@cspeach/cli 1.1.17 → 1.1.19

package/dist/tools/fiori/smoke/draft-safety.js

@@ -0,0 +1,241 @@
+export const MARKER_PREFIX = 'CSP-SMOKE-';
+const NAME = '[A-Za-z0-9_]+';
+/** `/sap/opu/odata4/<group>/<binding>/<srvd|srvd_a2x|srvd_f4>/<ns>/<definition>/<nnnn>/` (+ `$metadata`). */
+const V4_PATH = new RegExp(`^/sap/opu/odata4/(${NAME})/(${NAME})/(srvd|srvd_a2x|srvd_f4)/(${NAME})/(${NAME})/(\\d{4})/(\\$metadata)?$`, 'i');
+const CUSTOMER = /^[ZY]/i;
+/**
+ * Is this the path of one of the customer's OWN OData V4 services? Both the
+ * service binding and the service definition must start with Z or Y. Anything
+ * that is not exactly the V4 path grammar — a traversal, an encoded character,
+ * a query, a full URL, an OData V2 path — is refused, not interpreted.
+ */
+export function customerService(servicePath) {
+    const p = typeof servicePath === 'string' ? servicePath : '';
+    if (/[%?#\\]|\/\.\.?\/|\/\/|\s/.test(p)) {
+        return { ok: false, reason: `service path "${p}" contains an encoded character, a query, "..", "//" or a backslash` };
+    }
+    const m = V4_PATH.exec(p);
+    if (!m) {
+        return {
+            ok: false,
+            reason: `service path "${p}" is not an OData V4 service path of the form ` +
+                '/sap/opu/odata4/<group>/<binding>/srvd/<ns>/<definition>/<version>/',
+        };
+    }
+    const binding = m[2].toUpperCase();
+    const definition = m[5].toUpperCase();
+    const foreign = [binding, definition].filter((n) => !CUSTOMER.test(n));
+    if (foreign.length > 0) {
+        return {
+            ok: false,
+            reason: `${foreign.join(' and ')} ${foreign.length > 1 ? 'are' : 'is'} not in the customer namespace (Z*/Y*) — ` +
+                'fiori_draft_smoke writes test rows only through the customer\'s own services',
+        };
+    }
+    const serviceRoot = p.replace(/\$metadata$/i, '');
+    return { ok: true, binding, definition, serviceRoot: serviceRoot.endsWith('/') ? serviceRoot : `${serviceRoot}/` };
+}
+// ── App URL ─────────────────────────────────────────────────────────────────
+/** A local preview: http(s) on localhost, 127.0.0.0/8 or [::1] — never a deployed app. */
+export function isLoopbackAppUrl(url) {
+    let u;
+    try {
+        u = new URL(url);
+    }
+    catch {
+        return false;
+    }
+    if (u.protocol !== 'http:' && u.protocol !== 'https:')
+        return false;
+    if (u.username || u.password)
+        return false;
+    const h = u.hostname.toLowerCase();
+    if (h === 'localhost' || h === '[::1]')
+        return true;
+    return /^127\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(h);
+}
+// ── Marker ──────────────────────────────────────────────────────────────────
+/** `yyyymmddHHMMSS-xxxx` (local time + four hex). */
+export function newRunId(now = new Date(), rand = () => Math.floor(Math.random() * 0x10000)) {
+    const p = (n, w = 2) => String(n).padStart(w, '0');
+    const stamp = `${now.getFullYear()}${p(now.getMonth() + 1)}${p(now.getDate())}` +
+        `${p(now.getHours())}${p(now.getMinutes())}${p(now.getSeconds())}`;
+    return `${stamp}-${(rand() & 0xffff).toString(16).padStart(4, '0')}`;
+}
+export function isMarked(value) {
+    return typeof value === 'string' && value.startsWith(MARKER_PREFIX);
+}
+/** The rows a sweep may delete: ONLY those whose marker field, as read, carries the marker. */
+export function selectSweepTargets(rows, markerField) {
+    return rows.filter((r) => isMarked(r?.[markerField]));
+}
+// ── Keys ────────────────────────────────────────────────────────────────────
+const GUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const NUMBER = /^-?\d+(\.\d+)?$/;
+function keyLiteral(p, v) {
+    if (v === undefined || v === null)
+        throw new Error(`key ${p.name} has no value`);
+    switch (p.type) {
+        case 'Edm.Guid':
+            if (!GUID.test(String(v)))
+                throw new Error(`key ${p.name} is not a Guid: ${String(v).slice(0, 40)}`);
+            return String(v);
+        case 'Edm.Boolean':
+            if (typeof v !== 'boolean')
+                throw new Error(`key ${p.name} is not a boolean`);
+            return String(v);
+        case 'Edm.Byte':
+        case 'Edm.SByte':
+        case 'Edm.Int16':
+        case 'Edm.Int32':
+        case 'Edm.Int64':
+        case 'Edm.Decimal':
+            if (!NUMBER.test(String(v)))
+                throw new Error(`key ${p.name} is not a number`);
+            return String(v);
+        case 'Edm.Date':
+            if (!/^\d{4}-\d{2}-\d{2}$/.test(String(v)))
+                throw new Error(`key ${p.name} is not a date`);
+            return String(v);
+        case 'Edm.String':
+            return `'${encodeURIComponent(String(v).replace(/'/g, "''")).replace(/%27/g, "'")}'`;
+        default:
+            throw new Error(`key ${p.name} has a type the smoke does not address rows by (${p.type})`);
+    }
+}
+/** `(K1=v1,K2=v2)` for a row, typed by the audit's key properties. */
+export function keyPredicate(keys, row) {
+    if (keys.length === 0)
+        throw new Error('the entity has no key properties');
+    return `(${keys.map((k) => `${k.name}=${keyLiteral(k, row[k.name])}`).join(',')})`;
+}
+// ── Preconditions from the audit ────────────────────────────────────────────
+export function markerFieldProblem(audit, markerField, marker) {
+    const p = audit.properties.find((x) => x.name === markerField);
+    if (!p)
+        return `the entity ${audit.entitySet} has no property "${markerField}" for the marker`;
+    if (p.isKey)
+        return `marker field ${markerField} is a key`;
+    if (p.computed)
+        return `marker field ${markerField} is computed by the backend`;
+    if (p.type !== 'Edm.String')
+        return `marker field ${markerField} is ${p.type}, not Edm.String`;
+    if (p.maxLength !== undefined && p.maxLength < marker.length) {
+        return `marker field ${markerField} holds ${p.maxLength} characters; the marker needs ${marker.length}`;
+    }
+    return undefined;
+}
+export function draftActionsProblem(audit) {
+    if (!audit.draft.root)
+        return `${audit.entitySet} is not a draft root (no Common.DraftRoot) — nothing to round-trip`;
+    if (!audit.draft.actions.activate) {
+        return `${audit.entitySet}'s Common.DraftRoot names no ActivationAction — the smoke never guesses one`;
+    }
+    return undefined;
+}
+// ── Setup payload ───────────────────────────────────────────────────────────
+function isoDate(d) {
+    return d.toISOString().slice(0, 10);
+}
+/**
+ * The body of the new draft: the marker, plus every mandatory, non-key,
+ * non-computed property — its first value-help value when it has one
+ * (`firstValues`), else a plain value of its type. A mandatory field it cannot
+ * fill honestly is an error.
+ */
+export function buildSetupPayload(audit, markerField, marker, firstValues, now) {
+    const payload = { [markerField]: marker };
+    for (const p of audit.properties) {
+        if (!p.mandatory || p.isKey || p.computed || p.name === markerField)
+            continue;
+        if (firstValues[p.name] !== undefined) {
+            payload[p.name] = firstValues[p.name];
+            continue;
+        }
+        switch (p.type) {
+            case 'Edm.String':
+                payload[p.name] = 'CSP smoke'.slice(0, p.maxLength ?? 9);
+                break;
+            case 'Edm.Date':
+                payload[p.name] = isoDate(now);
+                break;
+            case 'Edm.DateTimeOffset':
+                payload[p.name] = now.toISOString();
+                break;
+            case 'Edm.TimeOfDay':
+                payload[p.name] = '00:00:00';
+                break;
+            case 'Edm.Boolean':
+                payload[p.name] = false;
+                break;
+            case 'Edm.Byte':
+            case 'Edm.SByte':
+            case 'Edm.Int16':
+            case 'Edm.Int32':
+            case 'Edm.Int64':
+            case 'Edm.Decimal':
+            case 'Edm.Double':
+            case 'Edm.Single':
+                payload[p.name] = 1;
+                break;
+            default:
+                return {
+                    error: `cannot fill the mandatory field ${p.name} (${p.type}) of a new row — give it a value help or a default`,
+                };
+        }
+    }
+    return { payload };
+}
+// ── Which field the round trip changes ──────────────────────────────────────
+export function pickEditField(audit, explicit, markerField) {
+    const usable = (p) => !!p.valueHelp && !p.isKey && !p.computed;
+    if (explicit !== undefined) {
+        if (explicit === markerField)
+            return { error: `editField ${explicit} is the marker field` };
+        const p = audit.properties.find((x) => x.name === explicit);
+        if (!p)
+            return { error: `the entity ${audit.entitySet} has no property "${explicit}"` };
+        if (!usable(p))
+            return { error: `editField ${explicit} has no value help (or is a key / computed)` };
+        return { property: p };
+    }
+    const order = audit.lineItem.map((c) => c.property).filter((x) => !!x);
+    const ranked = [...audit.properties]
+        .filter((p) => usable(p) && p.rendered && p.name !== markerField)
+        .sort((a, b) => {
+        const ia = order.indexOf(a.name);
+        const ib = order.indexOf(b.name);
+        if (a.coded !== b.coded)
+            return a.coded ? -1 : 1;
+        return (ia < 0 ? 1e6 : ia) - (ib < 0 ? 1e6 : ib);
+    });
+    if (ranked.length === 0) {
+        return { error: `${audit.entitySet} has no field with a value help to change — the value-help check needs one` };
+    }
+    return { property: ranked[0] };
+}
+/** A CAP OData service path: /seg/…/<service>/ (optionally …/$metadata) — never /sap/. */
+export function capService(servicePath) {
+    const p = typeof servicePath === 'string' ? servicePath.replace(/\$metadata$/i, '') : '';
+    if (/[%?#\\]|\/\.\.?\/|\/\/|\s/.test(p)) {
+        return { ok: false, reason: `service path "${p}" contains an encoded character, a query, "..", "//" or a backslash` };
+    }
+    const root = p.endsWith('/') ? p : `${p}/`;
+    if (!/^\/(?:[A-Za-z0-9_-]+\/)+$/.test(root) || root.startsWith('/sap/')) {
+        return { ok: false, reason: `service path "${p}" is not a CAP service path like /odata/v4/<service>/` };
+    }
+    const segs = root.split('/').filter(Boolean);
+    return { ok: true, service: segs[segs.length - 1], serviceRoot: root };
+}
+/**
+ * True when `html` is CAP's development index ("Welcome to @sap/cds") AND it
+ * lists `serviceRoot`. CAP serves this page only in development — a production
+ * CAP app serves none, and a UI5 preview proxy serves its own page — so this is
+ * the proof that the loopback origin is the CAP dev server itself.
+ */
+export function isCapDevIndex(html, serviceRoot) {
+    if (typeof html !== 'string' || !/Welcome to/.test(html) || !/@sap\/cds/.test(html))
+        return false;
+    const rel = serviceRoot.replace(/^\//, '').replace(/\/$/, '');
+    return html.includes(`href="${rel}"`) || html.includes(`href="/${rel}"`);
+}