@sap/cds 8.9.4 → 9.0.2

package/libx/_runtime/cds-services/util/assert.js

@@ -2,14 +2,10 @@ const cds = require('../../cds')
 const LOG = cds.log('app')
 const templatePathSerializer = require('../../common/utils/templateProcessorPathSerializer')
 
-// REVISIT: replace with cds.Request
-const getEntry = require('../../common/error/entry')
-
 const typeCheckers = require('../../../common/assert/type-strict')
 const { 'cds.Decimal': checkDecimal } = typeCheckers
 const { checkMandatory, checkEnum, checkRange, checkFormat } = require('../../../common/assert/validation')
 
-const ASSERT_VALID_ELEMENT = 'ASSERT_VALID_ELEMENT'
 const ASSERT_RANGE = 'ASSERT_RANGE'
 const ASSERT_FORMAT = 'ASSERT_FORMAT'
 const ASSERT_DATA_TYPE = 'ASSERT_DATA_TYPE'
@@ -49,11 +45,12 @@ const assertError = (code, element, value, key, path) => {
     args: args ?? [name ?? key]
   }
 
-  const assertError = Object.assign(error, getEntry(errorEntry))
+  const assertError = Object.assign(error, errorEntry)
   Object.assign(assertError, {
     entity: element.parent && element.parent.name,
     element: name, // > REVISIT: when is error.element needed?
     type: element.items ? element.items._type : type,
+    status: 400,
     value
   })
 
@@ -69,58 +66,6 @@ const assertError = (code, element, value, key, path) => {
   return assertError
 }
 
-// Limitation: depth 1
-const checkComplexType = ([key, value], elements, ignoreNonModelledData) => {
-  let found = false
-
-  for (const objKey in elements) {
-    if (objKey.startsWith(`${key}_`)) {
-      const element = elements[objKey]
-      const typeChecker = typeCheckers[element._type]
-      found = true
-
-      const nestedData = value[objKey.substring(key.length + 1)]
-      // check existence of nestedData to not stumble across not-provided, yet-modelled type parts with depth > 1
-      if (nestedData && !typeChecker(nestedData)) {
-        return false
-      }
-    }
-  }
-
-  return found || ignoreNonModelledData
-}
-
-// TODO: what fails if no-op?!
-const checkStaticElementByKey = (definition, key, value, result = [], ignoreNonModelledData = true) => {
-  const elementsOrParameters = definition.elements || definition.params
-  if (!elementsOrParameters) return result
-  const elementOrParameter = elementsOrParameters[key]
-
-  if (!elementOrParameter) {
-    if (!checkComplexType([key, value], elementsOrParameters, ignoreNonModelledData)) {
-      result.push(assertError(ASSERT_VALID_ELEMENT, { name: key }))
-    }
-
-    return result
-  }
-
-  let typeChecker
-  if (elementOrParameter.isUUID && definition.name === 'ProvisioningService.tenant') {
-    // > old SCP accounts don't have UUID ids
-    typeChecker = typeCheckers['cds.String']
-  } else {
-    typeChecker = typeCheckers[elementOrParameter._type]
-  }
-
-  if (typeChecker && !typeChecker(value, elementOrParameter)) {
-    // code, entity, element, value
-    const args = [typeof value === 'string' ? '"' + value + '"' : value, elementOrParameter._type]
-    result.push(assertError({ code: ASSERT_DATA_TYPE, args }, elementOrParameter, value, key))
-  }
-
-  return result
-}
-
 /**
  * @param {import('../../types/api').InputConstraints} constraints
  */
@@ -176,19 +121,6 @@ const checkInputConstraints = ({ element, value, errors, key, pathSegmentsInfo }
   return errors
 }
 
-// TODO: what fails if no-op?!
-const checkStatic = (definition, data, ignoreNonModelledData = false) => {
-  if (!Array.isArray(data)) data = [data]
-
-  return data.reduce((result, row) => {
-    return Object.entries(row)
-      .filter(([, value]) => value !== null && value !== undefined)
-      .reduce((result, [key, value]) => {
-        return checkStaticElementByKey(definition, key, value, result, ignoreNonModelledData)
-      }, result)
-  }, [])
-}
-
 /**
  * Check whether the target entity referenced by the association (the reference's target) exists and assert an error if
  * the the reference's target doesn't exist.
@@ -244,8 +176,6 @@ const assertTargets = async (assertMap, errors) => {
 }
 
 module.exports = {
-  checkStatic,
-  checkStaticElementByKey,
   checkInputConstraints,
   assertTargets
 }

package/libx/_runtime/cds.js

@@ -15,10 +15,17 @@ cds.extend(service).with(require('./common/aspects/service'))
  * Added to cds.Service so it can be reused in cds.ApplicationService and cds.RemoteService.
  */
 cds.Service.prototype._requires_resolving = function (req) {
-  const already_resolved = req._resolved
-  const belongs_to_me = req.target?.name?.startsWith(this.definition?.name + '.')
-  const is_resolvable = this.model && _is_simple_cqn_query(req.query)
-  const requires_resolving = !(already_resolved || belongs_to_me) && is_resolvable
-  return requires_resolving
+  if (req._resolved) return false
+  if (!this.model) return false
+  if (!req.query || typeof req.query !== 'object') return false
+  if (Array.isArray(req.query)) return false
+  if (Object.keys(req.query).length === 0) return false
+  if (req.target?.name?.startsWith(this.definition?.name + '.')) return false
+  else return true
+}
+
+// FIXME: move resolve out of cds.ql !
+const resolve = require('../../lib/ql/resolve')
+cds.Service.prototype.resolve = function (query) {
+  return resolve(query, this)
 }
-const _is_simple_cqn_query = q => typeof q === 'object' && q !== null && !Array.isArray(q) && Object.keys(q).length > 0

package/libx/_runtime/common/Service.js

@@ -1,6 +1,5 @@
 const cds = require('../cds')
 
-const { findQueryTarget } = require('./utils/resolveView')
 const postProcess = require('./utils/postProcess')
 
 /**
@@ -8,111 +7,70 @@ const postProcess = require('./utils/postProcess')
  */
 class ApplicationService extends cds.Service {
   init() {
-    const clazz = this.constructor,
-      { generics } = clazz
-    for (let each of generics) clazz[each].call(this)
+    const clazz = this.constructor
+    for (let each of clazz.generics) clazz[each].call(this)
     return super.init()
   }
-
   static get generics() {
-    let generics = Reflect.getOwnPropertyDescriptor(this, '_generics')
-    if (generics) return generics.value
-    else {
-      const set = new Set(this.__proto__.generics)
-      for (let p of Reflect.ownKeys(this)) if (p.startsWith('handle_')) set.add(p)
-      Object.defineProperty(this, '_generics', { value: (generics = [...set]) })
-    }
-    return generics
-  }
-
-  static handle_authorization() {
-    require('./generic/auth').call(this)
+    return (this._generics ??= new Set([
+      ...(this.__proto__.generics || []),
+      ...Reflect.ownKeys(this).filter(p => p.startsWith('handle_'))
+    ]))
   }
 
-  static handle_etags() {
-    require('./generic/etag').call(this)
+  static get handle_authorization() {
+    return require('./generic/auth')
   }
 
-  static handle_validations() {
-    require('./generic/input').call(this)
+  static get handle_etags() {
+    return require('./generic/etag')
   }
 
-  static handle_stream_property() {
-    require('./generic/stream').call(this)
+  static get handle_validations() {
+    return require('./generic/input')
   }
 
-  static handle_puts() {
-    require('./generic/put').call(this)
+  static get handle_stream_property() {
+    return require('./generic/stream-only')
   }
 
-  static handle_temporal_data() {
-    require('./generic/temporal').call(this)
+  static get handle_temporal_data() {
+    return require('./generic/temporal')
   }
 
-  static handle_localized_data() {
-    // TODO: can we move handling of localized data here?
+  static get handle_paging() {
+    return require('./generic/paging') // > paging must be executed before sorting
   }
 
-  static handle_managed_data() {
-    // TODO: can we move handling of managed data here?
+  static get handle_sorting() {
+    return require('./generic/sorting')
   }
 
-  static handle_paging() {
-    require('./generic/paging').call(this) // > paging must be executed before sorting
-    require('./generic/sorting').call(this)
+  static get handle_drafts() {
+    return require('../fiori/lean-draft')
   }
 
-  static handle_fiori() {
-    require('../fiori/lean-draft').impl.call(this)
-  }
-
-  static handle_crud() {
-    require('./generic/crud').impl.call(this)
+  static get handle_crud() {
+    return require('./generic/crud')
   }
 
   // Overload .handle in order to resolve projections up to a definition that is known by the remote service instance.
   // Result is post processed according to the inverse projection in order to reflect the correct result of the original query.
   async handle(req) {
-    let result
-    let target = req.target
-
     // REVISIT: We must not allow arbitrary CQNs, so this shouldn't be here!
-    if (!this._requires_resolving(req)) {
-      result = await super.handle(req)
-    } else {
-      const query = cds.ql.resolve(req.query, this)
-      if (!query) throw new Error(`Target ${target.name} cannot be resolved for service ${this.name}`)
-      target = findQueryTarget(query) || req.target
-      // REVISIT: get rid of _4odata
-      if (req.query.SELECT?._4odata) Object.defineProperty(query.SELECT, '_4odata', { value: true })
-      // we need to provide target explicitly because it's cached within ensure_target
-      const _req = new cds.Request({ query, target, _resolved: true })
-      result = await super.dispatch(_req)
-      result = postProcess(query, result, this)
-    }
-
-    return result
-  }
-
-  /**
-   * @param serviceImpl
-   * @deprecated since version 1.11.0 - use Service.prepend instead
-   */
-  with(serviceImpl) {
-    return this.prepend(serviceImpl)
-  }
-
-  /**
-   * Registers custom handlers.
-   * @param {string | object | Function} serviceImpl - init function to register custom handlers.
-   */
-  impl(serviceImpl) {
-    if (typeof serviceImpl === 'string') serviceImpl = require(serviceImpl)
-    return this.prepend(serviceImpl)
+    if (!this._requires_resolving?.(req)) return super.handle(req)
+    // rewrite the query to a target entity served by this service...
+    const query = this.resolve(req.query)
+    if (!query) throw new Error(`Target ${req.target.name} cannot be resolved for service ${this.name}`)
+    const target = query._target || req.target
+    // we need to provide target explicitly because it's cached within ensure_target
+    const _req = new cds.Request({ query, target, _resolved: true })
+    return await this.dispatch(_req).then(result => postProcess(query, result, this))
   }
 }
 
 // NOTE: getRestrictions is VERY INOFFICIAL!!!
+//> only kept temporary because of an ill-devised usage in AMS plugin
 const { getRestrictions } = require('./generic/auth/restrictions')
 ApplicationService.prototype.getRestrictions = function (..._) {
   return getRestrictions.call(this, ..._)

package/libx/_runtime/common/aspects/any.js

@@ -27,39 +27,6 @@ const _isReadOnly = e => {
   )
 }
 
-const Relation = require('./relation')
-
-const _exposeRelation = relation => Object.defineProperty({}, '_', { get: () => relation })
-
-const _relationHandler = relation => ({
-  get: (target, name) => {
-    const path = name.split(',')
-    const prop = path.join('_')
-    if (!target[prop]) {
-      if (path.length === 1) {
-        // REVISIT: property 'join' must not be used in CSN to make this working
-        if (relation._has(prop)) return relation[prop]
-        const newRelation = Relation.to(relation, prop)
-        if (newRelation) {
-          target[prop] = new Proxy(_exposeRelation(newRelation), _relationHandler(newRelation))
-        }
-
-        return target[prop]
-      }
-
-      target[prop] = path.reduce((relation, value) => relation[value] || relation.csn._relations[value], relation)
-      target[prop].path = path
-    }
-
-    return target[prop]
-  }
-})
-
-const _getRelations = e => {
-  const newRelation = Relation.to(e)
-  return new Proxy(_exposeRelation(newRelation), _relationHandler(newRelation))
-}
-
 // NOTE: Please only add things which are relevant to _any_ type,
 // use specialized types otherwise (entity, Association, ...).
 module.exports = class {
@@ -83,11 +50,6 @@ module.exports = class {
     )
   }
 
-  // REVISIT: Where to put?
-  get _relations() {
-    return this.own('__relations', () => _getRelations(this))
-  }
-
   get _foreignKey4() {
     return this.own('__foreignKey4', () => foreignKey4(this))
   }

package/libx/_runtime/common/constants/events.js

@@ -1,13 +1,5 @@
-const MOD_EVENTS = { UPDATE: 1, DELETE: 1, EDIT: 1 }
-const WRITE_EVENTS = Object.assign({ CREATE: 1, NEW: 1, PATCH: 1, CANCEL: 1 }, MOD_EVENTS)
-const CRUD_EVENTS = Object.assign({ READ: 1 }, WRITE_EVENTS)
-const DRAFT_EVENTS = { PATCH: 1, CANCEL: 1, draftActivate: 1, draftPrepare: 1 }
-const CDS_EVENTS = Object.assign({}, CRUD_EVENTS, DRAFT_EVENTS)
-
-module.exports = {
-  MOD_EVENTS,
-  WRITE_EVENTS,
-  CRUD_EVENTS,
-  DRAFT_EVENTS,
-  CDS_EVENTS
-}
+exports.MOD_EVENTS = { UPDATE: 1, DELETE: 1, EDIT: 1 }
+exports.WRITE_EVENTS = { CREATE: 1, NEW: 1, PATCH: 1, CANCEL: 1, ...exports.MOD_EVENTS }
+exports.CRUD_EVENTS = { READ: 1, ...exports.WRITE_EVENTS }
+exports.DRAFT_EVENTS = { PATCH: 1, CANCEL: 1, draftActivate: 1, draftPrepare: 1 }
+exports.CDS_EVENTS = { ...exports.CRUD_EVENTS, ...exports.DRAFT_EVENTS }

package/libx/_runtime/common/generic/auth/autoexpose.js

@@ -1,6 +1,4 @@
-const cds = require('../../../../../lib')
-
-function noah_handler(req) {
+function check_autoexposed(req) {
   if (!req.subject) return
   const root = this.model.definitions[req.subject.ref[0].id || req.subject.ref[0]]
   if (!root) return
@@ -11,32 +9,20 @@ function noah_handler(req) {
    * Draft case is an exception. Direct requests are allowed.
    */
   if (!root._isDraftEnabled && root['@cds.autoexposed']) {
-    if (root['@cds.autoexpose']) {
-      if (req.event === 'READ') return //> allow read for value help requests
-      req.reject(405, 'ENTITY_IS_AUTOEXPOSE_READONLY', [root.name])
-    }
-    req.reject(405, 'ENTITY_IS_AUTOEXPOSED', [root.name])
+    if (!root['@cds.autoexpose']) return req.reject(405, 'ENTITY_IS_AUTOEXPOSED', [root.name])
+    if (req.event !== 'READ') return req.reject(405, 'ENTITY_IS_AUTOEXPOSE_READONLY', [root.name])
   }
-  const isAutoexposed = _isAutoexposed(req.target)
-  if (isAutoexposed && req.event !== 'READ') {
-    req.reject(405, 'ENTITY_IS_AUTOEXPOSE_READONLY', [req.target.name])
+  if (req.event !== 'READ' && _isAutoexposed(req.target)) {
+    return req.reject(405, 'ENTITY_IS_AUTOEXPOSE_READONLY', [req.target.name])
   }
 }
 
 const _isAutoexposed = entity => {
-  if (!entity) return false
-  return (entity['@cds.autoexpose'] && entity['@cds.autoexposed']) || entity.name.match(/\.DraftAdministrativeData$/)
-}
-
-// REVISIT: To be deleted after okra is removed
-function okra_handler(req) {
-  const isAutoexposed = _isAutoexposed(req.target)
-  if (isAutoexposed && req.event !== 'READ') {
-    req.reject(405, 'ENTITY_IS_AUTOEXPOSE_READONLY', [req.target.name])
-  }
+  if (!entity) return
+  if (entity['@cds.autoexpose'] && entity['@cds.autoexposed']) return true
+  if (entity.name.endsWith('.DraftAdministrativeData')) return true
 }
 
-const handler = cds.env.features.odata_new_adapter ? noah_handler : okra_handler
-handler._initial = true
+check_autoexposed._initial = true
 
-module.exports = handler
+module.exports = check_autoexposed

package/libx/_runtime/common/generic/auth/capabilities.js

@@ -1,15 +1,15 @@
-const { cqnFrom } = require('./utils')
-const { RESTRICTIONS } = require('./constants')
-
-const _getRestriction = (req, capability, capabilityReadByKey) => {
-  if (capabilityReadByKey !== undefined && req.query.SELECT?.one) {
-    return capabilityReadByKey
-  }
-  return capability
+const RESTRICTIONS = {
+  CREATE: 'InsertRestrictions.Insertable',
+  READ: 'ReadRestrictions.Readable',
+  READABLE_BY_KEY: 'ReadRestrictions.ReadByKeyRestrictions.Readable',
+  UPDATE: 'UpdateRestrictions.Updatable',
+  DELETE: 'DeleteRestrictions.Deletable'
 }
 
+const _getRestriction = (req, capability, capabilityReadByKey) =>
+  capabilityReadByKey !== undefined && req.query.SELECT?.one ? capabilityReadByKey : capability
+
 const _getNavigationRestriction = (target, path, annotation, req) => {
-  if (!target) return
   if (!Array.isArray(target['@Capabilities.NavigationRestrictions.RestrictedProperties'])) return
 
   const [restriction, operation] = annotation.split('.')
@@ -33,14 +33,15 @@ const _getNav = from => {
   return []
 }
 
-function handler(req) {
+function check_odata_constraints(req) {
   // TODO: Determine auth-relevant entity
   const annotation = RESTRICTIONS[req.event]
+  if (!annotation) return
+  if (!req.target) return
 
-  if (!req.target || !annotation) return
+  const from = req.subject
+  if (!from) return //> exit fast
 
-  const action = annotation.split('.').pop().toLowerCase()
-  const from = cqnFrom(req)
   const nav = _getNav(from)
 
   let navRestriction
@@ -61,11 +62,12 @@ function handler(req) {
     }
     if (lastTarget && navigation) {
       navRestriction = _getNavigationRestriction(lastTarget, navigation, annotation, req)
-    }
-    if (navRestriction === false) {
-      // REVISIT: rework exception with using target
-      const trgt = `${_localName(lastTarget)}.${navs.join('.')}`
-      req.reject(405, 'ENTITY_IS_NOT_CRUD_VIA_NAVIGATION', [_localName(req.target), action, trgt])
+      if (navRestriction === false) {
+        // REVISIT: rework exception with using target
+        const trgt = `${_localName(lastTarget)}.${navs.join('.')}`
+        const action = annotation.split('.').pop().toLowerCase() // REVISIT: .split.pop is an anti pattern !!
+        req.reject(405, 'ENTITY_IS_NOT_CRUD_VIA_NAVIGATION', [_localName(req.target), action, trgt])
+      }
     }
   }
 
@@ -77,10 +79,11 @@ function handler(req) {
       req.target['@Capabilities.' + RESTRICTIONS.READABLE_BY_KEY]
     ) === false
   ) {
+    const action = annotation.split('.').pop().toLowerCase() // REVISIT: .split.pop is an anti pattern !!
     req.reject(405, 'ENTITY_IS_NOT_CRUD', [_localName(req.target), action])
   }
 }
 
-handler._initial = true
+check_odata_constraints._initial = true
 
-module.exports = handler
+module.exports = check_odata_constraints

package/libx/_runtime/common/generic/auth/expand.js

@@ -40,7 +40,7 @@ const _getRestrictedExpand = (columns, target, definitions) => {
   }
 }
 
-function handler(req) {
+function restrict_expand(req) {
   if (!req.query) return
   const restricted = _getRestrictedExpand(
     req.query.SELECT && req.query.SELECT.columns,
@@ -50,6 +50,6 @@ function handler(req) {
   if (restricted) req.reject(400, 'EXPAND_IS_RESTRICTED', [restricted])
 }
 
-handler._initial = true
+restrict_expand._initial = true
 
-module.exports = handler
+module.exports = restrict_expand

package/libx/_runtime/common/generic/auth/index.js

@@ -41,7 +41,7 @@ module.exports = cds.service.impl(function authorization() {
   // }
 
   // mark entities that depend on ancestor for auth with that ancestor
-  const defs = this.model.definitions
+  const defs = this.model?.definitions
   for (const each of this.entities) {
     for (const k in each.compositions) {
       const c = each.compositions[k]
@@ -59,8 +59,8 @@ module.exports = cds.service.impl(function authorization() {
   }
 
   // service-level restrictions (not all requests are dispatched by protocol adapter with its early access check)
-  // REVISIT: make default in cds^9 -> remove feature flag completely or at least make it an opt-out
-  if (cds.env.features.service_level_restrictions) this.before('*', serviceHandler)
+  // REVISIT cds^10: remove opt-out
+  if (cds.env.features.service_level_restrictions !== false && this.definition) this.before('*', serviceHandler)
 
   /*
    * @requires

package/libx/_runtime/common/generic/auth/insertOnly.js

@@ -1,6 +1,6 @@
 const { getAuthRelevantEntity } = require('./utils')
 
-function handler(req) {
+function check_insertonly(req) {
   const entity = getAuthRelevantEntity(req, this.model, ['@insertonly'])
   if (!entity || !entity['@insertonly']) return
 
@@ -10,6 +10,6 @@ function handler(req) {
   }
 }
 
-handler._initial = true
+check_insertonly._initial = true
 
-module.exports = handler
+module.exports = check_insertonly

package/libx/_runtime/common/generic/auth/readOnly.js

@@ -1,7 +1,7 @@
 const { getAuthRelevantEntity } = require('./utils')
-const { WRITE_EVENTS } = require('./constants')
+const { WRITE_EVENTS } = require('../../constants/events')
 
-function handler(req) {
+function check_readonly(req) {
   // @read-only
   let entity = getAuthRelevantEntity(req, this.model, ['@readonly'])
   entity = entity?.actives || entity
@@ -10,6 +10,6 @@ function handler(req) {
   if (entity['@readonly'] && req.event in WRITE_EVENTS) req.reject(405, 'ENTITY_IS_READ_ONLY', [entity.name])
 }
 
-handler._initial = true
+check_readonly._initial = true
 
-module.exports = handler
+module.exports = check_readonly

package/libx/_runtime/common/generic/auth/requires.js

@@ -1,5 +1,5 @@
 const { reject, getRejectReason, getAuthRelevantEntity } = require('./utils')
-const { CRUD_EVENTS } = require('./constants')
+const { CRUD_EVENTS } = require('../../constants/events')
 
 const _getRequiresAsArray = definition =>
   definition['@requires']
@@ -8,7 +8,7 @@ const _getRequiresAsArray = definition =>
       : [definition['@requires']]
     : false
 
-function handler(req) {
+function check_auth_privileges(req) {
   if (req.user._is_privileged) {
     // > skip checks
     return
@@ -37,6 +37,6 @@ function handler(req) {
   reject(req, getRejectReason(req, '@requires', definition))
 }
 
-handler._initial = true
+check_auth_privileges._initial = true
 
-module.exports = handler
+module.exports = check_auth_privileges