@sap/cds 9.3.0 → 9.3.1

package/CHANGELOG.md

@@ -4,6 +4,14 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 9.3.1 - 2025-09-03
+
+### Fixed
+
+- In messaging services, propagated headers (e.g. `x-correlation-id`) will not be automatically propagated for `format: 'cloudevents'`
+- Avoid deprecation warning for `cds.context.user.tokenInfo`
+- Consider `@Capabilities.ExpandRestrictions.NonExpandableProperties` annotation and ignore fields referenced by the annotation, when rewriting asterisk expand into columns
+
 ## Version 9.3.0 - 2025-08-29
 
 ### Added

package/lib/srv/middlewares/auth/ias-auth.js

@@ -113,14 +113,17 @@ function get_user_factory(credentials, skipped_attrs) {
       if (Array.isArray(payload.ias_apis)) payload.ias_apis.forEach(r => (roles[r] = 1))
       if (clientid === credentials.clientid) roles['internal-user'] = 1
       else delete roles['internal-user']
-      return new cds.User({
-        id: 'system', roles, authInfo: securityContext,
-        // REVISIT: remove compat in cds^10
-        get tokenInfo() {
+
+      const user = new cds.User({ id: 'system', roles, authInfo: securityContext })
+      // REVISIT: remove compat in cds^10
+      Object.defineProperty(user, 'tokenInfo', {
+        get() {
+          // prettier-ignore
           cds.utils.deprecated({ kind: 'API', old: 'cds.context.user.tokenInfo', use: 'cds.context.user.authInfo.token' })
           return securityContext.token
         }
       })
+      return user
     }
 
     // add all unknown attributes to req.user.attr in order to keep public API small
@@ -138,14 +141,15 @@ function get_user_factory(credentials, skipped_attrs) {
     if (attr.given_name) attr.givenName = attr.given_name
     if (attr.family_name) attr.familyName = attr.family_name
 
-    return new cds.User({
-      id: payload.sub, attr, authInfo: securityContext,
-      // REVISIT: remove compat in cds^10
-      get tokenInfo() {
+    const user = new cds.User({ id: payload.sub, attr, authInfo: securityContext })
+    // REVISIT: remove compat in cds^10
+    Object.defineProperty(user, 'tokenInfo', {
+      get() {
         cds.utils.deprecated({ kind: 'API', old: 'cds.context.user.tokenInfo', use: 'cds.context.user.authInfo.token' })
         return securityContext.token
       }
     })
+    return user
   }
 }
 

package/lib/srv/middlewares/auth/jwt-auth.js

@@ -87,14 +87,15 @@ function get_user_factory(credentials, xsappname, kind) {
       attr.email = payload.email
     }
 
-    return new cds.User({
-      id, roles, attr, authInfo: securityContext,
-      // REVISIT: remove compat in cds^10
-      get tokenInfo() {
+    const user = new cds.User({ id, roles, attr, authInfo: securityContext })
+    // REVISIT: remove compat in cds^10
+    Object.defineProperty(user, 'tokenInfo', {
+      get() {
         cds.utils.deprecated({ kind: 'API', old: 'cds.context.user.tokenInfo', use: 'cds.context.user.authInfo.token' })
         return securityContext.token
       }
     })
+    return user
   }
 }
 

package/libx/_runtime/common/utils/rewriteAsterisks.js

@@ -89,11 +89,17 @@ const rewriteExpandAsterisk = (columns, target) => {
   })
   if (expandAllColIdx > -1) {
     const { expand } = columns.splice(expandAllColIdx, 1)[0]
+
+    const annotation = target['@Capabilities.ExpandRestrictions.NonExpandableProperties']
+    const restrictions = annotation?.map(element => element['=']) ?? []
+
     for (const elName in target.elements) {
-      if (target.elements[elName]._target && !columns.find(col => col.expand && col.ref && col.ref[0] === elName)) {
-        if (elName === 'SiblingEntity') continue
-        columns.push({ ref: [elName], expand: [...expand] })
-      }
+      if (!target.elements[elName]._target) continue
+      if (restrictions.includes(elName)) continue
+      if (elName === 'SiblingEntity') continue
+      if (columns.find(col => col.expand && col.ref && col.ref[0] === elName)) continue
+
+      columns.push({ ref: [elName], expand: [...expand] })
     }
   }
 }

package/libx/_runtime/messaging/service.js

@@ -103,6 +103,13 @@ module.exports = class MessagingService extends cds.Service {
 
   prepareHeaders(headers, event) {
     if (this.options.format === 'cloudevents') {
+      for (const propagatedHeader of cds.EventContext.propagateHeaders) {
+        if (headers[propagatedHeader] && !Object.hasOwn(propagatedHeader, headers)) {
+          // For propagated headers, e.g. `x-correlation-id` (from inbound HTTP request), we don't want to set the
+          // respective header. It's incompatible to the cloudevents spec, allowed is only [a-zA-Z0-9].
+          Object.defineProperty(headers, propagatedHeader, { value: undefined, enumerable: false })
+        }
+      }
       if (!('id' in headers)) headers.id = cds.utils.uuid()
       if (!('type' in headers)) headers.type = event
       if (!('source' in headers)) headers.source = `/default/sap.cap/${process.pid}`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "9.3.0",
+  "version": "9.3.1",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [