fix: entity auth filter

[Akatuoro]

Noticed some issues for entity-level require annotations. Only affects the context, actual authorization checks were still working. Here's the summary by claude:

1. @requires on entities was ignored — per CAP docs, @requires is valid on entities (shorthand for @restrict: [{grant:'*', to: role}]). Added handling in checkEntityReadAccess.
2. @restrict with no to clause used wrong semantics — the old code only admitted authenticated users when to was absent. Per docs, omitting to means the any pseudo-role → all users including unauthenticated are admitted. Fixed in _matchesToRoles.
3. @restrict on actions was ignored — checkActionAccess only checked @requires. Per docs, @restrict is also valid on actions (with grant implicitly treated as *; only to is enforced). Added the check.
4. system-user pseudo-role was unhandled — added explicit handling in _hasRole alongside any and authenticated-user.

The refactor also extracted _hasRole and _matchesToRoles helpers to eliminate the duplicated role-checking logic that existed across all three check functions.

[hyperspace-pr-bot]

Summary

The following content is AI-generated and provides a summary of the pull request:

---

Fix: Entity Auth Filter for @requires and @restrict Annotations

Overview

This PR fixes several bugs in lib/auth.js where CAP authorization annotations were not correctly enforced when filtering tool context for MCP. The logic has been refactored to extract shared helpers and align behavior with CAP documentation.

Bug Fixes 🐛

Issue	Description
@requires on entities ignored	@requires is valid on entities (shorthand for @restrict: [{grant:'*', to: role}]) but was not handled in checkEntityReadAccess
@restrict with no to clause had wrong semantics	Omitting to means the any pseudo-role (all users, including unauthenticated), but the old code only admitted authenticated users
@restrict on actions ignored	checkActionAccess only checked @requires; @restrict is also valid on actions (with grant implicitly treated as *)
system-user pseudo-role unhandled	No explicit handling existed alongside any and authenticated-user

Refactor ♻️

Extracted two shared helpers to eliminate duplicated role-checking logic across all check functions:

• _hasRole(user, role) — handles any, authenticated-user, system-user, and custom roles
• _matchesToRoles(toRoles, user) — evaluates a to clause (absent = any), replacing inline role loops in checkEntityReadAccess, checkActionAccess, and checkAuthorization

Tests ✅

Added a comprehensive integration test suite (tests/integration/auth-combinations.test.js) with a dedicated test service (AuthTestService) covering:

• Entity @requires (single role, multiple roles)
• Entity @restrict with READ, *, WRITE-only, no to, multiple roles, multiple privileges
• Action @requires and action @restrict
• MCP call tool visibility rules
• Both MCP and OData surfaces verified to enforce permissions identically

Changelog

Updated CHANGELOG.md for version 1.4.3.

Have you...

• Added relevant entry to the change log?

---

• 🔄 Regenerate and Update Summary
• ✏️ Insert as PR Description (deletes this comment)
• 🗑️ Delete comment

PR Bot Information

Version: 1.29.26

• Summary Prompt: Default Prompt
• Output Template: Repository PR Template
• LLM: anthropic--claude-4.6-sonnet
• File Content Strategy: Full file content
• Correlation ID: 8014fca0-965d-11f1-96db-d131f9551d8d
• Event Trigger: pull_request.ready_for_review