{"ref":"content:cap-for-nodejs","page":"/content/cap-for-nodejs","json":"/content/cap-for-nodejs.json","generated":"2026-10-26","drafted_with_ai":true,"entity":{"id":"cap-for-nodejs","title":"CAP for nodejs安全的暴露接口练习","url":"https://community.sap.com/t5/technology-blog-posts-by-sap/cap-for-nodejs%E5%AE%89%E5%85%A8%E7%9A%84%E6%9A%B4%E9%9C%B2%E6%8E%A5%E5%8F%A3%E7%BB%83%E4%B9%A0/ba-p/13959875","content_type":"blog","published_on":"source:sap-community","explains":[{"ref":"capability:authorization","applies_to":{"ecosystems":["cap"]}},{"ref":"capability:authentication","applies_to":{"ecosystems":["cap"]}},{"ref":"capability:local-development","applies_to":{"ecosystems":["cap"]}}],"summary":"Starting from the risk-management sample, the walkthrough adds an open ExternalAPI service beside the existing RiskService, then moves every security annotation into a separate service-auth.cds file: @requires: authenticated-user on one entity, role-scoped @restrict grants for RiskViewer and RiskManager on another. It tests the unprotected action locally with cds watch, calling it from Postman with the session cookie read out of [SAP Business Application Studio](artifact:btp-business-application-studio)'s preview tab. It then deploys to BTP and reads Risks with a client-credentials OAuth token fetched from a service key of the cpapp-auth instance, after changing that entity's READ grant from RiskViewer to authenticated-user, which the post, citing capire's CDS-based Authorization page, describes as a grant for a technical user integrating systems rather than for access from a front end.","short":"Exposing a CAP Node.js service with separate security annotations","author":"ArthurYang","published":"2024-12-10","provenance":{"discovered_via":[{"source":"source:sap-community","channel":"cap-tag"}],"first_seen":"2026-10-09"},"drafted_with_ai":true},"readings":{"liveness":[{"label":"Checked against the source","tier":"unknown","evidence":"nobody has checked it"},{"label":"Source reachable","tier":"unknown","evidence":"not crawled"},{"label":"Age","tier":"fair","evidence":"published 22 months ago"}],"compatibility":[{"label":"Version","tier":"unknown","evidence":"no version declared"},{"label":"Moved since?","tier":"poor","evidence":"CAP Java 3.7.1, 2025-01 and 1 more"},{"label":"Findings","tier":"good","evidence":"none flagged"}],"reach":[{"value":829,"unit":"views"},{"value":0,"unit":"comments"},{"value":1,"unit":"likes"}]},"signals":{"views":829,"likes":1,"comments":0,"metrics_at":"2026-10-25"},"series":null,"edges":{"authors":[]}}