Skip to content

Node.js: clarify instance-based auth - #2761

Open
sjvans wants to merge 12 commits into
rjegl/untoggle-sec-authfrom
instance-based
Open

Node.js: clarify instance-based auth#2761
sjvans wants to merge 12 commits into
rjegl/untoggle-sec-authfrom
instance-based

Conversation

@sjvans

@sjvans sjvans commented Jul 21, 2026

Copy link
Copy Markdown
Contributor

No description provided.

@sjvans sjvans mentioned this pull request Jul 21, 2026
Closed
sjvans
sjvans commented Jul 27, 2026
View reviewed changes
Comment thread guides/security/authorization.md Outdated
sjvans
sjvans commented Jul 27, 2026
View reviewed changes
Comment thread guides/security/authorization.md Outdated
sjvans
sjvans commented Aug 14, 2026
View reviewed changes
Comment thread guides/security/authorization.md Outdated
@sjvans
sjvans marked this pull request as ready for review August 14, 2026 00:42
@sjvans
sjvans requested review from danjoa and smahati as code owners August 14, 2026 00:42
@renejeglinsky

renejeglinsky commented Aug 14, 2026

Copy link
Copy Markdown
Contributor

This guide is about to be untoggled: #2759
Does it make sense to base this PR on the "untoggle" one so that you don't add new profiling here?

@sjvans

sjvans commented Aug 14, 2026

Copy link
Copy Markdown
Contributor Author

This guide is about to be untoggled: #2759 Does it make sense to base this PR on the "untoggle" one so that you don't add new profiling here?

is it ready?

@renejeglinsky

renejeglinsky commented Aug 17, 2026

Copy link
Copy Markdown
Contributor

This guide is about to be untoggled: #2759 Does it make sense to base this PR on the "untoggle" one so that you don't add new profiling here?

is it ready?

Yes :)

sjvans and others added 10 commits August 17, 2026 10:54
@sjvans
Node.js: clarify instance-based auth
b9662e8
@sjvans
restore toggle
fe1cd2b
@sjvans
more toggles
a526121
@sjvans
Simple Static Checks
93f9d7f
@sjvans
Apply suggestion from @sjvans
86c719a
@sjvans
Apply suggestion from @sjvans
85637dd
@sjvans
docs(auth): static @restrict.where on collection-bound actions + Node…
98e81b5 
… reject-403

- Simple static checks now also apply to collection-bound actions in Node.js
  (cap/cds#6570), alongside CREATE/NEW and unbound actions/functions.
- Rejected Entity Selection (single-entity READ -> 404, UPDATE/DELETE -> 403)
  is no longer Java-only; Node.js aligns (verified in cds-compliance#46). The
  CAP Java version/config note is scoped to an impl-java block.
@sjvans
Apply suggestion from @sjvans
9018e5c
@sjvans
1,2
2807d81
@sjvans
untoggle authorization guide
000bc07
@sjvans
sjvans changed the base branch from main to rjegl/untoggle-sec-auth August 17, 2026 09:01
sjvans
sjvans commented Aug 17, 2026
View reviewed changes
Comment thread guides/security/authorization.md Outdated
sjvans
sjvans commented Aug 17, 2026
View reviewed changes
Comment thread guides/security/authorization.md Outdated
sjvans
sjvans commented Aug 17, 2026
View reviewed changes
Comment thread guides/security/authorization.md Outdated
sjvans
sjvans commented Aug 17, 2026
View reviewed changes
Comment thread guides/security/authorization.md Outdated
@sjvans

sjvans commented Aug 17, 2026

Copy link
Copy Markdown
Contributor Author

This guide is about to be untoggled: #2759 Does it make sense to base this PR on the "untoggle" one so that you don't add new profiling here?

is it ready?

Yes :)

i had claude do it, but there are many Java-/ Node.js-only things that i fear will become unclear for readers...

renejeglinsky
renejeglinsky reviewed Aug 20, 2026
View reviewed changes
Comment thread guides/security/authorization.md
Comment on lines +639 to +640
entity Reviews @(restrict: [
{ grant: 'CREATE', where: '$user.level >= 2' } ]);

@renejeglinsky renejeglinsky Aug 20, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This snippet seems not correct (see build error).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@renejeglinsky renejeglinsky renejeglinsky left review comments
@smahati smahati Awaiting requested review from smahati smahati is a code owner
@danjoa danjoa Awaiting requested review from danjoa danjoa is a code owner
@BraunMatthias BraunMatthias Awaiting requested review from BraunMatthias
@johannes-vogel johannes-vogel Awaiting requested review from johannes-vogel

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sjvans @renejeglinsky