@sap/cds 9.7.0 → 9.7.1

package/CHANGELOG.md

@@ -4,6 +4,15 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 9.7.1 - 2026-02-06
+
+### Fixed
+
+- `DELETE` requests nulling a `@mandatory` property
+- Correctly call remote collection bound action for `odata-v4` services
+- Flow annotation validation at compile time strictly follows the documentation: only enum status values are allowed
+  + Status value validation can be disabled via `cds.features.skip_flows_validation=true`
+
 ## Version 9.7.0 - 2026-02-02
 
 ### Added

package/lib/compile/for/flows.js

@@ -147,7 +147,7 @@ function enhanceCSNwithFlowAnnotations4FE(csn) {
 }
 
 module.exports = function cds_compile_for_flows(csn) {
-  const { history_for_flows } = cds.env.features
+  const { history_for_flows, skip_flows_validation } = cds.env.features
 
   const _requires_history = !history_for_flows
     ? () => false
@@ -168,6 +168,61 @@ module.exports = function cds_compile_for_flows(csn) {
           }
         }
 
+  const _validate_status_types = skip_flows_validation
+    ? () => {}
+    : (name, def, status, csn, errors) => {
+        // enum
+        let enumVals
+        if (status.type === 'cds.Association') {
+          const target = csn.definitions[status.target]
+          if (!status.keys || status.keys.length !== 1) {
+            errors.push(`Status element in entity ${name} must have exactly one key when used as association`)
+            return
+          }
+          const code = target.elements[status.keys[0].ref[0]]
+          enumVals = code.enum || csn.definitions[code.type]?.enum
+        } else {
+          enumVals = status.enum ?? csn.definitions[status.type]?.enum
+        }
+        if (!enumVals) {
+          errors.push(`Status element in entity ${name} must be an enum or target an entity with an enum named "code"`)
+          return
+        }
+        // actions
+        for (const each in def.actions) {
+          const action = def.actions[each]
+          const from = action[FROM]
+          if (from !== undefined) {
+            if (Array.isArray(from)) {
+              for (let i = 0; i < from.length; i++) {
+                if (from[i] !== null) {
+                  let val = from[i]['#']
+                  if (!(typeof val === 'string' && Object.entries(enumVals).some(([key]) => key === val))) {
+                    errors.push(`Invalid ${FROM} value at position ${i} in action ${each}`)
+                  }
+                }
+              }
+            } else if (from !== null) {
+              let val = from['#']
+              if (!(typeof val === 'string' && Object.entries(enumVals).some(([key]) => key === val))) {
+                errors.push(`Invalid ${FROM} value in action ${each}`)
+              }
+            }
+          }
+          const to = action[TO]
+          if (to !== undefined) {
+            if (Array.isArray(to)) {
+              errors.push(`${TO} must not be an array in action ${each}`)
+            } else if (to !== null && to['='] !== FLOW_PREVIOUS) {
+              let val = to['#']
+              if (!(typeof val === 'string' && Object.entries(enumVals).some(([key]) => key === val))) {
+                errors.push(`Invalid ${TO} value in action ${each}`)
+              }
+            }
+          }
+        }
+      }
+
   /*
    * 1. propagate flows for well-known actions from extensions to definitions
    */
@@ -185,11 +240,14 @@ module.exports = function cds_compile_for_flows(csn) {
     }
   }
 
+  const errors = []
   const to_be_extended = new Set()
 
   for (const name in csn.definitions) {
     const def = csn.definitions[name]
 
+    if (!def.kind || def.kind !== 'entity' || !def.elements || !def.actions) continue
+
     /*
      * 2. propagate @flow.status to respective element and make it @readonly
      */
@@ -201,8 +259,6 @@ module.exports = function cds_compile_for_flows(csn) {
       }
     }
 
-    if (!def.kind || def.kind !== 'entity' || !def.actions) continue
-
     /*
      * 3. normalize @from and @to annotations
      */
@@ -213,7 +269,19 @@ module.exports = function cds_compile_for_flows(csn) {
     }
 
     /*
-     * 4. automatically apply aspect FlowHistory if needed and not present yet
+     * 4. validate annotations
+     */
+    let status = Object.values(def.elements).filter(e => e['@flow.status'])
+    if (status.length === 0) continue
+    if (status.length > 1) {
+      errors.push(`Entity ${name} has multiple status elements. Only one @flow.status element is allowed per entity`)
+      continue
+    }
+    status = status[0]
+    _validate_status_types(name, def, status, csn, errors)
+
+    /*
+     * 5. automatically apply aspect FlowHistory if needed and not present yet
      */
     if (!_requires_history(def)) continue
 
@@ -226,6 +294,17 @@ module.exports = function cds_compile_for_flows(csn) {
     to_be_extended.add(base_name)
   }
 
+  /*
+   * 6. throw validation errors, if any
+   */
+  if (errors.length) {
+    if (errors.length === 1) cds.error(errors[0])
+    else cds.error('MULTIPLE_ERRORS', { details: errors.map(message => ({ message })) })
+  }
+
+  /*
+   * 7. apply the extensions
+   */
   if (to_be_extended.size) {
     // REVISIT: ensure sap.common.FlowHistory is there
     csn.definitions['sap.common.FlowHistory'] ??= JSON.parse(FlowHistory)
@@ -254,81 +333,9 @@ module.exports = function cds_compile_for_flows(csn) {
     csn = dsn
   }
 
-  // validate flow in CSN
-  const messages = []
-  const validate = (status, enumVals, action, fromTo) => {
-    if (status === null) return true    
-    if (enumVals) {
-      let val = status['#']
-      if (
-        !(typeof val === 'string' && Object.entries(enumVals).some(([key]) => key === val)) &&
-        !(fromTo === TO && typeof status === 'object' && status['='] === FLOW_PREVIOUS)
-      ) {
-        messages.push(`Invalid ${fromTo} value(s) in action ${action}`);
-        return false;
-      }
-    } else {
-      if (typeof status !== 'string' && !(fromTo === TO && typeof status === 'object' && status['='] === FLOW_PREVIOUS)) {
-        messages.push(`Invalid ${fromTo} value(s) in action ${action}`)
-        return false
-      }
-    }
-
-    return true
-  }
-  
-  for (const name in csn.definitions) {
-    const def = csn.definitions[name]
-    if (!def.kind || def.kind !== 'entity' || !def.actions || !def.elements) continue
-   
-    const statusElements = Object.values(def.elements).filter(e => e['@flow.status'])
-    if (statusElements.length === 0) continue
-    if (statusElements.length > 1) {
-      messages.push(`Entity ${name} has multiple status elements. Only one @flow.status element is allowed per entity`)
-      continue
-    }    
-    const status = statusElements[0]
-  
-    let enumVals
-    if (status.type === 'cds.Association') {
-      const target = csn.definitions[status.target]
-      if (!status.keys || status.keys.length !== 1) {
-        messages.push(`Status element in entity ${name} must have exactly one key when used as association`)
-        continue
-      } 
-      const code = target.elements[status.keys[0].ref[0]]
-      enumVals = code.enum || csn.definitions[code.type]?.enum
-    } else if (status.enum) {
-      enumVals = status.enum  
-    } else if (csn.definitions[status.type]?.enum) {
-      enumVals = csn.definitions[status.type].enum
-    }
-
-    for (const each in def.actions) {
-      const action = def.actions[each]
-      let froms = action[FROM]
-      if (froms !== undefined) {        
-        froms = Array.isArray(froms) ? froms : [froms]
-        for (let from of froms) if (!validate(from, enumVals, each, FROM)) break
-      }
-      let tos = action[TO]
-      if (tos !== undefined) {
-        if (Array.isArray(tos)) {
-          messages.push(`${TO} must not be an array in action ${each}`)
-          continue
-        }
-        validate(tos, enumVals, each, TO)
-      }
-    }
-  }
-  if (messages.length) {
-    if (messages.length === 1) cds.error(messages[0])
-    else {
-     const errors = messages.map(message => ({ message }))
-     cds.error ('MULTIPLE_ERRORS', { details: errors })    
-    }    
-  }
-
+  /*
+   * 8. exclude transitions_ from draft
+   */
   // REVISIT: annotate all X.transitions_ with @odata.draft.enabled: false
   for (const name in csn.definitions)
     if (name.endsWith('.transitions_')) csn.definitions[name]['@odata.draft.enabled'] = false

package/lib/srv/protocols/http.js

@@ -51,7 +51,7 @@ class HttpAdapter {
       const user = cds.context.user
       if (required.some(role => user.has(role))) return next()
       else if (user._is_anonymous) return next(401) // request login
-      else throw Object.assign(new Error, { code: 403, reason: `User '${user.id}' is lacking required roles: [${required}]`, user, required })
+      else throw Object.assign(new Error, { code: 403, reason: `User '${user.id}' is lacking required roles: [${required}]` })
     }
   }
 

package/libx/_runtime/remote/Service.js

@@ -45,7 +45,7 @@ const _buildPartialUrlFunctions = (url, data, params, kind = 'odata-v4') => {
     : `${url}(${funcParams.join(',')})?${queryOptions.join('&')}`
 }
 
-const _extractParamsFromData = (data, params = {}) => {
+const _extractParamsFromData = (data = {}, params = {}) => {
   return Object.keys(data).reduce((res, el) => {
     if (params[el]) Object.assign(res, { [el]: data[el] })
     return res
@@ -142,7 +142,16 @@ const _addHandlerActionFunction = (srv, def, target) => {
     srv.on(event, target, async function (req) {
       const shortEntityName = req.target.name.replace(`${this.definition.name}.`, '')
       if (this.kind === 'odata-v2') return _handleV2BoundActionFunction(srv, def, req, event, this.kind)
-      const url = `/${shortEntityName}(${_buildKeys(req, this.kind).join(',')})/${this.definition.name}.${event}`
+
+      const action = req.target.actions[req.event]
+      const onCollection = !!(
+        action['@cds.odata.bindingparameter.collection'] ||
+        (action?.params && [...action.params].some(p => p?.items?.type === '$self'))
+      )
+
+      const url = onCollection
+        ? `/${shortEntityName}/${this.definition.name}.${event}`
+        : `/${shortEntityName}(${_buildKeys(req, this.kind).join(',')})/${this.definition.name}.${event}`
       return _handleBoundActionFunction(srv, def, req, url)
     })
   } else {

package/libx/odata/middleware/delete.js

@@ -38,7 +38,8 @@ module.exports = adapter => {
     const headers = { ...cds.context.http.req.headers, ...req.headers }
 
     // we need a cds.Request for multiple reasons, incl. params, headers, sap-messages, read after write, ...
-    const cdsReq = adapter.request4({ query, data, headers, params, req, res })
+    // for UPDATE: data is already provided via query
+    const cdsReq = adapter.request4({ query, data: query.DELETE ? data : undefined, headers, params, req, res })
 
     // NOTES:
     // - only via srv.run in combination with srv.dispatch inside,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "9.7.0",
+  "version": "9.7.1",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [