┌─────────────────────────────────────────────────────────────┐
│                    SAP BTP Global Account                    │
│                                                               │
│  ┌─────────────────┐         ┌─────────────────┐           │
│  │   Directory 1    │         │   Directory 2    │           │
│  │                  │         │                  │           │
│  │  ┌──────────────┴┐        │  ┌──────────────┴┐          │
│  │  │ Subaccount 1  │        │  │ Subaccount 3  │          │
│  │  │  (Dev)        │        │  │  (Prod)       │          │
│  │  │               │        │  │               │          │
│  │  │ Runtime:      │        │  │ Runtime:      │          │
│  │  │ Cloud Foundry │        │  │ Cloud Foundry │          │
│  │  │               │        │  │ + Kyma        │          │
│  │  │ Services:     │        │  │               │          │
│  │  │ • HANA Cloud  │        │  │ Services:     │          │
│  │  │ • XSUAA       │        │  │ • HANA Cloud  │          │
│  │  │ • Destination │        │  │ • XSUAA       │          │
│  │  └───────────────┘        │  │ • Integration │          │
│  │                           │  │   Suite       │          │
│  │  ┌──────────────┐        │  └───────────────┘          │
│  │  │ Subaccount 2 │        │                              │
│  │  │  (Test)      │        │                              │
│  │  └──────────────┘        │                              │
│  └─────────────────┘        └─────────────────┘           │
└─────────────────────────────────────────────────────────────┘

# manifest.yml - Cloud Foundry application descriptor
---
applications:
- name: my-app
  memory: 512M
  instances: 2
  buildpacks:
  - nodejs_buildpack
  path: ./
  routes:
  - route: my-app-prod.cfapps.eu10.hana.ondemand.com
  services:
  - my-hana-db
  - my-xsuaa
  - my-destination
  env:
    NODE_ENV: production
    SAP_JWT_TRUST_ACL: '[{"clientid":"*","identityzone":"*"}]'

# deployment.yaml - Kyma/Kubernetes deployment
apiVersion: apps/v1
kind: Deployment
metadata:
  name: my-app
  namespace: production
spec:
  replicas: 3
  selector:
    matchLabels:
      app: my-app
  template:
    metadata:
      labels:
        app: my-app
    spec:
      containers:
      - name: app
        image: your-registry/my-app:v1.0.0
        ports:
        - containerPort: 8080
        env:
        - name: HANA_HOST
          valueFrom:
            secretKeyRef:
              name: hana-credentials
              key: host
---
apiVersion: v1
kind: Service
metadata:
  name: my-app
spec:
  selector:
    app: my-app
  ports:
  - port: 80
    targetPort: 8080
  type: LoadBalancer

-- CDS (Core Data Services) View
@AbapCatalog.sqlViewName: 'ZSALESORDER'
@AbapCatalog.compiler.compareFilter: true
@AbapCatalog.preserveKey: true
@AccessControl.authorizationCheck: #CHECK
@EndUserText.label: 'Sales Order View'

define view Z_SALES_ORDER_VIEW
  as select from snwd_so
  association [1..1] to snwd_bpa as _BusinessPartner
    on $projection.buyer_guid = _BusinessPartner.node_key
{
  key node_key as OrderId,
      so_id as OrderNumber,
      buyer_guid as BuyerId,
      currency_code as Currency,
      gross_amount as GrossAmount,
      net_amount as NetAmount,
      _BusinessPartner.bp_id as CustomerNumber,
      _BusinessPartner.company_name as CustomerName
}

// Middleware to check authorization
const xssec = require('@sap/xssec');
const passport = require('passport');

passport.use(new xssec.JWTStrategy(xsenv.getServices({
  uaa: { tag: 'xsuaa' }
}).uaa));

app.use(passport.initialize());
app.use(passport.authenticate('JWT', { session: false }));

// Check scope in route
app.get('/api/sensitive-data',
  checkScope('Write'),
  (req, res) => {
    // Only accessible with Write scope
    res.json({ data: 'sensitive' });
  }
);

function checkScope(scope) {
  return (req, res, next) => {
    if (req.authInfo.checkScope(`$XSAPPNAME.${scope}`)) {
      next();
    } else {
      res.status(403).json({ error: 'Insufficient permissions' });
    }
  };
}

// Extension application calling S/4HANA OData service
const cds = require('@sap/cds');

module.exports = async function() {
  const { BusinessPartner } = this.entities;
  const s4hana = await cds.connect.to('S4HANA');

  // Before creating local entity, check S/4HANA
  this.before('CREATE', 'Customer', async (req) => {
    const bpNumber = req.data.businessPartnerNumber;

    // Call S/4HANA
    const bp = await s4hana.run(
      SELECT.one.from('A_BusinessPartner')
        .where({ BusinessPartner: bpNumber })
    );

    if (!bp) {
      req.error(404, `Business Partner ${bpNumber} not found in S/4HANA`);
    }

    // Enrich with S/4HANA data
    req.data.businessPartnerName = bp.BusinessPartnerName;
    req.data.country = bp.Country;
  });

  // Expose combined data
  this.on('READ', 'Customer', async (req, next) => {
    const customers = await next();

    // Enhance with real-time S/4HANA data
    for (let customer of customers) {
      const creditInfo = await s4hana.run(
        SELECT.one.from('A_CustomerCreditInfo')
          .where({ Customer: customer.businessPartnerNumber })
      );
      customer.creditLimit = creditInfo?.CreditLimit;
      customer.creditExposure = creditInfo?.CreditExposure;
    }

    return customers;
  });
};

// producer.js - Publishing events
const { EventEmitter } = require('@sap/xb-msg-env');

async function publishOrderCreated(order) {
  const messaging = await EventEmitter.connect();

  await messaging.send('orderCreated', {
    source: 'order-service',
    type: 'sap.s4.beh.salesorder.v1.SalesOrder.Created.v1',
    data: {
      salesOrder: order.orderNumber,
      customer: order.customerId,
      amount: order.totalAmount,
      currency: order.currency
    }
  });

  console.log(`Published order created event: ${order.orderNumber}`);
}

// consumer.js - Consuming events
const { MessageConsumer } = require('@sap/xb-msg-env');

async function subscribeToOrderEvents() {
  const messaging = await MessageConsumer.connect();

  messaging.on('orderCreated', async (message) => {
    console.log('Received order created event:', message.data);

    // Process event
    await processNewOrder(message.data);

    // Acknowledge
    message.ack();
  });

  messaging.on('error', (error) => {
    console.error('Messaging error:', error);
  });
}

Global Account (Enterprise)
├── Directory: Production
│   └── Subaccount: PROD-EU
│       ├── Space: api-services
│       ├── Space: web-apps
│       └── Space: background-jobs
├── Directory: Non-Production
│   ├── Subaccount: DEV
│   │   └── Space: development
│   ├── Subaccount: TEST
│   │   └── Space: testing
│   └── Subaccount: QA
│       └── Space: quality-assurance
└── Directory: Sandbox
    └── Subaccount: SANDBOX
        └── Space: experiments

// Implement proper authentication checks
app.use((req, res, next) => {
  // Verify JWT token
  if (!req.authInfo || !req.authInfo.checkLocalScope('Read')) {
    return res.status(403).json({
      error: 'Forbidden',
      message: 'Insufficient permissions'
    });
  }
  next();
});

// Implement audit logging
const auditLog = require('@sap/audit-logging');
const credentials = xsenv.getServices({ auditlog: { tag: 'audit-log' } }).auditlog;

auditLog.v2(credentials, (err, auditLogClient) => {
  if (err) {
    console.error('Failed to initialize audit log:', err);
    return;
  }

  // Log data access
  auditLogClient.read({
    user: req.user.id,
    object: { type: 'Customer', id: customerId },
    data: { before: oldData }
  }).log((err) => {
    if (err) console.error('Audit log failed:', err);
  });
});

// Custom metrics with Application Logging
const logging = require('@sap/logging');
const appContext = logging.createAppContext();

const logger = appContext.createLogContext().getLogger('/Application');

// Structured logging
logger.info('Order processed', {
  orderId: order.id,
  amount: order.amount,
  processingTime: Date.now() - startTime
});

// Error tracking
logger.error('Payment failed', {
  orderId: order.id,
  error: error.message,
  stack: error.stack
});