TODO: Remove with cds 9
-    xssec = xssec.v3 || xssec
-    return function ias_auth (req, _, next) {
-      if (!req.headers.authorization) return next()
-      const token = req.headers.authorization.slice(7) // skip /^bearer /
-        xssec.createSecurityContext(token, credentials, 'IAS', function (err, securityContext, tokenInfo) {
-
-          if (err) LOG.warn('User could not be authenticated due to error:', err)
-          if (!securityContext) {
-            return next(401)
-          }
-          else req.authInfo = securityContext //> compat req.authInfo
-
-          const ctx = cds.context
-          ctx.user = getUser(tokenInfo)
-          ctx.tenant = tokenInfo.getZoneId()
-          next()
-        })
-    }
-  }
-}

package/lib/srv/middlewares/auth/jwt-auth.js

@@ -1,27 +1,60 @@
 const cds = require('../../../index.js')
 const LOG = cds.log('auth')
 
-let xssec = require('./xssec')
+const {
+  createSecurityContext,
+  XsuaaService,
+  errors: { ValidationError }
+} = require('./xssec')
 
 module.exports = function jwt_auth(config) {
-  const { kind, credentials } = config
+  const { kind, credentials, config: serviceConfig = {} } = config
+
+  if (!credentials)
+    throw new Error(
+      `Authentication kind "${kind}" configured, but no XSUAA instance bound to application. ` +
+        'Either bind an XSUAA instance, or switch to an authentication kind that does not require a binding.'
+    )
+
+  const auth_service = new XsuaaService(credentials, serviceConfig)
+  const user_factory = get_user_factory(credentials, credentials.xsappname, kind)
+
+  return async function jwt_auth(req, _, next) {
+    if (!req.headers.authorization) return next()
+
+    try {
+      const securityContext = await createSecurityContext(auth_service, { req })
+      const tokenInfo = securityContext.token
+      const ctx = cds.context
+      ctx.user = user_factory(tokenInfo)
+      ctx.tenant = tokenInfo.getZoneId()
+      req.authInfo = securityContext //> compat req.authInfo
+    } catch (e) {
+      if (e instanceof ValidationError) {
+        LOG.warn('Unauthenticated request: ', e)
+        return next(401)
+      }
+      LOG.error('Error while authenticating user: ', e)
+      return next(500)
+    }
 
-  if (!credentials) throw new Error(
-    `Authentication kind "${kind}" configured, but no XSUAA instance bound to application. ` +
-    'Either bind an XSUAA instance, or switch to an authentication kind that does not require a binding.'
-  )
+    next()
+  }
+}
 
-  const xsappname = credentials.xsappname.length + 1
+function get_user_factory(credentials, xsappname, kind) {
+  xsappname = xsappname + '.'
 
-  function getUser(tokenInfo) {
+  return function user_factory(tokenInfo) {
     const payload = tokenInfo.getPayload()
 
     let id = payload.user_name
 
     const roles = {}
     for (let scope of payload.scope) {
-      let role = scope.slice(xsappname) // Roles = scope names w/o xsappname...
-      if (role in { 'internal-user': 1, 'system-user': 1 }) continue  // Disallow setting system roles from external
+      let role = scope.replace(xsappname, '') // Roles = scope names w/o xsappname...
+      if (role in { 'internal-user': 1, 'system-user': 1 })
+        continue // Disallow setting system roles from external
       else roles[role] = 1
     }
 
@@ -32,7 +65,7 @@ module.exports = function jwt_auth(config) {
       if (tokenInfo.getClientId() === credentials.clientid) roles['internal-user'] = 1
     }
 
-    const attr = { ... payload['xs.user.attributes'] }
+    const attr = { ...payload['xs.user.attributes'] }
     if (kind === 'xsuaa') {
       attr.logonName = payload.user_name
       attr.givenName = payload.given_name
@@ -42,50 +75,4 @@ module.exports = function jwt_auth(config) {
 
     return new cds.User({ id, roles, attr, tokenInfo })
   }
-  if (xssec.v3 && cds.env.features.xssec_compat !== true) { // no official flag!
-    const { createSecurityContext, XsuaaService, errors: { ValidationError } } = xssec
-    const authService = new XsuaaService(credentials)
-
-      return async function jwt_auth(req, _, next) {
-        if (!req.headers.authorization) return next()
-
-        try {
-          const secContext = await createSecurityContext(authService, { req })
-          const tokenInfo = secContext.token
-          const ctx = cds.context
-          ctx.user = getUser(tokenInfo)
-          ctx.tenant = tokenInfo.getZoneId()
-          req.authInfo = secContext //> compat req.authInfo
-        } catch(e) {
-          if(e instanceof ValidationError) {
-            LOG.warn("Unauthenticated request: ", e);
-            return next(401)
-          }
-          LOG.error("Error while authenticating user: ", e);
-          return next(500)
-        }
-
-        next()
-      }
-
-  } else {
-    xssec = xssec.v3 || xssec
-
-    // NOTE: Use named function for better stack traces... for the actual middleware, of course, not that much for the factory!
-      return function jwt_auth (req, _, next) {
-        if (!req.headers.authorization) return next()
-        const token = req.headers.authorization.slice(7) // skip /^bearer /
-          xssec.createSecurityContext(token, credentials, function (err, securityContext, tokenInfo) {
-
-            if (err) LOG.warn('User could not be authenticated due to error:', err)
-            if (!securityContext) return next(401)
-            else req.authInfo = securityContext //> compat req.authInfo
-
-            const ctx = cds.context
-            ctx.user = getUser(tokenInfo)
-            ctx.tenant = tokenInfo.getZoneId()
-            next()
-          })
-      }
-  }
 }

package/lib/srv/middlewares/cds-context.js

@@ -12,6 +12,6 @@ module.exports = () => {
     const id = req.headers[corr_id] ??= req.headers[crippled_corr_id] || req.headers[req_id] || req.headers[vr_id] || uuid()
     const ctx = EventContext.for ({ id, http: { req, res } })
     res.set ('X-Correlation-ID', id) // Note: we use capitalized style here as that's common standard in HTTP world
-    cds._context.run (ctx, next)
+    cds._with (ctx, next)
   }
 }

package/lib/srv/middlewares/ctx-model.js

@@ -9,7 +9,7 @@ module.exports = ()=> {
     if (req.baseUrl.startsWith('/-/')) return next() //> our own tech services cannot be extended
     const ctx = cds.context
     if (ctx.tenant || ctx.features?.given) try {
-      ctx.model = req.__model = await model4 (ctx.tenant, ctx.features) // REVISIT: req.__model is because of Okra
+      ctx.model = await model4 (ctx.tenant, ctx.features)
     } catch (e) {
       LOG.error(e)
       return res.status(503) .json ({ // REVISIT: we should throw a simple error, nothing else! -> this is overly OData-specific!

package/lib/srv/middlewares/errors.js

@@ -1,55 +1,47 @@
-const { isStandardError } = require('../../../libx/_runtime/common/error/standardError')
-
-const production = process.env.NODE_ENV === 'production'
-const cds = require('../..')
+const cds = require('../..'), {i18n} = cds
 const LOG = cds.log('error')
-const { inspect } = cds.utils
+const internals = /\n +at .*(?:node_modules\/express|node:).*/gm
+const is_test = typeof global.it === 'function'
 
 module.exports = () => {
-  // eslint-disable-next-line no-unused-vars
-  return async function http_error(error, req, res, next) {
-    if (isStandardError(error) && cds.env.server.shutdown_on_uncaught_errors) {
-      cds.log().error('❗️Uncaught', error)
-      await cds.shutdown(error)
-      return
-    }
+  /** @param {import('express').Response} res */
+  return function http_error (err, req, res, next) { // eslint-disable-line no-unused-vars
 
     // In case of 401 require login if available by auth strategy
-    if (typeof error === 'number') error = { code: error }
-    if (error.code == 401 && req._login) return req._login()
-
-    // Prepare and log the error object
-    const status = error.statusCode || error.status || Number(error.code) || 500
-    delete error.statusCode
-    delete error.status
-    if (!production && error.stack)
-      error.stack = error.stack.replace(/\n {4}at .*(?:node_modules\/express|node:internal).*/g, '')
-
-    if (400 <= status && status < 500) {
-      LOG.warn(status, '>', inspect(error))
-    } else {
-      LOG.error(status, '>', inspect(error))
-    }
+    if (typeof err === 'number') err = { code: err }
+    if (err.code == 401 && req._login) return req._login()
+
+    // Shutdown on uncaught errors, which could be critical programming errors
+    if (!is_test && cds.env.server.shutdown_on_uncaught_errors)
+      if (cds.error.isSystemError(err))
+        return cds.shutdown(err)
+
+    // Prepare status and a serializable error object
+    let { statusCode:sc, status = sc || Number(err.code) || 500, message, toJSON, ...rest } = err // eslint-disable-line no-unused-vars
+    let error = { message, ...rest, __proto__:err } // toJSON is inherited from __proto__:err
+    res.status(status)
+
+    // Log the error, with cleansed stack trace
+    if (err.stack) Object.defineProperty (err, 'stack', { value: err.stack.replace (internals,'') })
+    const log = status < 500 ? LOG.warn : LOG.error
+    log (status, '-', error) // TODO: don't log validation errors as errors
 
+    // Already sent a response? => done
     if (res.headersSent) return
 
-    // Expose as little information as possible in production, and as much as possible in development
-    if (production) {
-      Object.defineProperties(error, {
-        message: { enumerable: true },
-        user: { enumerable: false }
-      })
-    } else {
-      Object.defineProperties(error, {
-        message: { enumerable: true },
-        stack: { enumerable: true }
-      })
+    // In case of 5xx errors in production don't reveal details to clients
+    let PROD = process.env.NODE_ENV === 'production' || process.env.CDS_ENV === 'prod'
+    if (PROD && status >= 500 && error.$sanitize !== false) error = {
+      message: i18n.messages.at(status, cds.context.locale) || 'Internal Server Error',
+      code: String(status), // toJSON is intentionally gone
     }
 
-    // Send the error response
-    return res.status(status).json({ error })
+    // Errors can come with a custom $response() method to control how the
+    // error response shall be structured; default: { error: { ... } }
+    // E.g., SCIM doesn't wrap the error => err.$response = err => err
+    let response = err.$response?.call(error,error) || { error }
 
-    // Note: express returns errors as XML, we prefer JSON
-    // next(error)
+    // Finally send the error response
+    return res.json (response)
   }
 }

package/lib/srv/protocols/hcql.js

@@ -1,12 +1,12 @@
 const cds = require('../../index'), {inspect} = cds.utils
 const express = require('express')
 const LOG = cds.log('hcql')
+const PROD = process.env.NODE_ENV === 'production'
 
 class HCQLAdapter extends require('./http') {
 
   get router() {
 
-    const srv = this.service
     const router = super.router
     .get ('/\\$csn', this.schema.bind(this))      //> return the CSN as schema
     .use (express.json(this.body_parser_options)) //> for application/json -> cqn
@@ -14,29 +14,27 @@ class HCQLAdapter extends require('./http') {
 
     // Route for custom actions and functions ...
     const action = this.action.bind(this)
-    router.param('action', (req,_,next,a) => { (req.action = a) in srv.actions ? next() : next('route') })
+    router.param('action', (r,_,next,a) => a in this.service.actions ? next() : next('route'))
     router.route('/:action')
     .post (action)
     .get (action)
     .all ((req,res,next) => next(501))
 
     // Route for REST-style convenience shortcuts with queries in URL + body ...
-    if (process.env.NODE_ENV !== 'production') {
-      const $ = cb => (req,_,next) => { req.body = cb(req.params,req); next() }
-      router.param('entity', (req,_,next,a) => { a in srv.entities ? next() : next(404) })
-      router.route('/:entity/:id?(%20?:tail)?')
-      .get ($(({entity,id,tail}, req) => {
-        const body = typeof req.body === 'string' ? req.body : ''
-        return tail || body ? {SELECT:{
-          ...SELECT (`from _ ${body} ${tail||''}`).SELECT,
-          ...SELECT.from (entity,id).SELECT
-        }} : SELECT.from (entity,id)
-      }))
-      .post   ($(({entity}, {query,body}) => INSERT.into (entity) .entries ({...query,...body})))
-      .put    ($(({entity,id}, {query,body}) => UPDATE (entity,id) .with ({...query,...body})))
-      .patch  ($(({entity,id}, {query,body}) => UPDATE (entity,id) .with ({...query,...body})))
-      .delete ($(({entity,id}) => DELETE.from (entity, id)))
-    }
+    const $ = cb => (req,_,next) => { req.body = cb(req.params,req); next() }
+    PROD || router.route('/:entity/:id?')
+    .get ($(({entity,id,tail}, req) => {
+      if (entity.includes(' ')) [,entity,tail] = /^(\w+)( .*)?/.exec(entity)
+      if (id?.includes(' ')) [,id,tail] = /^(\w+)( .*)/.exec(id)
+      let q = SELECT.from (entity,id), body = req.body
+      if (body) Object.assign (q.SELECT, ql_fragment(body))
+      if (tail) Object.assign (q.SELECT, ql_fragment(tail))
+      return q
+    }))
+    .post   ($(({entity}, {query,body}) => INSERT.into (entity) .entries ({...query,...body})))
+    .put    ($(({entity,id}, {query,body}) => UPDATE (entity,id) .with ({...query,...body})))
+    .patch  ($(({entity,id}, {query,body}) => UPDATE (entity,id) .with ({...query,...body})))
+    .delete ($(({entity,id}) => DELETE.from (entity, id)))
 
     // The ultimate handler for CRUD requests
     router.use (this.crud.bind(this))
@@ -48,7 +46,7 @@ class HCQLAdapter extends require('./http') {
    * Handle requests to custom actions and functions.
    */
   action (req, res, next) {
-    return this.service.send (req.action, { ...req.query, ...req.body })
+    return this.service.send (req.params.action, { ...req.query, ...req.body })
     .then (results => this.reply (results, res))
     .catch (next)
   }
@@ -71,11 +69,6 @@ class HCQLAdapter extends require('./http') {
    */
   query4 (/** @type express.Request */ req) {
     let q = req.body = cds.ql(req.body) || this.error (400, 'Invalid query', { query: req.body })
-    // assert valid target entity
-    if (q.target?._unresolved && this.service.definition) {
-      q.target = q._target = this.service.entities [q.target.name]
-      || this.error (404, `'${q.target.name}' is not an entity served by '${this.service.name}'.`, { query:q })
-    }
     // handle request headers
     if (q.SELECT) {
       if (req.get('Accept-Language')) q.SELECT.localized = true
@@ -83,7 +76,17 @@ class HCQLAdapter extends require('./http') {
     }
     // got a valid query
     if (LOG._debug) LOG.debug (inspect(q))
-    return q
+    return this.valid(q)
+  }
+
+  /**
+   * Checks whether the service actually serves the target entity.
+   */
+  valid (query) {
+    if (!this.service.definition) return query
+    let target = cds.infer.target (query, this.service)
+    if (target._unresolved) throw this.error (400, `${target.name} is not an entity served by '${this.service.name}'.`, { query })
+    return query
   }
 
   /**
@@ -116,4 +119,11 @@ class HCQLAdapter extends require('./http') {
   }
 }
 
+const ql_fragment = x => {
+  if (x.length) {
+    x = SELECT (`from x ${x}`).SELECT
+    delete x.from
+  }
+  return x
+}
 module.exports = HCQLAdapter

package/lib/srv/protocols/index.js

@@ -127,15 +127,6 @@ class Protocols {
     return endpoints //.length ? endpoints : null
   }
 
-
-  /**
-   * For compatibility with old @sap/cds-dk versions <= 7.4.0
-   * @deprecated Use def.protocols instead
-   */
-  protocol4 (def) {
-    return def.protocols?.odata ? ['odata'] : []
-  }
-
   /**
    * Rarely used, e.g., by compile.to.openapi:
    * NOT PUBLIC API, hence not documented.

package/lib/srv/protocols/odata-v4.js

@@ -1,6 +1 @@
-const cds = require('../../index')
-if (cds.env.features.odata_new_adapter) {
-  module.exports = require('../../../libx/odata/ODataAdapter')
-} else {
-  module.exports = require('./okra')
-}
+module.exports = require('../../../libx/odata/ODataAdapter')

package/lib/srv/srv-dispatch.js

@@ -20,14 +20,11 @@ exports.dispatch = async function dispatch (req) { //NOSONAR
     q => this.dispatch ({ query:q, context: req.context, __proto__:req })
   ))
 
-  // Ensure target and fqns
-  if (!req.target) _ensure_target (this,req)
-  if (typeof req.query === 'object') {
-    if (req.query._target !== req.target) Object.defineProperty (req.query,'_target',{ value:req.target, configurable:true, writable:true })
-    if (!req.query._srv) Object.defineProperty (req.query,'_srv',{ value:this, configurable:true, writable:true })
-  }
+  // Ensure inferred target and fqns
+  _ensure_target (this,req)
 
-  return this.handle(req)
+  // Actually handle the request
+  return this.handle (req)
 }
 
 
@@ -64,7 +61,6 @@ exports.handle = async function handle (req) {
       const x = await each.handler.call (srv,r,next)
       if (x !== undefined)      return r.reply(x)
       if (r.results)            return r.results
-      if (srv._implicit_next)   return next()
     }()
     if (req.errors) throw req.reject()
   }
@@ -86,33 +82,35 @@ const _is_array = Array.isArray
 const _dummy = ()=>{} // REVISIT: required for some messaging tests which obviously still expect and call next()
 
 const _ensure_target = (srv,req) => {
-  const q = req.query, p = req._.path || req._.entity; if (!q && !p) return
-  if (srv.namespace) { // ensure fully-qualified names
-    if (p) _ensure_fqn (req,'path',srv, p.startsWith('/') ? p.slice(1) : p)
-    else if (q.SELECT) _ensure_fqn (q.SELECT,'from',srv)
-    else if (q.INSERT) _ensure_fqn (q.INSERT,'into',srv)
-    else if (q.UPSERT) _ensure_fqn (q.UPSERT,'into',srv)
-    else if (q.UPDATE) _ensure_fqn (q.UPDATE,'entity',srv)
-    else if (q.DELETE) _ensure_fqn (q.DELETE,'from',srv)
+
+  // Requests with query
+  if (typeof req.query === 'object') {
+    const q = req.query = cds.ql(req.query)
+    if (!q._subject) return // REVISIT: this is for attic code which sends strange req.query = {}
+    if (!q._srv) q.bind (srv) // ensure req.query to be an instance of cds.ql.Query
+    if (!req.target) {
+      if (srv.namespace && q._subject.ref) _ensure_fqn (q._subject.ref,0, srv)
+      req.target = cds.infer.target(q)
+    }
+    if (q._target !== req.target) q._target = req.target
+  }
+
+  // Requests without query
+  else if (!req.target && srv.namespace) {
+    let p = req._.path || req._.entity
+    if (p) _ensure_fqn (req,'path', srv, p[0] === '/' ? p.slice(1) : p)
+    if (srv.model?.definitions[req.path]) req.target = srv.model.definitions[req.path]
   }
-  const defs = srv.model?.definitions || {}
-  req.target = typeof q === 'object' ? cds.infer(q,defs) : defs[req.path]
 }
 
-const _ensure_fqn = (x,p,srv, from = x[p]) => {
-  if (!from) return
-  if (typeof from === 'string') {
-    if (from in srv.entities) return x[p] = srv.entities[from].name
-    if (srv.isDatabaseService) return
-    if (srv.model && from in srv.model.definitions) return
-    if (from.startsWith(srv.namespace)) return
-    if (from.endsWith('_drafts')) return // REVISIT: rather fix test/fiori/localized-draft.test.js ?
-    else x[p] = `${srv.namespace}.${from}`
-  } else if (from.ref) {
-    const [head] = from.ref
-    head.id ? _ensure_fqn(head,'id',srv) : _ensure_fqn(from.ref,0,srv)
-    if (x.where) for (let y of x.where) if (y.SELECT) _ensure_fqn(y.SELECT,'from',srv)
+const _ensure_fqn = (x,p,srv, name = x[p]) => {
+  if (name.id) return _ensure_fqn (name,'id', srv, name.id)
+  if (srv.model) {
+    if (name in srv.model.definitions) return // already an fqn
+    if (name in srv.entities) return x[p] = srv.entities[name].name
   }
+  if (srv.isDatabaseService) return // db services allow unknown entities, e.g. 'sqlite.schema'
+  if (!name.startsWith(srv.namespace+'.')) x[p] = `${srv.namespace}.${name}`
 }
 
 const _unhandled = (srv,req) => {