You have developed a risk service application in CAP. To which file must you add restrictions - @(restrict...) - to add authorizations to your service?

Question

Options

• Asrv/risk-service.js
• Bsrv/risk-service.cds
• Cxs-security.js
• Dpackage-lock.json

• A
  8% (3)
• B
  87% (34)
• C
  3% (1)
• D
  3% (1)

Explanation

In CAP (SAP Cloud Application Programming Model), authorization restrictions using the @(restrict: ...) annotation belong in the service definition file - srv/risk-service.cds - because .cds (Core Data Services) files are where you declaratively define your service model, entities, and access control rules.

Why the distractors are wrong:

• A (risk-service.js) is the service handler for custom business logic (event handlers, hooks) - not for declarative model annotations.
• C (xs-security.js) doesn't exist as a standard file; the security descriptor is xs-security.json, which defines OAuth scopes and roles at the platform level, but does not contain CDS-level service restrictions.
• D (package-lock.json) is the npm dependency lock file and has nothing to do with application logic or authorization.

Memory tip: Think ".cds = contract" - the .cds file is your service's contract, and access control (@restrict) is part of defining who that contract applies to. Wherever you define the service, you restrict the service.

No community discussion yet for this question.