Route the backend on BTP, close the app's security gaps, consume the cds-plugin

[oblomov-dev]

The deployed app could not have worked

mta.yaml has always declared an abap2UI5-srv destination pointing at the CAP module, and xs-app.json never routed anything to it. Its last route is a catch-all to the static HTML5 repository, so on a real BTP deployment every POST /rest/root/z2ui5 roundtrip went to the file store instead of the service — that is the entire application.

It was invisible because jest runs against a local cds server that never sees the approuter, and deploy-check deliberately skips mbt build. Routes added for the roundtrip, the OData service and /health; src/test/approuter-routes.test.js pins the contract, the route order (backend routes must beat the catch-all), the auth types, and that every destination a route names exists in mta.yaml.

csrfProtection: false on the roundtrip route is deliberate: the webapp posts with no CSRF token and never fetches one, so the approuter's default would 403 every roundtrip. CSRF is defended one layer down — see below.

Security

• The User role is now required instead of bare authenticated-user. xs-security.json had declared the $XSAPPNAME.User scope and a role template since the beginning and nothing referenced them, so the authorization model existed on paper while every authenticated user in the subaccount passed, role collection assigned or not.
• Security headers reach the data endpoints. Only the bootstrap page applied them; the roundtrip and the OData entities — the responses that actually carry application state — answered with no nosniff, no frame guard, and cacheable by any intermediary.
• The request body is capped explicitly (Z2UI5_MAX_BODY, default 2mb). The action takes an @open object so CDS validates nothing, and the only limit was express's 100kb default applying by accident.
• Draft retention had disagreed with the framework about its own TTL — this job deleted at 24h while the exit's draft_exp_time_in_hours said 4h, with nothing connecting them. The framework value is now the source of truth. It also ran on every instance, so N instances meant N concurrent hourly DELETEs over the same rows.
• Indexes for the two non-primary-key access paths as HANA design-time artifacts: createdAt, because the hourly retention delete was a full scan whose cost grew with the very table it exists to contain, and owner, because the service projection filters on it. Verified to reach gen/db/src through cds build --production.
• instances: 1 in mta.yaml: sticky app state lives in the serving process with no session affinity configured, so scaling out produces intermittent, hard-to-reproduce state loss. The comment says what to fix before raising it.

The app stops duplicating the framework's wiring

The package now ships its CAP wiring (cds-plugin.js → srv/cap/activate.js) and its CDS model, so srv/server.js drops ~120 lines, srv/draft-retention.js is deleted, and db/schema.cds / srv/z2ui5-service.cds import the packaged definitions rather than redeclaring them — the same import an external project writes, so this app's suite is what proves they work.

That last point was not cosmetic: CAP auto-loads a dependency's cds-plugin, so with the app also doing the wiring, retention started twice — two hourly DELETE loops over the same rows in one process. Now once, asserted.

A contradiction between two published documents

The README said "put your own apps into srv/app/" while AGENTS.md said srv/app/ is overwritten on every publish. Both now say the same thing, with a table answering it by what the reader is doing, and the README opens by stating that the generated repository is the demo, not the delivery mechanism.

---

builder 30 tests, app 44 tests (was 23), lint clean, cds build --production ok.

Generated by Claude Code

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.