@sap/cds 8.9.4 → 9.0.3

package/libx/_runtime/common/generic/auth/restrict.js

@@ -2,8 +2,8 @@ const cds = require('../../../cds'),
   LOG = cds.log('auth')
 
 const { reject, getRejectReason, resolveUserAttrs, getAuthRelevantEntity } = require('./utils')
-const { DRAFT_EVENTS, MOD_EVENTS } = require('./constants')
-const { getNormalizedPlainRestrictions } = require('./restrictions')
+const { DRAFT_EVENTS, MOD_EVENTS } = require('../../constants/events')
+const { getNormalizedPlainRestrictions, getRestrictions } = require('./restrictions')
 
 const _hasRef = xpr => {
   for (const each of xpr) if (each.ref || (each.xpr && _hasRef(each.xpr))) return true
@@ -164,41 +164,23 @@ const _addRestrictionsToRead = async (req, model, resolvedApplicables) => {
 }
 
 const _getUnrestrictedCount = async req => {
-  const dbtx = cds.tx(req)
-
   const target =
     (req.query.UPDATE && req.query.UPDATE.entity) ||
     (req.query.DELETE && req.query.DELETE.from) ||
     (req.query.SELECT && req.query.SELECT.from)
-  const selectUnrestricted = SELECT.one(['count(*) as n']).from(target)
-
-  // REVISIT: remove with cds^9
-  if (cds.env.features.compat_restrict_where) {
-    const whereUnrestricted =
-      (req.query.UPDATE && req.query.UPDATE.where) || (req.query.DELETE && req.query.DELETE.where)
-    if (whereUnrestricted) selectUnrestricted.where(whereUnrestricted)
-  }
 
   // Because of side effects, the statements have to be fired sequentially.
-  const { n } = await dbtx.run(selectUnrestricted)
+  const { n } = await cds.run(SELECT.one(['count(*) as n']).from(target))
   return n
 }
 
 const _getRestrictedCount = async (req, model, resolvedApplicables) => {
-  const dbtx = cds.tx(req)
-
   const target =
     (req.query.UPDATE && req.query.UPDATE.entity) ||
     (req.query.DELETE && req.query.DELETE.from) ||
     (req.query.SELECT && req.query.SELECT.from)
   const selectRestricted = SELECT.one(['count(*) as n']).from(target)
 
-  // REVISIT: remove with cds^9
-  if (cds.env.features.compat_restrict_where) {
-    const whereRestricted = (req.query.UPDATE && req.query.UPDATE.where) || (req.query.DELETE && req.query.DELETE.where)
-    if (whereRestricted) selectRestricted.where(whereRestricted)
-  }
-
   if (typeof selectRestricted.SELECT === 'object') {
     selectRestricted.SELECT.from.ref = _addWheresToRef(selectRestricted.SELECT.from.ref, model, resolvedApplicables)
   }
@@ -206,11 +188,11 @@ const _getRestrictedCount = async (req, model, resolvedApplicables) => {
   const restrictionForTarget = _getRestrictionForTarget(resolvedApplicables, req.target)
   if (restrictionForTarget) selectRestricted.where(restrictionForTarget)
 
-  const { n } = await dbtx.run(selectRestricted)
+  const { n } = await cds.run(selectRestricted)
   return n
 }
 
-async function check_roles(req) {
+async function enforce_auth(req) {
   if (req.user._is_privileged || DRAFT_EVENTS[req.event]) {
     // > skip checks (events in DRAFT_EVENTS are checked in draft handlers via InProcessByUser)
     return
@@ -233,7 +215,8 @@ async function check_roles(req) {
     return
   }
 
-  let restrictions = this.getRestrictions.call(this, definition, req.event, req.user)
+  // REVISIT: that (this.getRestrictions||getRestrictions) thing below is for a bad test only!
+  let restrictions = (this.getRestrictions || getRestrictions)(definition, req.event, req.user)
   if (restrictions instanceof Promise) restrictions = await restrictions
 
   if (!restrictions) {
@@ -268,7 +251,7 @@ async function check_roles(req) {
   }
 
   // Instance based authorization for bound actions /functions
-  await restrictBoundActionFunctions(req, resolvedApplicables, definition, this)
+  await restrictBoundActionFunctions(req, resolvedApplicables, definition)
 
   // no modification -> nothing more to do
   if (!MOD_EVENTS[req.event]) return
@@ -293,12 +276,12 @@ const isBoundToCollection = action =>
   action['@cds.odata.bindingparameter.collection'] ||
   (action.params && Object.values(action.params).some(param => param?.items?.type === '$self'))
 
-const restrictBoundActionFunctions = async (req, resolvedApplicables, definition, srv) => {
+const restrictBoundActionFunctions = async (req, resolvedApplicables, definition) => {
   if (req.target?.actions?.[req.event] && !isBoundToCollection(req.target.actions[req.event])) {
     // Clone to avoid target modification, which would cause a different query
     const query = req.query ? cds.ql.clone(req.query) : SELECT.one.from(req.subject)
     _addRestrictionsToRead({ query: query, target: req.target }, cds.model, resolvedApplicables)
-    const result = await (cds.env.features.compat_restrict_bound ? srv : cds.tx(req)).run(query)
+    const result = await cds.db.run(query)
     if (!result || result.length === 0) {
       // If we got a result, we don't need to check for the existence, hence only in this special case we must determine if `404` or `403`.
       const unrestrictedCount = await _getUnrestrictedCount(req)
@@ -310,6 +293,6 @@ const restrictBoundActionFunctions = async (req, resolvedApplicables, definition
   }
 }
 
-check_roles._initial = true
+enforce_auth._initial = true
 
-module.exports = check_roles
+module.exports = enforce_auth

package/libx/_runtime/common/generic/auth/service.js

@@ -7,7 +7,7 @@ const _getRequiresAsArray = definition =>
       : [definition['@requires']]
     : false
 
-function handler(req) {
+function check_service_level_restrictions(req) {
   if (req.user._is_privileged) {
     // > skip checks
     return
@@ -19,6 +19,6 @@ function handler(req) {
   reject(req, getRejectReason(req, '@requires', this.definition))
 }
 
-handler._initial = true
+check_service_level_restrictions._initial = true
 
-module.exports = handler
+module.exports = check_service_level_restrictions

package/libx/_runtime/common/generic/auth/utils.js

@@ -1,7 +1,7 @@
 const cds = require('../../../cds')
 const LOG = cds.log('app')
 
-const { CRUD_EVENTS } = require('./constants')
+const { CRUD_EVENTS } = require('../../constants/events')
 
 const { getDraftTreeRoot } = require('../../utils/csn')
 
@@ -163,15 +163,6 @@ const _authDependsOnAncestor = (entity, annotations) => {
   )
 }
 
-const cqnFrom = req => {
-  const { query } = req
-  if (!query) return
-  if (query.SELECT) return query.SELECT.from
-  if (query.INSERT) return query.INSERT.into
-  if (query.UPDATE) return query.UPDATE.entity
-  if (query.DELETE) return query.DELETE.from
-}
-
 const getAuthRelevantEntity = (req, model, annotations) => {
   if (!req.target || !(req.event in CRUD_EVENTS)) return
 
@@ -179,7 +170,7 @@ const getAuthRelevantEntity = (req, model, annotations) => {
   if (!it) return req.target
   if (it?.kind === 'entity' && req.subject.ref?.length === 1) return it
 
-  let cqn = cqnFrom(req)
+  let cqn = req.subject
 
   // REVISIT: needed in draft for some reason
   if (typeof cqn === 'string') cqn = { ref: [cqn] }
@@ -218,6 +209,5 @@ module.exports = {
   reject,
   getRejectReason,
   resolveUserAttrs,
-  cqnFrom,
   getAuthRelevantEntity
 }

package/libx/_runtime/common/generic/crud.js

@@ -1,58 +1,46 @@
 const cds = require('../../cds')
 const { SELECT } = cds.ql
 
-const { deepCopy } = require('../utils/copy')
-const { getColumns } = require('../utils/columns')
-const { enhanceStreamResult } = require('../utils/stream')
-const getError = require('../error')
-
 const _targetEntityDoesNotExist = async req => {
-  const exists = await cds.tx(req).run(SELECT.from(req.subject, [1]))
+  const exists = await cds.run(SELECT.from(req.subject, [1]))
   return exists.length === 0
 }
 
-exports.impl = cds.service.impl(function () {
-  this.on(['CREATE', 'READ', 'UPDATE', 'DELETE', 'UPSERT'], '*', async function (req) {
-    if (!req.query) {
-      throw getError({
-        code: 501,
-        message: 'The request has no query and cannot be served generically.'
-      })
-    }
-    if (typeof req.query !== 'string' && req.target && req.target._hasPersistenceSkip) {
-      throw getError({
-        code: 501,
-        message: `Entity "${req.target.name}" is annotated with "@cds.persistence.skip" and cannot be served generically.`
-      })
-    }
+module.exports = cds.service.impl(function () {
+  // prettier-ignore
+  this.on(['CREATE', 'READ', 'UPDATE', 'DELETE', 'UPSERT'], '*', async function handle_crud_requests(req) {
+
+    if (!cds.db)
+      return req.reject ('NO_DATABASE_CONNECTION') // REVISIT: error message
 
-    // REVISIT: error message
-    if (!cds.db) req.reject('NO_DATABASE_CONNECTION')
+    if (!req.query)
+      return req.reject (501, 'The request has no query and cannot be served generically.')
 
-    let result
+    if (typeof req.query !== 'string' && req.target?._hasPersistenceSkip)
+      return req.reject (501, `Entity "${req.target.name}" is annotated with "@cds.persistence.skip" and cannot be served generically.`)
 
     // validate that all elements in path exist on db, if necessary
     // - INSERT has no where clause to do this in one roundtrip
     // - SELECT returns [] -> really empty collection or invalid path?
-    let pathExistsQuery
-
-    const { ref } = (req.query.INSERT && req.query.INSERT.into) || (req.query.SELECT && req.query.SELECT.from) || {}
-    // REVISIT: why is copy necessary?
-    if (ref && ref.length > 1) pathExistsQuery = SELECT(1).from({ ref: deepCopy(ref.slice(0, -1)) })
+    const subject = req.query.INSERT?.into || req.query.SELECT?.from
+    const pathExistsQuery = subject?.ref?.length > 1 && SELECT(1).from({ ref: subject.ref.slice(0,-1) })
 
     if (req.event === 'CREATE' && pathExistsQuery) {
+      // REVISIT: Why dont't we just run the insert and check affected rows?
       const res = await pathExistsQuery
       if (res.length === 0) req.reject(404)
     }
 
-    if (req.event in { DELETE: 1, UPDATE: 1 } && req.target && req.target._isSingleton) {
-      if (req.event === 'DELETE' && !req.target['@odata.singleton.nullable']) req.reject(400, 'SINGLETON_NOT_NULLABLE')
+    if (req.event in { DELETE: 1, UPDATE: 1 } && req.target?._isSingleton) {
+      if (req.event === 'DELETE' && !req.target['@odata.singleton.nullable'])
+        return req.reject (400, 'SINGLETON_NOT_NULLABLE')
+
       const selectSingleton = SELECT.one(req.target)
-      const keyColumns = getColumns(req.target, { onlyNames: true, keysOnly: true })
+      const keyColumns = [...(req.target.keys||[])].filter(e => !e.isAssociation).map(e => e.name)
 
       // if no keys available, select all columns so we can delete the singleton with same content
       if (keyColumns.length) selectSingleton.columns(keyColumns)
-      const singleton = await cds.tx(req).run(selectSingleton)
+      const singleton = await cds.run(selectSingleton)
       if (!singleton) req.reject(404)
 
       // REVISIT: Workaround for singleton, to get keys into singleton
@@ -64,13 +52,9 @@ exports.impl = cds.service.impl(function () {
       req.query.where(singleton)
     }
 
-    if (req.event === 'READ' && req.query?.SELECT) {
-      req.query.SELECT.localized ??= true
-    }
+    if (req.event === 'READ' && req.query?.SELECT && req.locale) req.query.SELECT.localized ??= true
 
-    if (!result) {
-      result = await cds.tx(req).run(req.query, req.data)
-    }
+    const result = await cds.run (req.query, req.data)
 
     if (req.event === 'READ') {
       // do not execute additional select to distinguish between 412 and 404
@@ -81,12 +65,6 @@ exports.impl = cds.service.impl(function () {
         if (res.length === 0) req.reject(404)
       }
 
-      if (cds.env.features.stream_compat) {
-        if (result !== undefined && req.query?._streaming && (result === null || result.pipe)) {
-          return { value: result }
-        }
-      }
-
       return result
     }
 
@@ -106,13 +84,4 @@ exports.impl = cds.service.impl(function () {
 
     return req.data
   })
-
-  this.after('READ', '*', async function ([result], req) {
-    if (!result) return
-    if (cds.env.features.stream_compat) {
-      if (req.query?._streaming) {
-        await enhanceStreamResult(req, req.query, result, this.model)
-      }
-    }
-  })
 })

package/libx/_runtime/common/generic/etag.js

@@ -1,16 +1,8 @@
 const cds = require('../../cds')
 const { SELECT } = cds.ql
 
-const { convertPathExpressionToWhere } = require('../utils/cqn2cqn4sql')
 const { addEtagColumns } = require('../utils/etag')
 
-const _getMatchHeaders = req => {
-  return {
-    ifMatch: req.headers['if-match']?.replace(/^"\*"$/, '*'),
-    ifNoneMatch: req.headers['if-none-match']?.replace(/^"\*"$/, '*')
-  }
-}
-
 const _parseHeaderEtagValue = value => {
   return value.split(',').map(str => {
     let result = str.trim()
@@ -20,12 +12,10 @@ const _parseHeaderEtagValue = value => {
   })
 }
 
-const _getValidationStmt = (ifMatchEtags, ifNoneMatchEtags, req, model) => {
+const _getValidationStmt = (ifMatchEtags, ifNoneMatchEtags, req) => {
   const etagElement = req.target.elements[req.target._etag.name]
 
-  const { target, alias, where } = convertPathExpressionToWhere(req.subject, model, { tableAliasPrefix: 'ETAG_' })
-  const select = SELECT.from(target).columns(1).where(where)
-  if (alias) select.SELECT.from.as = alias
+  const select = SELECT.from(req.subject).columns(1)
   // tell resolveView to leave this select alone
   select._doNotResolve = true
   // tell db layer that this is a subselect for etag validation
@@ -41,7 +31,7 @@ const _getValidationStmt = (ifMatchEtags, ifNoneMatchEtags, req, model) => {
       if (!ifMatchEtags.length) return false
     }
 
-    cond.push({ ref: alias ? [alias, etagElement.name] : [etagElement.name] })
+    cond.push({ ref: [etagElement.name] })
     if (ifMatchEtags.length === 1) cond.push('=', { val: ifMatchEtags[0] })
     else cond.push('in', { list: ifMatchEtags.map(val => ({ val })) })
   } else {
@@ -55,7 +45,7 @@ const _getValidationStmt = (ifMatchEtags, ifNoneMatchEtags, req, model) => {
     }
 
     if (req.event !== 'READ') {
-      cond.push({ ref: alias ? [alias, etagElement.name] : [etagElement.name] })
+      cond.push({ ref: [etagElement.name] })
       if (ifNoneMatchEtags.length === 1) cond.push('!=', { val: ifNoneMatchEtags[0] })
       else cond.push('not', 'in', { list: ifNoneMatchEtags.map(val => ({ val })) })
     }
@@ -70,7 +60,7 @@ const _getValidationStmt = (ifMatchEtags, ifNoneMatchEtags, req, model) => {
  *
  * @param req
  */
-const commonGenericValidateETag = async function (req) {
+const validate_etag = async function (req) {
   /*
    * currently, etag is only supported for OData requests
    * REST requests should be added later -> REVISIT!!!
@@ -85,7 +75,8 @@ const commonGenericValidateETag = async function (req) {
   if (req.event === 'READ' && !req.query.SELECT.one) return
 
   // etag provided?
-  const { ifMatch, ifNoneMatch } = _getMatchHeaders(req)
+  const ifMatch = req.headers['if-match']
+  const ifNoneMatch = req.headers['if-none-match']
   if (!ifMatch && !ifNoneMatch) {
     if (req.event === 'READ') return // > ok and nothing more to do
     req.reject(428) // > on writes, an etag must be provided
@@ -109,11 +100,7 @@ const commonGenericValidateETag = async function (req) {
 
   // bound action or CRUD?
   if (req.event === 'EDIT' || (req.target.actions && req.event in req.target.actions)) {
-    // REVISIT: how to not directly access db?
-    if (cds.db) {
-      const result = await cds.tx(req).run(validationStmt)
-      if (!result.length) req.reject(412)
-    }
+    await cds.db?.run(validationStmt).then(result => result.length || req.reject(412))
   } else if (validationStmt) {
     // add where clause for validation
     const validationClause = ['exists', validationStmt]
@@ -129,7 +116,7 @@ const commonGenericValidateETag = async function (req) {
  *
  * @param req
  */
-const commonGenericGenerateETag = function (req) {
+const add_etag = function (req) {
   const etagElement = req.target.elements[req.target._etag.name]
   req.data[etagElement.name] = cds.utils.uuid()
 }
@@ -139,8 +126,8 @@ const commonGenericGenerateETag = function (req) {
  */
 /* istanbul ignore next */
 module.exports = cds.service.impl(function () {
-  commonGenericValidateETag._initial = true
-  commonGenericGenerateETag._initial = true
+  validate_etag._initial = true
+  add_etag._initial = true
 
   for (const k in this.entities) {
     const entity = this.entities[k]
@@ -148,12 +135,12 @@ module.exports = cds.service.impl(function () {
     if (!entity._etag) continue
 
     if (entity._isDraftEnabled) {
-      this.before(['READ', 'DELETE'], entity, commonGenericValidateETag)
+      this.before(['READ', 'DELETE'], entity, validate_etag)
       // if draft compat is on, the read handler is automatically registered for <entity> and <entity>.drafts
-      const events = cds.env.fiori.draft_compat ? ['UPDATE', 'CANCEL'] : ['READ', 'UPDATE', 'CANCEL']
-      this.before(events, entity.drafts, commonGenericValidateETag)
+      const events = ['READ', 'UPDATE', 'CANCEL']
+      this.before(events, entity.drafts, validate_etag)
     } else {
-      this.before(['READ', 'UPDATE', 'DELETE'], entity, commonGenericValidateETag)
+      this.before(['READ', 'UPDATE', 'DELETE'], entity, validate_etag)
     }
 
     for (const action in entity.actions) {
@@ -161,14 +148,14 @@ module.exports = cds.service.impl(function () {
       if (entity.actions[action].kind !== 'action') continue
       if (entity._isDraftEnabled) {
         const _entity = action === 'draftEdit' ? entity : entity.drafts
-        this.before(action === 'draftEdit' ? 'EDIT' : action, _entity, commonGenericValidateETag)
+        this.before(action === 'draftEdit' ? 'EDIT' : action, _entity, validate_etag)
       } else {
-        this.before(action, entity, commonGenericValidateETag)
+        this.before(action, entity, validate_etag)
       }
     }
 
     // for backwards compatibility w.r.t. ETag generation if type UUID
     const etagElement = entity.elements[entity._etag.name]
-    if (etagElement.isUUID) this.before(['CREATE', 'UPDATE', 'NEW'], entity, commonGenericGenerateETag)
+    if (etagElement.isUUID) this.before(['CREATE', 'UPDATE', 'NEW'], entity, add_etag)
   }
 })