@cspeach/cli 1.1.24 → 1.1.26

package/dist/tools/fiori/deploy/yaml-read.js

@@ -0,0 +1,236 @@
+// cspeach-cli/src/tools/fiori/deploy/yaml-read.ts
+/**
+ * fiori_deploy — read the deploy-to-abap task out of an app's ui5-deploy.yaml.
+ *
+ * The file sits in a folder the model can write, and what it says decides
+ * where the SAP logon is sent, so it is read STRICTLY: a small block-style
+ * YAML reader (the CLI ships no YAML library and the ruling forbids adding
+ * one — same stance as preview/app-guard.ts) that FAILS CLOSED on anything it
+ * cannot read with certainty: flow style, anchors / aliases, tags, block
+ * scalars, tabs, escapes in double quotes, duplicate keys, document markers.
+ *
+ * It reads exactly what the fiori engine writes (deploy-config.ts) and what
+ * `fiori add deploy-config` writes for an on-premise ABAP target. Anything a
+ * BTP / destination / cloud target needs is refused (out of scope, and a
+ * destination would send the logon somewhere this tool cannot check).
+ */
+class YamlUncertain extends Error {
+}
+function stripComment(text) {
+    // A comment starts at " #" outside quotes (or at the line start).
+    let quote = null;
+    for (let i = 0; i < text.length; i++) {
+        const c = text[i];
+        if (quote) {
+            if (c === quote)
+                quote = null;
+            continue;
+        }
+        if (c === '"' || c === "'")
+            quote = c;
+        else if (c === '#' && (i === 0 || /\s/.test(text[i - 1])))
+            return text.slice(0, i).trimEnd();
+    }
+    return text.trimEnd();
+}
+function toLines(src) {
+    const out = [];
+    const raw = src.replace(/^/, '').split(/\r?\n/);
+    raw.forEach((r, i) => {
+        if (/^\s*(#.*)?$/.test(r))
+            return;
+        if (/^[ ]*\t/.test(r))
+            throw new YamlUncertain(`line ${i + 1} is indented with a tab`);
+        if (/^(---|\.\.\.)(\s|$)/.test(r))
+            throw new YamlUncertain(`line ${i + 1} is a YAML document marker`);
+        if (/^\s*%/.test(r))
+            throw new YamlUncertain(`line ${i + 1} is a YAML directive`);
+        const indent = r.length - r.trimStart().length;
+        const text = stripComment(r.slice(indent));
+        if (text.length === 0)
+            return;
+        out.push({ indent, text, no: i + 1 });
+    });
+    return out;
+}
+function scalar(raw, no) {
+    const v = raw.trim();
+    if (v.startsWith('"')) {
+        if (!v.endsWith('"') || v.length < 2)
+            throw new YamlUncertain(`line ${no}: unterminated double-quoted value`);
+        const body = v.slice(1, -1);
+        if (body.includes('\\') || body.includes('"'))
+            throw new YamlUncertain(`line ${no}: escapes in a double-quoted value`);
+        return body;
+    }
+    if (v.startsWith("'")) {
+        if (!v.endsWith("'") || v.length < 2)
+            throw new YamlUncertain(`line ${no}: unterminated single-quoted value`);
+        const body = v.slice(1, -1);
+        if (body.replace(/''/g, '').includes("'"))
+            throw new YamlUncertain(`line ${no}: a stray quote`);
+        return body.replace(/''/g, "'");
+    }
+    if (/^[{[&*!|>%@`]/.test(v))
+        throw new YamlUncertain(`line ${no}: the value is not a plain value (flow style, anchor, alias, tag or block scalar)`);
+    return v;
+}
+const KEY_RE = /^([A-Za-z0-9_.\-/$]+)\s*:(?:\s+(.*))?$/;
+function parseNode(lines, i, indent) {
+    const line = lines[i];
+    if (!line || line.indent < indent)
+        return [null, i];
+    if (line.text === '-' || line.text.startsWith('- '))
+        return parseSeq(lines, i, line.indent);
+    return parseMap(lines, i, line.indent);
+}
+function parseSeq(lines, i, indent) {
+    const items = [];
+    while (i < lines.length && lines[i].indent === indent && (lines[i].text === '-' || lines[i].text.startsWith('- '))) {
+        const line = lines[i];
+        const rest = line.text.slice(1).trimStart();
+        if (rest.length === 0) {
+            const next = lines[i + 1];
+            if (next && next.indent > indent) {
+                const [v, ni] = parseNode(lines, i + 1, next.indent);
+                items.push(v);
+                i = ni;
+            }
+            else {
+                items.push(null);
+                i += 1;
+            }
+            continue;
+        }
+        const restIndent = indent + (line.text.length - rest.length);
+        if (KEY_RE.test(rest)) {
+            lines[i] = { indent: restIndent, text: rest, no: line.no };
+            const [v, ni] = parseMap(lines, i, restIndent);
+            items.push(v);
+            i = ni;
+        }
+        else {
+            items.push(scalar(rest, line.no));
+            i += 1;
+        }
+    }
+    if (i < lines.length && lines[i].indent > indent) {
+        throw new YamlUncertain(`line ${lines[i].no} is indented under nothing`);
+    }
+    return [items, i];
+}
+function parseMap(lines, i, indent) {
+    const obj = {};
+    while (i < lines.length && lines[i].indent === indent) {
+        const line = lines[i];
+        if (line.text === '-' || line.text.startsWith('- '))
+            break;
+        const m = KEY_RE.exec(line.text);
+        if (!m)
+            throw new YamlUncertain(`line ${line.no} is not a plain "key: value" line`);
+        const key = m[1];
+        if (Object.prototype.hasOwnProperty.call(obj, key))
+            throw new YamlUncertain(`line ${line.no}: duplicate key "${key}"`);
+        const value = m[2];
+        if (value !== undefined && value.length > 0) {
+            obj[key] = scalar(value, line.no);
+            i += 1;
+            continue;
+        }
+        const next = lines[i + 1];
+        if (next && next.indent > indent) {
+            const [v, ni] = parseNode(lines, i + 1, next.indent);
+            obj[key] = v;
+            i = ni;
+        }
+        else if (next && next.indent === indent && (next.text === '-' || next.text.startsWith('- '))) {
+            const [v, ni] = parseSeq(lines, i + 1, indent);
+            obj[key] = v;
+            i = ni;
+        }
+        else {
+            obj[key] = null;
+            i += 1;
+        }
+    }
+    if (i < lines.length && lines[i].indent > indent) {
+        throw new YamlUncertain(`line ${lines[i].no} is indented under nothing`);
+    }
+    return [obj, i];
+}
+export function parseStrictYaml(src) {
+    const lines = toLines(src);
+    if (lines.length === 0)
+        return null;
+    const [node, i] = parseNode(lines, 0, lines[0].indent);
+    if (i < lines.length)
+        throw new YamlUncertain(`line ${lines[i].no} could not be read`);
+    return node;
+}
+const isMap = (n) => !!n && typeof n === 'object' && !Array.isArray(n);
+const str = (n) => (typeof n === 'string' ? n : undefined);
+/** The only keys allowed under target: — anything else (destination, scp, cloud, service, …) is refused. */
+const TARGET_KEYS = new Set(['url', 'client']);
+/** The deploy-to-abap configuration keys fiori_deploy accepts. */
+const CONFIG_KEYS = new Set(['target', 'app', 'ignoreCertErrors', 'exclude']);
+const APP_KEYS = new Set(['name', 'description', 'package', 'transport']);
+export function readDeployYaml(src) {
+    let root;
+    try {
+        root = parseStrictYaml(src);
+    }
+    catch (e) {
+        return { ok: false, error: `ui5-deploy.yaml could not be read with certainty — ${e instanceof Error ? e.message : String(e)}` };
+    }
+    const tasks = isMap(root) && isMap(root.builder) ? root.builder.customTasks : undefined;
+    const deployTasks = Array.isArray(tasks) ? tasks.filter((t) => isMap(t) && t.name === 'deploy-to-abap') : [];
+    if (deployTasks.length !== 1) {
+        return {
+            ok: false,
+            error: deployTasks.length === 0
+                ? 'ui5-deploy.yaml has no deploy-to-abap task — write it with fiori_deploy_config first'
+                : 'ui5-deploy.yaml has more than one deploy-to-abap task',
+        };
+    }
+    const cfg = deployTasks[0].configuration;
+    if (!isMap(cfg))
+        return { ok: false, error: 'the deploy-to-abap task has no configuration block' };
+    if (cfg.credentials !== undefined) {
+        return { ok: false, error: 'ui5-deploy.yaml carries a credentials block — remove it; CSPeach supplies the logon from its own store' };
+    }
+    // Review 2026-10-03: only known keys pass. Others change what is deployed or how —
+    // safeMode: false (no server-side 412 guard), archivePath/archiveUrl (another archive),
+    // strictSsl / ignoreCertError (TLS), keep, lrep, verbose (logs the config) …
+    for (const k of Object.keys(cfg)) {
+        if (!CONFIG_KEYS.has(k)) {
+            return { ok: false, error: `configuration.${k} is not supported by fiori_deploy (allowed: ${[...CONFIG_KEYS].join(', ')}) — remove it from ui5-deploy.yaml` };
+        }
+    }
+    const target = cfg.target;
+    const app = cfg.app;
+    if (!isMap(target) || !isMap(app))
+        return { ok: false, error: 'the deploy-to-abap configuration needs a target and an app block' };
+    for (const k of Object.keys(app)) {
+        if (!APP_KEYS.has(k)) {
+            return { ok: false, error: `app.${k} is not supported by fiori_deploy (allowed: ${[...APP_KEYS].join(', ')}) — remove it from ui5-deploy.yaml` };
+        }
+    }
+    for (const k of Object.keys(target)) {
+        if (!TARGET_KEYS.has(k)) {
+            return { ok: false, error: `target.${k} is not supported — fiori_deploy deploys only to the on-premise ABAP system of the SAP alias (url + client)` };
+        }
+    }
+    const url = str(target.url);
+    const client = str(target.client);
+    const name = str(app.name);
+    const pkg = str(app.package);
+    const transport = app.transport === null ? '' : str(app.transport);
+    if (!url || !client || !name || !pkg || transport === undefined) {
+        return { ok: false, error: 'ui5-deploy.yaml must name target.url, target.client, app.name, app.package and app.transport (empty for $TMP)' };
+    }
+    const cert = cfg.ignoreCertErrors;
+    if (cert !== undefined && cert !== 'true' && cert !== 'false') {
+        return { ok: false, error: 'ignoreCertErrors must be true or false' };
+    }
+    return { ok: true, config: { url, client, name, package: pkg, transport, ignoreCertErrors: cert === 'true' } };
+}

package/dist/tools/fiori/deploy-config.js

@@ -9,22 +9,40 @@
 // take the NAMES of environment variables at deploy time.
 import { readFileSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-export function writeDeployConfig(appDir, opts) {
-    const appName = opts.appName;
+/**
+ * The BSP name / package / transport rules, shared by the writer below and by
+ * `fiori_deploy` (which re-checks the yaml it is about to deploy — the file is
+ * in a folder the model can write, so it is never trusted on read).
+ * Returns the normalised (upper-cased) package and whether it is $TMP.
+ */
+export function validateDeployTarget(t) {
+    const appName = t.appName;
+    if (appName.length === 0) {
+        throw new Error('BSP app name is empty');
+    }
     if (appName.length > 15) {
         throw new Error(`BSP app name "${appName}" exceeds 15 characters (ABAP repository limit)`);
     }
     if (appName !== appName.toUpperCase()) {
         throw new Error(`BSP app name "${appName}" must be uppercase`);
     }
-    const pkg = opts.package.toUpperCase();
+    const pkg = t.package.toUpperCase();
     if (!/^(\$TMP|[ZY][A-Z0-9_]*|\/[A-Z0-9_]+\/[A-Z0-9_]+)$/.test(pkg)) {
-        throw new Error(`Package "${opts.package}" is not in the customer namespace (Z-/Y-prefixed, $TMP, or /namespace/pkg)`);
+        throw new Error(`Package "${t.package}" is not in the customer namespace (Z-/Y-prefixed, $TMP, or /namespace/pkg)`);
     }
     const isTmp = pkg === '$TMP';
-    if (!isTmp && !/^[A-Z0-9]{3}K[0-9]{6,}$/.test(opts.transport)) {
-        throw new Error(`A valid workbench transport (e.g. S4HK903359) is required unless package is $TMP — got "${opts.transport}"`);
+    if (isTmp && t.transport.trim() !== '') {
+        throw new Error(`Package $TMP is local-only and takes no transport, but transport "${t.transport}" is set — ` +
+            'either remove the transport (local-only app) or use the real Z/Y package that transport belongs to');
+    }
+    if (!isTmp && !/^[A-Z0-9]{3}K[0-9]{6,}$/.test(t.transport)) {
+        throw new Error(`A valid workbench transport (e.g. S4HK903359) is required unless package is $TMP — got "${t.transport}"`);
     }
+    return { package: pkg, isTmp };
+}
+export function writeDeployConfig(appDir, opts) {
+    const appName = opts.appName;
+    const { package: pkg, isTmp } = validateDeployTarget({ appName, package: opts.package, transport: opts.transport });
     const pkgJsonPath = join(appDir, 'package.json');
     const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf8'));
     const projectName = pkgJson.name ?? appName.toLowerCase();

package/dist/tools/fiori/fe-extend.js

@@ -16,6 +16,8 @@
  */
 import { create } from 'mem-fs';
 import { create as createEditor } from 'mem-fs-editor';
+import { commitContained } from './commit-gate.js';
+import { assertFeExtendParams } from './path-params.js';
 /** The four supported extension operations. Closed union → schema enum. */
 export const FE_EXTEND_OPS = ['custom-column', 'custom-action', 'custom-section', 'controller-extension'];
 /** Thrown when the target app is not a V4 Fiori Elements app (no sap.fe.templates). */
@@ -52,6 +54,9 @@ export function withActionHandler(params) {
     return { ...params, settings, eventHandler };
 }
 export async function feExtend(opts) {
+    // Path-shaped params first (name / folder / handler fileName): no `..`, no
+    // absolute paths, no drive letters. The commit gate below is the backstop.
+    assertFeExtendParams(opts.params);
     // Dynamic import: keep the heavy writer out of the cold-start path (mirrors
     // the engine's lazy-load convention; only paid when the tool actually runs).
     const fpm = await import('@sap-ux/fe-fpm-writer');
@@ -87,5 +92,5 @@ export async function feExtend(opts) {
             throw new NotV4FeAppError();
         throw err;
     }
-    await new Promise((res, rej) => result.commit((e) => (e ? rej(e) : res())));
+    await commitContained(result, opts.basePath, opts.denyRoot ?? opts.basePath);
 }

package/dist/tools/fiori/fe-scaffold.js

@@ -2,6 +2,8 @@ import { create } from 'mem-fs';
 import { create as createEditor } from 'mem-fs-editor';
 import { join } from 'node:path';
 import { PINNED_UI5_VERSION } from './ui5-version.js';
+import { commitContained } from './commit-gate.js';
+import { assertPlainName } from './path-params.js';
 // The ONE pinned, CDN-hosted patch (ui5-version.ts) — never an x.y.0 guess.
 const DEFAULT_UI5_VERSION = PINNED_UI5_VERSION;
 /**
@@ -102,6 +104,9 @@ function loadListsOnOpen(fs, manifestPath, ui5Version) {
 export async function scaffoldFioriElements(opts) {
     // Loaded on use (fix round 3, item 11e): this writer's module graph alone
     // cost ~2.8 s of every CLI start, Fiori work or not.
+    // technicalName becomes webapp/annotations/<name>.xml — a plain name only.
+    if (opts.localAnnotations)
+        assertPlainName('localAnnotations.technicalName', opts.localAnnotations.technicalName);
     const { generate, TemplateType, OdataVersion } = await import('@sap-ux/fiori-elements-writer');
     const ui5Version = opts.ui5Version ?? DEFAULT_UI5_VERSION;
     const version = opts.service.version === '2.0' ? OdataVersion.v2 : OdataVersion.v4;
@@ -194,5 +199,5 @@ export async function scaffoldFioriElements(opts) {
     if (opts.localAnnotations) {
         fs.write(join(opts.basePath, 'webapp', 'annotations', `${opts.localAnnotations.technicalName}.xml`), opts.localAnnotations.xml);
     }
-    await new Promise((res, rej) => fs.commit((err) => (err ? rej(err) : res())));
+    await commitContained(fs, opts.basePath, opts.denyRoot ?? opts.basePath);
 }

package/dist/tools/fiori/path-params.js

@@ -0,0 +1,78 @@
+// cspeach-cli/src/tools/fiori/path-params.ts
+/**
+ * Validation for caller-supplied values the @sap-ux writers turn into file
+ * paths (fe_extend `name` / `folder` / event-handler `fileName`, scaffold_fe
+ * `localAnnotations.technicalName`). First layer only — commit-gate.ts is the
+ * authoritative check on the final paths.
+ */
+import { isWindowsReservedName } from '../_filesystem-shared.js';
+/** Thrown for a path-shaped param that could leave the app folder. */
+export class UnsafePathParamError extends Error {
+    constructor(label, value, why) {
+        super(`${label} ${JSON.stringify(value)} is not allowed: ${why}`);
+        this.name = 'UnsafePathParamError';
+    }
+}
+/** A single name segment: no separators, no `..`, no `:`, no NUL, no trailing dot/space. */
+function badSegment(seg) {
+    if (seg.length === 0)
+        return 'empty name';
+    if (seg === '.' || seg === '..' || seg.includes('..'))
+        return 'no ".." allowed';
+    if (seg.includes(':'))
+        return 'no ":" allowed';
+    if (seg.includes('\0'))
+        return 'no NUL allowed';
+    if (/[. ]$/.test(seg))
+        return 'must not end with a dot or space';
+    if (/[<>"|?*\u0000-\u001f]/.test(seg))
+        return 'contains a character not allowed in file names';
+    if (isWindowsReservedName(seg))
+        return 'is a reserved Windows device name (CON, PRN, AUX, NUL, COM0-9, LPT0-9)';
+    return null;
+}
+/** A plain file/folder name: one segment, no separators. */
+export function assertPlainName(label, value) {
+    if (typeof value !== 'string')
+        throw new UnsafePathParamError(label, value, 'must be a string');
+    if (value.includes('/') || value.includes('\\'))
+        throw new UnsafePathParamError(label, value, 'must be a plain name, no folders');
+    const why = badSegment(value);
+    if (why)
+        throw new UnsafePathParamError(label, value, why);
+}
+/**
+ * A relative sub-folder (`ext/sections`): '/'-separated plain segments.
+ * Not absolute, no backslashes, no drive letters, no `..` anywhere.
+ */
+export function assertRelativeSubfolder(label, value) {
+    if (typeof value !== 'string')
+        throw new UnsafePathParamError(label, value, 'must be a string');
+    if (value.includes('\\'))
+        throw new UnsafePathParamError(label, value, 'use "/" between folders');
+    if (value.startsWith('/'))
+        throw new UnsafePathParamError(label, value, 'must be relative to the app');
+    const segs = value.replace(/\/+$/, '').split('/');
+    for (const seg of segs) {
+        const why = badSegment(seg);
+        if (why)
+            throw new UnsafePathParamError(label, value, why);
+    }
+}
+/**
+ * fe_extend params: `name` (plain), `folder` (relative sub-folder), and an
+ * event handler's `fileName` (top level or under settings) — a sub-folder
+ * path is allowed there too, still with no `..`.
+ */
+export function assertFeExtendParams(params) {
+    if (params.name !== undefined)
+        assertPlainName('name', params.name);
+    if (params.folder !== undefined)
+        assertRelativeSubfolder('folder', params.folder);
+    const handlers = [params.eventHandler, params.settings?.eventHandler];
+    for (const h of handlers) {
+        if (h && typeof h === 'object' && h.fileName !== undefined) {
+            assertRelativeSubfolder('eventHandler.fileName', h.fileName);
+        }
+    }
+}

package/dist/tools/fiori/scaffold.js

@@ -4,6 +4,7 @@ import { create as createEditor } from 'mem-fs-editor';
 import { join } from 'node:path';
 import { PINNED_UI5_VERSION } from './ui5-version.js';
 import { decodePropertiesValues } from './html-escapes.js';
+import { commitContained } from './commit-gate.js';
 // Without an explicit ui5 config the writer falls back to minUI5Version 1.60,
 // which fiori-tools-proxy resolves to the 1.71 LTS — whose bootstrap does NOT
 // understand the hyphenated `data-sap-ui-on-init` attribute the writer itself
@@ -47,5 +48,5 @@ export async function scaffoldFreestyle(opts) {
     const i18nPath = join(opts.basePath, 'webapp', 'i18n', 'i18n.properties');
     if (fs.exists(i18nPath))
         fs.write(i18nPath, decodePropertiesValues(fs.read(i18nPath)));
-    await new Promise((res, rej) => fs.commit((err) => (err ? rej(err) : res())));
+    await commitContained(fs, opts.basePath, opts.denyRoot ?? opts.basePath);
 }