refactor authorization

finkmanAtSap · finkmanAtSap · commit 257494494672 · 2026-01-15T16:50:05.000+01:00
diff --git a/.tours/ams-cap-nodejs-bookshop.tour b/.tours/ams-cap-nodejs-bookshop.tour
diff --git a/ams-cap-nodejs-bookshop/.cdsrc.json b/ams-cap-nodejs-bookshop/.cdsrc.json
@@ -4,31 +4,29 @@
             "[development]": {
                 "kind": "mocked",
                 "users": {
-                    "bob": {
+                    "content-manager": {
                         "policies": [
-                            "cap.admin",
-                            "cap.Reader"
+                            "cap.ContentManager"
                         ]
                     },
-                    "carol": {
+                    "stock-manager": {
                         "policies": [
-                            "local.Zealot"
+                            "cap.StockManager"
                         ]
                     },
-                    "dave": {
+                    "reader": {
                         "policies": [
-                            "local.JuniorReader"
+                            "cap.Reader"
                         ]
                     },
-                    "erin": {
+                    "stock-manager-fiction": {
                         "policies": [
-                            "local.BestsellerReader"
+                            "local.StockManagerFiction"
                         ]
                     },
-                    "fred": {
+                    "juniorReader": {
                         "policies": [
-                            "local.Zealot",
-                            "local.BestsellerReader"
+                            "local.JuniorReader"
                         ]
                     },
                     "technicalUser": {
@@ -49,7 +47,7 @@
                     },
                     "amsValueHelp": {
                         "policies": [
-                            "cap.admin"
+                            "cap.ContentManager"
                         ],
                         "ias_apis": [
                             "AMS_ValueHelp"
diff --git a/ams-cap-nodejs-bookshop/ams/dcl/cap/basePolicies.dcl b/ams-cap-nodejs-bookshop/ams/dcl/cap/basePolicies.dcl
@@ -1,16 +1,17 @@
-POLICY "Reader" {
-    ASSIGN ROLE "Reader" WHERE
-        genre           IS NOT RESTRICTED   AND
-        description     IS NOT RESTRICTED   AND
-        stock           IS NOT RESTRICTED;
+POLICY StockManager {
+  ASSIGN ROLE ManageBooks WHERE Genre IS NOT RESTRICTED;
 }
 
-POLICY Inquisitor {
-    ASSIGN ROLE "Inquisitor" WHERE 
-        description     IS NOT RESTRICTED;
+POLICY ContentManager {
+  ASSIGN ROLE ManageAuthors;
+  ASSIGN ROLE ManageBooks;
+  ASSIGN ROLE ValueHelpUser;
 }
 
-POLICY "admin" {
-    ASSIGN ROLE "admin";
+POLICY Reader {
+  ASSIGN ROLE ReadBooks WHERE Genre IS NOT RESTRICTED;
 }
 
+POLICY "ValueHelpUser" {
+	ASSIGN ROLE "ValueHelpUser";
+}
diff --git a/ams-cap-nodejs-bookshop/ams/dcl/internal/apiPolicies.dcl b/ams-cap-nodejs-bookshop/ams/dcl/internal/apiPolicies.dcl
@@ -1,10 +1,6 @@
-INTERNAL Policy AMS_ValueHelp {
-    USE cap.admin;
+INTERNAL POLICY AMS_ValueHelp {
+  ASSIGN ROLE ValueHelpUser;
 }
-
-INTERNAL Policy ReadCatalog {
-    USE cap.Reader RESTRICT 
-        genre           IS NOT RESTRICTED,
-        description     IS NOT RESTRICTED,
-        stock           < 30;
+INTERNAL POLICY ReadCatalog {
+    USE cap.Reader RESTRICT Genre NOT IN ('Mystery', 'Romance', 'Thriller', 'Dystopia');
 }
diff --git a/ams-cap-nodejs-bookshop/ams/dcl/local/adminPolicies.dcl b/ams-cap-nodejs-bookshop/ams/dcl/local/adminPolicies.dcl
@@ -1,18 +1,7 @@
-POLICY JuniorReader {
-    USE cap.Reader RESTRICT 
-        genre           IN ('Fantasy', 'Fairy Tale', 'Mystery'),
-        description     IS NOT RESTRICTED,
-        stock           IS NOT RESTRICTED;
-}
-
-POLICY BestsellerReader {
-    USE cap.Reader RESTRICT 
-        genre           IS NOT RESTRICTED,
-        description     IS NOT RESTRICTED,
-        stock           < 20;
+POLICY StockManagerFiction {
+    USE cap.StockManager RESTRICT Genre IN ('Mystery', 'Fantasy');
 }
 
-POLICY Zealot {
-    USE cap.Inquisitor RESTRICT 
-        description     LIKE '%religious%references%';
+POLICY JuniorReader {
+    USE cap.Reader RESTRICT Genre IN ('Fairy Tale', 'Fantasy', 'Mystery');
 }
diff --git a/ams-cap-nodejs-bookshop/ams/dcl/schema.dcl b/ams-cap-nodejs-bookshop/ams/dcl/schema.dcl
@@ -1,15 +1,8 @@
-// ---------------------------------HEADER_START-----------------------------------------------
-// Generated from a CAP model by the SAP AMS Plugin (@sap/ams) 3.3.0
-// hash of generated content: 760f88aa8521b7b516c368a517af58f0a55f37dfd0be60eb07c5d94cc2ea3efe
-// ----------------------------------HEADER_END------------------------------------------------
-
 SCHEMA {
 	@valueHelp: { 
 		path: 'Genres',
 		valueField: 'name',
 		labelField: 'name'
 	}
-	genre: String,
-	description: String,
-	stock: Number
+	Genre: String
 }
diff --git a/ams-cap-nodejs-bookshop/db/aspects.cds b/ams-cap-nodejs-bookshop/db/aspects.cds
@@ -0,0 +1,6 @@
+using { sap.capire.bookshop.Genres } from './schema';
+
+aspect media {
+    genre: Association to Genres;
+    stock: Integer;
+}
diff --git a/ams-cap-nodejs-bookshop/db/schema.cds b/ams-cap-nodejs-bookshop/db/schema.cds
@@ -1,12 +1,13 @@
 using { Currency, managed, sap } from '@sap/cds/common';
-using { stocked, media } from '../srv/aspects';
+using { media } from './aspects';
 namespace sap.capire.bookshop;
 
 
-entity Books : managed, media, stocked {
+entity Books : managed, media {
   key ID : Integer;
   @mandatory title  : localized String(111);
   @mandatory author : Association to Authors;
+  descr: localized String(1111);
   price  : Decimal;
   currency : Currency;
   image : LargeBinary @Core.MediaType : 'image/png';
diff --git a/ams-cap-nodejs-bookshop/package.json b/ams-cap-nodejs-bookshop/package.json
@@ -1,6 +1,6 @@
 {
   "name": "ams-cap-nodejs-bookshop",
-  "version": "2.2.0",
+  "version": "3.0.0",
   "description": "A simple CAP project demonstrating the integration of AMS into CAP.",
   "license": "UNLICENSED",
   "private": true,
diff --git a/ams-cap-nodejs-bookshop/srv/admin-service.cds b/ams-cap-nodejs-bookshop/srv/admin-service.cds
@@ -1,5 +1,14 @@
-using { sap.capire.bookshop as my } from '../db/schema';
-service AdminService @(requires:'admin', path: '/admin') {
+using {sap.capire.bookshop as my} from '../db/schema';
+
+service AdminService @(path: '/admin', requires: ['ManageAuthors', 'ManageBooks']) {
+
+  @(restrict: [
+    { grant: ['READ'], to: 'ManageAuthors' },
+    { grant: ['READ', 'WRITE'], to: 'ManageBooks' } ])
   entity Books as projection on my.Books;
+
+  @(restrict: [
+    { grant: ['READ', 'WRITE'], to: 'ManageAuthors' },
+    { grant: ['READ'], to: 'ManageBooks' } ])
   entity Authors as projection on my.Authors;
-}
+}
diff --git a/ams-cap-nodejs-bookshop/srv/aspects.cds b/ams-cap-nodejs-bookshop/srv/aspects.cds
diff --git a/ams-cap-nodejs-bookshop/srv/authorization.cds b/ams-cap-nodejs-bookshop/srv/authorization.cds
@@ -0,0 +1,5 @@
+using { media } from '../db/aspects';
+
+annotate media with @ams.attributes: {
+    Genre: (genre.name)
+};
diff --git a/ams-cap-nodejs-bookshop/srv/authorizations.cds b/ams-cap-nodejs-bookshop/srv/authorizations.cds
diff --git a/ams-cap-nodejs-bookshop/srv/cat-service.cds b/ams-cap-nodejs-bookshop/srv/cat-service.cds
@@ -3,21 +3,18 @@ using { sap.capire.bookshop as my } from '../db/schema';
 service CatalogService {
 
   /** For displaying lists of Books */
-  @ams.attributes: {
-    description: null
-  }
   @readonly entity ListOfBooks as projection on Books
   excluding { descr };
 
   /** For display in details pages */
-  @restrict: [{ grant:['READ'], to: ['Reader', 'Inquisitor'], where: 'stock > 0' }]
+  @restrict: [{ grant:['READ'], to: ['ReadBooks'], where: 'stock > 0' }]
   entity Books as projection on my.Books { *,
     author.name as author
   } excluding { createdBy, modifiedBy }
   actions {
-    @restrict: [{ to: ['Reader'] }]
+    @restrict: [{ to: ['ReadBooks'] }]
     function getStockedValue(book: $self) returns Decimal;
-    @restrict: [{ to: ['Reader'] }]
+    @restrict: [{ to: ['ReadBooks'] }]
     function getTotalStockedValue(books: many $self) returns Decimal;
   };
 
diff --git a/ams-cap-nodejs-bookshop/srv/vh-service.cds b/ams-cap-nodejs-bookshop/srv/vh-service.cds
@@ -1,6 +1,6 @@
 using { sap.capire.bookshop as my }  from '../db/schema';
 
-service AmsValueHelpService @(requires: 'admin') {
+service AmsValueHelpService @(requires: 'ValueHelpUser') {
     @cds.localized: false
     entity Genres as projection on my.Genres;
 }
diff --git a/ams-cap-nodejs-bookshop/test/cat-service.test.js b/ams-cap-nodejs-bookshop/test/cat-service.test.js
@@ -3,7 +3,7 @@ const cds = require('@sap/cds')
 describe('CatalogService', () => {
   const { GET, axios } = cds.test()
 
-  describe('called by alice (no Reader)', () => {
+  describe('called by alice (no ReadBooks)', () => {
     beforeAll(() => {
       axios.defaults.auth = { username: 'alice', password: '' }
     })
@@ -23,7 +23,7 @@ describe('CatalogService', () => {
     })
   })
 
-  describe('called by bob (cap.Reader policy assigned)', () => {
+  describe('called by bob (cap.ReadBooks policy assigned)', () => {
     beforeAll(() => {
       axios.defaults.auth = { username: 'bob', password: '' }
     })

Original file line number	Diff line number	Diff line change
`@@ -1,6 +1,6 @@`
`1`	`1`	`{`
`2`	`2`	`"name": "ams-cap-nodejs-bookshop",`
`3`		`- "version": "2.2.0",`
	`3`	`+ "version": "3.0.0",`
`4`	`4`	`"description": "A simple CAP project demonstrating the integration of AMS into CAP.",`
`5`	`5`	`"license": "UNLICENSED",`
`6`	`6`	`"private": true,`