@cspeach/cli 1.1.24 → 1.1.26

package/dist/tools/fiori/apply.js

@@ -5,7 +5,7 @@ import { getEntry } from './catalog/index.js';
 import { renderEntry } from './render.js';
 import { mergeManifest } from './manifest.js';
 import { appendI18n } from './i18n.js';
-import { resolveSafePath } from '../_filesystem-shared.js';
+import { resolveSafePath, assertWritableSync } from '../_filesystem-shared.js';
 /**
  * Render a catalog entry and apply it into an existing scaffolded app on disk.
  *
@@ -15,35 +15,44 @@ import { resolveSafePath } from '../_filesystem-shared.js';
  * CUSTOMER params (e.g. `webapp/ext/fragment/<%- ns %>Chart.fragment.xml`), so a
  * hostile param could otherwise carry `..` and escape `appDir`. Every path this
  * function writes — rendered files, manifest.json, and the i18n file (whose
- * relative location is itself read from on-disk manifest data) — is resolved
- * through `resolveSafePath(opts.appDir, rel)`, which throws PathOutsideRootError
- * if the resolved absolute path is not contained under appDir. This is the
- * authoritative defense; the catalog-side `ns` pattern (render.ts) is the
- * second, earlier layer.
+ * relative location is itself read from on-disk manifest data) — goes through
+ * `resolveSafePath(opts.appDir, rel)` (string containment) and then
+ * `assertWritableSync` (real path after links / short names must stay inside
+ * appDir and must not be a protected path such as a nested `.git`). ALL
+ * targets are checked BEFORE the first write, so a refusal writes nothing.
+ * The catalog-side `ns` pattern (render.ts) is the second, earlier layer.
  */
 export function applyEntry(opts) {
     const rendered = renderEntry(getEntry(opts.entryName), opts.params);
-    // 1. write files — re-validate EVERY rendered (param-derived) path against appDir.
-    for (const f of rendered.files) {
-        const abs = resolveSafePath(opts.appDir, f.path);
-        mkdirSync(dirname(abs), { recursive: true });
-        writeFileSync(abs, f.content, 'utf8');
-    }
-    // 2. merge manifest — ALWAYS re-read from disk (I2). Fixed relative path, but
-    // routed through resolveSafePath for uniform containment.
-    const manifestPath = resolveSafePath(opts.appDir, 'webapp/manifest.json');
+    const denyRoot = opts.denyRoot ?? opts.appDir;
+    const target = (rel) => {
+        const abs = resolveSafePath(opts.appDir, rel);
+        assertWritableSync(abs, opts.appDir, denyRoot);
+        return abs;
+    };
+    // 0. Resolve + verify every write target first.
+    const files = rendered.files.map((f) => ({ abs: target(f.path), content: f.content }));
+    // manifest — ALWAYS re-read from disk (I2). Fixed relative path, still contained.
+    const manifestPath = target('webapp/manifest.json');
     const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
     let merged = mergeManifest(manifest, rendered.manifestPatch);
     for (const lib of rendered.libraries) {
         merged = mergeManifest(merged, { 'sap.ui5': { dependencies: { libs: { [lib]: {} } } } });
     }
-    writeFileSync(manifestPath, JSON.stringify(merged, null, 2), 'utf8');
-    // 3. append i18n — resolve path from sap.app.i18n (M1). i18nRel is on-disk
-    // data, not a render param, but it still drives a write target, so contain it.
+    // i18n — path from sap.app.i18n (M1): on-disk data that drives a write target.
     const i18nRel = merged['sap.app']?.i18n ?? 'i18n/i18n.properties';
-    const i18nPath = resolveSafePath(opts.appDir, `webapp/${i18nRel}`);
-    const existing = existsSync(i18nPath) ? readFileSync(i18nPath, 'utf8') : '';
-    if (Object.keys(rendered.i18nKeys).length) {
+    const hasI18n = Object.keys(rendered.i18nKeys).length > 0;
+    const i18nPath = hasI18n ? target(`webapp/${i18nRel}`) : null;
+    // 1. write files.
+    for (const f of files) {
+        mkdirSync(dirname(f.abs), { recursive: true });
+        writeFileSync(f.abs, f.content, 'utf8');
+    }
+    // 2. merge manifest.
+    writeFileSync(manifestPath, JSON.stringify(merged, null, 2), 'utf8');
+    // 3. append i18n.
+    if (i18nPath) {
+        const existing = existsSync(i18nPath) ? readFileSync(i18nPath, 'utf8') : '';
         mkdirSync(dirname(i18nPath), { recursive: true });
         writeFileSync(i18nPath, appendI18n(existing, rendered.i18nKeys), 'utf8');
     }

package/dist/tools/fiori/commit-gate.js

@@ -0,0 +1,58 @@
+// cspeach-cli/src/tools/fiori/commit-gate.ts
+/**
+ * Commit-time containment gate for every mem-fs editor the Fiori engine
+ * flushes (scaffoldFreestyle, scaffoldFioriElements, feExtend).
+ *
+ * The @sap-ux writers build paths from caller-supplied config (`folder`,
+ * `name`, `localAnnotationsName`, event-handler file names, …). Validating
+ * each known param is the first layer; THIS is the authoritative one: before
+ * anything reaches disk, every pending path in the editor's store must land —
+ * after following links and expanding Windows short names — inside the app
+ * folder, and must not be a protected path (`.git` at any depth, `.cspeach`,
+ * `.env*`, the CLI home). One bad path refuses the WHOLE commit, so nothing
+ * is half-written.
+ */
+import * as path from 'node:path';
+import { assertWritable, PathOutsideRootError, ProtectedPathError } from '../_filesystem-shared.js';
+/** Thrown when a pending write would leave the app folder or hit a protected path. */
+export class UnsafeCommitError extends Error {
+    constructor(detail) {
+        super(`refusing to write the app: ${detail}. Nothing was written.`);
+        this.name = 'UnsafeCommitError';
+    }
+}
+/** Every path the editor would write or delete on commit. */
+function pendingPaths(editor) {
+    const store = editor.store;
+    if (!store || typeof store.each !== 'function') {
+        // Without a store we cannot see what commit would touch — fail closed.
+        throw new UnsafeCommitError('the pending file list could not be read');
+    }
+    const out = [];
+    store.each((f) => {
+        if (f && (f.state === 'modified' || f.state === 'deleted'))
+            out.push(f.path);
+    });
+    return out;
+}
+/**
+ * Verify every pending path, then commit. `appDir` is the containment root;
+ * `denyRoot` (default appDir) is the project root the denylist is judged
+ * against — tools pass ctx.cwd so a protected folder ABOVE the app is caught.
+ */
+export async function commitContained(editor, appDir, denyRoot = appDir) {
+    for (const p of pendingPaths(editor)) {
+        try {
+            await assertWritable(path.resolve(p), appDir, denyRoot);
+        }
+        catch (err) {
+            const shown = path.relative(path.resolve(denyRoot), path.resolve(p)).replace(/\\/g, '/');
+            if (err instanceof PathOutsideRootError)
+                throw new UnsafeCommitError(`"${shown}" is outside the app folder`);
+            if (err instanceof ProtectedPathError)
+                throw new UnsafeCommitError(`"${shown}" is a protected path`);
+            throw err;
+        }
+    }
+    await new Promise((res, rej) => editor.commit((e) => (e ? rej(e) : res())));
+}

package/dist/tools/fiori/deploy/existing-bsp.js

@@ -0,0 +1,67 @@
+// cspeach-cli/src/tools/fiori/deploy/existing-bsp.ts
+/**
+ * fiori_deploy pre-check — does the target BSP already exist, and whose app is it?
+ *
+ * `fiori deploy --yes` would silently overwrite a BSP that holds ANOTHER app
+ * (the tooling's HTTP 412 "different sap app id" handler auto-confirms with
+ * --yes), which could be another team's application. So before either mode
+ * runs, two read-only GETs over the alias's authenticated connection:
+ *
+ *   1. /sap/opu/odata/UI5/ABAP_REPOSITORY_SRV/Repositories('<BSP>') — the same
+ *      OData service the deploy itself uploads through. 404 → a new app;
+ *      200 → it exists; anything else (401/403/500, no answer) → the check
+ *      could not run, and the deploy is refused rather than guessed.
+ *   2. when it exists: /sap/bc/ui5_ui5/sap/<bsp>/manifest.json → sap.app.id.
+ *      If that cannot be read, the app id is UNKNOWN, which is treated like a
+ *      different app (never assumed to be ours).
+ */
+function repositoryPath(bsp) {
+    return `/sap/opu/odata/UI5/ABAP_REPOSITORY_SRV/Repositories('${encodeURIComponent(bsp)}')?$format=json`;
+}
+/** /sap/bc/ui5_ui5/sap/<bsp>/<file>, or /sap/bc/ui5_ui5/<ns>/<name>/<file> for a namespaced BSP. */
+export function bspFilePath(bsp, file) {
+    const lower = bsp.toLowerCase();
+    const ns = /^\/([a-z0-9_]+)\/([a-z0-9_]+)$/.exec(lower);
+    return ns ? `/sap/bc/ui5_ui5/${ns[1]}/${ns[2]}/${file}` : `/sap/bc/ui5_ui5/sap/${lower}/${file}`;
+}
+export async function readExistingBsp(bsp, get) {
+    let repo;
+    try {
+        repo = await get(repositoryPath(bsp));
+    }
+    catch (e) {
+        return { kind: 'unknown', reason: `the ABAP repository service did not answer (${e instanceof Error ? e.message : String(e)})` };
+    }
+    if (repo.status === 404)
+        return { kind: 'new' };
+    if (repo.status !== 200) {
+        return {
+            kind: 'unknown',
+            reason: `the ABAP repository service answered HTTP ${repo.status}` +
+                (repo.status === 401 || repo.status === 403 ? ' (the SAP user may lack authorisation for /UI5/ABAP_REPOSITORY_SRV)' : ''),
+        };
+    }
+    let description;
+    let pkg;
+    try {
+        const d = JSON.parse(repo.body ?? '').d;
+        description = d?.Description || undefined;
+        pkg = d?.Package || undefined;
+    }
+    catch { /* the entry exists; its details are only for the message */ }
+    let appId = null;
+    try {
+        const m = await get(bspFilePath(bsp, 'manifest.json'));
+        if (m.status === 200) {
+            const id = JSON.parse(m.body ?? '')['sap.app']?.id;
+            if (typeof id === 'string' && id.trim() !== '')
+                appId = id.trim();
+        }
+    }
+    catch { /* unknown app id — treated as a different app */ }
+    return { kind: 'existing', appId, ...(description ? { description } : {}), ...(pkg ? { package: pkg } : {}) };
+}
+/** The approval object an overwrite must carry: `<BSP> overwrites app id <id|unknown>`. */
+export function overwriteApprovalObject(bsp, remoteAppId) {
+    return `${bsp} overwrites app id ${remoteAppId ?? 'unknown'}`;
+}