CapabilitySecurity & ComplianceNode.js, read from its artifacts

Input validation

Rejecting bad input before it reaches the database. While this can be done manually inside a handler, there are solutions in place to derive type, range, enum and mandatory checks from the model definitions.

Showing artifacts, examples and content with confirmed Node.js applicability. View All CAP

Overview

SAP SHIPS
@sap/cds

Enforces @mandatory, @assert.range, @assert.format, @assert.target and @assert with a CXL case expression whenever data is written: the static checks on the input, the expressions collected into one query and run in the database, and a failure rejects the request and rolls the transaction back.

SourceDeclarative Constraints — capirechecked

A Node.js coverage assessment has not been written. View all flavors

THE COMMUNITY ADDS
sap-cap-validator-plugin

Adds a second declarative vocabulary beside the model's own assertions: JSON Schema draft-07 keywords, annotated per element and checked on the way in, for the types and formats CDS does not express.

capval

Overrides what a failed validation returns to the client: the message per element, resolved from the i18n bundle and able to interpolate values from the record, and a handler class whose isValid decides, with the target worked out by the plugin and the errors collated.

SourceMertSAP/CAPVAL — READMEchecked

A Node.js coverage assessment has not been written. View all flavors

Artifacts5

5 of 5 artifacts
ArtifactSignals
CDS plugins2
capvalCustom messages and handler classes for CAP input validation
Signals
none
sap-cap-validator-pluginCAP plugin validating input against @Validator JSON Schema rules
Signals
Quiet+1
Packages3
@sap/cdsCAP Node.js runtime
Signals
none
cap-toolkitUtility bundle for CAP handlers: builder, roles, validation, queries
Signals
Functional boundary
cds-validateZod schemas as CAP validation middleware
Signals
none

Content4

Group by
Piece, what it offers
Declarative Programming in CAP: Less Code, More Value
SAP Community, BirgitS, BlogThe reasoning
CAPVAL: A project is born
SAP Community, MattBrightman, Blog
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL Plugin
SAP Community, MattBrightman, BlogThe reasoningRunnable code
Everything new: Try out the latest features in CAP
SAP TechEd — session catalogue, Daniel Hutzel, Daniel Schlachter, TalkA recipe
CAPVAL: A project is born
SAP Community, MattBrightman, Blog
Extend SAP Cloud Application Programming Model(CAP) Validations with the CAPVAL Plugin
SAP Community, MattBrightman, BlogThe reasoningRunnable code
Declarative Programming in CAP: Less Code, More Value
SAP Community, BirgitS, BlogThe reasoning
Everything new: Try out the latest features in CAP
SAP TechEd — session catalogue, Daniel Hutzel, Daniel Schlachter, TalkA recipe

Seen working1

ArtifactSignals
Samples1
assert-targetWhich CAP paths trigger @assert.target and which do not
No license

Details

What changed — and what it makes stale1
@sap/cds 8.5.0, CAP, Node.js

@assert.range accepts open intervals, a min or max wrapped in parentheses, and an underscore for infinity. Before this release a range was a closed [min, max] and a one-sided bound needed a case expression or a handler. CAP Java gained the same in 3.5.0.

Makes stale:

Advice that @assert.range cannot express 'strictly positive' or an unbounded side, and the before handlers written for that.

Coverage
statecore and community, CAP, Node.js, derived
also inABAP, UI5
For your agent
Ref
capability:input-validation
JSON
/capabilities/input-validation.json
MCP
Connecting an agent