@sap/cds 9.8.3 → 9.8.4

package/CHANGELOG.md

@@ -4,6 +4,14 @@
 - The format is based on [Keep a Changelog](https://keepachangelog.com/).
 - This project adheres to [Semantic Versioning](https://semver.org/).
 
+## Version 9.8.4 - 2026-03-26
+
+### Fixed
+
+- `res.statusCode` of batch sub-requests did not consider potential modifications during `srv.on('error')`
+- Restore login challenge for late `401` with mocked authentication in `$batch`
+- Batched request fails when depended upon atomicity group fails
+
 ## Version 9.8.3 - 2026-03-12
 
 ### Fixed

package/libx/odata/middleware/batch.js

@@ -149,7 +149,12 @@ const _createSubrequest = (request, _req, _res) => {
   req.headers['content-type'] ??= _req.headers['content-type']
   if (request.content_id) req.headers['content-id'] = request.content_id
   req.body = request.body
-  if (_req._login) req._login = _req._login
+  if (_req._login) {
+    req._login = () => {
+      _req._login() //> sends 401 to client
+      req.res.sendStatus(401) //> fails the subrequest
+    }
+  }
   // REVISIT: mark as subrequest (only needed for logging)
   req._subrequest = true
 
@@ -392,6 +397,7 @@ const _replaceResponsesWithCommitErrors = (err, responses, ids) => {
 const _serializeErrors = responses => {
   for (const response of responses) {
     if (response.status === 'fail' && typeof response.body === 'object') {
+      if (response.body.error?.status) response.statusCode = response.body.error.status
       if (response.body.error && !response.body.error.toJSON) response.body.error = _getODataError(response.body.error)
       response.body = JSON.stringify(response.body)
     }
@@ -435,9 +441,18 @@ const _processBatch = async (srv, router, req, res, next, body, ct, boundary) =>
     if (only_gets && cds.env.odata.group_parallel_gets && _only_individual_requests())
       atomicityGroups = [atomicityGroups.reduce((acc, cur) => (acc.push(...cur), acc), [])]
 
-    res.setHeader('Content-Type', isJson ? CT.JSON : CT.MULTIPART + ';boundary=' + boundary)
-    res.status(200)
-    res.write(isJson ? '{"responses":[' : '')
+    // IMPORTANT: Avoid sending headers and responses too eagerly, as we might still have to send a 401
+    let sendPostlude = () => {} //> only if prelude was sent
+    let sendPreludeOnce = () => {
+      res.setHeader('Content-Type', isJson ? CT.JSON : CT.MULTIPART + ';boundary=' + boundary)
+      res.status(200)
+      res.write(isJson ? '{"responses":[' : '')
+      sendPreludeOnce = () => {} //> only once
+      sendPostlude = () => {
+        res.write(isJson ? ']}' : `--${boundary}--${CRLF}`)
+        res.end()
+      }
+    }
 
     const queue = []
     let _continue = true
@@ -501,8 +516,8 @@ const _processBatch = async (srv, router, req, res, next, body, ct, boundary) =>
           .catch(err => {
             responses._has_failure = true
 
-            // abort batch on first failure with odata.continue-on-error: false
-            if (!continue_on_error) {
+            // abort batch on first failure with odata.continue-on-error: false or if it was a 401
+            if (!continue_on_error || err.code == 401 || err.status == 401) {
               _continue = false
               while (queue.length) queue.shift()()
             }
@@ -511,6 +526,8 @@ const _processBatch = async (srv, router, req, res, next, body, ct, boundary) =>
               // here, the commit was rejected even though all requests were successful (e.g., by custom handler or db consistency check)
               _replaceResponsesWithCommitErrors(err, responses, ids)
             }
+
+            throw err
           })
           .finally(async () => {
             // trigger next in queue
@@ -524,6 +541,10 @@ const _processBatch = async (srv, router, req, res, next, body, ct, boundary) =>
             for (let i = 0; i < agIndex; i++) prevs.push(promises[i])
             await Promise.allSettled(prevs)
 
+            // don't write to res if already closed (e.g., due to 401 and login)
+            if (res.closed) return
+
+            sendPreludeOnce()
             if (isJson) _writeResponseJson(responses, res)
             else _writeResponseMultipart(responses, res, boundary)
           })
@@ -543,8 +564,7 @@ const _processBatch = async (srv, router, req, res, next, body, ct, boundary) =>
 
     await Promise.allSettled(promises)
 
-    res.write(isJson ? ']}' : `--${boundary}--${CRLF}`)
-    res.end()
+    sendPostlude()
   } catch (e) {
     next(e)
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cds",
-  "version": "9.8.3",
+  "version": "9.8.4",
   "description": "SAP Cloud Application Programming Model - CDS for Node.js",
   "homepage": "https://cap.cloud.sap/",
   "keywords": [