Skip to content

Commit

Permalink
Use more config inspector
Browse files Browse the repository at this point in the history
  • Loading branch information
chgeo committed Oct 23, 2024
1 parent 896dba0 commit fda9f43
Show file tree
Hide file tree
Showing 10 changed files with 29 additions and 39 deletions.
9 changes: 3 additions & 6 deletions .vitepress/theme/components/ConfigInspect.vue
Original file line number Diff line number Diff line change
Expand Up @@ -108,13 +108,10 @@
const slots = useSlots()
const slotVal = slots.default?.().at(0)?.children?.toString() ?? 'error: provide <Config>your_key:value</Config>'
const { java, keyOnly } = withDefaults(defineProps<{
java?:boolean,
const { java, keyOnly } = defineProps<{
java?: boolean,
keyOnly?: boolean
}>(), {
java: false,
keyOnly: false
})
}>()
const [key, val] = slotVal.split(/\s*[:=]\s*/)
let value:any = val
Expand Down
9 changes: 1 addition & 8 deletions guides/data-privacy/audit-logging.md
Original file line number Diff line number Diff line change
Expand Up @@ -40,14 +40,7 @@ npm add @cap-js/audit-logging

[CDS Plugin Packages](../../node.js/cds-plugins) are self-contained extensions. They not only include the relevant code but also bring their own default configuration. In our case, next to bringing the respective code, the plugin does the following:

1. Sets `cds.requires.audit-log: true` in `cds.env`, equivalent to:
```json
{"cds":{
"requires": {
"audit-log": true
}
}}
```
1. Sets <Config>cds.requires.audit-log: true</Config>

2. Which in turn activates the `audit-log` configuration **presets**:
```jsonc
Expand Down
2 changes: 1 addition & 1 deletion guides/databases-postgres.md
Original file line number Diff line number Diff line change
Expand Up @@ -368,7 +368,7 @@ When redeploying after you changed your CDS models, like adding fields, automati
5. Store a CSN representation of the current model in `cds_model`.


> You can disable automatic schema evolution, if necessary, by setting `cds.requires.db.schema_evolution = false`.
> You can disable automatic schema evolution, if necessary, by setting <Config>cds.requires.db.schema_evolution = false</Config>.

### Limitations

Expand Down
2 changes: 1 addition & 1 deletion guides/databases-sqlite.md
Original file line number Diff line number Diff line change
Expand Up @@ -750,7 +750,7 @@ ID;title;author.ID;currency.code // [!code --]
As mentioned in [Using Lean Draft](#using-lean-draft), we eliminated all draft handling from new database service implementations, and instead implemented draft in a modular, non-intrusive, and optimized way — called *'Lean Draft'*.
When using the new service, the new `cds.fiori.lean_draft` mode is automatically switched on. You may additionally switch on `cds.fiori.draft_compat` in case you run into problems.
When using the new service, the new `cds.fiori.lean_draft` mode is automatically switched on. You may additionally switch on <Config keyOnly>cds.fiori.draft_compat:true</Config> in case you run into problems.
More detailed documentation for that is coming.
Expand Down
4 changes: 1 addition & 3 deletions guides/databases.md
Original file line number Diff line number Diff line change
Expand Up @@ -735,9 +735,7 @@ The information about foreign key relations contained in the associations of CDS
Enable generation of foreign key constraints on the database with:
```js
cds.features.assert_integrity = 'db'
```
<Config>cds.features.assert_integrity = db</Config>
::: warning Database constraints are not supported for H2
Referential constraints on H2 cannot be defined as "deferred", which is needed for database constraints within CAP.
Expand Down
8 changes: 4 additions & 4 deletions guides/i18n.md
Original file line number Diff line number Diff line change
Expand Up @@ -72,7 +72,7 @@ srv/
_i18n/i18n.properties # in a parent folder
```
::: tip
You can configure the folder names where `cds` searches for property bundles by setting `cds.i18n.folders` in your project's _package.json_.
You can configure the folder names where `cds` searches for property bundles by setting <Config>cds.i18n.folders</Config> in your project's _package.json_.
:::

The default is:
Expand Down Expand Up @@ -130,7 +130,7 @@ So, the complete stack of overlaid models for the given example would look like
| *db/schema.cds* | underlying data model |

::: tip _Note_ <!-- -->
The _default language_ is usually `en` but can be overridden by configuring `cds.i18n.default_language` in your project's _package.json_.
The _default language_ is usually `en` but can be overridden by configuring <Config>cds.i18n.default_language</Config> in your project's _package.json_.
:::

## Merging Reuse Bundles
Expand Down Expand Up @@ -188,7 +188,7 @@ To reduce the number of required translations, most determined locales are norma

#### Configuring Normalized Locales

For CAP Node.js, the list of preserved locales is configurable, for example in the _package.json_ file, using the configuration option `cds.i18n.preserved_locales`as follows:
For CAP Node.js, the list of preserved locales is configurable, for example in the _package.json_ file, using the configuration option <Config>cds.i18n.preserved_locales</Config> as follows:

```jsonc
{"cds":{
Expand All @@ -208,7 +208,7 @@ For CAP Node.js, the list of preserved locales is configurable, for example in t

In this example we removed `es_CO` and `es_MX` from the list, and added `pt_BR`.

In CAP Java the preserved locales can be configured via the [`cds.locales.normalization.includeList` property](../java/developing-applications/properties#cds-locales-normalization).
In CAP Java the preserved locales can be configured via the <Config java>cds.locales.normalization.includeList</Config> [property](../java/developing-applications/properties#cds-locales-normalization).

::: warning *Note:* <!-- -->
However this list is configured, ensure to have translations for the listed locales, as the fallback language will otherwise be `en`.
Expand Down
6 changes: 3 additions & 3 deletions guides/providing-services.md
Original file line number Diff line number Diff line change
Expand Up @@ -512,8 +512,8 @@ Don't use reliable pagination if an entity set is sorted by elements that contai
:::

The feature can be enabled with the following [configuration options](../node.js/cds-env#project-settings) set to `true`:
- Java: `cds.query.limit.reliablePaging.enabled`
- Node.js: `cds.query.limit.reliablePaging`
- Java: <Config java keyOnly>cds.query.limit.reliablePaging.enabled: true</Config>
- Node.js: <Config keyOnly>cds.query.limit.reliablePaging: true</Config>


#### Paging Limits
Expand Down Expand Up @@ -1321,7 +1321,7 @@ a CDS query, a binary string is used to query data stored as binary, this wouldn
binary data differently. For example, HDB automatically converts binary strings into binary data, whereas SAP HANA
Client doesn't.
- In the Node.js Runtime, all binary strings are converted into binary data according to SAP HANA property types.
To disable this default behavior, you can set the environment variable `cds.env.hana.base64_to_buffer` to `false`.
To disable this default behavior, you can set the environment variable <Config>cds.hana.base64_to_buffer: false</Config>.

# Best Practices

Expand Down
16 changes: 9 additions & 7 deletions guides/security/aspects.md
Original file line number Diff line number Diff line change
Expand Up @@ -439,16 +439,16 @@ Apart from that the used web server frameworks such as Spring or Express already
<div class="impl node">
CAP Node.js offers a CLRF-safe [logging API](../../node.js/cds-log#logging-in-production) that should be used for application logs.
</div>
<div class="impl java">
::: warning
Currently, CAP applications need to care for escaping user data that is used as input parameter for application logging.
It's recommended to make use of an existing Encoder such as OWASP [ESAPI](https://www.javadoc.io/doc/org.owasp.esapi/esapi/2.0.1/org/owasp/esapi/Encoder.html).
:::

</div>

- [Deserialization of untrusted data](https://owasp.org/www-community/vulnerabilities/Deserialization_of_untrusted_data) can lead to serious exploits including remote code execution.
Expand Down Expand Up @@ -527,15 +527,17 @@ See section [Maximum Request Body Size](../../node.js/cds-server#maximum-request
Moreover, CAP adapters automatically introduce query results pagination in order to limit memory peaks (customize with [`@cds.query.limit`](../providing-services#annotation-cds-query-limit)).
The total number of request of OData batches can be limited by application configuration.

<div markdown="1" class="impl java">
Settings `cds.odataV4.batch.maxRequests` resp. `cds.odataV2.batch.maxRequests` specify the corresponding limits.
<div class="impl java">

Settings <Config java>cds.odataV4.batch.maxRequests</Config> resp. <Config java>cds.odataV2.batch.maxRequests</Config> specify the corresponding limits.

</div>

::: warning
CAP applications have to limit the amount of `$expands` per request in a custom handler.
Also the maximum amount of requests per `$batch` request need to be configured as follows:
- Node.js: `cds.odata.batch_limit = <max_requests>`
- Java: `cds.odataV4.batch.maxRequests = <max_requests>`
- Node.js: <Config>cds.odata.batch_limit = \<max_requests\></Config>
- Java: <Config java>cds.odataV4.batch.maxRequests = \<max_requests\></Config>
:::

::: tip
Expand Down
10 changes: 5 additions & 5 deletions guides/security/authorization.md
Original file line number Diff line number Diff line change
Expand Up @@ -256,7 +256,7 @@ annotate ShopService.ReplicationAction with @(requires: 'system-user');

In this example, the `BrowseBooksService` service is open for authenticated but not for anonymous users. A user who has the `Vendor` _or_ `ProcurementManager` role is allowed to access the `ShopService.Books` entity. Unbound action `ShopService.ReplicationAction` can only be triggered by a technical user.
::: tip
When restricting service access through `@requires`, the service's metadata endpoints (that means, `/$metadata` as well as the service root `/`) are restricted by default as well. If you require public metadata, you can disable the check through config `cds.env.odata.protectMetadata = false` (Node.js) or `cds.security.authentication.authenticateMetadataEndpoints = false` (Java), respectively. Please be aware that the `/$metadata` endpoint is *not* checking for authorizations implied by `@restrict` annotation.
When restricting service access through `@requires`, the service's metadata endpoints (that means, `/$metadata` as well as the service root `/`) are restricted by default as well. If you require public metadata, you can disable the check through config <Config>cds.odata.protectMetadata: false</Config> (Node.js) or <Config java>cds.security.authentication.authenticateMetadataEndpoints = false</Config> (Java), respectively. Please be aware that the `/$metadata` endpoint is *not* checking for authorizations implied by `@restrict` annotation.
:::


Expand Down Expand Up @@ -345,7 +345,7 @@ Restrictions can be defined on different types of CDS resources, but there are s
| action/function | <Na/> | <Y/> | <Na/><sup>2</sup> | = `@requires` |

> <sup>1</sup>For bound actions and functions that aren't bound against a collection, Node.js supports instance-based authorization at the entity level. For example, you can use `where` clauses that *contain references to the model*, such as `where: CreatedBy = $user`. For all bound actions and functions, Node.js supports simple static expressions at the entity level that *don't have any reference to the model*, such as `where: $user.level = 2`.
> <sup>2</sup> For unbound actions and functions, Node.js supports simple static expressions that *don't have any reference to the model*, such as `where: $user.level = 2`.
> <sup>2</sup> For unbound actions and functions, Node.js supports simple static expressions that *don't have any reference to the model*, such as `where: $user.level = 2`.
Unsupported privilege properties are ignored by the runtime. Especially, for bound or unbound actions, the `grant` property is implicitly removed (assuming `grant: '*'` instead). The same also holds for functions:

Expand Down Expand Up @@ -864,17 +864,17 @@ If generic enforcement doesn't fit your needs, you can override or adapt it with

The Authorization Management Service (AMS) as part of SAP Cloud Identity Services (SCI) provides libraries and services for developers of cloud business applications to declare, enforce and manage instance based authorization checks. When used together with CAP the AMS "Policies” can contain the CAP roles as well as additional filter criteria for instance based authorizations that can be defined in the CAP model. transformed to AMS policies and later on refined by customers user and authorization administrators in the SCI administration console and assigned to business users.

### Use AMS as Authorization Management System on SAP BTP
### Use AMS as Authorization Management System on SAP BTP

SAP BTP is currently replacing the authorization management done with XSUAA by an integrated solution with AMS. AMS is integrated into SAP Cloud Identity (SCI), which will offer authentication, authorization, user provisioning and management in one place.
SAP BTP is currently replacing the authorization management done with XSUAA by an integrated solution with AMS. AMS is integrated into SAP Cloud Identity (SCI), which will offer authentication, authorization, user provisioning and management in one place.

For newly build applications the usage of AMS is generally recommended. The only constraint that comes with the usage of AMS is that customers need to copy their users to the Identity Directory Service as the central place to manage users for SAP BTP applications. This is also the general SAP strategy to simplify user management in the future.

### Case For XSUAA

There is one use case where currently an XSUAA based authorization management is preferable: When XSUAA based services to be consumed by a CAP application come with their own business user roles and thus make user role assignment in the SAP Cloud Cockpit necessary. This will be resolved in the future when the authorization management will be fully based on the SCI Admin console.

For example, SAP Task Center you want to consume an XSUAA-based service that requires own end user role. Apart from this, most services should be technical services that do not require an own authorization management that is not yet integrated in AMS.
For example, SAP Task Center you want to consume an XSUAA-based service that requires own end user role. Apart from this, most services should be technical services that do not require an own authorization management that is not yet integrated in AMS.


<!-- [Learn more about using IAS and AMS with CAP Java.](/java/ams){.learn-more} -->
Expand Down
2 changes: 1 addition & 1 deletion tools/cds-editors.md
Original file line number Diff line number Diff line change
Expand Up @@ -258,7 +258,7 @@ Enable to get quickfix proposals for artifact names, like entities, that aren't
1. Press <kbd>F1</kbd>
1. Open *CDS: Show CAP Release Notes*

If there are new release notes, this page opens on startup. You can disable this behavior using the *CDS > Release Notes: Show Automatically* (`cds.releaseNotes.showAutomatically`) setting.
If there are new release notes, this page opens on startup. You can disable this behavior using the *Cds > [Release Notes: Show Automatically](vscode://settings/cds.releaseNotes.showAutomatically)* setting.

##### CAP Notebooks Page { #cap-notebooks-page }

Expand Down

0 comments on commit fda9f43

Please sign in to comment.