@sap/cds 9.8.2 → 9.8.4

package/CHANGELOG.md

@@ -4,6 +4,20 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 9.8.4 - 2026-03-26
+
+### Fixed
+
+- `res.statusCode` of batch sub-requests did not consider potential modifications during `srv.on('error')`
+- Restore login challenge for late `401` with mocked authentication in `$batch`
+- Batched request fails when depended upon atomicity group fails
+
+## Version 9.8.3 - 2026-03-12
+
+### Fixed
+
+- OData batch parallel processing: Drain remaining queue when aborting
+
 ## Version 9.8.2 - 2026-03-10
 
 ### Fixed

package/lib/srv/protocols/hcql.js

@@ -47,7 +47,7 @@ class HCQLAdapter extends require('./http') {
 
     // Error formatting
     router.use ((err, req, res, next) => {
-      err.$response = e => ({ errors: [ { ...e, message: e.message } ] })
+      if (typeof err === 'object') err.$response = e => ({ errors: [ { ...e, message: e.message } ] })
       next(err)
     })
 

package/libx/odata/middleware/batch.js

@@ -149,7 +149,12 @@ const _createSubrequest = (request, _req, _res) => {
   req.headers['content-type'] ??= _req.headers['content-type']
   if (request.content_id) req.headers['content-id'] = request.content_id
   req.body = request.body
-  if (_req._login) req._login = _req._login
+  if (_req._login) {
+    req._login = () => {
+      _req._login() //> sends 401 to client
+      req.res.sendStatus(401) //> fails the subrequest
+    }
+  }
   // REVISIT: mark as subrequest (only needed for logging)
   req._subrequest = true
 
@@ -392,6 +397,7 @@ const _replaceResponsesWithCommitErrors = (err, responses, ids) => {
 const _serializeErrors = responses => {
   for (const response of responses) {
     if (response.status === 'fail' && typeof response.body === 'object') {
+      if (response.body.error?.status) response.statusCode = response.body.error.status
       if (response.body.error && !response.body.error.toJSON) response.body.error = _getODataError(response.body.error)
       response.body = JSON.stringify(response.body)
     }
@@ -435,9 +441,18 @@ const _processBatch = async (srv, router, req, res, next, body, ct, boundary) =>
     if (only_gets && cds.env.odata.group_parallel_gets && _only_individual_requests())
       atomicityGroups = [atomicityGroups.reduce((acc, cur) => (acc.push(...cur), acc), [])]
 
-    res.setHeader('Content-Type', isJson ? CT.JSON : CT.MULTIPART + ';boundary=' + boundary)
-    res.status(200)
-    res.write(isJson ? '{"responses":[' : '')
+    // IMPORTANT: Avoid sending headers and responses too eagerly, as we might still have to send a 401
+    let sendPostlude = () => {} //> only if prelude was sent
+    let sendPreludeOnce = () => {
+      res.setHeader('Content-Type', isJson ? CT.JSON : CT.MULTIPART + ';boundary=' + boundary)
+      res.status(200)
+      res.write(isJson ? '{"responses":[' : '')
+      sendPreludeOnce = () => {} //> only once
+      sendPostlude = () => {
+        res.write(isJson ? ']}' : `--${boundary}--${CRLF}`)
+        res.end()
+      }
+    }
 
     const queue = []
     let _continue = true
@@ -487,42 +502,49 @@ const _processBatch = async (srv, router, req, res, next, body, ct, boundary) =>
 
             // ensure all subrequests run in this tx
             // (if first subrequest fails without really opening the tx, the rest are executed in a "dangling tx")
-            return Promise.allSettled(subrequests)
-              .then(ress => {
-                // wait for all previous atomicity groups (ignoring errors via allSettled) for odata v2
-                const prevs = []
-                for (let i = 0; i < agIndex; i++) prevs.push(promises[i])
-                return Promise.allSettled(prevs).then(() => ress)
-              })
-              .then(ress => {
-                const failed = ress.filter(({ status }) => status === 'rejected')
-                if (!failed.length) return
-                // throw first error and call srv.on('error') for the others
-                const first = failed.shift()
-                if (srv.handlers._error?.length)
-                  for (const other of failed)
-                    for (const each of srv.handlers._error) each.handler.call(srv, other.reason, cds.context)
-                throw first.reason
-              })
+            return Promise.allSettled(subrequests).then(ress => {
+              const failed = ress.filter(({ status }) => status === 'rejected')
+              if (!failed.length) return
+              // throw first error and call srv.on('error') for the others
+              const first = failed.shift()
+              if (srv.handlers._error?.length)
+                for (const other of failed)
+                  for (const each of srv.handlers._error) each.handler.call(srv, other.reason, cds.context)
+              throw first.reason
+            })
           })
           .catch(err => {
             responses._has_failure = true
 
-            // abort batch on first failure with odata.continue-on-error: false
-            if (!continue_on_error) _continue = false
+            // abort batch on first failure with odata.continue-on-error: false or if it was a 401
+            if (!continue_on_error || err.code == 401 || err.status == 401) {
+              _continue = false
+              while (queue.length) queue.shift()()
+            }
 
             if (!responses.some(r => r.status === 'fail')) {
               // here, the commit was rejected even though all requests were successful (e.g., by custom handler or db consistency check)
               _replaceResponsesWithCommitErrors(err, responses, ids)
             }
+
+            throw err
           })
-          .finally(() => {
+          .finally(async () => {
             // trigger next in queue
             if (queue.length) queue.shift()()
 
             // late error serialization
             if (responses._has_failure) _serializeErrors(responses)
 
+            // wait for all previous atomicity groups (ignoring errors via allSettled) for odata v2
+            const prevs = []
+            for (let i = 0; i < agIndex; i++) prevs.push(promises[i])
+            await Promise.allSettled(prevs)
+
+            // don't write to res if already closed (e.g., due to 401 and login)
+            if (res.closed) return
+
+            sendPreludeOnce()
             if (isJson) _writeResponseJson(responses, res)
             else _writeResponseMultipart(responses, res, boundary)
           })
@@ -540,10 +562,9 @@ const _processBatch = async (srv, router, req, res, next, body, ct, boundary) =>
     // trigger first max_parallel in queue
     for (let i = 0; i < max_parallel; i++) if (queue.length) queue.shift()()
 
-    await Promise.all(promises)
+    await Promise.allSettled(promises)
 
-    res.write(isJson ? ']}' : `--${boundary}--${CRLF}`)
-    res.end()
+    sendPostlude()
   } catch (e) {
     next(e)
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "9.8.2",
+  "version": "9.8.4",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [