Events and Requests

• Class cds.EventContext
  • ctx.id → string
  • ctx.user → cds.User
  • ctx.tenant → string
  • ctx.locale → string
  • ctx.timestamp → Date
• Class cds.Event
  • msg.event → string
  • msg.data → {…} or […]
  • msg.headers → {…}
• Class cds.Request
  • req._ → {…}
  • req.method → string
  • req.target → [def]
  • req.path → string
  • req.entity → string
  • req.params → iterable
  • req.query → cqn
  • req.reply (results)
  • req.reject (code?, msg, target?, args?)
  • req.error, notify, info, warn (code?, msg, target?, args?)

Class cds.EventContext

Class cds.EventContext represents the invocation context of incoming request and event messages, mostly tenant. It also serves as a base class for cds.Event and cds.Request.

ctx.id → string

ctx.user → cds.User

The current user as identified and verified by the authentication strategy.

See reference docs for cds.User.

ctx.tenant → string

A unique string identifying the current tenant, or undefined if not run in multitenancy mode. In case of multitenant operation, this string is used for tenant isolation, for example as keys in the database connection pools.

ctx.locale → string

The current user’s preferred locale, usually taken from HTTP Accept-Language header of incoming requests and resolve to normalized

ctx.timestamp → Date

Class cds.Event

Class cds.Event represents event messages in asynchronous messaging, providing access to the event name, target, payload data, and headers. It also serves as the base class for cds.Request and hence for all synchronous interaction.

msg.event → string

The name of the incoming event, which can be one of:

• The name of an incoming CRUD request like CREATE
• The name of an emitted CRUD event like UPDATED
• The name of a custom operation like cancelOrder.
• The name of a custom event like cancelledOrder

msg.data → {…} or […]

Contains the request payload if CREATE and UPDATE requests, which can either be a single object or an array of objects in case of bulk operations (example: await CatalogService.create('Books').entries([...])).
Contains the keys of the entity if DELETE and READ requests on a single entity through OData or REST.
Contains parameters for functions and payload for actions.

msg.headers → {…}

Provides access to headers of the event message or request. In case of asynchronous event messages, it’s the headers information sent by the event source. If HTTP requests, it’s the standard Node.js headers of class IncomingMessage.

Class cds.Request

Class cds.Request extends cds.Event with additional features to represent and deal with synchronous requests to services in [event handlers], such as the query, additional request parameters, the authenticated user, and methods to send responses.

req._ → {…}

Provides access to original inbound protocol-specific request objects. For events triggered by an HTTP request, it contains the original req and res objects as obtained from express.js.

Please refrain from using internal properties of that object, i.e. the ones starting with ‘_’. They might be removed in any future release without notice.

req.method → string

The HTTP method of the incoming request:

req.target → [def]

Refers to the current request’s target entity definition, if any; undefined for unbound actions/functions and events. The returned definition is a linked definition as reflected from the CSN model.

In case of OData navigation requests along associations, msg.target refers to the last target. For example:

See also req.path to learn how to access full navigation paths. See Entity Definitions in the CSN reference. Learn more about linked models and definitions.

req.path → string

Captures the full canonicalized path information of incoming requests with navigation. If requests without navigation, req.path is identical to req.target.name (or req.entity, which is a shortcut for that).

Examples based on cap/samples/bookshop AdminService:

See also req.target

req.entity → string

This is a convenience shortcut to msg.target.name.

req.params → iterable

Provides access to parameters in URL paths as an iterable with the contents matching the positional occurrence of parameters in the url path. In case of compound parameters, the respective entry is the key value pairs as given in the URL.

For example, the parameters in an HTTP request like that:

GET /catalog/Authors(101)/books(title='Eleonora',edition=2)`

The provided parameters can be accessed as follows:

const [ author, book ] = req.params
// > author === 101
// > book === { title: 'Eleonora', edition: 2 }

req.query → cqn

Captures the incoming request as a CQN query object. For example, an HTTP request like GET http://.../Books would be captured as follows:

req.query = {SELECT:{from:{ref:['Books']}}}

If bound custom operations req.query contains the query to the entity, on which the bound custom operation is called. For unbound custom operations req.query contains an empty object.

req.reply (results)

Stores the given results in req.results, which will then be sent back to the client, rendered in a protocol-specific way.

req.reject (code?, msg, target?, args?)

Rejects the request with the given HTTP response code and single message. Additionally, req.reject throws an error based on the passed arguments. Hence, no additional code and handlers will be executed once req.reject has been invoked.

Arguments are the same as for req.error

req.error, notify, info, warn (code?, msg, target?, args?)

Use these methods to collect messages or error and return them in the request response to the caller. The method variants reflect different severity levels, use them as follows:

Variants

Note: messages with severity < 4 a collected and accessible in property req.messages, while error messages are collected in property req.errors. The latter allows to easily check, whether errors occurred with:

if (req.errors) //> get out somehow...

Arguments

• code Number, that means, HTTP status codes
• msg String | Object | Error → see below for details on the non-string version.
• target the name of an input field/element a message is related to.
• args array of placeholder values → see Localized Messages for details.

Using an Object as Argument

You can also pass an object as the sole argument, which then contains the properties code, message, target, and args. Additional properties are preserved until the error or message is sanitized for the client. In case of an error, the additional property status (or statusCode) can be used to specify the HTTP status code of the response.

req.error ({
  code: 'Some-Custom-Code',
  message: 'Some Custom Error Message',
  target: 'some_field',
  status: 418
})

Additional properties can be added as well, for example to be used in custom error handlers.

In OData responses, notifications get collected and put into header sap-messages as a stringified array, while the others are collected in the respective response body properties (→ see OData Error Responses).

Error Sanitization

In production, errors should never disclose any internal information that could be used by malicious actors. Hence, we sanitize all server-side errors. That is, all errors with a 5xx status code (the default status code is 500) are returned to the client with only the respective generic message (example: 500 Internal Server Error).

Additionally, the OData protocol specifies which properties an error object may have. If a custom property shall reach the client, it must be prefixed with @ in order to not be purged.