[BUG] auto-exposed readonly entities contain POST/PATCH/DELETE in openAPI document

[lucasvaccaro]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When a CAP service transitively exposes an entity via @cds.autoexpose (e.g. a CodeList), the generated OpenAPI document emits full CRUD operations (POST, PATCH, DELETE) for that entity and its compositions even though it is effectively read-only reference data:

In these cases, although the entity has no @readonly and no @Capabilities.InsertRestrictions/UpdateRestrictions/DeleteRestrictions, its readonly behavior is enforced by the CAP runtime:

Expected Behavior

OpenAPI document should contain only GET for readonly entities.

Steps To Reproduce

1. In a CAP project, add attachments to an entity:

  using { Attachments } from '@cap-js/attachments';
  entity Books { ...; attachments : Composition of many Attachments; }

2. Expose it in a service (e.g. AdminService).
3. Generate the OpenAPI document:

cds compile srv --service all --to openapi

The generated AdminService.openapi3.json contains full CRUD for ScanStates.

Environment

| Package              | Version | Location                                                   |
| -------------------- | ------- | ---------------------------------------------------------- |
| @sap/cds-dk          | 9.9.4   | ./node_modules/@sap/cds-dk                                 |
| @sap/cds             | 9.9.3   | ./node_modules/@sap/cds                                    |
| @sap/cds-compiler    | 6.9.4   | ./node_modules/@sap/cds-compiler                           |
| @cap-js/attachments  | 3.13.4  | ./node_modules/@cap-js/attachments                         |
| @cap-js/openapi      | 1.6.0   | ./node_modules/@cap-js/openapi                             |
| Node.js              | 22.23.1 | |

Repository Containing a Minimal Reproducible Example

Internal repo (contact me).

Anything else?

No response

[lucasvaccaro]

Just observed that this issue also occurs for GET requests from auto-exposed compositions that do not have explicit @cds.autoexpose). In this case, the entity is only accessible via navigation path, while a GET to the top-level entity projection returns 405 by CAP:

{
  "error": {
    "message": "Entity \"....\" is not readable",
    "code": "ENTITY_IS_NOT_CRUD",
    "@Common.numericSeverity": 4
  }
}

The openapi compiler, however, adds a GET request for the top-level entity projection to the OpenAPI document.

[daogrady]

Hi Lucas,

thank you for your report. That makes sense. We will address this shortly.

Best,
Daniel

[lucasvaccaro]

Hi Lucas,

thank you for your report. That makes sense. We will address this shortly.

Best, Daniel

Thanks! See also my other comment... not sure if the fix will be the same, but it is a similar case.