@sap/cds 9.4.4 → 9.5.1

package/libx/odata/parse/afterburner.js

@@ -150,19 +150,19 @@ function _convertVal(value, element) {
     case 'cds.Int32':
       if (!/^-?\+?\d+$/.test(value)) {
         const msg = `Element "${element.name}" does not contain a valid Integer`
-        throw Object.assign(new Error(msg), { statusCode: 400 })
+        cds.error({ status: 400, message: msg })
       }
 
       // eslint-disable-next-line no-case-declarations
       const n = Number(value)
       if (!Number.isSafeInteger(n)) {
         const msg = `Element "${element.name}" does not contain a valid Integer`
-        throw Object.assign(new Error(msg), { statusCode: 400 })
+        cds.error({ status: 400, message: msg })
       }
 
       if (element._type === 'cds.UInt8' && n < 0) {
         const msg = `Element "${element.name}" does not contain a valid positive Integer`
-        throw Object.assign(new Error(msg), { statusCode: 400 })
+        cds.error({ status: 400, message: msg })
       }
 
       return n
@@ -191,7 +191,7 @@ function _convertVal(value, element) {
     case 'cds.UUID':
       if (!RELAXED_UUID_REGEX.test(value)) {
         const msg = `Element "${element.name}" does not contain a valid UUID`
-        throw Object.assign(new Error(msg), { statusCode: 400 })
+        cds.error({ status: 400, message: msg })
       }
       return value
 
@@ -230,10 +230,9 @@ const getStructTargetName = element => {
 const _getDataFromParams = (params, operation) => {
   try {
     return Object.keys(params).reduce((acc, cur) => {
+      const def = operation.params?.[cur]
       acc[cur] =
-        typeof params[cur] === 'string' && (operation.params[cur]?.elements || operation.params[cur]?.items)
-          ? JSON.parse(params[cur])
-          : params[cur]
+        typeof params[cur] === 'string' && (def?.elements || def?.items) ? JSON.parse(params[cur]) : params[cur]
       return acc
     }, {})
   } catch (e) {
@@ -262,7 +261,7 @@ function _handleCollectionBoundActions(current, ref, i, namespace, one) {
     const msg = `${action.kind.at(0).toUpperCase() + action.kind.slice(1)} "${
       action.name
     }" must be called on a collection of ${current.name}`
-    throw Object.assign(new Error(msg), { statusCode: 400 })
+    cds.error({ status: 400, message: msg })
   }
 
   if (incompleteKeys) {
@@ -270,7 +269,7 @@ function _handleCollectionBoundActions(current, ref, i, namespace, one) {
       const msg = `${action.kind.at(0).toUpperCase() + action.kind.slice(1)} "${
         action.name
       }" must be called on a single instance of ${current.name}`
-      throw Object.assign(new Error(msg), { statusCode: 400 })
+      cds.error({ status: 400, message: msg })
     }
 
     incompleteKeys = false
@@ -337,7 +336,7 @@ function _processSegments(from, model, namespace, cqn, protocol) {
 
       ref[i] = null
       ref[i - keyCount] = base
-      incompleteKeys = keyCount < keys.length
+      incompleteKeys = keyCount < keys.filter(k => k !== 'IsActiveEntity').length
     } else {
       // > entity or property (incl. nested) or navigation or action or function
       keys = null
@@ -363,7 +362,7 @@ function _processSegments(from, model, namespace, cqn, protocol) {
         } else {
           // parentheses are missing
           const msg = `Invalid call to "${current.name}". Parentheses are missing`
-          throw cds.error(msg, { code: '400', statusCode: 400 })
+          cds.error({ status: 400, message: msg })
         }
 
         _addDefaultParams(ref[i], current)
@@ -384,7 +383,7 @@ function _processSegments(from, model, namespace, cqn, protocol) {
         if (ref[i + 1] !== 'Set') {
           // /Set is missing
           const msg = `Invalid call to "${current.name}". You need to navigate to Set`
-          throw cds.error(msg, { code: '400', statusCode: 400 })
+          cds.error({ status: 400, message: msg })
         }
 
         ref[++i] = null
@@ -406,19 +405,19 @@ function _processSegments(from, model, namespace, cqn, protocol) {
 
           if (keyCount === 0 && !Object.keys(params).length && whereRef.length === 1) {
             const msg = `Entity "${current.name}" can not be accessed by key.`
-            throw Object.assign(new Error(msg), { statusCode: 400 })
+            cds.error({ status: 400, message: msg })
           }
         }
       } else if ({ action: 1, function: 1 }[current.kind]) {
         // > action or function
         if (current.kind === 'action' && ref && ref.at(-1)?.where?.length === 0) {
           const msg = `Parentheses are not allowed for action calls.`
-          throw Object.assign(new Error(msg), { statusCode: 400 })
+          cds.error({ status: 400, message: msg })
         }
 
         if (i !== ref.length - 1) {
           const msg = `${i ? 'Bound' : 'Unbound'} ${current.kind}s are only supported as the last path segment`
-          throw Object.assign(new Error(msg), { statusCode: 400 })
+          cds.error({ status: 400, message: msg })
         }
 
         ref[i] = { operation: current.name }
@@ -449,10 +448,11 @@ function _processSegments(from, model, namespace, cqn, protocol) {
           target = current.returns.items ?? current.returns
         }
       } else if (current.isAssociation) {
-        if (!current._target._service) {
+        if (current._target._service !== _get_service_of(target)) {
           // not exposed target
-          cds.error(`Property '${current.name}' does not exist in type '${target.name.replace(namespace + '.', '')}'`, {
-            statusCode: 404
+          cds.error({
+            status: 400,
+            message: `Property "${current.name}" does not exist in "${target.name.replace(namespace + '.', '')}"`
           })
         }
 
@@ -503,7 +503,7 @@ function _processSegments(from, model, namespace, cqn, protocol) {
           const propRef = ref.slice(i)
           if (propRef[0].where?.length === 0) {
             const msg = 'Parentheses are not allowed when addressing properties.'
-            throw Object.assign(new Error(msg), { statusCode: 400 })
+            cds.error({ status: 400, message: msg })
           }
           cqn.SELECT.columns.push({ ref: propRef })
 
@@ -527,7 +527,7 @@ function _processSegments(from, model, namespace, cqn, protocol) {
     const msg = `Entity "${current.name}" has ${keysOf(current).length} keys. Only ${keyCount} ${
       keyCount === 1 ? 'was' : 'were'
     } provided.`
-    throw Object.assign(new Error(msg), { statusCode: 400 })
+    cds.error({ status: 400, message: msg })
   }
 
   // remove all nulled refs
@@ -607,9 +607,9 @@ function _processColumns(cqn, target, protocol) {
 
   // Error if groupBy is present but no columns are selected
   if (columns && !columns.length && cqn.SELECT.groupBy) {
-    throw cds.error('Explicit select must include at least one column available in the result set of groupby', {
-      code: '400',
-      statusCode: 400
+    cds.error({
+      status: 400,
+      message: 'Explicit select must include at least one column available in the result set of groupby'
     })
   }
 
@@ -695,9 +695,8 @@ function _processColumns(cqn, target, protocol) {
     if (processedColumn.func === null) {
       processedColumn.func = aggregatedElement?.[AGGR_DFLT]?.['#']?.toLowerCase()
       if (!customAggregate)
-        throw cds.error(`Result type for custom aggregation of property "${aggregatedPropertyName}" not found`)
-      if (!processedColumn.func)
-        throw cds.error(`Default aggregation for property "${aggregatedPropertyName}" not found`)
+        cds.error(`Result type for custom aggregation of property "${aggregatedPropertyName}" not found`)
+      if (!processedColumn.func) cds.error(`Default aggregation for property "${aggregatedPropertyName}" not found`)
       if (processedColumn.func === 'count_distinct') processedColumn.func = 'countdistinct'
     }
 
@@ -705,7 +704,7 @@ function _processColumns(cqn, target, protocol) {
     const semanticsAmountElementName = aggregatedElement?.[SMTCS_AMT_CC] ?? aggregatedElement?.[SMTCS_AMT_UOM]
     if (!semanticsAmountElementName) continue
     if (!target.elements[semanticsAmountElementName])
-      throw cds.error(`Referenced semantics amount element not found: ${semanticsAmountElementName}`)
+      cds.error(`Referenced semantics amount element not found: ${semanticsAmountElementName}`)
     const semanticsAmountElementRef = [...prefixRef, semanticsAmountElementName]
 
     columns[i] = {
@@ -737,7 +736,7 @@ const _checkAllKeysProvided = (params, entity) => {
   if (isView) {
     // view with params
     if (params === undefined) {
-      throw cds.error(`Invalid call to "${entity.name}". You need to navigate to Set`, { code: '400', statusCode: 400 })
+      cds.error({ status: 400, message: `Invalid call to "${entity.name}". You need to navigate to Set` })
     }
 
     keysOfEntity = Object.keys(entity.params)
@@ -747,7 +746,7 @@ const _checkAllKeysProvided = (params, entity) => {
 
   if (!keysOfEntity) return
   for (const keyOfEntity of keysOfEntity) {
-    if (!(keyOfEntity in params)) {
+    if (keyOfEntity !== 'IsActiveEntity' && !(keyOfEntity in params)) {
       if (isView && entity.params[keyOfEntity].default) {
         // will be added later?
         continue
@@ -755,16 +754,22 @@ const _checkAllKeysProvided = (params, entity) => {
 
       // prettier-ignore
       const msg = `${isView ? 'Parameter' : 'Key'} "${keyOfEntity}" is missing for ${isView ? 'view' : 'entity'} "${entity.name}"`
-      throw Object.assign(new Error(msg), { statusCode: 400 })
+      cds.error({ status: 400, message: msg })
     }
   }
 }
 
 const _doesNotExistError = (isExpand, refName, targetName, targetKind) => {
   const msg = isExpand
-    ? `Navigation property "${refName}" is not defined in "${targetName}"`
+    ? `Navigation property "${refName}" does not exist in "${targetName}"`
     : `Property "${refName}" does not exist in ${targetKind === 'type' ? 'type ' : ''}"${targetName}"`
-  throw Object.assign(new Error(msg), { statusCode: 400 })
+  cds.error({ status: 400, message: msg })
+}
+
+const _get_service_of = element => {
+  if (element._service) return element._service
+  if (element.parent) return _get_service_of(element.parent)
+  return null
 }
 
 function _validateXpr(xpr, target, isOne, model, aliases = []) {
@@ -818,8 +823,13 @@ function _validateXpr(xpr, target, isOne, model, aliases = []) {
           _validateXpr([{ ref: x.ref.slice(1) }], element, isOne, model)
           element = _structProperty(x.ref.slice(1), element)
         }
-        if (!element._target) {
-          _doesNotExistError(true, refName, target.name)
+        const target_service = _get_service_of(target)
+        if (!element._target || element._target._service !== target_service) {
+          _doesNotExistError(
+            true,
+            refName,
+            target_service ? target.name.replace(target_service.name + '.', '') : target.name
+          )
         }
         _validateXpr(x.expand, element._target, false, model)
         if (x.where) {
@@ -872,14 +882,14 @@ module.exports = (cqn, model, namespace, protocol) => {
   let edmName = ref[0].id || ref[0]
   // REVISIT: shouldn't be necessary
   if (edmName.split('.').length > 1)
-    //required for concat query, where the root is already identified with the first query and subsequent queries already have correct root
+    // required for concat query, where the root is already identified with the first query and subsequent queries already have correct root
     edmName = edmName.split('.')[edmName.split('.').length - 1]
 
   // Make first path segment fully qualified
   const root = findCsnTargetFor(edmName, model, namespace)
 
   if (!root) {
-    //404 else we would expose knowledge to potential attackers
+    // 404 else we would expose knowledge to potential attackers
     throw new cds.error(404, `Invalid resource path "${namespace}.${ref[0].id || ref[0]}"`)
   }
   if (cds.env.effective.odata.containment && model.definitions[namespace]._containedEntities.has(root.name)) {

package/libx/odata/parse/cqn2odata.js

@@ -210,7 +210,7 @@ function _xpr(expr, target, kind, isLambda, navPrefix = []) {
         res.push(OPERATORS[cur] || cur.toLowerCase())
       }
     } else {
-      const ref = expr[i - 2]
+      const ref = expr[i - 1] in OPERATORS ? expr[i - 2] : expr[i + 1] in OPERATORS ? expr[i + 2] : null
       const formatted = _format(
         cur,
         ref?.ref && (ref.ref.length ? ref.ref : ref.ref[0]),
@@ -281,7 +281,7 @@ function _getQueryTarget(entity, propOrEntity, model) {
 
 const _params = (args, kind, target) => {
   if (!args) {
-    throw cds.error(`Invalid call to "${target.name}". You need to navigate to Set`, { code: '400', statusCode: 400 })
+    cds.error({ status: 400, message: `Invalid call to "${target.name}". You need to navigate to Set` })
   }
   const params = Object.keys(args)
   if (params.length !== Object.keys(target.params).length) {
@@ -298,10 +298,6 @@ const _params = (args, kind, target) => {
 }
 
 function _from(from, kind, model) {
-  if (typeof from === 'string') {
-    return { url: _entityUrl(from), queryTarget: model && model.definitions[from] }
-  }
-
   let ref = getProp(from, 'ref')
   ref = (Array.isArray(ref) && ref) || [ref]
 

package/libx/odata/parse/grammar.peggy

@@ -189,7 +189,7 @@
       }
       if (newCqn.SELECT?.recurse && cqn.where) {
         const where = cqn.where 
-        delete cqn.where
+        delete newCqn.SELECT.where
         const columns = newCqn.SELECT.columns
         delete newCqn.SELECT.columns
         newCqn = { SELECT: { from: newCqn, where, columns } }
@@ -515,8 +515,58 @@
       })
       return isAliased
     }
+
+    const _replaceComputedProperties = (columns, col) =>  {
+      for (let i = 0; i < columns.length; i++) {
+        if (columns[i].ref && columns[i].ref.at(-1) === col.as && (col.xpr || col.ref || col.val)) {
+          columns[i] = col
+          return true;
+        }
+      }
+      return false;
+    }
+
+    const _checkComputedPropsUsage = (elements, computedAliases, context) => {
+      if (!elements || !computedAliases.length) return
+      
+      const _checkElement = element => {
+        if (element.ref && computedAliases.includes(element.ref.at(-1))) {
+          const err = new Error(`Computed property "${element.ref.at(-1)}" cannot be used in ${context}. Computed properties are only supported in $select`)
+          err.statusCode = 501
+          throw err
+        }
+        if (Array.isArray(element.xpr)) element.xpr.forEach(_checkElement)
+        if (Array.isArray(element.args)) element.args.forEach(_checkElement)
+      }
+      
+      if (Array.isArray(elements)) elements.forEach(_checkElement)
+      else _checkElement(elements)
+    }
+
+    const _validateComputedPropsUsage = (SELECT) => {
+      const computedAliases = SELECT.compute.map(col => col.as)
+      
+      if (SELECT.where) _checkComputedPropsUsage(SELECT.where, computedAliases, '$filter')
+      if (SELECT.orderBy) _checkComputedPropsUsage(SELECT.orderBy, computedAliases, '$orderby')      
+    }
+
+    const _processComputedProps = (SELECT) => {      
+      _validateComputedPropsUsage(SELECT)
+        
+      for (const col of SELECT.compute) {
+        if (SELECT.columns) {
+          const propFound = _replaceComputedProperties(SELECT.columns, col)
+          if (!propFound) SELECT.columns.push(col)
+        } else {
+          SELECT.columns = ['*']
+          SELECT.columns.push(col)
+        }
+      }
+      delete SELECT.compute
+    }
   }
 
+
 // ---------- Entity Paths ---------------
 
   ODataRelativeURI // Note: case-sensitive!
@@ -551,6 +601,8 @@
         SELECT.__countAggregated = true
       if(SELECT.apply)
         return _handleApply(SELECT, SELECT.apply, onlyColumnsFromExpand)
+      if(SELECT.compute)
+        _processComputedProps(SELECT)
       return { SELECT }
     }
 
@@ -640,10 +692,11 @@
     aliasedParamEqualsValOrPrefixParam /
     deltaToken
   // @OData spec for $expand:
-  // "Allowed system query options are $filter, $select, $orderby, $skip, $top, $count, $search, $expand and 
+  // "Allowed system query options are $filter, $select, $compute, $orderby, $skip, $top, $count, $search, $expand and 
   // $apply (https://go.sap.corp/0jzs)."
   ExpandOption =
     "$select="      o select ( COMMA select )* /
+    "$compute="     o compute ( COMMA compute )* /
     "$expand="      o expand ( COMMA expand )* expandCount? /
     "$filter="      o f:filter { SELECT.where = f } /
     "$orderby="     o o:orderby ( COMMA o2:orderby{_setOrderBy(o2)} )* {_setOrderBy(o,true)} /
@@ -748,6 +801,14 @@
     = val:$( [^;)]+ ) { return [{ val }] }
        / o // Do not add search property for space only
 
+  compute
+    = expr:mathCalc as:asAlias {
+        SELECT.compute = Array.isArray(SELECT.compute) ? SELECT.compute : []
+        const comp = expr.xpr ? { xpr: expr.xpr, as } : { ...expr, as }
+        SELECT.compute.push(comp)
+        return comp        
+      }
+
   filter
     = p:where_clause { return p }
 
@@ -877,6 +938,33 @@
 //
 // ---------- Expressions ------------
 
+  mathCalc
+    = head:mathOperand tail:(o op:("add" / "sub" / "mul" / "divby" / "div" ) o operand:mathOperand { return { op, operand } })* {
+        const opMap = { sub: '-', add: '+', mul: '*', divby: '/', div: '/' }        
+        
+        const toXprElement = (operand) => {
+          if (typeof operand === 'number') return { val: operand }
+          if (typeof operand === 'string') return { ref: [operand] }
+          return operand // xpr
+        }
+        
+        let xpr = [toXprElement(head)]
+        for (let i = 0; i < tail.length; i++) {
+          xpr.push(opMap[tail[i].op])
+          xpr.push(toXprElement(tail[i].operand))
+        }
+        return tail.length === 0 ? xpr[0] : { xpr }
+      }
+
+  mathOperand
+    = integer / negativeIdentifier / identifier / parenthesizedMath
+
+  negativeIdentifier
+    = "-" id:identifier { return { xpr: ['-', { ref: [id] }] } }
+
+  parenthesizedMath
+    = OPEN expr:mathCalc CLOSE { return expr }
+
   comparison
     = a:operand _ o:$("eq" / "ne" / "lt" / "gt" / "le" / "ge") _ b:operand {
       return [ a, OPERATORS[o] || o, b ]
@@ -888,9 +976,6 @@
     = a:operand _ "in" _ b:listFilterParam {
       return [ a, "in", b ]
     }
-
-  mathCalc
-    = operand (_ ("add" / "sub" / "mul" / "div" / "mod") _ operand)*
   
   operand
     = navigationCount / function / val / ref / jsonObject / jsonArray / list
@@ -1025,7 +1110,6 @@
       // REVISIT: All transformations below need improvment
       "search" search:searchTrafo{return search} /
       "concat" con:concatTrafo{return con} / //> Return con so that concat string is not returned
-      "compute" compute:computeTrafo{return compute} /
       "top" top:topTrafo{return top} /
       "skip" skip:skipTrafo{return skip} /
       "orderby" order:orderbyTrafo{return order} /
@@ -1054,8 +1138,7 @@
           ) { return res }
   aggregateExpr
     = path:(
-        ref
-     // / mathCalc - needs CAP support
+        ref     
       )
       func:aggregateWith? aggregateFrom? as:asAlias?
         { return { func, args: [ path ], as: as ?? path.ref[0] } }
@@ -1102,11 +1185,6 @@
     return {concat: [trafo1, ...trafo2]}
   }
 
-  // REVISIT: support compute - current implementation is deviating from odata
-  computeTrafo = OPEN o computeExpr (o COMMA o computeExpr)* o CLOSE
-
-  computeExpr = where_clause asAlias
-
   commonFuncTrafo = OPEN o first:operand o COMMA o second:operand o CLOSE { return [first, second] }
 
   // REVISIT: support identity