XSUAA Config 1

package.json

@@ -11,13 +11,13 @@
     "bookshop": "cds watch packages/bookshop",
     "bookshop-enhanced": "cds watch packages/bookshop-enhanced",
     "reviews-service": "cds watch packages/reviews-service",
-
     "bookstore": "cds watch packages/bookstore",
     "media-server": "cds watch packages/media-server"
   },
   "dependencies": {
     "@sap/cds": "latest",
-    "express": "*"
+    "express": "*",
+    "passport": "^0.4.1"
   },
   "devDependencies": {
     "sqlite3": "*"

packages/bookshop/.cdsrc.json

@@ -0,0 +1,20 @@
+{
+  "auth": {
+  "passport": {
+    "strategy": "mock",
+    "users": {
+      "alice": {
+          "password": "123",
+          "ID": "alice",
+          "roles": ["admin", "authenticated-user"],
+          "xs.user.attributes": { "currency":  [ "USD" ] }
+      },
+      "bob": {
+          "password": "123",
+          "ID": "bob",
+          "roles": ["authenticated-user"]
+      }
+    }
+  }
+}
+}

packages/bookshop/package.json

@@ -5,10 +5,38 @@
   "license": "SAP SAMPLE CODE LICENSE",
   "dependencies": {
     "@sap/cds": "latest",
-    "express": "*"
+    "express": "*",
+    "passport": "^0.4.1"
   },
   "scripts": {
     "start": "cds run --in-memory?",
     "watch": "cds watch"
+  },
+  "auth": {
+    "passport": {
+      "strategy": "mock",
+      "users": {
+        "alice": {
+          "password": "123",
+          "ID": "alice",
+          "roles": [
+            "admin",
+            "authenticated-user"
+          ],
+          "xs.user.attributes": {
+            "country": [
+              "US"
+            ]
+          }
+        },
+        "bob": {
+          "password": "123",
+          "ID": "bob",
+          "roles": [
+            "authenticated-user"
+          ]
+        }
+      }
+    }
   }
 }

packages/bookshop/srv/admin-service.cds

@@ -14,3 +14,7 @@ annotate AdminService.Orders with @odata.draft.enabled;
 extend service AdminService with {
   entity OrderItems as select from my.OrderItems;
 }
+// Restrict access to orders to users with role "admin"
+ annotate AdminService.Orders with  @(restrict: [
+   { grant: 'READ', to: 'admin' } 
+  ]);

packages/bookshop/srv/cat-service.js

@@ -4,6 +4,7 @@ const { Books } = cds.entities
 /** Service implementation for CatalogService */
 module.exports = cds.service.impl(function() {
   this.after ('READ', 'Books', each => each.stock > 111 && _addDiscount2(each,11))
+  this.before ('CREATE', 'Orders', _checkOrderCreateAuth)
   this.before ('CREATE', 'Orders', _reduceStock)
 })
 
@@ -24,3 +25,10 @@ async function _reduceStock (req) {
     )
   }))
 }
+
+/** Check authorization  */
+function _checkOrderCreateAuth (req) {
+  req.user.country === req.data.country || req.reject(403)
+}
+
+