@cspeach/cli 1.1.21 → 1.1.23

package/dist/sap/system-info.js

@@ -19,6 +19,12 @@ import { join } from 'node:path';
 import { auditLog, xmlParser } from '@cspeach/sap-client';
 import { cspeachRoot } from '../config/paths.js';
 const CACHE_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+/**
+ * Bump when the cached shape or its meaning changes, so files written by
+ * an older CLI are re-queried instead of served. v2 (2026-09-29): CVERS
+ * now includes SAP_APPL; v1 files classified ECC EHP8 as NetWeaver.
+ */
+const CACHE_VERSION = 2;
 const memCache = new Map();
 /**
  * Top-level entry point. Returns cached info when available, queries
@@ -68,7 +74,8 @@ export function _resetSystemInfoCache() {
 async function queryLive(adt, alias) {
     // S4FND covers some private-cloud variants where S4CORE isn't shipped
     // — including both broadens detection without extra cost.
-    const sql = `SELECT COMPONENT, RELEASE FROM CVERS WHERE COMPONENT IN ('SAP_BASIS', 'S4CORE', 'S4FND', 'SAP_ABA')`;
+    // SAP_APPL tells ECC apart from plain NetWeaver (see classify()).
+    const sql = `SELECT COMPONENT, RELEASE FROM CVERS WHERE COMPONENT IN ('SAP_BASIS', 'S4CORE', 'S4FND', 'SAP_ABA', 'SAP_APPL')`;
     // Dispatch order is INTENTIONALLY connection-first: AdtClient.sqlQuery
     // internally uses parseDataPreview which silently returns empty rows on
     // shapes it doesn't recognise — exactly the failure mode that surfaced
@@ -380,11 +387,17 @@ export async function parseCversTree(xml) {
  */
 export function classify(alias, components) {
     const sapBasis = components['SAP_BASIS'];
+    // SAP_APPL is the ERP application component: present on ECC, replaced by
+    // S4CORE on S/4, absent on BW / SolMan / PI. It — not the SAP_BASIS
+    // number — is what tells ECC apart from a plain NetWeaver system
+    // (ECC EHP8 runs on SAP_BASIS 750).
+    const sapAppl = components['SAP_APPL'];
     const s4Core = components['S4CORE'] || components['S4FND'];
     const platform = s4Core ? 'S/4HANA'
-        : sapBasis ? (parseInt(sapBasis, 10) >= 750 ? 'NetWeaver' : 'ECC')
-            : 'unknown';
-    const release = humanReadableRelease(platform, sapBasis, s4Core);
+        : sapAppl ? 'ECC'
+            : sapBasis ? 'NetWeaver'
+                : 'unknown';
+    const release = humanReadableRelease(platform, sapBasis, s4Core, sapAppl);
     const abapVersion = abapVersionFor(sapBasis);
     return {
         alias,
@@ -405,38 +418,42 @@ export function classify(alias, components) {
  * so we anchor on S4CORE when present and fall back to SAP_BASIS only
  * for ECC/NW systems.
  */
-function humanReadableRelease(platform, sapBasis, s4Core) {
+function humanReadableRelease(platform, sapBasis, s4Core, sapAppl) {
     if (platform === 'S/4HANA' && s4Core) {
+        // S4CORE release → S/4HANA edition. FPS/SPS levels do not change the
+        // S4CORE release, so there are no "FPS" entries here.
         const map = {
-            '100': 'S/4HANA 1503',
-            '101': 'S/4HANA 1511',
-            '102': 'S/4HANA 1610',
-            '103': 'S/4HANA 1709',
-            '104': 'S/4HANA 1809',
-            '105': 'S/4HANA 1909',
-            '106': 'S/4HANA 2020',
+            '100': 'S/4HANA 1511',
+            '101': 'S/4HANA 1610',
+            '102': 'S/4HANA 1709',
+            '103': 'S/4HANA 1809',
+            '104': 'S/4HANA 1909',
+            '105': 'S/4HANA 2020',
+            '106': 'S/4HANA 2021',
             '107': 'S/4HANA 2022',
             '108': 'S/4HANA 2023',
-            '109': 'S/4HANA 2023 FPS01',
-            '110': 'S/4HANA 2025',
+            '109': 'S/4HANA 2025',
         };
         return map[s4Core] ?? `S/4HANA (S4CORE ${s4Core})`;
     }
     if (platform === 'NetWeaver' && sapBasis) {
-        return `NetWeaver / ECC (SAP_BASIS ${sapBasis})`;
+        return `NetWeaver (SAP_BASIS ${sapBasis})`;
     }
-    if (platform === 'ECC' && sapBasis) {
+    if (platform === 'ECC' && sapAppl) {
+        // Enhancement pack is read from SAP_APPL: SAP_BASIS is ambiguous
+        // (730 covers EHP5 and EHP6; 750 is EHP8 but also plain NW 7.50).
         const map = {
-            '700': 'ECC 6.0',
-            '701': 'ECC 6.0 EHP1',
-            '702': 'ECC 6.0 EHP2',
-            '703': 'ECC 6.0 EHP3',
-            '704': 'ECC 6.0 EHP4',
-            '730': 'ECC 6.0 EHP5/6',
-            '731': 'ECC 6.0 EHP6',
-            '740': 'ECC 6.0 EHP7',
+            '600': 'ECC 6.0',
+            '602': 'ECC 6.0 EHP2',
+            '603': 'ECC 6.0 EHP3',
+            '604': 'ECC 6.0 EHP4',
+            '605': 'ECC 6.0 EHP5',
+            '606': 'ECC 6.0 EHP6',
+            '616': 'ECC 6.0 EHP6 (HANA)',
+            '617': 'ECC 6.0 EHP7',
+            '618': 'ECC 6.0 EHP8',
         };
-        return map[sapBasis] ?? `ECC 6.0 (SAP_BASIS ${sapBasis})`;
+        return map[sapAppl] ?? `ECC 6.0 (SAP_APPL ${sapAppl})`;
     }
     return 'unknown';
 }
@@ -455,6 +472,9 @@ function abapVersionFor(sapBasis) {
     // Modern releases — return as N.NN (e.g. 757 → 7.57).
     if (n >= 740 && n < 800)
         return `7.${n - 700}`;
+    // ABAP Platform 2025 moved to 8.xx (SAP_BASIS 816 → 8.16).
+    if (n >= 800 && n < 900)
+        return `8.${String(n - 800).padStart(2, '0')}`;
     return sapBasis;
 }
 // ── Disk cache ─────────────────────────────────────────────────────────────
@@ -473,12 +493,15 @@ function readDiskCache(alias) {
         if (!existsSync(path))
             return null;
         const raw = JSON.parse(readFileSync(path, 'utf8'));
+        if (raw.cacheVersion !== CACHE_VERSION)
+            return null;
         if (!raw.queriedAt)
             return null;
         const age = Date.now() - new Date(raw.queriedAt).getTime();
         if (age > CACHE_TTL_MS)
             return null;
-        return raw;
+        const { cacheVersion: _v, ...info } = raw;
+        return info;
     }
     catch {
         return null;
@@ -489,7 +512,7 @@ function writeDiskCache(alias, info) {
         const dir = cacheDir();
         if (!existsSync(dir))
             mkdirSync(dir, { recursive: true });
-        writeFileSync(cacheFile(alias), JSON.stringify(info, null, 2), 'utf8');
+        writeFileSync(cacheFile(alias), JSON.stringify({ ...info, cacheVersion: CACHE_VERSION }, null, 2), 'utf8');
     }
     catch {
         // best-effort — we still return the in-memory result

package/dist/sap-link/policy.js

@@ -0,0 +1,185 @@
+const READS = new Set(['GET', 'HEAD']);
+const WRITES = new Set(['POST', 'PUT', 'PATCH', 'MERGE', 'DELETE']);
+const OVERRIDE_HEADERS = ['x-http-method', 'x-http-method-override'];
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHAR = /[\u0000-\u001f\u007f]/;
+/** All values for a header, matched case-insensitively; arrays are flattened. */
+function headerValues(h, name) {
+    const out = [];
+    for (const [k, v] of Object.entries(h)) {
+        if (k.toLowerCase() !== name)
+            continue;
+        if (Array.isArray(v))
+            out.push(...v);
+        else if (v !== undefined)
+            out.push(v);
+    }
+    return out;
+}
+/**
+ * The method the request really performs, or an error when the override headers are
+ * unusable (unknown/empty verb, or conflicting values).
+ */
+/** Echo a verb only when it is plain letters; never reflect arbitrary text. */
+function unknownVerbMessage(verb) {
+    if (verb === '')
+        return 'The SAP link does not forward empty requests.';
+    if (/^[A-Z]{1,16}$/.test(verb))
+        return `The SAP link does not forward ${verb} requests.`;
+    return 'The SAP link does not forward that method.';
+}
+function effectiveMethod(realMethod, h) {
+    const real = realMethod.trim().toUpperCase();
+    if (!READS.has(real) && !WRITES.has(real)) {
+        return { error: unknownVerbMessage(real) };
+    }
+    const overrides = OVERRIDE_HEADERS.flatMap((n) => headerValues(h, n)).map((v) => v.trim().toUpperCase());
+    if (overrides.length === 0)
+        return { method: real, real };
+    const distinct = new Set(overrides);
+    if (distinct.size > 1) {
+        return { error: 'The SAP link refuses requests with conflicting method override headers.' };
+    }
+    const override = overrides[0];
+    if (!READS.has(override) && !WRITES.has(override)) {
+        return { error: unknownVerbMessage(override) };
+    }
+    return { method: override, real, override };
+}
+/** Each `%` must be `%XY` decoding to a printable ASCII char other than . / \ % ;. */
+function pathEncodingIsSafe(rawPath) {
+    for (let i = 0; i < rawPath.length; i++) {
+        if (rawPath[i] !== '%')
+            continue;
+        const hex = rawPath.slice(i + 1, i + 3);
+        if (!/^[0-9a-fA-F]{2}$/.test(hex))
+            return false;
+        const code = parseInt(hex, 16);
+        if (code < 0x20 || code >= 0x7f)
+            return false;
+        if (code === 0x2e || code === 0x2f || code === 0x5c || code === 0x25 || code === 0x3b)
+            return false;
+        i += 2;
+    }
+    return true;
+}
+/** Lower-cased, slash-led, no trailing slash; null when the prefix is not a clean path. */
+function normPrefix(p) {
+    const withSlash = p.startsWith('/') ? p : `/${p}`;
+    const trimmed = withSlash.replace(/\/+$/, '');
+    if (trimmed === '' || trimmed === '/')
+        return null;
+    if (/[%\\?#;]/.test(trimmed) || /[^\x20-\x7e]/.test(trimmed))
+        return null;
+    const segments = trimmed.slice(1).split('/');
+    if (segments.some((s) => s === '' || s === '.' || s === '..'))
+        return null;
+    return trimmed.toLowerCase();
+}
+function isBatchPath(pathname) {
+    return pathname.split('/').some((seg) => {
+        let decoded;
+        try {
+            decoded = decodeURIComponent(seg);
+        }
+        catch {
+            decoded = seg;
+        }
+        return decoded.split(';', 1)[0].trim().toLowerCase() === '$batch';
+    });
+}
+/**
+ * True when any query parameter name (decoded, trimmed) starts with `sap-`, except
+ * sap-language. 'malformed' when a name cannot be decoded (caller fails closed).
+ */
+function hasSapQueryParam(rawQuery) {
+    for (const part of rawQuery.split(/[&;]/)) {
+        const rawName = part.split('=', 1)[0];
+        let name;
+        try {
+            name = decodeURIComponent(rawName.replace(/\+/g, ' '));
+        }
+        catch {
+            return 'malformed';
+        }
+        const n = name.trim().toLowerCase();
+        if (n.startsWith('sap-') && n !== 'sap-language')
+            return true;
+    }
+    return false;
+}
+export function writesBlockedMessage(alias, role) {
+    const now = role === undefined ? 'has no role set' : `has role ${role}`;
+    return `Writes to ${alias} need role dev. ${alias} ${now}. Set it with: cspeach config set sap.${alias}.role dev`;
+}
+export function decideRequest(input) {
+    const m = effectiveMethod(input.method, input.headers);
+    if ('error' in m)
+        return { allow: false, status: 400, message: m.error };
+    const method = m.method;
+    const verbIsWrite = WRITES.has(m.real) || (m.override !== undefined && WRITES.has(m.override));
+    const raw = input.rawUrl;
+    if (!raw.startsWith('/') || raw.startsWith('//')) {
+        return { allow: false, status: 400, message: 'The SAP link only accepts paths on this machine, not full URLs.' };
+    }
+    if (CONTROL_CHAR.test(raw)) {
+        return { allow: false, status: 400, message: 'The SAP link refuses paths with control characters.' };
+    }
+    const rawPath = raw.split(/[?#]/, 1)[0];
+    if (rawPath.includes('\\') || /[^\x00-\x7f]/.test(rawPath) || !pathEncodingIsSafe(rawPath)) {
+        return { allow: false, status: 400, message: 'The SAP link refuses encoded or backslash paths.' };
+    }
+    const url = new URL(raw, 'http://127.0.0.1');
+    if (url.host !== '127.0.0.1') {
+        return { allow: false, status: 400, message: 'The SAP link only accepts paths on this machine, not full URLs.' };
+    }
+    for (const seg of url.pathname.split('/')) {
+        let decoded;
+        try {
+            decoded = decodeURIComponent(seg);
+        }
+        catch {
+            return { allow: false, status: 400, message: 'The SAP link refuses encoded or backslash paths.' };
+        }
+        const bare = decoded.split(';', 1)[0].trim();
+        if (bare === '.' || bare === '..') {
+            return { allow: false, status: 400, message: 'The SAP link refuses dot segments with parameters.' };
+        }
+    }
+    const pathLower = url.pathname.toLowerCase();
+    const usable = input.allowedPrefixes
+        .map((original) => ({ original, norm: normPrefix(original) }))
+        .filter((p) => p.norm !== null);
+    const hit = usable.find((p) => pathLower === p.norm || pathLower.startsWith(`${p.norm}/`) || pathLower.startsWith(`${p.norm};`));
+    if (!hit) {
+        return {
+            allow: false,
+            status: 404,
+            message: `The SAP link only forwards the services this project imported: ` +
+                `${usable.map((p) => p.original).join(', ') || '(none)'}.`,
+        };
+    }
+    // Only `;v=<digits>` directly on the service segment; no other `;` anywhere.
+    const afterPrefix = pathLower.slice(hit.norm.length);
+    const version = /^;v=\d+(?=\/|$)/.exec(afterPrefix);
+    const rest = version ? afterPrefix.slice(version[0].length) : afterPrefix;
+    if (rest.includes(';')) {
+        return {
+            allow: false,
+            status: 400,
+            message: 'The SAP link only accepts ;v=<number> after the service name. Other path parameters are refused.',
+        };
+    }
+    if (hasSapQueryParam(url.search.replace(/^\?/, '')) !== false) {
+        return {
+            allow: false,
+            status: 400,
+            message: 'The SAP link refuses sap- query parameters. It uses the client and login from your SAP settings.',
+        };
+    }
+    const write = verbIsWrite || isBatchPath(url.pathname);
+    if (write && input.role !== 'dev') {
+        return { allow: false, status: 403, message: writesBlockedMessage(input.alias, input.role) };
+    }
+    return { allow: true, write, method, upstreamPath: url.pathname + url.search, servicePrefix: hit.original };
+}

package/dist/sap-link/project.js

@@ -0,0 +1,163 @@
+// cspeach-cli/src/sap-link/project.ts
+import { promises as fs } from 'node:fs';
+import * as path from 'node:path';
+export class LinkConfigError extends Error {
+}
+const LOOPBACK = new Set(['127.0.0.1', 'localhost']);
+/** Keys that carry a secret. Matched case-insensitively at any depth of an S/4 entry. None may sit in package.json. */
+const SECRET_KEYS = new Set([
+    'user', 'username', 'password', 'token', 'clientsecret', 'client_secret',
+    'authentication', 'headers', 'key', 'apikey',
+]);
+/** The only OData roots the SAP link may be pointed at, and how many segments name exactly one service. */
+const ODATA_ROOTS = [
+    { root: '/sap/opu/odata/', segments: 2, version: 'v2' }, // <namespace>/<SERVICE>[;v=N]
+    { root: '/sap/opu/odata4/', segments: 6, version: 'v4' }, // <ns>/<group>/<repo>/<ns>/<service>/<version>
+];
+const MAX_PACKAGE_BYTES = 5 * 1024 * 1024;
+const MAX_DEPTH = 20;
+// eslint-disable-next-line no-control-regex
+const CONTROL_CHARS = /[\u0000-\u001f\u007f]/;
+/**
+ * Raw path chars allowed: printable ASCII 0x21-0x7e that the URL parser leaves as-is,
+ * i.e. without `"` `<` `>` backtick `{` `|` `}` `^` `%` and backslash.
+ */
+const PATH_CHARS = /^[!#$&-;=?-[\]_a-z~]*$/;
+/** A URL with a login in it (`scheme://user[:pass]@host`). */
+const URL_USERINFO = /:\/\/[^/?#\s]*@/;
+const isObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+const loginMessage = (name) => `package.json holds a login for ${name}. Remove it — the SAP link adds the login from your keychain.`;
+/** Walks a whole `requires` entry and refuses any secret-bearing key at any depth. Never reports values. */
+function scanForSecrets(name, value, depth = 0, seen = new Set()) {
+    if (typeof value === 'string' && URL_USERINFO.test(value))
+        throw new LinkConfigError(loginMessage(name));
+    if (typeof value !== 'object' || value === null)
+        return;
+    if (depth > MAX_DEPTH)
+        throw new LinkConfigError(`The entry for ${name} in package.json is nested too deeply.`);
+    if (seen.has(value))
+        return;
+    seen.add(value);
+    if (Array.isArray(value)) {
+        for (const item of value)
+            scanForSecrets(name, item, depth + 1, seen);
+        return;
+    }
+    for (const [k, v] of Object.entries(value)) {
+        if (SECRET_KEYS.has(k.toLowerCase()))
+            throw new LinkConfigError(loginMessage(name));
+        scanForSecrets(name, v, depth + 1, seen);
+    }
+}
+/** Checks one service's `[s4]` URL and returns its port and allowlist prefix. Never echoes the URL. */
+function checkUrl(name, raw) {
+    // Before parsing: `URL` silently strips tabs, newlines and leading/trailing controls.
+    if (CONTROL_CHARS.test(raw))
+        throw new LinkConfigError(`${name}: the [s4] URL holds control characters.`);
+    let u;
+    try {
+        u = new URL(raw);
+    }
+    catch {
+        throw new LinkConfigError(`${name}: the [s4] URL is not a valid URL.`);
+    }
+    if (u.username !== '' || u.password !== '')
+        throw new LinkConfigError(loginMessage(name));
+    const authority = /^[a-z][a-z0-9+.-]*:[/\\]{2}([^/\\?#]*)/i.exec(raw);
+    const rawAuthority = authority?.[1] ?? '';
+    // `URL` drops the default port, so an explicit :80 would otherwise read as "no port".
+    if (u.protocol === 'http:' && u.port === '' && /:0*80$/.test(rawAuthority)) {
+        throw new LinkConfigError(`${name}: port 80 is not supported for the SAP link. Use another port, such as 4005.`);
+    }
+    if (u.protocol !== 'http:' || !LOOPBACK.has(u.hostname) || u.port === '' || !authority) {
+        throw new LinkConfigError(`${name}: the [s4] URL must point at the SAP link on 127.0.0.1 with a port.`);
+    }
+    const port = Number(u.port);
+    if (!Number.isInteger(port) || port < 0 || port > 65535) {
+        throw new LinkConfigError(`${name}: the [s4] URL port must be a whole number from 0 to 65535.`);
+    }
+    // Check the raw string too: `URL` drops an empty `?` or `#`.
+    if (u.search !== '' || u.hash !== '' || raw.includes('?') || raw.includes('#')) {
+        throw new LinkConfigError(`${name}: the [s4] URL must not have a query or fragment.`);
+    }
+    const prefix = u.pathname.replace(/\/+$/, '');
+    const root = ODATA_ROOTS.find((r) => prefix.toLowerCase().startsWith(r.root));
+    if (!root || prefix.length <= root.root.length) {
+        throw new LinkConfigError(`${name}: the [s4] URL path must start with /sap/opu/odata/ or /sap/opu/odata4/ and name a service.`);
+    }
+    // Judge the RAW path, not what normalisation made of it.
+    const rawPath = raw.slice(authority[0].length).replace(/\/+$/, '');
+    const rawSegments = rawPath.split('/').slice(1);
+    if (rawPath.includes('%') || rawPath.includes('\\') ||
+        rawSegments.some((s) => {
+            // `..;v=1` climbs on servers that strip matrix params, so judge the part before `;`.
+            const bare = s.split(';')[0];
+            return bare === '' || bare === '.' || bare === '..';
+        })) {
+        throw new LinkConfigError(`${name}: the [s4] URL path must not hold dot segments, encoded characters, backslashes or empty segments.`);
+    }
+    // Anything the parser percent-encodes (space, quotes, braces, non-ASCII, ...) would come back
+    // as `%XY` in the prefix, which the policy drops. Refuse it on both sides of parsing.
+    if (!PATH_CHARS.test(rawPath) || u.pathname.includes('%')) {
+        throw new LinkConfigError(`${name}: the [s4] URL path may only hold plain ASCII letters, digits and URL punctuation.`);
+    }
+    const segments = prefix.slice(root.root.length).split('/');
+    if (segments.length !== root.segments || segments.some((s) => s === '')) {
+        throw new LinkConfigError(`${name}: the [s4] URL path must name exactly one service, like /sap/opu/odata/sap/API_BUSINESS_PARTNER.`);
+    }
+    const last = segments.length - 1;
+    const matrixOk = segments.every((s, i) => !s.includes(';') || (root.version === 'v2' && i === last && /^[^;]+;v=\d+$/.test(s)));
+    if (!matrixOk) {
+        throw new LinkConfigError(`${name}: the [s4] URL path may only carry ;v=<number> on the service name.`);
+    }
+    // The policy matches the bare service and accepts `;v=N` right after it, so the prefix drops it.
+    return { port, prefix: prefix.replace(/;v=\d+$/, '') };
+}
+async function readPackageJson(projectDir) {
+    const file = path.join(projectDir, 'package.json');
+    let size;
+    try {
+        size = (await fs.stat(file)).size;
+    }
+    catch {
+        throw new LinkConfigError(`No readable package.json in ${projectDir}.`);
+    }
+    if (size > MAX_PACKAGE_BYTES) {
+        throw new LinkConfigError(`package.json in ${projectDir} is larger than 5 MB. The SAP link will not read it.`);
+    }
+    try {
+        return JSON.parse(await fs.readFile(file, 'utf8'));
+    }
+    catch {
+        throw new LinkConfigError(`No readable package.json in ${projectDir}.`);
+    }
+}
+/** The generated app's `[s4]` profile points each remote service at the SAP link (spec §6.2). */
+export async function readLinkTargets(projectDir) {
+    const pkg = await readPackageJson(projectDir);
+    const cds = isObject(pkg) ? pkg.cds : undefined;
+    const requires = isObject(cds) && isObject(cds.requires) ? cds.requires : {};
+    const services = [];
+    const ports = new Set();
+    for (const [name, entry] of Object.entries(requires)) {
+        if (!isObject(entry))
+            continue;
+        const profile = entry['[s4]'];
+        if (!isObject(profile))
+            continue;
+        const creds = profile.credentials;
+        if (!isObject(creds) || typeof creds.url !== 'string')
+            continue;
+        // Only S/4 entries are scanned: other entries (e.g. mocked auth users) legitimately hold test passwords.
+        scanForSecrets(name, entry);
+        const { port, prefix } = checkUrl(name, creds.url);
+        ports.add(port);
+        services.push({ name, prefix });
+    }
+    if (services.length === 0) {
+        throw new LinkConfigError('No S/4 services in this project. Import one first (cap_metadata_import, then cds import).');
+    }
+    if (ports.size !== 1)
+        throw new LinkConfigError('All [s4] URLs must use one port — the SAP link listens on one.');
+    return { port: [...ports][0], services };
+}