@gavdi/cap-mcp 1.5.0 → 1.6.0

package/README.md

@@ -29,7 +29,7 @@ By integrating MCP with your CAP applications, you unlock:
 
 - **Node.js**: Version 18 or higher
 - **SAP CAP**: Version 9 or higher
-- **Express**: Version 4 or higher
+- **Express**: Version 5 or higher
 - **TypeScript**: Optional but recommended
 
 ### Step 1: Install the Plugin

package/lib/auth/utils.js

@@ -282,124 +282,134 @@ function registerOAuthEndpoints(expressApp, credentials, kind) {
             registration_endpoint_auth_methods_supported: ["client_secret_basic"],
         });
     });
+    // BUG: This element has been commented out as a part of a hotfix for authorization flows.
+    // It should not be included again until further investigation has been done, but a patch will have to be released to remedy this.
+    // This is likely related to the fact that most MCP clients do not include application/json as their preferred response time when authenticating,
+    // causing issues when targeting SAP's XSUAA service, that will default to HTML.
+    //
     // RFC 9728: OAuth 2.0 Protected Resource Metadata endpoint
-    expressApp.get("/.well-known/oauth-protected-resource", (req, res) => {
-        const baseUrl = (0, host_resolver_1.buildPublicBaseUrl)(req);
-        res.json({
-            resource: baseUrl,
-            authorization_servers: [credentials.url],
-            bearer_methods_supported: ["header"],
-            resource_documentation: `${baseUrl}/mcp/health`,
-        });
-    });
+    // expressApp.get(
+    //   "/.well-known/oauth-protected-resource",
+    //   (req: Request, res: Response): void => {
+    //     const baseUrl = buildPublicBaseUrl(req);
+    //
+    //     res.json({
+    //       resource: baseUrl,
+    //       authorization_servers: [credentials.url],
+    //       bearer_methods_supported: ["header"],
+    //       resource_documentation: `${baseUrl}/mcp/health`,
+    //     });
+    //   },
+    // );
     // OAuth Dynamic Client Registration discovery endpoint (GET)
     expressApp.get("/oauth/register", async (req, res) => {
         const baseUrl = (0, host_resolver_1.buildPublicBaseUrl)(req);
+        // XSUAA does not support DCR so we will respond with the pre-configured client_id
         // IAS does not support DCR so we will respond with the pre-configured client_id
-        if (kind === "ias") {
-            const enhancedResponse = {
-                client_id: credentials.clientid, // Add our CAP app's client ID
-                redirect_uris: req.body.redirect_uris || [
-                    `${baseUrl}/oauth/callback`,
-                ],
-            };
-            logger_1.LOGGER.debug("Provided static client_id during DCR registration process");
-            res.json(enhancedResponse);
-            return;
-        }
+        // if (kind === "ias") {
+        const enhancedResponse = {
+            client_id: credentials.clientid, // Add our CAP app's client ID
+            redirect_uris: req.body.redirect_uris || [`${baseUrl}/oauth/callback`],
+        };
+        logger_1.LOGGER.debug("Provided static client_id during DCR registration process");
+        res.json(enhancedResponse);
+        return;
+        // }
         // Keep original implementation for XSUAA
-        try {
-            // Simple proxy for discovery - no CSRF needed
-            const response = await fetch(`${credentials.url}/oauth/register`, {
-                method: "GET",
-                headers: {
-                    Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
-                    Accept: "application/json",
-                },
-            });
-            const xsuaaData = await response.json();
-            // Add missing required fields that MCP client expects
-            const enhancedResponse = {
-                ...xsuaaData, // Keep all XSUAA fields
-                client_id: credentials.clientid, // Add our CAP app's client ID
-                redirect_uris: [`${baseUrl}/oauth/callback`], // Add our callback URL for discovery
-            };
-            res.status(response.status).json(enhancedResponse);
-        }
-        catch (error) {
-            logger_1.LOGGER.error("OAuth registration discovery error:", error);
-            res.status(500).json({
-                error: "server_error",
-                error_description: error instanceof Error ? error.message : "Unknown error",
-            });
-        }
+        // try {
+        //   // Simple proxy for discovery - no CSRF needed
+        //   const response = await fetch(`${credentials.url}/oauth/register`, {
+        //     method: "GET",
+        //     headers: {
+        //       Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
+        //       Accept: "application/json",
+        //     },
+        //   });
+        //   const xsuaaData = await response.json();
+        //   // Add missing required fields that MCP client expects
+        //   const enhancedResponse = {
+        //     ...xsuaaData, // Keep all XSUAA fields
+        //     client_id: credentials.clientid, // Add our CAP app's client ID
+        //     redirect_uris: [`${baseUrl}/oauth/callback`], // Add our callback URL for discovery
+        //   };
+        //   res.status(response.status).json(enhancedResponse);
+        // } catch (error) {
+        //   LOGGER.error("OAuth registration discovery error:", error);
+        //   res.status(500).json({
+        //     error: "server_error",
+        //     error_description:
+        //       error instanceof Error ? error.message : "Unknown error",
+        //   });
+        // }
     });
     // OAuth Dynamic Client Registration endpoint (POST) with CSRF handling
     expressApp.post("/oauth/register", async (req, res) => {
         const baseUrl = (0, host_resolver_1.buildPublicBaseUrl)(req);
+        // XSUAA does not support DCR so we will respond with the pre-configured client_id
         // IAS does not support DCR so we will respond with the pre-configured client_id
-        if (kind === "ias") {
-            const enhancedResponse = {
-                client_id: credentials.clientid, // Add our CAP app's client ID
-                redirect_uris: req.body.redirect_uris || [
-                    `${baseUrl}/oauth/callback`,
-                ],
-            };
-            logger_1.LOGGER.debug("Provided static client_id during DCR registration process");
-            res.json(enhancedResponse);
-            return;
-        }
+        // if (kind === "ias") {
+        const enhancedResponse = {
+            client_id: credentials.clientid, // Add our CAP app's client ID
+            redirect_uris: req.body.redirect_uris || [`${baseUrl}/oauth/callback`],
+        };
+        logger_1.LOGGER.debug("Provided static client_id during DCR registration process");
+        res.json(enhancedResponse);
+        return;
+        // }
         // Keep original implementation for XSUAA
-        try {
-            // Step 1: Fetch CSRF token from XSUAA
-            const csrfResponse = await fetch(`${credentials.url}/oauth/register`, {
-                method: "GET",
-                headers: {
-                    "X-CSRF-Token": "Fetch",
-                    Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
-                    Accept: "application/json",
-                },
-            });
-            if (!csrfResponse.ok) {
-                throw new Error(`CSRF fetch failed: ${csrfResponse.status}`);
-            }
-            // Step 2: Extract CSRF token and session cookie
-            const setCookieHeader = csrfResponse.headers.get("set-cookie") || "";
-            const csrfToken = extractCsrfFromCookie(setCookieHeader);
-            if (!csrfToken) {
-                throw new Error("Could not extract CSRF token from XSUAA response");
-            }
-            // Step 3: Make actual registration POST with CSRF token
-            const registrationResponse = await fetch(`${credentials.url}/oauth/register`, {
-                method: "POST",
-                headers: {
-                    "Content-Type": "application/json",
-                    "X-CSRF-Token": csrfToken,
-                    Cookie: setCookieHeader,
-                    Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
-                    Accept: "application/json",
-                },
-                body: JSON.stringify(req.body),
-            });
-            const xsuaaData = await registrationResponse.json();
-            // Add missing required fields that MCP client expects
-            const enhancedResponse = {
-                ...xsuaaData, // Keep all XSUAA fields
-                client_id: credentials.clientid, // Add our CAP app's client ID
-                redirect_uris: req.body.redirect_uris || [
-                    `${baseUrl}/oauth/callback`,
-                ],
-            };
-            logger_1.LOGGER.debug("[AUTH] Register POST response", enhancedResponse);
-            res.status(registrationResponse.status).json(enhancedResponse);
-        }
-        catch (error) {
-            logger_1.LOGGER.error("OAuth registration error:", error);
-            res.status(500).json({
-                error: "server_error",
-                error_description: error instanceof Error ? error.message : "Unknown error",
-            });
-        }
+        // try {
+        // Step 1: Fetch CSRF token from XSUAA
+        // const csrfResponse = await fetch(`${credentials.url}/oauth/register`, {
+        //   method: "GET",
+        //   headers: {
+        //     "X-CSRF-Token": "Fetch",
+        //     Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
+        //     Accept: "application/json",
+        //   },
+        // });
+        // if (!csrfResponse.ok) {
+        //   throw new Error(`CSRF fetch failed: ${csrfResponse.status}`);
+        // }
+        // Step 2: Extract CSRF token and session cookie
+        // const setCookieHeader = csrfResponse.headers.get("set-cookie") || "";
+        // const csrfToken = extractCsrfFromCookie(setCookieHeader);
+        // if (!csrfToken) {
+        //   throw new Error("Could not extract CSRF token from XSUAA response");
+        // }
+        // Step 3: Make actual registration POST with CSRF token
+        // const registrationResponse = await fetch(
+        //   `${credentials.url}/oauth/register`,
+        //   {
+        //     method: "POST",
+        //     headers: {
+        //       "Content-Type": "application/json",
+        //       "X-CSRF-Token": csrfToken,
+        //       Cookie: setCookieHeader,
+        //       Authorization: `Basic ${Buffer.from(`${credentials.clientid}:${credentials.clientsecret}`).toString("base64")}`,
+        //       Accept: "application/json",
+        //     },
+        //     body: JSON.stringify(req.body),
+        //   },
+        // );
+        // const xsuaaData = await registrationResponse.json();
+        // Add missing required fields that MCP client expects
+        //   const enhancedResponse = {
+        //     ...xsuaaData, // Keep all XSUAA fields
+        //     client_id: credentials.clientid, // Add our CAP app's client ID
+        //     redirect_uris: req.body.redirect_uris || [
+        //       `${baseUrl}/oauth/callback`,
+        //     ],
+        //   };
+        //   LOGGER.debug("[AUTH] Register POST response", enhancedResponse);
+        //   res.status(registrationResponse.status).json(enhancedResponse);
+        // } catch (error) {
+        //   LOGGER.error("OAuth registration error:", error);
+        //   res.status(500).json({
+        //     error: "server_error",
+        //     error_description:
+        //       error instanceof Error ? error.message : "Unknown error",
+        //   });
+        // }
     });
     logger_1.LOGGER.debug("OAuth endpoints registered for XSUAA integration");
 }

package/lib/mcp/utils.js

@@ -195,14 +195,14 @@ function buildDeepInsertZodType(targetEntityName) {
 async function handleMcpSessionRequest(req, res, sessions) {
     const sessionIdHeader = req.headers[constants_1.MCP_SESSION_HEADER];
     if (!sessionIdHeader || !sessions.has(sessionIdHeader)) {
-        res.status(400).send("Invalid or missing session ID");
+        res.status(404).json({
+            jsonrpc: "2.0",
+            error: { code: -32001, message: "Session not found" },
+            id: null,
+        });
         return;
     }
     const session = sessions.get(sessionIdHeader);
-    if (!session) {
-        res.status(400).send("Invalid session");
-        return;
-    }
     await session.transport.handleRequest(req, res);
 }
 /**

package/lib/mcp.js

@@ -104,13 +104,13 @@ class McpPlugin {
             const sessionIdHeader = req.headers[constants_1.MCP_SESSION_HEADER];
             const sessions = this.sessionManager.getSessions();
             if (!sessionIdHeader || !sessions.has(sessionIdHeader)) {
-                return res.status(400).json({
+                return res.status(404).json({
                     jsonrpc: "2.0",
                     error: {
-                        code: -32000,
-                        message: "Bad Request: No valid sessions ID provided",
-                        id: null,
+                        code: -32001,
+                        message: "Session not found",
                     },
+                    id: null,
                 });
             }
             const session = sessions.get(sessionIdHeader);
@@ -139,13 +139,13 @@ class McpPlugin {
                 : this.sessionManager.getSession(sessionIdHeader);
             if (!session) {
                 logger_1.LOGGER.error("Invalid session ID", sessionIdHeader);
-                res.status(400).json({
+                res.status(404).json({
                     jsonrpc: "2.0",
                     error: {
-                        code: -32000,
-                        message: "Bad Request: No valid sessions ID provided",
-                        id: null,
+                        code: -32001,
+                        message: "Session not found",
                     },
+                    id: null,
                 });
                 return;
             }
@@ -163,8 +163,8 @@ class McpPlugin {
                     error: {
                         code: -32603,
                         message: "Internal Error: Transport failed",
-                        id: null,
                     },
+                    id: null,
                 });
                 return;
             }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@gavdi/cap-mcp",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "MCP Plugin for CAP",
   "keywords": [
     "MCP",
@@ -44,7 +44,7 @@
   },
   "peerDependencies": {
     "@sap/cds": ">=9",
-    "express": "^4"
+    "express": "^5"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.23.0",
@@ -60,7 +60,7 @@
     "@types/cors": "^2.8.19",
     "@types/express": "^5.0.3",
     "@types/jest": "^30.0.0",
-    "@types/node": "^24.0.3",
+    "@types/node": "^25.3.0",
     "@types/sinon": "^17.0.4",
     "@types/supertest": "^6.0.2",
     "docsify-cli": "^4.4.4",