Fix Critical Compromise of Multitenant CAP apps

.github/workflows/blackduck.yml

@@ -31,12 +31,53 @@ jobs:
           distribution: 'temurin'
           cache: maven
 
-      - name: Install dependencies
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install Maven dependencies
         run: |
           mvn clean install -P unit-tests -DskipIntegrationTests
           mvn clean install -f app/single-tenant/central-space/demoapp/pom.xml -DskipTests
           mvn clean install -f app/multi-tenant/central-space/cloud-cap-samples-java/pom.xml -DskipTests
-
+
+      - name: Setup npm registries and install SAP packages
+        env:
+          NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+          SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }}
+          SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }}
+        run: |
+          set +x
+          echo "::add-mask::$NPM_AUTH_TOKEN"
+          echo "::add-mask::$SAP_CDS_MTXS_TARBALL"
+          echo "::add-mask::$SAP_CDS_DK_TARBALL"
+
+          MTXS="$SAP_CDS_MTXS_TARBALL"
+          DK="$SAP_CDS_DK_TARBALL"
+          TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#')
+
+          for dir in \
+            "app/multi-tenant/central-space/cloud-cap-samples-java" \
+            "app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar" \
+            "app/multi-tenant/personal-space/cloud-cap-samples-java" \
+            "app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar"; do
+
+            printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \
+              "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc"
+
+            tmp=$(mktemp)
+            jq --arg mtxs "$MTXS" --arg dk "$DK" '
+              (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end)
+              | (if .dependencies["@sap/cds-dk"]   then .dependencies["@sap/cds-dk"]   = $dk   else . end)
+              | .overrides["@sap/cds-mtxs"] = $mtxs
+            ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json"
+
+            npm install --prefix "$dir"
+
+            git checkout "$dir/package.json"
+          done
+
       # - name: Download Synopsys Detect Script
       #   run: curl --silent -O https://detect.synopsys.com/detect9.sh
       - name: Download Black Duck Detect Script

.github/workflows/cfdeploy.yml

@@ -48,6 +48,11 @@ jobs:
           java-version: 21
           distribution: 'temurin'
 
+      - name: Set up Node.js 🟢
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
       - name: Build and package 🔨
         run: |
           echo "🚀 Building and packaging..."
@@ -71,6 +76,36 @@ jobs:
             fi
           fi
 
+      - name: Setup npm registry and pin SAP tarballs 📦
+        env:
+          NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+          SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }}
+          SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }}
+        run: |
+          set +x
+          echo "::add-mask::$NPM_AUTH_TOKEN"
+          echo "::add-mask::$SAP_CDS_MTXS_TARBALL"
+          echo "::add-mask::$SAP_CDS_DK_TARBALL"
+
+          MTXS="$SAP_CDS_MTXS_TARBALL"
+          DK="$SAP_CDS_DK_TARBALL"
+          TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#')
+
+          for dir in \
+            "app/single-tenant/personal-space/demoapp" \
+            "app/single-tenant/personal-space/demoapp/db" \
+            "app/single-tenant/personal-space/demoapp/app"; do
+
+            printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \
+              "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc"
+
+            tmp=$(mktemp)
+            jq --arg mtxs "$MTXS" --arg dk "$DK" '
+              (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end)
+              | (if .dependencies["@sap/cds-dk"]   then .dependencies["@sap/cds-dk"]   = $dk   else . end)
+            ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json"
+          done
+
       - name: Prepare and Deploy to Cloud Foundry ☁️
         run: |
           set +x
@@ -142,6 +177,11 @@ jobs:
           java-version: 21
           distribution: 'temurin'
 
+      - name: Set up Node.js 🟢
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
       - name: Override cds.services.version (runtime only)
         if: ${{ github.event.inputs.cds_services_version != '' }}
         env:
@@ -204,6 +244,36 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
+      - name: Setup npm registry and pin SAP tarballs 📦
+        env:
+          NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+          SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }}
+          SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }}
+        run: |
+          set +x
+          echo "::add-mask::$NPM_AUTH_TOKEN"
+          echo "::add-mask::$SAP_CDS_MTXS_TARBALL"
+          echo "::add-mask::$SAP_CDS_DK_TARBALL"
+
+          MTXS="$SAP_CDS_MTXS_TARBALL"
+          DK="$SAP_CDS_DK_TARBALL"
+          TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#')
+
+          for dir in \
+            "app/single-tenant/central-space/demoapp" \
+            "app/single-tenant/central-space/demoapp/db" \
+            "app/single-tenant/central-space/demoapp/app"; do
+
+            printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \
+              "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc"
+
+            tmp=$(mktemp)
+            jq --arg mtxs "$MTXS" --arg dk "$DK" '
+              (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end)
+              | (if .dependencies["@sap/cds-dk"]   then .dependencies["@sap/cds-dk"]   = $dk   else . end)
+            ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json"
+          done
+
       - name: Prepare and Deploy to Cloud Foundry ☁️
         run: |
           set +x

.github/workflows/multiTenancyDeployLocal.yml

@@ -52,6 +52,36 @@ jobs:
         with:
           node-version: '20' # Ensure to use at least version 18
 
+      - name: Setup npm registry and pin SAP tarballs 📦
+        env:
+          NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+          SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }}
+          SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }}
+        run: |
+          set +x
+          echo "::add-mask::$NPM_AUTH_TOKEN"
+          echo "::add-mask::$SAP_CDS_MTXS_TARBALL"
+          echo "::add-mask::$SAP_CDS_DK_TARBALL"
+
+          MTXS="$SAP_CDS_MTXS_TARBALL"
+          DK="$SAP_CDS_DK_TARBALL"
+          TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#')
+
+          for dir in \
+            "app/multi-tenant/personal-space/cloud-cap-samples-java" \
+            "app/multi-tenant/personal-space/cloud-cap-samples-java/mtx/sidecar"; do
+
+            printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \
+              "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc"
+
+            tmp=$(mktemp)
+            jq --arg mtxs "$MTXS" --arg dk "$DK" '
+              (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end)
+              | (if .dependencies["@sap/cds-dk"]   then .dependencies["@sap/cds-dk"]   = $dk   else . end)
+              | .overrides["@sap/cds-mtxs"] = $mtxs
+            ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json"
+          done
+
       - name: Install MBT ⚙️
         run: |
             echo "🔧 Installing MBT..."

.github/workflows/multiTenant_deploy_and_Integration_test.yml

@@ -43,6 +43,36 @@ jobs:
         with:
           node-version: '20' # Ensure to use at least version 18
 
+      - name: Setup npm registry and pin SAP tarballs 📦
+        env:
+          NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+          SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }}
+          SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }}
+        run: |
+          set +x
+          echo "::add-mask::$NPM_AUTH_TOKEN"
+          echo "::add-mask::$SAP_CDS_MTXS_TARBALL"
+          echo "::add-mask::$SAP_CDS_DK_TARBALL"
+
+          MTXS="$SAP_CDS_MTXS_TARBALL"
+          DK="$SAP_CDS_DK_TARBALL"
+          TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#')
+
+          for dir in \
+            "app/multi-tenant/central-space/cloud-cap-samples-java" \
+            "app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar"; do
+
+            printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \
+              "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc"
+
+            tmp=$(mktemp)
+            jq --arg mtxs "$MTXS" --arg dk "$DK" '
+              (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end)
+              | (if .dependencies["@sap/cds-dk"]   then .dependencies["@sap/cds-dk"]   = $dk   else . end)
+              | .overrides["@sap/cds-mtxs"] = $mtxs
+            ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json"
+          done
+
       - name: Install MBT ⚙️
         run: |
             echo "🔧 Installing MBT..."

.github/workflows/multiTenant_deploy_and_Integration_test_LatestVersion.yml

@@ -43,6 +43,36 @@ jobs:
         with:
           node-version: '20' # Ensure to use at least version 18
 
+      - name: Setup npm registry and pin SAP tarballs 📦
+        env:
+          NPM_AUTH_TOKEN: ${{ secrets.NPM_AUTH_TOKEN }}
+          SAP_CDS_MTXS_TARBALL: ${{ secrets.SAP_CDS_MTXS_TARBALL }}
+          SAP_CDS_DK_TARBALL: ${{ secrets.SAP_CDS_DK_TARBALL }}
+        run: |
+          set +x
+          echo "::add-mask::$NPM_AUTH_TOKEN"
+          echo "::add-mask::$SAP_CDS_MTXS_TARBALL"
+          echo "::add-mask::$SAP_CDS_DK_TARBALL"
+
+          MTXS="$SAP_CDS_MTXS_TARBALL"
+          DK="$SAP_CDS_DK_TARBALL"
+          TARBALL_HOST=$(printf '%s' "$MTXS" | sed -E 's#^https?://([^/]+)/.*#\1#')
+
+          for dir in \
+            "app/multi-tenant/central-space/cloud-cap-samples-java" \
+            "app/multi-tenant/central-space/cloud-cap-samples-java/mtx/sidecar"; do
+
+            printf '@sap:registry=https://registry.npmjs.org/\n//%s/:_authToken=%s\nlegacy-peer-deps=true\n' \
+              "$TARBALL_HOST" "$NPM_AUTH_TOKEN" > "$dir/.npmrc"
+
+            tmp=$(mktemp)
+            jq --arg mtxs "$MTXS" --arg dk "$DK" '
+              (if .dependencies["@sap/cds-mtxs"] then .dependencies["@sap/cds-mtxs"] = $mtxs else . end)
+              | (if .dependencies["@sap/cds-dk"]   then .dependencies["@sap/cds-dk"]   = $dk   else . end)
+              | .overrides["@sap/cds-mtxs"] = $mtxs
+            ' "$dir/package.json" > "$tmp" && mv "$tmp" "$dir/package.json"
+          done
+
       - name: Install MBT ⚙️
         run: |
             echo "🔧 Installing MBT..."

app/multi-tenant/central-space/cloud-cap-samples-java/package.json

@@ -6,8 +6,8 @@
     "repository": "https://github.com/SAP-samples/cloud-cap-samples-java.git",
     "dependencies": {
         "@cap-js/hana": "^2.1.2",
-        "@sap/cds": "^9.8.0",
-        "@sap/cds-dk": "^9.8.0",
+        "@sap/cds": "^9",
+        "@sap/cds-dk": "^9",
         "@sap/cds-mtxs": "^3"
     }
 }

app/multi-tenant/personal-space/cloud-cap-samples-java/package.json

@@ -6,8 +6,8 @@
     "repository": "https://github.com/SAP-samples/cloud-cap-samples-java.git",
     "dependencies": {
         "@cap-js/hana": "^2.1.2",
-        "@sap/cds": "^9.2.0",
-        "@sap/cds-dk": "^9.3.1",
+        "@sap/cds": "^9",
+        "@sap/cds-dk": "^9",
         "@sap/cds-mtxs": "^3"
     }
 }