[BUG] auto-exposed readonly entities contain POST/PATCH/DELETE in openAPI document

[lucasvaccaro]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

When a CAP service transitively exposes an entity via @cds.autoexpose (e.g. a CodeList), the generated OpenAPI document emits full CRUD operations (POST, PATCH, DELETE) for that entity and its compositions even though it is effectively read-only reference data:

In these cases, although the entity has no @readonly and no @Capabilities.InsertRestrictions/UpdateRestrictions/DeleteRestrictions, its readonly behavior is enforced by the CAP runtime:

Expected Behavior

OpenAPI document should contain only GET for readonly entities.

Steps To Reproduce

1. In a CAP project, add attachments to an entity:

  using { Attachments } from '@cap-js/attachments';
  entity Books { ...; attachments : Composition of many Attachments; }

2. Expose it in a service (e.g. AdminService).
3. Generate the OpenAPI document:

cds compile srv --service all --to openapi

The generated AdminService.openapi3.json contains full CRUD for ScanStates.

Environment

| Package              | Version | Location                                                   |
| -------------------- | ------- | ---------------------------------------------------------- |
| @sap/cds-dk          | 9.9.4   | ./node_modules/@sap/cds-dk                                 |
| @sap/cds             | 9.9.3   | ./node_modules/@sap/cds                                    |
| @sap/cds-compiler    | 6.9.4   | ./node_modules/@sap/cds-compiler                           |
| @cap-js/attachments  | 3.13.4  | ./node_modules/@cap-js/attachments                         |
| @cap-js/openapi      | 1.6.0   | ./node_modules/@cap-js/openapi                             |
| Node.js              | 22.23.1 | |

Repository Containing a Minimal Reproducible Example

Internal repo (contact me).

Anything else?

No response