@mcp-abap-adt/connection 4.0.0 → 6.0.0

package/dist/connection/AdtCloudConnector.d.ts

@@ -0,0 +1,34 @@
+/**
+ * An ABAP Cloud system.
+ *
+ * A session there is a **resource**: asked for at
+ * `/sap/bc/adt/core/http/sessions` with `x-sap-security-session: create` and
+ * `sap-adt-purpose: preflight_logon`, and given back by `DELETE` on the address
+ * the server publishes in the answer. Reproduced from Eclipse ADT 3.60 and
+ * measured against a BTP trial: without that request the same connection gets
+ * `sap-usercontext` and `sap-XSRF_*` and no session for a lock to be bound to,
+ * which is how "cloud issues no SAP_SESSIONID" came to be believed.
+ *
+ * **Taking this class is the consumer stating which system it is dialling**, and
+ * it is the only thing that states it: a communication user against ABAP Cloud
+ * gets this mechanism because the caller asked for this connector. Nothing is
+ * inferred — not from the credential, not from the host name, not from what the
+ * server answers.
+ */
+import type { IAuthProvider } from '@mcp-abap-adt/interfaces';
+import type { SapConfig } from '../config/sapConfig.js';
+import type { ILogger } from '../logger.js';
+import type { CloudHttpTransport } from './CloudHttpTransport.js';
+import { CredentialAbapConnection } from './CredentialAbapConnection.js';
+import type { ICloudTransport } from './IAdtTransport.js';
+export declare class AdtCloudConnector<TCredential extends IAuthProvider = IAuthProvider, 
+/**
+ * Constrained to the cloud wire, so "cloud over RFC" does not compile.
+ * There is no such deployment, and a connector that accepted the transport
+ * would be offering a combination that cannot exist.
+ */
+TTransport extends ICloudTransport = CloudHttpTransport> extends CredentialAbapConnection<TCredential> {
+    readonly transport: TTransport;
+    constructor(config: SapConfig, credential: TCredential, transport: TTransport, logger?: ILogger | null, sessionId?: string);
+}
+//# sourceMappingURL=AdtCloudConnector.d.ts.map

package/dist/connection/AdtCloudConnector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdtCloudConnector.d.ts","sourceRoot":"","sources":["../../src/connection/AdtCloudConnector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAE1D,qBAAa,iBAAiB,CAC5B,WAAW,SAAS,aAAa,GAAG,aAAa;AACjD;;;;GAIG;AACH,UAAU,SAAS,eAAe,GAAG,kBAAkB,CACvD,SAAQ,wBAAwB,CAAC,WAAW,CAAC;IAC7C,SAAiB,SAAS,EAAE,UAAU,CAAC;gBAGrC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,WAAW,EACvB,SAAS,EAAE,UAAU,EACrB,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM;CAIrB"}

package/dist/connection/AdtCloudConnector.js

@@ -0,0 +1,27 @@
+"use strict";
+/**
+ * An ABAP Cloud system.
+ *
+ * A session there is a **resource**: asked for at
+ * `/sap/bc/adt/core/http/sessions` with `x-sap-security-session: create` and
+ * `sap-adt-purpose: preflight_logon`, and given back by `DELETE` on the address
+ * the server publishes in the answer. Reproduced from Eclipse ADT 3.60 and
+ * measured against a BTP trial: without that request the same connection gets
+ * `sap-usercontext` and `sap-XSRF_*` and no session for a lock to be bound to,
+ * which is how "cloud issues no SAP_SESSIONID" came to be believed.
+ *
+ * **Taking this class is the consumer stating which system it is dialling**, and
+ * it is the only thing that states it: a communication user against ABAP Cloud
+ * gets this mechanism because the caller asked for this connector. Nothing is
+ * inferred — not from the credential, not from the host name, not from what the
+ * server answers.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdtCloudConnector = void 0;
+const CredentialAbapConnection_js_1 = require("./CredentialAbapConnection.js");
+class AdtCloudConnector extends CredentialAbapConnection_js_1.CredentialAbapConnection {
+    constructor(config, credential, transport, logger = null, sessionId) {
+        super(config, credential, transport, logger, sessionId);
+    }
+}
+exports.AdtCloudConnector = AdtCloudConnector;

package/dist/connection/AdtOnPremConnector.d.ts

@@ -0,0 +1,43 @@
+/**
+ * An on-prem ABAP system.
+ *
+ * The session arrives with the establishing call — the logon *is* that call —
+ * and the platform's `/sap/public/bc/icf/logoff` is how it is given back. That
+ * is what on-prem has always used here, and it does not change.
+ *
+ * **Taking this class is the consumer stating which system it is dialling.**
+ * Nothing is probed and nothing is inferred: `/sap/bc/adt/core/http/sessions` answers on on-prem too —
+ * measured on S/4HANA, publishing both the session resource and the ICF logoff
+ * in one document — so asking the server tells you an endpoint exists, not
+ * which kind of system you reached.
+ *
+ * The credential is passed in and decides none of this. A bearer token against
+ * an on-prem system is ordinary, and it gets this mechanism because the caller
+ * asked for this connector — not because of what is in the header, and not
+ * because anything worked out where it was pointing.
+ */
+import type { IAuthProvider } from '@mcp-abap-adt/interfaces';
+import type { SapConfig } from '../config/sapConfig.js';
+import type { ILogger } from '../logger.js';
+import { CredentialAbapConnection } from './CredentialAbapConnection.js';
+import type { IOnPremTransport } from './IAdtTransport.js';
+import type { OnPremHttpTransport } from './OnPremHttpTransport.js';
+export declare class AdtOnPremConnector<TCredential extends IAuthProvider = IAuthProvider, 
+/**
+ * The two wires an on-prem system actually offers. Said by the caller: the
+ * same ADT call travels over HTTP, or over RFC on a system where stateful
+ * HTTP sessions are not usable.
+ */
+TTransport extends IOnPremTransport = OnPremHttpTransport> extends CredentialAbapConnection<TCredential> {
+    /**
+     * The transport this was built with, in the type.
+     *
+     * `declare` because the base already assigns it — this only narrows what the
+     * caller gets back, which is the whole point of the parameter: a signature
+     * can ask for `AdtOnPremConnector<IAuthProvider, RfcTransport>` instead of
+     * taking any connection and casting.
+     */
+    readonly transport: TTransport;
+    constructor(config: SapConfig, credential: TCredential, transport: TTransport, logger?: ILogger | null, sessionId?: string);
+}
+//# sourceMappingURL=AdtOnPremConnector.d.ts.map

package/dist/connection/AdtOnPremConnector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdtOnPremConnector.d.ts","sourceRoot":"","sources":["../../src/connection/AdtOnPremConnector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,qBAAa,kBAAkB,CAC7B,WAAW,SAAS,aAAa,GAAG,aAAa;AACjD;;;;GAIG;AACH,UAAU,SAAS,gBAAgB,GAAG,mBAAmB,CACzD,SAAQ,wBAAwB,CAAC,WAAW,CAAC;IAC7C;;;;;;;OAOG;IACH,SAAiB,SAAS,EAAE,UAAU,CAAC;gBAGrC,MAAM,EAAE,SAAS,EACjB,UAAU,EAAE,WAAW,EACvB,SAAS,EAAE,UAAU,EACrB,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM;CAIrB"}

package/dist/connection/AdtOnPremConnector.js

@@ -0,0 +1,28 @@
+"use strict";
+/**
+ * An on-prem ABAP system.
+ *
+ * The session arrives with the establishing call — the logon *is* that call —
+ * and the platform's `/sap/public/bc/icf/logoff` is how it is given back. That
+ * is what on-prem has always used here, and it does not change.
+ *
+ * **Taking this class is the consumer stating which system it is dialling.**
+ * Nothing is probed and nothing is inferred: `/sap/bc/adt/core/http/sessions` answers on on-prem too —
+ * measured on S/4HANA, publishing both the session resource and the ICF logoff
+ * in one document — so asking the server tells you an endpoint exists, not
+ * which kind of system you reached.
+ *
+ * The credential is passed in and decides none of this. A bearer token against
+ * an on-prem system is ordinary, and it gets this mechanism because the caller
+ * asked for this connector — not because of what is in the header, and not
+ * because anything worked out where it was pointing.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdtOnPremConnector = void 0;
+const CredentialAbapConnection_js_1 = require("./CredentialAbapConnection.js");
+class AdtOnPremConnector extends CredentialAbapConnection_js_1.CredentialAbapConnection {
+    constructor(config, credential, transport, logger = null, sessionId) {
+        super(config, credential, transport, logger, sessionId);
+    }
+}
+exports.AdtOnPremConnector = AdtOnPremConnector;

package/dist/connection/CloudHttpTransport.d.ts

@@ -0,0 +1,37 @@
+/**
+ * ABAP Cloud over HTTP: the wire where a session is a resource with an address.
+ *
+ * Asked for at `/sap/bc/adt/core/http/sessions` with `x-sap-security-session:
+ * create` and `sap-adt-purpose: preflight_logon`, and given back by `DELETE` on
+ * the address the server publishes in the answer. Reproduced from Eclipse ADT
+ * 3.60 and measured against a BTP trial: without that request the same
+ * connection gets `sap-usercontext` and `sap-XSRF_*` and no session for a lock
+ * to be bound to, which is how "cloud issues no SAP_SESSIONID" came to be
+ * believed.
+ *
+ * **Taking this transport is the consumer saying which system it is dialling.**
+ * Nothing here asks the server what it is. The strategy this replaces treated a
+ * 404 on the session resource as "then this must be on-prem" and quietly fell
+ * back to the platform logoff — an inference, and the only one left in this
+ * layer. A consumer that reaches an on-prem system with this transport has
+ * taken the wrong one, and finds out rather than being silently downgraded.
+ */
+import { HttpTransport } from './HttpTransport.js';
+import type { IAdtSessionContext, ICloudTransport } from './IAdtTransport.js';
+export declare class CloudHttpTransport extends HttpTransport implements ICloudTransport {
+    readonly kind = "cloud-http";
+    /** Which system this wire is for. Read by the compiler, never at runtime. */
+    readonly system: "cloud";
+    /** The address this server published for our session — the only close target. */
+    private resource;
+    open(context: IAdtSessionContext): Promise<void>;
+    close(context: IAdtSessionContext): Promise<void>;
+    /**
+     * The `securitysession` link's href, by its `rel` rather than by position.
+     *
+     * The document carries three links — the session, the logoff resource and
+     * system information — and their order is not a contract.
+     */
+    private securitySessionHref;
+}
+//# sourceMappingURL=CloudHttpTransport.d.ts.map

package/dist/connection/CloudHttpTransport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CloudHttpTransport.d.ts","sourceRoot":"","sources":["../../src/connection/CloudHttpTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AAa9E,qBAAa,kBACX,SAAQ,aACR,YAAW,eAAe;IAE1B,SAAkB,IAAI,gBAAgB;IAEtC,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAG,OAAO,CAAU;IAEnC,iFAAiF;IACjF,OAAO,CAAC,QAAQ,CAAuB;IAExB,IAAI,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqDhD,KAAK,CAAC,OAAO,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA4ChE;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;CAW5B"}

package/dist/connection/CloudHttpTransport.js

@@ -0,0 +1,145 @@
+"use strict";
+/**
+ * ABAP Cloud over HTTP: the wire where a session is a resource with an address.
+ *
+ * Asked for at `/sap/bc/adt/core/http/sessions` with `x-sap-security-session:
+ * create` and `sap-adt-purpose: preflight_logon`, and given back by `DELETE` on
+ * the address the server publishes in the answer. Reproduced from Eclipse ADT
+ * 3.60 and measured against a BTP trial: without that request the same
+ * connection gets `sap-usercontext` and `sap-XSRF_*` and no session for a lock
+ * to be bound to, which is how "cloud issues no SAP_SESSIONID" came to be
+ * believed.
+ *
+ * **Taking this transport is the consumer saying which system it is dialling.**
+ * Nothing here asks the server what it is. The strategy this replaces treated a
+ * 404 on the session resource as "then this must be on-prem" and quietly fell
+ * back to the platform logoff — an inference, and the only one left in this
+ * layer. A consumer that reaches an on-prem system with this transport has
+ * taken the wrong one, and finds out rather than being silently downgraded.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CloudHttpTransport = void 0;
+const cookies_js_1 = require("../utils/cookies.js");
+const timeouts_js_1 = require("../utils/timeouts.js");
+const HttpTransport_js_1 = require("./HttpTransport.js");
+const SESSIONS_PATH = '/sap/bc/adt/core/http/sessions';
+/** The versioned media types Eclipse asks this resource for, newest first. */
+const SESSION_ACCEPT = 'application/vnd.sap.adt.core.http.session.v3+xml, ' +
+    'application/vnd.sap.adt.core.http.session.v2+xml, ' +
+    'application/vnd.sap.adt.core.http.session.v1+xml';
+const SECURITY_SESSION_REL = 'http://www.sap.com/adt/categories/core/http/sessions/securitysession';
+class CloudHttpTransport extends HttpTransport_js_1.HttpTransport {
+    kind = 'cloud-http';
+    /** Which system this wire is for. Read by the compiler, never at runtime. */
+    system = 'cloud';
+    /** The address this server published for our session — the only close target. */
+    resource = null;
+    async open(context) {
+        try {
+            // Read ONCE. The contract lets a provider answer differently each time —
+            // a token provider renews behind the call — so two reads can build one
+            // request out of two different credentials.
+            const auth = await context.authHeaders();
+            const response = await this.send({
+                method: 'GET',
+                // The cache-buster is Eclipse's; kept because this must not be served
+                // from anything's cache — a cached session document would hand back an
+                // address that belongs to a session somebody else already ended.
+                url: `${context.baseUrl}${SESSIONS_PATH}?_=${Date.now()}`,
+                // Bounded: connect() waits for this one.
+                timeout: (0, timeouts_js_1.getTimeout)('csrf'),
+                headers: {
+                    ...auth,
+                    ...context.extraHeaders,
+                    Accept: SESSION_ACCEPT,
+                    Cookie: (0, cookies_js_1.mergeCookieHeaders)(auth.Cookie, this.cookies() ?? undefined),
+                    'sap-adt-purpose': 'preflight_logon',
+                    'x-sap-security-session': 'create',
+                },
+            });
+            // Its SAP_SESSIONID is the session, so the answer is folded in before
+            // anything is read out of it.
+            context.observe(response.headers);
+            this.ingest(response.headers);
+            const resource = this.securitySessionHref(response.data);
+            if (!resource) {
+                // Answered, but published no session of its own — so there is no
+                // address to give one back by. Said out loud rather than worked
+                // around: the establishment that follows reports what a connection
+                // without a session means, and this is the fact it will be reporting.
+                this.logger?.debug(`Session resource answered ${response.status} but published no securitysession link`);
+                return;
+            }
+            this.resource = resource;
+            this.logger?.debug(`Security session opened: ${resource}`);
+        }
+        catch (error) {
+            // Not fatal here. If no session was opened, the establishment that
+            // follows says so with the whole picture; an error raised from a
+            // preflight would replace that with something less useful.
+            this.logger?.debug(`Could not open a security session: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    async close(context) {
+        const resource = this.resource;
+        this.resource = null;
+        // Read SYNCHRONOUSLY, before the first await. A close is dispatched
+        // without being awaited, so the teardown's `forgetSession()` runs while
+        // this is suspended — and a goodbye assembled afterwards would carry no
+        // cookie, which is the one thing that proves the session is ours to end.
+        const cookies = this.cookies();
+        const csrf = this.csrfToken();
+        // Snapshotted for the same reason: the DELETE must reach the server holding
+        // this session, not whichever one the wire is pinned to when it goes out.
+        const affinity = this.affinityHeaders();
+        if (!resource || !cookies) {
+            // No address to send it to, or no cookie to prove the session is ours —
+            // holding the cookie is the whole permission to end one.
+            return;
+        }
+        try {
+            const auth = await context.authHeaders();
+            await this.sendDetached({
+                method: 'DELETE',
+                url: new URL(resource, context.baseUrl).toString(),
+                headers: {
+                    ...affinity,
+                    ...auth,
+                    ...context.extraHeaders,
+                    Cookie: (0, cookies_js_1.mergeCookieHeaders)(auth.Cookie, cookies),
+                    'x-sap-security-session': 'use',
+                    // A state change, so the server wants the token. Without one the
+                    // request is refused with 403 — which is still just a message the
+                    // server did not accept, and still not something to raise from a
+                    // teardown.
+                    ...(csrf ? { 'x-csrf-token': csrf } : {}),
+                },
+            });
+            this.logger?.debug('Told the server the security session is finished');
+        }
+        catch (error) {
+            this.logger?.debug(`Could not tell the server the session is finished: ${error instanceof Error ? error.message : String(error)}`);
+        }
+    }
+    /**
+     * The `securitysession` link's href, by its `rel` rather than by position.
+     *
+     * The document carries three links — the session, the logoff resource and
+     * system information — and their order is not a contract.
+     */
+    securitySessionHref(body) {
+        if (typeof body !== 'string')
+            return undefined;
+        for (const link of body.matchAll(/<[^>]*link\b([^>]*)>/g)) {
+            const attrs = link[1];
+            const rel = attrs.match(/\brel="([^"]*)"/)?.[1];
+            if (rel !== SECURITY_SESSION_REL)
+                continue;
+            const href = attrs.match(/\bhref="([^"]*)"/)?.[1];
+            if (href)
+                return href;
+        }
+        return undefined;
+    }
+}
+exports.CloudHttpTransport = CloudHttpTransport;

package/dist/connection/CredentialAbapConnection.d.ts

@@ -0,0 +1,55 @@
+/**
+ * A connection whose authentication is passed in.
+ *
+ * The shared half of the two platform connectors, and the reason the split is
+ * possible at all: `establishSession()` was measured to be the same work in
+ * every one of the five auth classes — fetch a CSRF token from
+ * `/sap/bc/adt/discovery`, keep it, tolerate a failure — with the only
+ * per-credential part being a step before it. That step is `prepare()`.
+ *
+ * So this owns the establishing call, and the credential contributes three
+ * things at most: what to prepare, what header to send, and what TLS material
+ * to present. Which system this is talking to was stated by the caller when it
+ * chose the subclass, and is never worked out here.
+ */
+import type { AgentOptions } from 'node:https';
+import type { IAuthProvider } from '@mcp-abap-adt/interfaces';
+import type { SapConfig } from '../config/sapConfig.js';
+import type { ILogger } from '../logger.js';
+import { AbstractAbapConnection } from './AbstractAbapConnection.js';
+import { type IAdtTransport } from './IAdtTransport.js';
+export declare abstract class CredentialAbapConnection<TCredential extends IAuthProvider = IAuthProvider> extends AbstractAbapConnection {
+    /** Public because the type is the point: a caller can reach what it gave. */
+    readonly credential: TCredential;
+    constructor(config: SapConfig, 
+    /** Public because the type is the point: a caller can reach what it gave. */
+    credential: TCredential, transport: IAdtTransport, logger?: ILogger | null, sessionId?: string);
+    /**
+     * Whatever the credential needs before the first request goes out.
+     *
+     * Runs before the preflight, not inside the establishing call: building the
+     * transport reads the TLS options, and a certificate whose material had not
+     * been loaded yet rejected the connect while the argument was still being
+     * evaluated — outside every catch, with no request sent.
+     */
+    /** The header last put on the wire, so a change can be seen. */
+    protected prepareCredential(): Promise<void>;
+    /**
+     * Nothing here: the header is asked for asynchronously in `getAuthHeaders()`,
+     * because a provider can renew behind the call and a synchronous read would
+     * have to hold what it returned. The base's abstract member is satisfied and
+     * unused.
+     */
+    protected buildAuthorizationHeader(): string;
+    /**
+     * The credential's cookies travel with its header.
+     *
+     * On every path, not only on ordinary requests: a SAML session that is not
+     * presented to the session preflight and the establishing call is a session
+     * the server never sees us in.
+     */
+    getAuthHeaders(): Promise<Record<string, string>>;
+    protected getHttpsAgentOptions(): AgentOptions;
+    protected establishSession(): Promise<void>;
+}
+//# sourceMappingURL=CredentialAbapConnection.d.ts.map

package/dist/connection/CredentialAbapConnection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CredentialAbapConnection.d.ts","sourceRoot":"","sources":["../../src/connection/CredentialAbapConnection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAGV,aAAa,EACd,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,6BAA6B,CAAC;AACrE,OAAO,EAAE,KAAK,aAAa,EAAa,MAAM,oBAAoB,CAAC;AASnE,8BAAsB,wBAAwB,CAC5C,WAAW,SAAS,aAAa,GAAG,aAAa,CACjD,SAAQ,sBAAsB;IAG5B,6EAA6E;IAC7E,QAAQ,CAAC,UAAU,EAAE,WAAW;gBAFhC,MAAM,EAAE,SAAS;IACjB,6EAA6E;IACpE,UAAU,EAAE,WAAW,EAChC,SAAS,EAAE,aAAa,EACxB,MAAM,GAAE,OAAO,GAAG,IAAW,EAC7B,SAAS,CAAC,EAAE,MAAM;IAKpB;;;;;;;OAOG;IACH,gEAAgE;cAEvC,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC;IAI3D;;;;;OAKG;IACH,SAAS,CAAC,wBAAwB,IAAI,MAAM;IAI5C;;;;;;OAMG;IACY,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;cAiB7C,oBAAoB,IAAI,YAAY;cAIvC,gBAAgB,IAAI,OAAO,CAAC,IAAI,CAAC;CAoDlD"}

package/dist/connection/CredentialAbapConnection.js

@@ -0,0 +1,128 @@
+"use strict";
+/**
+ * A connection whose authentication is passed in.
+ *
+ * The shared half of the two platform connectors, and the reason the split is
+ * possible at all: `establishSession()` was measured to be the same work in
+ * every one of the five auth classes — fetch a CSRF token from
+ * `/sap/bc/adt/discovery`, keep it, tolerate a failure — with the only
+ * per-credential part being a step before it. That step is `prepare()`.
+ *
+ * So this owns the establishing call, and the credential contributes three
+ * things at most: what to prepare, what header to send, and what TLS material
+ * to present. Which system this is talking to was stated by the caller when it
+ * chose the subclass, and is never worked out here.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CredentialAbapConnection = void 0;
+const AbstractAbapConnection_js_1 = require("./AbstractAbapConnection.js");
+const IAdtTransport_js_1 = require("./IAdtTransport.js");
+/** A 401 from the server, whatever transport shape it arrives in. */
+function isUnauthorized(error) {
+    const status = error?.response
+        ?.status;
+    return status === 401;
+}
+class CredentialAbapConnection extends AbstractAbapConnection_js_1.AbstractAbapConnection {
+    credential;
+    constructor(config, 
+    /** Public because the type is the point: a caller can reach what it gave. */
+    credential, transport, logger = null, sessionId) {
+        super(config, transport, logger, sessionId);
+        this.credential = credential;
+    }
+    /**
+     * Whatever the credential needs before the first request goes out.
+     *
+     * Runs before the preflight, not inside the establishing call: building the
+     * transport reads the TLS options, and a certificate whose material had not
+     * been loaded yet rejected the connect while the argument was still being
+     * evaluated — outside every catch, with no request sent.
+     */
+    /** The header last put on the wire, so a change can be seen. */
+    async prepareCredential() {
+        await this.credential.prepare();
+    }
+    /**
+     * Nothing here: the header is asked for asynchronously in `getAuthHeaders()`,
+     * because a provider can renew behind the call and a synchronous read would
+     * have to hold what it returned. The base's abstract member is satisfied and
+     * unused.
+     */
+    buildAuthorizationHeader() {
+        return '';
+    }
+    /**
+     * The credential's cookies travel with its header.
+     *
+     * On every path, not only on ordinary requests: a SAML session that is not
+     * presented to the session preflight and the establishing call is a session
+     * the server never sees us in.
+     */
+    async getAuthHeaders() {
+        const headers = await super.getAuthHeaders();
+        // Asked per request, never held: a provider renews behind this call, and a
+        // value kept here would be the stale one.
+        const authorization = await this.credential.authorizationHeader();
+        if (authorization) {
+            headers.Authorization = authorization;
+        }
+        const cookies = this.credential.cookies();
+        if (cookies) {
+            headers.Cookie = cookies;
+        }
+        return headers;
+    }
+    getHttpsAgentOptions() {
+        return this.credential.transportMaterial();
+    }
+    async establishSession() {
+        try {
+            // The wire establishes itself, always. What that means is the wire's:
+            // HTTP earns a CSRF token and the cookies that name the session; an RFC
+            // conversation was opened before this and already IS the session, so it
+            // does nothing and holds no token. Demanding one here was what made
+            // `connect()` impossible over RFC.
+            //
+            // There is no second path. A credential that wanted to run the exchange
+            // itself would need the connection to ask which of the two does the work,
+            // and a credential whose way in IS a round trip does not need that: the
+            // wire asks `authHeaders()` PER ATTEMPT, so a one-shot token is offered
+            // on the establishing call and withheld afterwards by the credential
+            // itself, with nobody deciding anything.
+            await this.transport.establish({
+                baseUrl: await this.getBaseUrl(),
+                authHeaders: () => this.getAuthHeaders(),
+                extraHeaders: { 'sap-adt-connection-id': this.getSessionId() ?? '' },
+                observe: (headers) => this.observeResponse(headers),
+                isFatal: (error) => this.isSessionVerdict(error),
+            });
+            this.logger?.debug('Connected', {
+                credential: this.credential.kind,
+                hasCsrfToken: !!this.getCsrfToken(),
+                hasCookies: !!this.getCookies(),
+            });
+        }
+        catch (error) {
+            this.logger?.warn(`Could not establish (${this.credential.kind}): ${error instanceof Error ? error.message : String(error)}`);
+            // A rejecting response can still carry the cookies that matter; the wire
+            // folds them in as it establishes, so nothing is read out of the error
+            // here beyond saying whether any arrived.
+            if ((0, IAdtTransport_js_1.refusalOf)(error)?.headers) {
+                this.logger?.debug(`Cookies after a failed establishment: ${this.getCookies() ? 'present' : 'none'}`);
+            }
+            // Rethrow: a resolved connect() must mean a usable session exists.
+            //
+            // This warned and resolved, on the reasoning that "the first request will
+            // retry" — true while establishment could happen lazily, and left behind
+            // when connect() became mandatory. Swallowing now leaves a connection
+            // that reports success and holds nothing; worse, it skips the debris
+            // clearing in establishAndCommit()'s catch, so the Set-Cookie that came
+            // with the 401 survives as the session identity. A cookie is proof to
+            // every credential that auth is settled, so the NEXT connect() goes out
+            // with no credentials at all and fails for an unrelated reason.
+            throw error;
+        }
+    }
+}
+exports.CredentialAbapConnection = CredentialAbapConnection;