@linkup-ai/abap-ai 0.1.0 → 0.2.0

package/dist/abap/security-agent/README.md

@@ -0,0 +1,30 @@
+# ABAP Security Agent — Objetos SAP
+
+Objetos ABAP que compõem o ABAP Security Agent do LKPABAP.ia.
+Instalados no SAP do cliente via `abap-ai init` ou manualmente.
+
+## Objetos
+
+| Objeto | Tipo | Descrição | Plano |
+|--------|------|-----------|-------|
+| `ZLKP_AI_CONFIG` | Tabela | Configuração por ambiente (SM30) | Enterprise+ |
+| `ZLKP_AI_AUDIT` | Tabela | Audit log de operações (SE16N) | Enterprise+ |
+| `ZCX_LKP_AI_DENIED` | Classe | Exception para tool bloqueada | Enterprise+ |
+| `ZCL_LKP_AI_GUARD` | Classe | Lógica de validação e audit | Enterprise+ |
+| `ZCL_LKP_AI_ICF_HANDLER` | Classe | Handler HTTP REST (SICF) | Corporate |
+| `ZLKP_AUTH` | Auth Object | Autorização PFCG | Corporate |
+
+## Ordem de instalação
+
+1. `ZLKP_AI_CONFIG` (tabela)
+2. `ZLKP_AI_AUDIT` (tabela)
+3. `ZCX_LKP_AI_DENIED` (exception — depende de nada)
+4. `ZCL_LKP_AI_GUARD` (depende das tabelas + exception)
+5. `ZCL_LKP_AI_ICF_HANDLER` (depende do guard — só Corporate)
+6. `ZLKP_AUTH` (auth object — só Corporate, criado via SU21)
+
+## Integração por plano
+
+- **Pro:** MCP server lê `ZLKP_AI_CONFIG` e insere em `ZLKP_AI_AUDIT` via SQL Console
+- **Enterprise:** MCP server chama `ZCL_LKP_AI_GUARD` via ADT (leitura de policy + escrita de audit)
+- **Corporate:** MCP server chama `/sap/z/lkpai/guard/check` (ICF handler com AUTHORITY-CHECK)

package/dist/abap/security-agent/zcl_lkp_ai_guard.clas.abap

@@ -0,0 +1,282 @@
+CLASS zcl_lkp_ai_guard DEFINITION
+  PUBLIC
+  FINAL
+  CREATE PRIVATE.
+
+  PUBLIC SECTION.
+    CLASS-METHODS get_instance
+      RETURNING VALUE(ro_inst) TYPE REF TO zcl_lkp_ai_guard.
+
+    "! Verifica se a tool é permitida no ambiente atual.
+    "! @parameter iv_tool_name | Nome da tool MCP (ex: abap_delete)
+    "! @parameter iv_uname     | Usuário SAP (default: sy-uname)
+    "! @parameter rv_allowed   | abap_true se permitido
+    "! @raising zcx_lkp_ai_denied | Se a tool é bloqueada
+    METHODS check_permission
+      IMPORTING
+        iv_tool_name      TYPE string
+        iv_uname          TYPE uname DEFAULT sy-uname
+      RETURNING
+        VALUE(rv_allowed) TYPE abap_bool
+      RAISING
+        zcx_lkp_ai_denied.
+
+    "! Grava uma entrada no audit log (tabela ZLKP_AI_AUDIT).
+    "! @parameter iv_tool_name | Nome da tool MCP
+    "! @parameter iv_obj_type  | Tipo do objeto ABAP (ex: PROG, CLAS)
+    "! @parameter iv_obj_name  | Nome do objeto
+    "! @parameter iv_status    | ALLOWED, DENIED ou ERROR
+    "! @parameter iv_message   | Motivo do deny ou descrição do erro
+    METHODS write_audit
+      IMPORTING
+        iv_tool_name TYPE string
+        iv_obj_type  TYPE string OPTIONAL
+        iv_obj_name  TYPE string OPTIONAL
+        iv_status    TYPE string
+        iv_message   TYPE string OPTIONAL.
+
+    "! Retorna a policy do ambiente atual como JSON (para o MCP server ler).
+    "! @parameter rv_json | JSON com a policy completa
+    METHODS get_policy_json
+      RETURNING VALUE(rv_json) TYPE string.
+
+  PROTECTED SECTION.
+  PRIVATE SECTION.
+    CLASS-DATA go_instance TYPE REF TO zcl_lkp_ai_guard.
+
+    DATA mv_env_role     TYPE char12.
+    DATA mv_current_tool TYPE char50.
+
+    METHODS load_env_role.
+
+    METHODS check_authority
+      IMPORTING iv_operation   TYPE char12
+      RETURNING VALUE(rv_ok)   TYPE abap_bool.
+ENDCLASS.
+
+CLASS zcl_lkp_ai_guard IMPLEMENTATION.
+
+  METHOD get_instance.
+    IF go_instance IS NOT BOUND.
+      go_instance = NEW #( ).
+      go_instance->load_env_role( ).
+    ENDIF.
+    ro_inst = go_instance.
+  ENDMETHOD.
+
+  METHOD load_env_role.
+    " Determinar o papel do ambiente baseado no client role
+    " T000-CCCATEGORY: C = Customizing, P = Production, T = Test, S = SAP Reference
+    DATA lv_category TYPE t000-cccategory.
+
+    SELECT SINGLE cccategory FROM t000
+      INTO @lv_category
+      WHERE mandt = @sy-mandt.
+
+    CASE lv_category.
+      WHEN 'C'.
+        mv_env_role = 'DEVELOPMENT'.
+      WHEN 'T'.
+        mv_env_role = 'QUALITY'.
+      WHEN 'P'.
+        mv_env_role = 'PRODUCTION'.
+      WHEN OTHERS.
+        " SAP reference ou desconhecido — tratar como DEV
+        mv_env_role = 'DEVELOPMENT'.
+    ENDCASE.
+
+    " Override: se existe entrada na config com env_role explícito, usa ela
+    SELECT SINGLE env_role FROM zlkp_ai_config
+      INTO @DATA(lv_override)
+      WHERE env_role <> @space
+        AND tool_name = '*'
+        AND user_group = '*'.
+    IF sy-subrc = 0 AND lv_override IS NOT INITIAL.
+      mv_env_role = lv_override.
+    ENDIF.
+  ENDMETHOD.
+
+  METHOD check_permission.
+    " 1. Verificar na tabela de configuração
+    "    Prioridade de lookup:
+    "    a) env_role + user (match exato por usuário)
+    "    b) env_role + user_group (match por grupo SU01)
+    "    c) env_role + '*' (wildcard — todos os usuários)
+    DATA lv_allowed TYPE abap_bool.
+    DATA lv_user_group TYPE zlkp_ai_config-user_group.
+
+    " Determinar user_group do usuário (campo CLASS em SU01)
+    SELECT SINGLE class FROM usr02
+      INTO @DATA(lv_usr_class)
+      WHERE bname = @iv_uname.
+    IF sy-subrc <> 0.
+      lv_usr_class = ''.
+    ENDIF.
+
+    " Lookup com prioridade: usuário > grupo > wildcard
+    DATA lv_found TYPE abap_bool VALUE abap_false.
+
+    " a) Match por usuário individual
+    SELECT SINGLE allowed FROM zlkp_ai_config
+      INTO @lv_allowed
+      WHERE env_role   = @mv_env_role
+        AND user_group = @iv_uname
+        AND tool_name  = @iv_tool_name.
+    IF sy-subrc = 0.
+      lv_found = abap_true.
+    ENDIF.
+
+    " b) Match por grupo de usuário (SU01 CLASS)
+    IF lv_found = abap_false AND lv_usr_class IS NOT INITIAL.
+      SELECT SINGLE allowed FROM zlkp_ai_config
+        INTO @lv_allowed
+        WHERE env_role   = @mv_env_role
+          AND user_group = @lv_usr_class
+          AND tool_name  = @iv_tool_name.
+      IF sy-subrc = 0.
+        lv_found = abap_true.
+      ENDIF.
+    ENDIF.
+
+    " c) Match por wildcard '*' (todos os usuários)
+    IF lv_found = abap_false.
+      SELECT SINGLE allowed FROM zlkp_ai_config
+        INTO @lv_allowed
+        WHERE env_role   = @mv_env_role
+          AND user_group = '*'
+          AND tool_name  = @iv_tool_name.
+      IF sy-subrc = 0.
+        lv_found = abap_true.
+      ENDIF.
+    ENDIF.
+
+    " d) Fallback: wildcard de tool '*' para o grupo/user
+    IF lv_found = abap_false.
+      SELECT SINGLE allowed FROM zlkp_ai_config
+        INTO @lv_allowed
+        WHERE env_role   = @mv_env_role
+          AND user_group = '*'
+          AND tool_name  = '*'.
+      IF sy-subrc = 0.
+        lv_found = abap_true.
+      ENDIF.
+    ENDIF.
+
+    " Avaliar resultado
+    IF lv_found = abap_true AND lv_allowed = abap_false.
+      write_audit(
+        iv_tool_name = iv_tool_name
+        iv_status    = 'DENIED'
+        iv_message   = |Tool { iv_tool_name } bloqueada em { mv_env_role } para { iv_uname }| ).
+
+      RAISE EXCEPTION TYPE zcx_lkp_ai_denied
+        EXPORTING
+          iv_tool = iv_tool_name
+          iv_env  = CONV string( mv_env_role ).
+    ENDIF.
+
+    " 2. Verificar autorização SAP (se objeto ZLKP_AUTH existe)
+    DATA lv_operation TYPE char12.
+
+    " Mapear tool → operação
+    IF iv_tool_name CP 'abap_create*' OR iv_tool_name = 'abap_scaffold_rap'.
+      lv_operation = 'CREATE'.
+    ELSEIF iv_tool_name = 'abap_delete'.
+      lv_operation = 'DELETE'.
+    ELSEIF iv_tool_name CP 'abap_write*' OR iv_tool_name = 'abap_activate'
+        OR iv_tool_name CP 'abap_refactor*' OR iv_tool_name = 'abap_extract_method'.
+      lv_operation = 'WRITE'.
+    ELSE.
+      lv_operation = 'READ'.
+    ENDIF.
+
+    mv_current_tool = iv_tool_name.
+    IF check_authority( lv_operation ) = abap_false.
+      write_audit(
+        iv_tool_name = iv_tool_name
+        iv_status    = 'DENIED'
+        iv_message   = |Sem autorização ZLKP_AUTH para { lv_operation }/{ iv_tool_name }| ).
+
+      RAISE EXCEPTION TYPE zcx_lkp_ai_denied
+        EXPORTING
+          iv_tool = iv_tool_name
+          iv_env  = CONV string( mv_env_role ).
+    ENDIF.
+
+    rv_allowed = abap_true.
+  ENDMETHOD.
+
+  METHOD check_authority.
+    " Mapear operação → ACTVT padrão SAP
+    DATA lv_actvt TYPE activ_auth.
+    CASE iv_operation.
+      WHEN 'READ'.   lv_actvt = '03'.
+      WHEN 'WRITE'.  lv_actvt = '02'.
+      WHEN 'CREATE'. lv_actvt = '01'.
+      WHEN 'DELETE'. lv_actvt = '06'.
+      WHEN OTHERS.   lv_actvt = '03'.
+    ENDCASE.
+
+    AUTHORITY-CHECK OBJECT 'ZLKP_AUTH'
+      ID 'ACTVT'    FIELD lv_actvt
+      ID 'LKPAI_OP' FIELD iv_operation
+      ID 'LKPAI_TL' FIELD mv_current_tool.
+
+    rv_ok = COND #( WHEN sy-subrc = 0 THEN abap_true ELSE abap_false ).
+  ENDMETHOD.
+
+  METHOD write_audit.
+    DATA ls_audit TYPE zlkp_ai_audit.
+
+    ls_audit-mandt      = sy-mandt.
+
+    TRY.
+        ls_audit-log_guid = cl_system_uuid=>create_uuid_x16_static( ).
+      CATCH cx_uuid_error.
+        " Fallback: timestamp como ID
+        GET TIME STAMP FIELD DATA(lv_ts).
+        ls_audit-log_guid = lv_ts.
+    ENDTRY.
+
+    GET TIME STAMP FIELD ls_audit-timestamp.
+    ls_audit-sy_uname   = sy-uname.
+    ls_audit-tool_name  = iv_tool_name.
+    ls_audit-obj_type   = iv_obj_type.
+    ls_audit-obj_name   = iv_obj_name.
+    ls_audit-status     = iv_status.
+    ls_audit-message    = iv_message.
+
+    INSERT zlkp_ai_audit FROM ls_audit.
+    IF sy-subrc <> 0.
+      " Audit silencioso — não deve quebrar operações
+    ENDIF.
+    COMMIT WORK.
+  ENDMETHOD.
+
+  METHOD get_policy_json.
+    " Monta JSON com toda a policy do ambiente atual
+    DATA lt_config TYPE STANDARD TABLE OF zlkp_ai_config.
+
+    SELECT * FROM zlkp_ai_config
+      INTO TABLE @lt_config
+      WHERE env_role = @mv_env_role.
+
+    " Montar JSON manualmente (sem dependência de /UI2/CL_JSON)
+    DATA(lv_json) = |\{"env_role":"{ mv_env_role }","tools":[\n|.
+    DATA lv_first TYPE abap_bool VALUE abap_true.
+
+    LOOP AT lt_config INTO DATA(ls_cfg).
+      IF lv_first = abap_false.
+        lv_json = lv_json && |,\n|.
+      ENDIF.
+      lv_json = lv_json && |\{"tool":"{ ls_cfg-tool_name }","allowed":{ COND #(
+        WHEN ls_cfg-allowed = abap_true THEN 'true' ELSE 'false'
+      ) },"max_rows":{ ls_cfg-max_rows }\}|.
+      lv_first = abap_false.
+    ENDLOOP.
+
+    lv_json = lv_json && |]\}|.
+    rv_json = lv_json.
+  ENDMETHOD.
+
+ENDCLASS.

package/dist/abap/security-agent/zcl_lkp_ai_icf_handler.clas.abap

@@ -0,0 +1,275 @@
+CLASS zcl_lkp_ai_icf_handler DEFINITION
+  PUBLIC
+  FINAL
+  CREATE PUBLIC.
+
+  PUBLIC SECTION.
+    INTERFACES if_http_extension.
+
+  PROTECTED SECTION.
+  PRIVATE SECTION.
+    METHODS handle_check
+      IMPORTING io_request  TYPE REF TO if_http_request
+                io_response TYPE REF TO if_http_response.
+
+    METHODS handle_policy
+      IMPORTING io_request  TYPE REF TO if_http_request
+                io_response TYPE REF TO if_http_response.
+
+    METHODS handle_exec
+      IMPORTING io_request  TYPE REF TO if_http_request
+                io_response TYPE REF TO if_http_response.
+
+    METHODS handle_audit
+      IMPORTING io_request  TYPE REF TO if_http_request
+                io_response TYPE REF TO if_http_response.
+
+    METHODS set_json_response
+      IMPORTING io_response TYPE REF TO if_http_response
+                iv_status   TYPE i
+                iv_json     TYPE string.
+
+    METHODS extract_json_field
+      IMPORTING iv_json        TYPE string
+                iv_field       TYPE string
+      RETURNING VALUE(rv_value) TYPE string.
+ENDCLASS.
+
+CLASS zcl_lkp_ai_icf_handler IMPLEMENTATION.
+
+  METHOD if_http_extension~handle_request.
+    DATA(lv_path) = server->request->get_header_field( '~path_info' ).
+    DATA(lv_method) = server->request->get_method( ).
+
+    CASE lv_path.
+      WHEN '/check'.
+        IF lv_method = 'POST'.
+          handle_check( io_request = server->request io_response = server->response ).
+        ELSE.
+          set_json_response( io_response = server->response iv_status = 405
+            iv_json = '{"error":"Method not allowed. Use POST."}' ).
+        ENDIF.
+
+      WHEN '/policy'.
+        IF lv_method = 'GET'.
+          handle_policy( io_request = server->request io_response = server->response ).
+        ELSE.
+          set_json_response( io_response = server->response iv_status = 405
+            iv_json = '{"error":"Method not allowed. Use GET."}' ).
+        ENDIF.
+
+      WHEN '/exec'.
+        IF lv_method = 'POST'.
+          handle_exec( io_request = server->request io_response = server->response ).
+        ELSE.
+          set_json_response( io_response = server->response iv_status = 405
+            iv_json = '{"error":"Method not allowed. Use POST."}' ).
+        ENDIF.
+
+      WHEN '/audit'.
+        IF lv_method = 'POST'.
+          handle_audit( io_request = server->request io_response = server->response ).
+        ELSE.
+          set_json_response( io_response = server->response iv_status = 405
+            iv_json = '{"error":"Method not allowed. Use POST."}' ).
+        ENDIF.
+
+      WHEN OTHERS.
+        set_json_response( io_response = server->response iv_status = 404
+          iv_json = '{"error":"Endpoints: /check (POST), /policy (GET), /exec (POST), /audit (POST)"}' ).
+    ENDCASE.
+  ENDMETHOD.
+
+  METHOD handle_check.
+    DATA(lv_body) = io_request->get_cdata( ).
+
+    DATA(lv_tool) = extract_json_field( iv_json = lv_body iv_field = 'tool' ).
+    DATA(lv_obj_type) = extract_json_field( iv_json = lv_body iv_field = 'obj_type' ).
+    DATA(lv_obj_name) = extract_json_field( iv_json = lv_body iv_field = 'obj_name' ).
+
+    IF lv_tool IS INITIAL.
+      set_json_response( io_response = io_response iv_status = 400
+        iv_json = '{"error":"Campo tool é obrigatório."}' ).
+      RETURN.
+    ENDIF.
+
+    DATA(lo_guard) = zcl_lkp_ai_guard=>get_instance( ).
+
+    TRY.
+        lo_guard->check_permission( iv_tool_name = lv_tool ).
+
+        lo_guard->write_audit(
+          iv_tool_name = lv_tool
+          iv_obj_type  = lv_obj_type
+          iv_obj_name  = lv_obj_name
+          iv_status    = 'ALLOWED' ).
+
+        DATA(lv_policy_json) = lo_guard->get_policy_json( ).
+        set_json_response( io_response = io_response iv_status = 200
+          iv_json = |\{"allowed":true,"policy":{ lv_policy_json }\}| ).
+
+      CATCH zcx_lkp_ai_denied INTO DATA(lx_denied).
+        set_json_response( io_response = io_response iv_status = 403
+          iv_json = |\{"allowed":false,"reason":"Tool { lv_tool } bloqueada em { lx_denied->mv_env }"\}| ).
+    ENDTRY.
+  ENDMETHOD.
+
+  METHOD handle_policy.
+    DATA(lo_guard) = zcl_lkp_ai_guard=>get_instance( ).
+    DATA(lv_json) = lo_guard->get_policy_json( ).
+    set_json_response( io_response = io_response iv_status = 200 iv_json = lv_json ).
+  ENDMETHOD.
+
+  METHOD handle_exec.
+    "! Executa um programa ABAP e retorna o output (list).
+    "! POST /exec { "program": "ZLKP_AI_SETUP", "variant": "" }
+    "!
+    "! Segurança: verifica autorização S_PROGRAM antes de executar.
+    "! Usa SUBMIT ... EXPORTING LIST TO MEMORY para capturar output.
+    DATA(lv_body) = io_request->get_cdata( ).
+    DATA lv_program TYPE syrepid.
+    DATA lv_variant TYPE variant.
+    lv_program = extract_json_field( iv_json = lv_body iv_field = 'program' ).
+    lv_variant = extract_json_field( iv_json = lv_body iv_field = 'variant' ).
+
+    IF lv_program IS INITIAL.
+      set_json_response( io_response = io_response iv_status = 400
+        iv_json = '{"error":"Campo program é obrigatório."}' ).
+      RETURN.
+    ENDIF.
+
+    " Normalizar
+    TRANSLATE lv_program TO UPPER CASE.
+
+    " Segurança: só permitir programas Z* ou Y* (namespace cliente)
+    IF lv_program(1) <> 'Z' AND lv_program(1) <> 'Y'.
+      set_json_response( io_response = io_response iv_status = 403
+        iv_json = |\{"error":"Apenas programas Z* ou Y* podem ser executados via LKPABAP.ia."\}| ).
+      RETURN.
+    ENDIF.
+
+    " Verificar se programa existe
+    SELECT SINGLE name FROM trdir INTO @DATA(lv_exists) WHERE name = @lv_program.
+    IF sy-subrc <> 0.
+      set_json_response( io_response = io_response iv_status = 404
+        iv_json = |\{"error":"Programa { lv_program } não encontrado."\}| ).
+      RETURN.
+    ENDIF.
+
+    " Verificar autorização S_PROGRAM
+    AUTHORITY-CHECK OBJECT 'S_PROGRAM'
+      ID 'P_GROUP' DUMMY
+      ID 'P_ACTION' FIELD 'SUBMIT'.
+    IF sy-subrc <> 0.
+      set_json_response( io_response = io_response iv_status = 403
+        iv_json = '{"error":"Sem autorização S_PROGRAM para executar programas."}' ).
+      RETURN.
+    ENDIF.
+
+    " Executar com captura de output
+    DATA lt_list TYPE TABLE OF abaplist.
+    DATA lv_output TYPE string.
+
+    TRY.
+        IF lv_variant IS NOT INITIAL.
+          SUBMIT (lv_program) USING SELECTION-SET lv_variant
+            EXPORTING LIST TO MEMORY AND RETURN.
+        ELSE.
+          SUBMIT (lv_program)
+            EXPORTING LIST TO MEMORY AND RETURN.
+        ENDIF.
+
+        " Ler output da memória
+        CALL FUNCTION 'LIST_FROM_MEMORY'
+          TABLES
+            listobject = lt_list
+          EXCEPTIONS
+            not_found  = 1
+            OTHERS     = 2.
+
+        IF sy-subrc = 0 AND lt_list IS NOT INITIAL.
+          " Converter list para texto
+          DATA lt_text TYPE TABLE OF char255.
+          CALL FUNCTION 'LIST_TO_ASCI'
+            TABLES
+              listasci           = lt_text
+              listobject         = lt_list
+            EXCEPTIONS
+              empty_list         = 1
+              list_index_invalid = 2
+              OTHERS             = 3.
+
+          LOOP AT lt_text INTO DATA(lv_line).
+            lv_output = lv_output && lv_line && cl_abap_char_utilities=>newline.
+          ENDLOOP.
+        ENDIF.
+
+        IF lv_output IS INITIAL.
+          lv_output = '(programa executado sem output)'.
+        ENDIF.
+
+        " Gravar no audit
+        DATA(lo_guard) = zcl_lkp_ai_guard=>get_instance( ).
+        lo_guard->write_audit(
+          iv_tool_name = 'abap_execute'
+          iv_obj_type  = 'PROG'
+          iv_obj_name  = CONV string( lv_program )
+          iv_status    = 'ALLOWED' ).
+
+        " Escapar aspas duplas no output para JSON
+        REPLACE ALL OCCURRENCES OF '"' IN lv_output WITH '\"'.
+        REPLACE ALL OCCURRENCES OF cl_abap_char_utilities=>newline IN lv_output WITH '\n'.
+
+        set_json_response( io_response = io_response iv_status = 200
+          iv_json = |\{"success":true,"program":"{ lv_program }","output":"{ lv_output }"\}| ).
+
+      CATCH cx_root INTO DATA(lx_error).
+        set_json_response( io_response = io_response iv_status = 500
+          iv_json = |\{"error":"Erro ao executar { lv_program }: { lx_error->get_text( ) }"\}| ).
+    ENDTRY.
+  ENDMETHOD.
+
+  METHOD handle_audit.
+    "! Grava uma entrada de audit diretamente.
+    "! POST /audit { "tool":"abap_read", "obj_type":"PROG", "obj_name":"ZTEST", "status":"ALLOWED" }
+    DATA(lv_body) = io_request->get_cdata( ).
+
+    DATA(lv_tool)    = extract_json_field( iv_json = lv_body iv_field = 'tool' ).
+    DATA(lv_type)    = extract_json_field( iv_json = lv_body iv_field = 'obj_type' ).
+    DATA(lv_name)    = extract_json_field( iv_json = lv_body iv_field = 'obj_name' ).
+    DATA(lv_status)  = extract_json_field( iv_json = lv_body iv_field = 'status' ).
+    DATA(lv_message) = extract_json_field( iv_json = lv_body iv_field = 'message' ).
+
+    IF lv_tool IS INITIAL OR lv_status IS INITIAL.
+      set_json_response( io_response = io_response iv_status = 400
+        iv_json = '{"error":"Campos tool e status são obrigatórios."}' ).
+      RETURN.
+    ENDIF.
+
+    DATA(lo_guard) = zcl_lkp_ai_guard=>get_instance( ).
+    lo_guard->write_audit(
+      iv_tool_name = lv_tool
+      iv_obj_type  = lv_type
+      iv_obj_name  = lv_name
+      iv_status    = lv_status
+      iv_message   = lv_message ).
+
+    set_json_response( io_response = io_response iv_status = 200
+      iv_json = '{"success":true}' ).
+  ENDMETHOD.
+
+  METHOD set_json_response.
+    io_response->set_status( code = iv_status reason = '' ).
+    io_response->set_header_field( name = 'Content-Type' value = 'application/json; charset=utf-8' ).
+    io_response->set_cdata( iv_json ).
+  ENDMETHOD.
+
+  METHOD extract_json_field.
+    DATA(lv_pattern) = |"{ iv_field }":"([^"]*)"|.
+    FIND REGEX lv_pattern IN iv_json SUBMATCHES rv_value.
+    IF sy-subrc <> 0.
+      CLEAR rv_value.
+    ENDIF.
+  ENDMETHOD.
+
+ENDCLASS.

package/dist/abap/security-agent/zcx_lkp_ai_denied.clas.abap

@@ -0,0 +1,50 @@
+CLASS zcx_lkp_ai_denied DEFINITION
+  PUBLIC
+  INHERITING FROM cx_static_check
+  FINAL
+  CREATE PUBLIC.
+
+  PUBLIC SECTION.
+    INTERFACES if_t100_message.
+
+    CONSTANTS:
+      BEGIN OF tool_blocked,
+        msgid TYPE symsgid VALUE 'ZLKP_AI',
+        msgno TYPE symsgno VALUE '001',
+        attr1 TYPE scx_attrname VALUE 'MV_TOOL',
+        attr2 TYPE scx_attrname VALUE 'MV_ENV',
+        attr3 TYPE scx_attrname VALUE '',
+        attr4 TYPE scx_attrname VALUE '',
+      END OF tool_blocked.
+
+    DATA mv_tool TYPE string READ-ONLY.
+    DATA mv_env  TYPE string READ-ONLY.
+
+    METHODS constructor
+      IMPORTING
+        textid   LIKE if_t100_message=>t100key OPTIONAL
+        previous LIKE previous OPTIONAL
+        iv_tool  TYPE string OPTIONAL
+        iv_env   TYPE string OPTIONAL.
+
+  PROTECTED SECTION.
+  PRIVATE SECTION.
+ENDCLASS.
+
+CLASS zcx_lkp_ai_denied IMPLEMENTATION.
+  METHOD constructor.
+    CALL METHOD super->constructor
+      EXPORTING
+        previous = previous.
+
+    mv_tool = iv_tool.
+    mv_env  = iv_env.
+
+    CLEAR me->textid.
+    IF textid IS INITIAL.
+      if_t100_message~t100key = tool_blocked.
+    ELSE.
+      if_t100_message~t100key = textid.
+    ENDIF.
+  ENDMETHOD.
+ENDCLASS.

package/dist/abap/security-agent/zlkp_ai_audit.tabl.asdic

@@ -0,0 +1,19 @@
+@EndUserText.label : 'LKPABAP.ia: Audit Log de Operações'
+@AbapCatalog.enhancement.category : #NOT_EXTENSIBLE
+@AbapCatalog.tableCategory : #TRANSPARENT
+@AbapCatalog.deliveryClass : #L
+@AbapCatalog.dataMaintenance : #RESTRICTED
+define table zlkp_ai_audit {
+
+  key mandt     : mandt not null;
+  key log_guid  : sysuuid_x16 not null;
+  timestamp     : timestampl;
+  sy_uname      : syuname;
+  tool_name     : abap.char(50);
+  obj_type      : abap.char(10);
+  obj_name      : abap.char(120);
+  risk_level    : abap.char(12);
+  status        : abap.char(10);
+  message       : abap.char(255);
+
+}

package/dist/abap/security-agent/zlkp_ai_config.tabl.asdic

@@ -0,0 +1,21 @@
+@EndUserText.label : 'LKPABAP.ia: Configuração por ambiente'
+@AbapCatalog.enhancement.category : #NOT_EXTENSIBLE
+@AbapCatalog.tableCategory : #TRANSPARENT
+@AbapCatalog.deliveryClass : #C
+@AbapCatalog.dataMaintenance : #ALLOWED
+define table zlkp_ai_config {
+
+  key mandt      : mandt not null;
+  key env_role   : abap.char(12) not null;
+  key user_group : abap.char(30) not null;
+  key tool_name  : abap.char(50) not null;
+  allowed        : abap_boolean;
+  max_rows       : abap.int4;
+  changed_by     : syuname;
+  changed_at     : timestampl;
+
+  // user_group: '*' = todos os usuários (default)
+  //             'CHARM_USERS' = grupo específico (mapeado via SU01 user group)
+  //             'DANDRADE' = usuário individual
+
+}