@cspeach/cli 1.1.48 → 1.1.49

package/dist/doctor/checks/zcspeach.js

@@ -0,0 +1,96 @@
+import keychain from '../../auth/keychain.js';
+import { readFile } from 'node:fs/promises';
+import { loadConfig, resolveSapTls } from '../../config/loader.js';
+import { probeGet } from './_http-probe.js';
+import { sapChecksSkipped, standaloneSkip } from './_standalone-skip.js';
+const SAP_SERVICE = 'cspeach-sap';
+export async function checkZcspeach() {
+    const cfg = await loadConfig();
+    // Standalone mode ONLY — an opted-in paste-mode user has nothing to probe.
+    // Everything below (including the no-alias failure) is unchanged.
+    if (sapChecksSkipped(cfg))
+        return standaloneSkip('zcspeach');
+    const systems = Object.entries(cfg.sap);
+    if (systems.length === 0) {
+        return {
+            name: 'zcspeach',
+            ok: false,
+            message: 'no SAP systems configured',
+            hint: 'Run: cspeach config add-sap',
+        };
+    }
+    const results = [];
+    let anyFailed = false;
+    for (const [alias, sys] of systems) {
+        const protocol = sys.useSsl ? 'https' : 'http';
+        const url = `${protocol}://${sys.host}:${sys.port}/sap/bc/zcspeach/discovery`;
+        let pwd = null;
+        try {
+            pwd = await keychain.getPassword(SAP_SERVICE, alias);
+        }
+        catch {
+            // keychain unavailable — fall through, will be skipped below
+        }
+        if (!pwd) {
+            results.push(`${alias}: skipped (no password in keychain)`);
+            continue;
+        }
+        // TLS posture (2026-06-14): verification ON by default; resolveSapTls maps
+        // the per-alias config (ca_cert_path / insecure_skip_tls_verify, legacy
+        // sslVerify:false fallback). See checks/_http-probe.ts.
+        const tls = resolveSapTls(sys);
+        let ca;
+        if (tls.mode === 'ca-trusted' && tls.caCertPath) {
+            try {
+                ca = await readFile(tls.caCertPath);
+            }
+            catch (e) {
+                results.push(`${alias}: CA unreadable at ${tls.caCertPath} (${e.message})`);
+                anyFailed = true;
+                continue;
+            }
+        }
+        const r = await probeGet(url, {
+            rejectUnauthorized: tls.mode !== 'insecure',
+            ca,
+            auth: `${sys.username}:${pwd}`,
+            accept: 'application/json',
+            timeoutMs: 5000,
+        });
+        if (r.error) {
+            results.push(`${alias}: ${r.error}`);
+            anyFailed = true;
+            continue;
+        }
+        if (r.status < 200 || r.status >= 300) {
+            results.push(`${alias}: HTTP ${r.status} from /zcspeach/discovery`);
+            anyFailed = true;
+            continue;
+        }
+        let body;
+        try {
+            body = JSON.parse(r.body);
+        }
+        catch {
+            results.push(`${alias}: invalid JSON from /zcspeach/discovery`);
+            anyFailed = true;
+            continue;
+        }
+        if (body.status !== 'ok') {
+            results.push(`${alias}: discovery returned status=${body.status ?? '<missing>'}`);
+            anyFailed = true;
+            continue;
+        }
+        const ver = body.data?.version ?? '<missing>';
+        const ops = body.data?.operations?.length ?? 0;
+        results.push(`${alias}: v${ver}, ${ops} ops`);
+    }
+    return {
+        name: 'zcspeach',
+        ok: !anyFailed,
+        message: results.join('; '),
+        hint: anyFailed
+            ? 'SICF node /sap/bc/zcspeach must be active; ensure SAP_BASIS supports the framework'
+            : undefined,
+    };
+}