@sap/cds 8.9.4 → 9.0.3

package/libx/odata/middleware/operation.js

@@ -1,10 +1,14 @@
 const cds = require('../../../')
 
+const { pipeline } = require('node:stream/promises')
+
+const { cds2edm, handleSapMessages } = require('../utils')
 const getODataMetadata = require('../utils/metadata')
 const postProcess = require('../utils/postProcess')
 const getODataResult = require('../utils/result')
 
-const { cds2edm, handleSapMessages, calculateLocationHeader } = require('../utils')
+const location4 = require('../../http/location')
+
 const { getKeysAndParamsFromPath } = require('../../common/utils/path')
 const {
   collectStreamMetadata,
@@ -96,7 +100,8 @@ module.exports = adapter => {
     const headers = { ...cds.context.http.req.headers, ...req.headers }
 
     // we need a cds.Request for multiple reasons, incl. params, headers, sap-messages, read after write, ...
-    const cdsReq = adapter.request4({ query, event, data, params, headers, target: query?.target, req, res })
+    const target = query && cds.infer.target(query) // FIXME: this should not happen here but only in an event handler !
+    const cdsReq = adapter.request4({ query, event, data, params, headers, target, req, res })
 
     const _isStream = operation.returns?._type === 'cds.LargeBinary' && !!operation.returns['@Core.MediaType']
 
@@ -124,28 +129,7 @@ module.exports = adapter => {
           if (filename && !res.get('content-disposition'))
             res.set('content-disposition', `${disposition}; filename="${encodeURIComponent(filename)}"`)
 
-          return new Promise((resolve, reject) => {
-            if (res.destroyed)
-              return reject(
-                new cds.error({ code: 'ERR_STREAM_PREMATURE_CLOSE', message: 'Response was closed while streaming' })
-              )
-            stream.pipe(res)
-            stream.on('end', () => resolve(result))
-            stream.once('error', reject)
-            let finished = false
-            res.on('finish', () => (finished = true))
-            res.on(
-              'close',
-              () =>
-                !finished &&
-                reject(
-                  new cds.error({
-                    code: 'ERR_STREAM_PREMATURE_CLOSE',
-                    message: 'Response was closed while streaming'
-                  })
-                )
-            )
-          }).then(() => res.end())
+          return pipeline(stream, res)
         })
       )
       .then(result => {
@@ -166,8 +150,8 @@ module.exports = adapter => {
         }
 
         if (res.statusCode === 201 && !res.hasHeader('location')) {
-          const locationHeader = calculateLocationHeader(operation.returns, service, result)
-          if (locationHeader) res.set('location', locationHeader)
+          const location = location4(operation.returns, service, result)
+          if (location) res.set('location', location)
         }
 
         if (operation.returns) {

package/libx/odata/middleware/read.js

@@ -85,12 +85,13 @@ const _checkExpandDeep = (column, entity, namespace) => {
   }
 }
 
-const resolveProxyExpands = ({ SELECT: { columns }, target: entity }, service) => {
-  if (!columns) return
-
-  for (const column of columns) {
+const resolveProxyExpands = (query, service) => {
+  const { SELECT } = query
+  if (!SELECT.columns) return
+  const { elements } = cds.infer.target(query) // FIXME: this should not happen here but only in an event handler !
+  for (const column of SELECT.columns) {
     if (column.expand) {
-      _checkExpandDeep(column, entity.elements[column.ref[0]]._target, service.definition.name)
+      _checkExpandDeep(column, elements[column.ref[0]]._target, service.definition.name)
     }
   }
 }
@@ -193,7 +194,6 @@ module.exports = adapter => {
     // REVISIT: better solution for _propertyAccess
     let {
       SELECT: { from, one },
-      target,
       _propertyAccess
     } = req._query
     const { _query: query } = req
@@ -208,9 +208,6 @@ module.exports = adapter => {
     // we need a cds.Request for multiple reasons, incl. params, headers, sap-messages, read after write, ...
     const cdsReq = adapter.request4({ query, data, params, headers, req, res })
 
-    // REVISIT: what is this for? some tests fail without it... we should find a better solution!
-    Object.defineProperty(query.SELECT, '_4odata', { value: true })
-
     if (cds.env.effective.odata.proxies && cds.env.effective.odata.xrefs) {
       // REVISIT check above is still not perfect solution
       resolveProxyExpands(query, service)
@@ -218,11 +215,9 @@ module.exports = adapter => {
 
     if (!query.SELECT.columns) query.SELECT.columns = ['*']
 
+    const target = cds.infer.target(req._query) // FIXME: this should not happen here but only in an event handler !
     handleStreamProperties(target, query.SELECT.columns, model)
 
-    // REVISIT: what is this for? some tests fail without it... we should find a better solution!
-    Object.defineProperty(query.SELECT, '_4odata', { value: true })
-
     // NOTES:
     // - only via srv.run in combination with srv.dispatch inside,
     //   we automatically either use a single auto-managed tx for the req (i.e., insert and read after write in same tx)
@@ -232,9 +227,8 @@ module.exports = adapter => {
       .run(() => {
         return service.dispatch(cdsReq).then(result => {
           // 404
-          if (result == null && query.SELECT.one && !(_isNullableSingleton(query) || _isToOneAssoc(query))) {
-            throw Object.assign(new Error('404'), { statusCode: 404 })
-          }
+          if (result == null && query.SELECT.one && !(_isNullableSingleton(query) || _isToOneAssoc(query)))
+            throw new cds.error(404)
 
           return result
         })
@@ -273,9 +267,7 @@ module.exports = adapter => {
         const metadata = getODataMetadata(query, { result, isCollection: !one })
         result = getODataResult(result, metadata, { isCollection: !one, property: _propertyAccess })
 
-        if (!result) {
-          throw Object.assign(new Error('404'), { statusCode: 404 })
-        }
+        if (!result) throw new cds.error({ code: 404 })
 
         res.send(result)
       })

package/libx/odata/middleware/stream.js

@@ -1,6 +1,6 @@
 const cds = require('../../../')
 const LOG = cds.log('odata')
-const getError = require('../../_runtime/common/error')
+const { pipeline } = require('node:stream/promises')
 
 const { handleSapMessages, validateIfNoneMatch, isStream, isRedirect } = require('../utils')
 const { getKeysAndParamsFromPath } = require('../../common/utils/path')
@@ -18,7 +18,8 @@ const _resolveContentProperty = (target, annotName, resolvedProp) => {
     LOG.warn(
       `"${annotName}" in entity "${target.name}" points to property "${resolvedProp}" which was renamed or is not part of the projection. You must update the annotation value.`
     )
-  const mapping = cds.ql.resolve.transitions({ target }, cds.db).mapping
+  // REVISIT: do not allow renaming of content type property. always rely on compiler resolving.
+  const mapping = cds.ql.resolve.transitions({ _target: target }, cds.db).mapping
   const key = [...mapping.entries()].find(({ 1: val }) => val.ref[0] === resolvedProp)
   return key?.length && key[0]
 }
@@ -26,14 +27,14 @@ const _resolveContentProperty = (target, annotName, resolvedProp) => {
 const _addMetadataProperty = (query, property, annotName, odataName) => {
   if (typeof property[annotName] === 'object') {
     const contentProperty = _resolveContentProperty(
-      query.target,
+      query._target,
       annotName,
       property[annotName]['='].replaceAll(/\./g, '_')
     )
-    query.target.elements[contentProperty]
+    query._target.elements[contentProperty]
       ? query.SELECT.columns.push({ ref: [contentProperty], as: odataName })
       : LOG._warn &&
-        LOG.warn(`"${annotName.split('.')[1]}" ${contentProperty} not found in entity "${query.target.name}".`)
+        LOG.warn(`"${annotName.split('.')[1]}" ${contentProperty} not found in entity "${query._target.name}".`)
   } else {
     query.SELECT.columns.push({ val: property[annotName], as: odataName })
   }
@@ -44,8 +45,8 @@ const _addStreamMetadata = query => {
   const ref = query.SELECT.columns?.[0].ref || query.SELECT.from.ref
   const propertyName = ref.at(-1)
   let mediaTypeProperty
-  for (let key in query.target.elements) {
-    const val = query.target.elements[key]
+  for (let key in query._target.elements) {
+    const val = query._target.elements[key]
     if (val['@Core.MediaType'] && val.name === propertyName) {
       mediaTypeProperty = val
       break
@@ -91,10 +92,10 @@ module.exports = adapter => {
 
     const [previous, lastPathElement] = req.path.split('/').slice(-2)
     const _isStreamByDollarValue =
-      query.SELECT?.one && lastPathElement === '$value' && !(previous in query.target.elements)
+      query.SELECT?.one && lastPathElement === '$value' && !(previous in cds.infer.target(query).elements) // FIXME: cds.infer should not be used before ensure_target / srv.dispatch
     if (_isStreamByDollarValue) {
-      for (const k in query.target.elements) {
-        if (query.target.elements[k]['@Core.MediaType']) {
+      for (const k in query._target.elements) {
+        if (query._target.elements[k]['@Core.MediaType']) {
           query.SELECT.columns = [{ ref: [k] }]
           query._propertyAccess = k
           break
@@ -108,7 +109,7 @@ module.exports = adapter => {
 
     if (!_isStream) return next()
 
-    if (!query.target['@cds.persistence.skip'] && !isMimeTypeStreamedByDefault) {
+    if (!query._target['@cds.persistence.skip'] && !isMimeTypeStreamedByDefault) {
       _addStreamMetadata(query)
     }
 
@@ -119,9 +120,6 @@ module.exports = adapter => {
     // we need the cds request, so we can access the modified query, which is cloned due to lean-draft, so we need to use dispatch here and pass a cds req
     const cdsReq = adapter.request4({ query, data: keys, params, req, res })
 
-    // REVISIT: what is this for? some tests fail without it... we should find a better solution!
-    Object.defineProperty(query.SELECT, '_4odata', { value: true })
-
     // NOTES:
     // - only via srv.run in combination with srv.dispatch inside,
     //   we automatically either use a single auto-managed tx for the req (i.e., insert and read after write in same tx)
@@ -131,7 +129,7 @@ module.exports = adapter => {
       .run(() => {
         return service.dispatch(cdsReq).then(async result => {
           if (res.headersSent) return
-          if (result === undefined) throw getError(404) // entity is not existing
+          if (result === undefined) throw new cds.error(404) // entity is not existing
           if (result === null) return res.sendStatus(204) // custom handler returns null
 
           if (validateIfNoneMatch(cdsReq.target, req.headers?.['if-none-match'], result)) return res.sendStatus(304)
@@ -158,25 +156,7 @@ module.exports = adapter => {
           if (filename && !res.get('content-disposition'))
             res.set('content-disposition', `${disposition}; filename="${encodeURIComponent(filename)}"`)
 
-          return new Promise((resolve, reject) => {
-            if (res.destroyed)
-              return reject(
-                new cds.error({ code: 'ERR_STREAM_PREMATURE_CLOSE', message: 'Response was closed while streaming' })
-              )
-            stream.pipe(res)
-            stream.on('end', () => resolve(result))
-            stream.once('error', reject)
-            let finished = false
-            res.on('finish', () => (finished = true))
-            res.on(
-              'close',
-              () =>
-                !finished &&
-                reject(
-                  new cds.error({ code: 'ERR_STREAM_PREMATURE_CLOSE', message: 'Response was closed while streaming' })
-                )
-            )
-          })
+          return pipeline(stream, res)
         })
       })
       .then(() => {

package/libx/odata/middleware/update.js

@@ -1,7 +1,7 @@
 const cds = require('../../../')
 const { UPDATE } = cds.ql
 
-const { handleSapMessages, getPreferReturnHeader, extractIfNoneMatch, isStream } = require('../utils')
+const { handleSapMessages, getPreferReturnHeader, isStream } = require('../utils')
 const getODataMetadata = require('../utils/metadata')
 const postProcess = require('../utils/postProcess')
 const readAfterWrite4 = require('../utils/readAfterWrite')
@@ -11,12 +11,8 @@ const odataBind = require('../utils/odataBind')
 
 const { getKeysAndParamsFromPath } = require('../../common/utils/path')
 
-const _isUpsertAllowed = ({ target, data, event }) => {
-  return (
-    !(cds.env.runtime && cds.env.runtime.allow_upsert === false) &&
-    !(target && target._isDraftEnabled && !data.IsActiveEntity && event === 'PATCH')
-  )
-}
+const prepare_put_requests = require('../../http/put')
+
 // Not supported:
 // 1) If some parent entity needs to be updated, reason: we only generate one CQN statement for the target.
 // 2) If the foreign key is not known, i.e. when having no key information of the immediate parent, e.g. /Root(1)/foo/bar
@@ -52,7 +48,6 @@ module.exports = adapter => {
     // REVISIT: better solution for _propertyAccess
     const {
       SELECT: { one, from },
-      target,
       _propertyAccess
     } = req._query
 
@@ -70,32 +65,27 @@ module.exports = adapter => {
     const model = cds.context.model ?? service.model
 
     // payload & params
+    const target = cds.infer.target(req._query) // FIXME: this should not happen here but only in an event handler !
     const data = _propertyAccess ? { [_propertyAccess]: req.body.value } : req.body
     odataBind(data, target)
     normalizeTimeData(data, model, target)
     const { keys, params } = getKeysAndParamsFromPath(from, { model })
-    // add keys from url into payload (overwriting if already present)
-    if (!_propertyAccess) Object.assign(data, keys)
+    if (!_propertyAccess) {
+      // add keys from url into payload (overwriting if already present)
+      Object.assign(data, keys)
+      // add default values for unprovided properties
+      if (req.method === 'PUT') prepare_put_requests(service, target, data)
+    }
 
-    const _isDraft = target.drafts && data.IsActiveEntity !== true
     // query
-    let query = UPDATE.entity(from).with(data)
+    const query = UPDATE.entity(from).with(data)
 
     // cdsReq.headers should contain merged headers of envelope and subreq
+    // REVISIT: this overrides the merging mechanism in cds.Request which is meant to handle this centrally !!
     const headers = { ...cds.context.http.req.headers, ...req.headers }
 
     // we need a cds.Request for multiple reasons, incl. params, headers, sap-messages, read after write, ...
-    const cdsReq = adapter.request4({
-      method: _propertyAccess ? 'PATCH' : req.method,
-      query,
-      params,
-      headers,
-      req,
-      res
-    })
-
-    // rewrite event for draft-enabled entities
-    if (_isDraft) cdsReq.event = 'PATCH'
+    const cdsReq = adapter.request4({ query, params, headers, req, res })
 
     // NOTES:
     // - only via srv.run in combination with srv.dispatch inside,
@@ -144,9 +134,10 @@ module.exports = adapter => {
         // if UPSERT is allowed, redirect to POST
         const is404 = err.code === 404 || err.status === 404 || err.statusCode === 404
         const isForcedInsert =
-          (err.code === 412 || err.status === 412 || err.statusCode === 412) &&
-          extractIfNoneMatch(req.headers?.['if-none-match']) === '*'
-        if (!_propertyAccess && (is404 || isForcedInsert) && _isUpsertAllowed({ target, data, event: req.method })) {
+          (err.code === 412 || err.status === 412 || err.statusCode === 412) && req.get('if-none-match') === '*'
+        const isUpsertAllowed =
+          (cds.env.runtime.put_as_upsert && req.method === 'PUT') || cds.env.runtime.patch_as_upsert
+        if (!_propertyAccess && (is404 || isForcedInsert) && isUpsertAllowed) {
           // PUT / PATCH with if-match header means "only if already exists" -> no insert if it does not
           if (req.headers['if-match']) return next(Object.assign(new Error('412'), { statusCode: 412 }))
 

package/libx/odata/parse/afterburner.js

@@ -303,7 +303,7 @@ function _processSegments(from, model, namespace, cqn, protocol) {
       // > key
       // in case of odata, values for keys that are backlinks are expected to be omitted
       keys = keys || keysOf(current, !!protocol?.match(/odata/i))
-      if (!keys.length) cds.error(`Invalid resource path "${path}"`, { code: '404', statusCode: 404 })
+      if (!keys.length) throw new cds.error(404, `Invalid resource path "${path}"`)
       let key = keys[keyCount++]
       one = true
       const element = current.elements[key]
@@ -337,7 +337,7 @@ function _processSegments(from, model, namespace, cqn, protocol) {
       current = _getDefinition(current, seg, namespace) || _getDefinition(current, seg.replace(/_/g, '.'), namespace)
 
       // REVISIT: 404 or 400?
-      if (!current) cds.error(`Invalid resource path "${path}"`, { code: '404', statusCode: 404 })
+      if (!current) throw new cds.error(404, `Invalid resource path "${path}"`)
 
       if (current.params && current.kind === 'entity') {
         // > View with params
@@ -585,6 +585,13 @@ function _processColumns(cqn, target, protocol) {
 
   let columns = cqn.SELECT.columns
 
+  if (columns && !columns.length && cqn.SELECT.groupBy) {
+    cds.error('Explicit select must include at least one column available in the result set of groupby!', {
+      code: '400',
+      statusCode: 400
+    })
+  }
+
   if (columns && !cqn.SELECT.groupBy) {
     let entity
     if (target.kind === 'entity') entity = target
@@ -773,20 +780,18 @@ module.exports = (cqn, model, namespace, protocol) => {
     //required for concat query, where the root is already identified with the first query and subsequent queries already have correct root
     edmName = edmName.split('.')[edmName.split('.').length - 1]
 
-  /*
-   * make first path segment fully qualified
-   */
+  // Make first path segment fully qualified
   const root = findCsnTargetFor(edmName, model, namespace)
 
   if (!root) {
     //404 else we would expose knowledge to potential attackers
-    cds.error(`Invalid resource path "${namespace}.${ref[0].id || ref[0]}"`, { code: '404', statusCode: 404 })
+    throw new cds.error(404, `Invalid resource path "${namespace}.${ref[0].id || ref[0]}"`)
   }
   if (cds.env.effective.odata.containment && model.definitions[namespace]._containedEntities.has(root.name)) {
-    cds.error(`Invalid resource path "${namespace}.${ref[0].id || ref[0]}"! It is not an entity set nor a singleton.`, {
-      code: '404',
-      statusCode: 404
-    })
+    throw new cds.error(
+      404,
+      `Invalid resource path "${namespace}.${ref[0].id || ref[0]}"! It is not an entity set nor a singleton.`
+    )
   }
   if (ref[0].id) ref[0].id = root.name
   else ref[0] = root.name
@@ -819,7 +824,7 @@ module.exports = (cqn, model, namespace, protocol) => {
   if (target?.elements?.LimitedDescendantCount) {
     let uplinkName
     for (const key in target) {
-      if (key.match(/@Aggregation\.RecursiveHierarchy#.*\.ParentNavigationProperty/)) {
+      if (key.match(/@Aggregation\.RecursiveHierarchy\s*#.*\.ParentNavigationProperty/)) {
         // Qualifiers are bad for lookups
         uplinkName = target[key]['=']
         break
@@ -832,15 +837,14 @@ module.exports = (cqn, model, namespace, protocol) => {
   }
 
   // REVISIT: better
-  // set target (csn definition) for later retrieval
-  cqn.__target = current.parent?.kind === 'entity' ? `${current.parent.name}:$:${current.name}` : current.name
+  // Set target (csn definition) for later retrieval
+  if (protocol === 'rest')
+    cqn.__target = current.parent?.kind === 'entity' ? `${current.parent.name}:$:${current.name}` : current.name
 
   // target <=> endpoint entity, all navigation refs must be resolvable accordingly
   if (cds.env.effective.odata.structs) _resolveAliasesInNavigation(cqn, target)
 
-  /*
-   * add default aggregation function (and alias)
-   */
+  // Add default aggregation function (and alias)
   _processColumns(cqn, current, protocol)
 
   if (target) {

package/libx/odata/parse/cqn2odata.js

@@ -194,7 +194,9 @@ function _xpr(expr, target, kind, isLambda, navPrefix = []) {
         } else if (!where) {
           res.push(`${nav}/any()`)
         } else {
-          res.push(`${nav}/any(${LAMBDA_VARIABLE}:${_xpr(where, target, kind, true, navPrefix)})`)
+          res.push(
+            `${nav}/any(${LAMBDA_VARIABLE}:${_xpr(where, target?.elements[nav]._target, kind, true, navPrefix)})`
+          )
         }
 
         i++