@mcp-abap-adt/header-validator 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,27 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.0] - 2025-11-30
+
+### Added
+- **Header validation** - Validates authentication headers for MCP ABAP ADT servers
+- **Priority system** - Automatically prioritizes authentication methods:
+  - Destination-based authentication (highest priority)
+  - Direct JWT authentication (medium priority)
+  - Basic authentication (lowest priority)
+- **Error reporting** - Detailed error messages for invalid configurations
+- **Warning system** - Warnings for conflicting or ignored headers
+- **TypeScript support** - Full TypeScript definitions and type safety
+- **Unit tests** - Comprehensive test suite with mocks (34 tests)
+- **Documentation** - Complete README with examples and API reference
+
+### Technical Details
+- **Dependencies**: None (zero dependencies)
+- **Node.js version**: >= 18.0.0
+- **Module system**: CommonJS
+- **Build output**: TypeScript compiled to JavaScript with type definitions
+

package/LICENSE

@@ -0,0 +1,22 @@
+MIT License
+
+Copyright (c) 2025 Oleksii Kyslytsia
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+

package/README.md

@@ -0,0 +1,473 @@
+# @mcp-abap-adt/header-validator
+
+Header validator for MCP ABAP ADT - validates and prioritizes authentication headers.
+
+## Features
+
+- ✅ **Header Validation**: Validates authentication headers for MCP ABAP ADT servers
+- ✅ **Priority System**: Automatically prioritizes authentication methods
+- ✅ **Error Reporting**: Detailed error messages and warnings
+- ✅ **Type Safety**: Full TypeScript support with type definitions
+
+## Installation
+
+```bash
+npm install @mcp-abap-adt/header-validator
+```
+
+## Usage
+
+```typescript
+import { validateAuthHeaders } from '@mcp-abap-adt/header-validator';
+import { IncomingHttpHeaders } from 'http';
+
+const headers: IncomingHttpHeaders = {
+  'x-sap-url': 'https://test.sap.com',
+  'x-mcp-destination': 'TRIAL',
+  // Note: x-sap-auth-type not needed - always uses JWT
+};
+
+const result = validateAuthHeaders(headers);
+
+if (result.isValid && result.config) {
+  console.log('Auth method:', result.config.priority);
+  console.log('Destination:', result.config.destination);
+} else {
+  console.error('Validation errors:', result.errors);
+}
+```
+
+## Authentication Methods and Priorities
+
+The validator supports four authentication methods, ordered by priority (highest to lowest):
+
+### 1. SAP Destination-Based Authentication (Highest Priority)
+
+**Priority**: `AuthMethodPriority.SAP_DESTINATION` (4)
+
+**Required Headers**:
+- `x-sap-url` - SAP system URL
+- `x-sap-destination` - Destination name (e.g., "S4HANA_E19")
+
+**Optional Headers**:
+- `x-sap-client` - SAP client number
+- `x-sap-login` / `x-sap-password` - Username/password (edge cases)
+
+**Description**: Simplest configuration - uses AuthBroker to manage tokens. Always uses JWT authentication. No `x-sap-auth-type` header needed.
+
+**Example**:
+```typescript
+const headers = {
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-destination': 'S4HANA_E19',
+};
+```
+
+**Notes**:
+- Does NOT require `x-sap-auth-type` (always JWT)
+- If `x-sap-auth-type` is provided, it will be ignored (warning issued)
+- If `x-sap-jwt-token` is also provided, it will be ignored (warning issued)
+- Requires AuthBroker to be initialized in the server
+- Automatically handles token refresh and validation
+
+### 2. MCP Destination-Based Authentication
+
+**Priority**: `AuthMethodPriority.MCP_DESTINATION` (3)
+
+**Required Headers**:
+- `x-sap-url` - SAP system URL
+- `x-mcp-destination` - Destination name (e.g., "TRIAL", "PRODUCTION")
+
+**Optional Headers**:
+- `x-sap-client` - SAP client number
+
+**Description**: Uses AuthBroker to manage tokens based on destination. Tokens are loaded from `{destination}.env` files, validated, and automatically refreshed when needed. Always uses JWT authentication.
+
+**Example**:
+```typescript
+const headers = {
+  'x-sap-url': 'https://test.sap.com',
+  'x-mcp-destination': 'TRIAL',
+  // Note: x-sap-auth-type not needed - always uses JWT
+};
+```
+
+**Notes**:
+- Does NOT require `x-sap-auth-type` (always JWT)
+- If `x-sap-auth-type` is provided, it will be ignored (warning issued)
+- If `x-sap-jwt-token` is also provided, it will be ignored (warning issued)
+- Requires AuthBroker to be initialized in the server
+- Automatically handles token refresh and validation
+
+### 3. Direct JWT Authentication (Medium Priority)
+
+**Priority**: `AuthMethodPriority.DIRECT_JWT` (2)
+
+**Required Headers**:
+- `x-sap-url` - SAP system URL
+- `x-sap-auth-type` - Must be `jwt` or `xsuaa`
+- `x-sap-jwt-token` - JWT access token
+
+**Optional Headers**:
+- `x-sap-refresh-token` - Refresh token for automatic token renewal
+- `x-sap-uaa-url` / `uaa-url` - UAA URL
+- `x-sap-uaa-client-id` / `uaa-client-id` - UAA Client ID
+- `x-sap-uaa-client-secret` / `uaa-client-secret` - UAA Client Secret
+- `x-sap-client` - SAP client number
+
+**Description**: Direct JWT token authentication. Token is provided directly in headers.
+
+**Example**:
+```typescript
+const headers = {
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-auth-type': 'jwt',
+  'x-sap-jwt-token': 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...',
+  'x-sap-refresh-token': 'refresh_token_here', // optional
+};
+```
+
+**Notes**:
+- Token must be at least 10 characters long
+- Refresh token is optional but recommended for automatic token renewal
+
+### 4. Basic Authentication (Lowest Priority)
+
+**Priority**: `AuthMethodPriority.BASIC` (1)
+
+**Required Headers**:
+- `x-sap-url` - SAP system URL
+- `x-sap-auth-type` - Must be `basic`
+- `x-sap-login` - Username
+- `x-sap-password` - Password
+
+**Description**: Basic HTTP authentication with username and password.
+
+**Example**:
+```typescript
+const headers = {
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-auth-type': 'basic',
+  'x-sap-login': 'username',
+  'x-sap-password': 'password',
+};
+```
+
+**Notes**:
+- Used primarily for on-premise SAP systems
+- Credentials are sent in plain text (use HTTPS in production)
+
+## Valid Header Combinations
+
+### ✅ Valid Combinations
+
+#### 1. SAP Destination Only (Simplest - Recommended)
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-destination': 'S4HANA_E19',
+}
+// No x-sap-auth-type needed - always JWT
+```
+
+#### 2. MCP Destination Only
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-mcp-destination': 'TRIAL',
+  // Note: x-sap-auth-type not needed - always uses JWT
+}
+```
+
+#### 3. Direct JWT Only
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-auth-type': 'jwt',
+  'x-sap-jwt-token': 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...',
+  'x-sap-refresh-token': 'refresh_token', // optional
+}
+```
+
+#### 4. Basic Auth Only
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-auth-type': 'basic',
+  'x-sap-login': 'username',
+  'x-sap-password': 'password',
+}
+```
+
+#### 5. SAP Destination + Auth Type (Warning Issued)
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-destination': 'S4HANA_E19',
+  'x-sap-auth-type': 'jwt', // ignored (warning)
+}
+```
+**Result**: SAP Destination auth is used, auth-type is ignored (warning issued)
+
+#### 6. Destination + Direct JWT (Warning Issued)
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-destination': 'S4HANA_E19',
+  'x-sap-jwt-token': 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...', // ignored
+}
+```
+**Result**: SAP Destination auth is used (Priority 4), direct JWT token is ignored (warning issued)
+
+#### 7. Multiple Destinations (SAP Takes Priority)
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-destination': 'S4HANA_E19', // Priority 4
+  'x-mcp-destination': 'TRIAL',      // Priority 3 - ignored
+}
+```
+**Result**: SAP Destination auth is used, MCP destination is ignored
+
+### ❌ Invalid Combinations
+
+#### 1. Missing Required Headers
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  // Missing x-sap-auth-type
+}
+```
+**Error**: `x-sap-auth-type header is required`
+
+#### 2. Invalid Auth Type
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-auth-type': 'invalid',
+}
+```
+**Error**: `x-sap-auth-type must be one of: jwt, xsuaa, basic`
+
+#### 3. JWT Auth Without Token or Destination
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-auth-type': 'jwt',
+  // Missing x-sap-destination, x-mcp-destination, and x-sap-jwt-token
+}
+```
+**Error**: `JWT authentication requires either x-sap-destination, x-mcp-destination, or x-sap-jwt-token header`
+
+#### 4. Basic Auth Without Credentials
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-auth-type': 'basic',
+  // Missing x-sap-login and/or x-sap-password
+}
+```
+**Error**: `Basic authentication requires x-sap-login and x-sap-password headers`
+
+#### 5. Empty Values
+```typescript
+{
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-destination': '   ', // empty after trim
+}
+```
+**Error**: `x-sap-destination header is empty`
+
+#### 6. Invalid URL
+```typescript
+{
+  'x-sap-url': 'not-a-valid-url',
+  'x-sap-auth-type': 'jwt',
+  'x-sap-jwt-token': 'token',
+}
+```
+**Error**: `x-sap-url is not a valid URL`
+
+## Priority Resolution
+
+When multiple authentication methods are detected, the validator automatically selects the highest priority method:
+
+1. **SAP Destination** (Priority 4) - Always selected if `x-sap-destination` is present
+2. **MCP Destination** (Priority 3) - Selected if `x-mcp-destination` is present (always uses JWT, no `x-sap-auth-type` needed)
+3. **Direct JWT** (Priority 2) - Selected if JWT token is provided (requires `x-sap-auth-type: jwt`)
+4. **Basic** (Priority 1) - Selected only if basic auth headers are present (requires `x-sap-auth-type: basic`)
+
+### Example: Priority Resolution
+
+```typescript
+const headers = {
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-destination': 'S4HANA_E19',  // Priority 4 (selected)
+  'x-sap-auth-type': 'jwt',           // Ignored (warning)
+  'x-mcp-destination': 'TRIAL',       // Priority 3 (ignored)
+  'x-sap-jwt-token': 'token',         // Priority 2 (ignored)
+  'x-sap-login': 'user',              // Priority 1 (ignored)
+  'x-sap-password': 'pass',           // Priority 1 (ignored)
+};
+
+const result = validateAuthHeaders(headers);
+// result.config.priority === AuthMethodPriority.SAP_DESTINATION (4)
+// result.warnings includes: "x-sap-auth-type is ignored when x-sap-destination is present"
+// result.warnings includes: "x-sap-jwt-token is ignored when x-sap-destination is present"
+```
+
+## API Reference
+
+### `validateAuthHeaders(headers?: IncomingHttpHeaders): HeaderValidationResult`
+
+Validates and prioritizes authentication headers.
+
+**Parameters**:
+- `headers` - HTTP headers object (optional)
+
+**Returns**: `HeaderValidationResult` object with:
+- `isValid: boolean` - Whether the configuration is valid
+- `config?: ValidatedAuthConfig` - Validated authentication configuration (if valid)
+- `errors: string[]` - List of validation errors
+- `warnings: string[]` - List of warnings (e.g., ignored headers)
+
+### `ValidatedAuthConfig`
+
+```typescript
+interface ValidatedAuthConfig {
+  priority: AuthMethodPriority;  // Authentication method priority
+  authType: AuthType;            // 'jwt' | 'xsuaa' | 'basic'
+  sapUrl: string;                // SAP system URL
+  destination?: string;          // Destination name (for destination-based auth)
+  jwtToken?: string;             // JWT token (for direct JWT auth)
+  refreshToken?: string;         // Refresh token (optional, for JWT auth)
+  username?: string;             // Username (for basic auth)
+  password?: string;             // Password (for basic auth)
+  errors: string[];              // Validation errors
+  warnings: string[];            // Warnings
+}
+```
+
+### `AuthMethodPriority`
+
+Enumeration of authentication method priorities:
+
+```typescript
+enum AuthMethodPriority {
+  DESTINATION_BASED = 3,  // Highest priority
+  DIRECT_JWT = 2,         // Medium priority
+  BASIC = 1,              // Lowest priority
+  NONE = 0                // Invalid/No auth
+}
+```
+
+## Error Handling
+
+The validator provides detailed error messages for common issues:
+
+- Missing required headers
+- Invalid header values
+- Empty header values (after trimming whitespace)
+- Invalid URL format
+- Invalid authentication type
+- Missing authentication credentials
+
+All errors are collected in the `errors` array, and the validation result includes `isValid: false` if any errors are present.
+
+## Warnings
+
+The validator issues warnings for:
+
+- Conflicting headers (e.g., destination and direct JWT token both present)
+- Multiple authentication methods with the same priority (should not happen in practice)
+
+Warnings do not prevent validation from succeeding but indicate potential configuration issues.
+
+## Examples
+
+### Example 1: SAP Destination Auth (Simplest)
+
+```typescript
+import { validateAuthHeaders } from '@mcp-abap-adt/header-validator';
+
+const headers = {
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-destination': 'S4HANA_E19',
+};
+
+const result = validateAuthHeaders(headers);
+
+if (result.isValid && result.config) {
+  console.log('Using SAP destination-based auth');
+  console.log('Destination:', result.config.destination);
+  console.log('Priority:', result.config.priority);
+  console.log('Auth Type:', result.config.authType); // Always 'jwt'
+}
+```
+
+### Example 2: MCP Destination Auth
+
+```typescript
+const headers = {
+  'x-sap-url': 'https://test.sap.com',
+  'x-mcp-destination': 'TRIAL',
+  // Note: x-sap-auth-type not needed - always uses JWT
+};
+
+const result = validateAuthHeaders(headers);
+
+if (result.isValid && result.config) {
+  console.log('Using MCP destination-based auth');
+  console.log('Destination:', result.config.destination);
+}
+```
+
+### Example 3: Direct JWT Auth
+
+```typescript
+const headers = {
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-auth-type': 'jwt',
+  'x-sap-jwt-token': 'eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9...',
+  'x-sap-refresh-token': 'refresh_token',
+};
+
+const result = validateAuthHeaders(headers);
+
+if (result.isValid && result.config) {
+  console.log('Using direct JWT auth');
+  console.log('Token:', result.config.jwtToken);
+}
+```
+
+### Example 4: Error Handling
+
+```typescript
+const headers = {
+  'x-sap-url': 'https://test.sap.com',
+  'x-sap-auth-type': 'jwt',
+  // Missing required headers
+};
+
+const result = validateAuthHeaders(headers);
+
+if (!result.isValid) {
+  console.error('Validation failed:');
+  result.errors.forEach(error => console.error(`  - ${error}`));
+}
+```
+
+## Documentation
+
+Complete documentation is available in the [`docs/`](docs/) directory:
+
+- **[Architecture](docs/architecture/ARCHITECTURE.md)** - System architecture, priority system, and valid header combinations
+- **[Development](docs/development/DEVELOPMENT.md)** - Development guide and testing
+- **[Usage](docs/using/USAGE.md)** - API reference and usage examples
+
+See [docs/README.md](docs/README.md) for the complete documentation index.
+
+## License
+
+MIT
+

package/dist/headerValidator.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Header validator for MCP ABAP ADT authentication headers
+ *
+ * Validates and prioritizes authentication headers according to:
+ * 1. Destination-based auth (x-mcp-destination) - highest priority
+ * 2. Direct JWT token (x-sap-jwt-token) - medium priority
+ * 3. Basic auth (x-sap-login + x-sap-password) - lowest priority
+ */
+import { IncomingHttpHeaders } from 'http';
+import { HeaderValidationResult } from './types';
+/**
+ * Validate and prioritize authentication headers
+ *
+ * @param headers HTTP headers
+ * @returns Validation result with prioritized authentication configuration
+ */
+export declare function validateAuthHeaders(headers?: IncomingHttpHeaders): HeaderValidationResult;

package/dist/headerValidator.js

@@ -0,0 +1,354 @@
+"use strict";
+/**
+ * Header validator for MCP ABAP ADT authentication headers
+ *
+ * Validates and prioritizes authentication headers according to:
+ * 1. Destination-based auth (x-mcp-destination) - highest priority
+ * 2. Direct JWT token (x-sap-jwt-token) - medium priority
+ * 3. Basic auth (x-sap-login + x-sap-password) - lowest priority
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAuthHeaders = validateAuthHeaders;
+const types_1 = require("./types");
+/**
+ * Extract header value (handles array values)
+ */
+function getHeaderValue(headers, name) {
+    const value = headers[name];
+    if (!value) {
+        return undefined;
+    }
+    if (Array.isArray(value)) {
+        return value[0]?.trim();
+    }
+    return String(value).trim();
+}
+/**
+ * Validate URL format
+ */
+function isValidUrl(url) {
+    try {
+        const parsed = new URL(url);
+        return parsed.protocol === 'http:' || parsed.protocol === 'https:';
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Validate SAP destination-based authentication (highest priority)
+ * x-sap-destination - uses AuthBroker, JWT only, no auth-type needed
+ * URL is taken from destination (service key or .env), not from x-sap-url header
+ */
+function validateSapDestinationAuth(headers) {
+    const destinationRaw = headers['x-sap-destination'];
+    if (!destinationRaw) {
+        return null;
+    }
+    const destination = getHeaderValue(headers, 'x-sap-destination');
+    const errors = [];
+    const warnings = [];
+    // Validate destination name (check if empty after trim)
+    if (!destination || destination.length === 0) {
+        errors.push('x-sap-destination header is empty');
+        return {
+            priority: types_1.AuthMethodPriority.NONE,
+            authType: 'jwt', // SAP destination always uses JWT
+            sapUrl: '', // URL will be loaded from destination
+            errors,
+            warnings,
+        };
+    }
+    // Extract optional SAP client
+    const sapClient = getHeaderValue(headers, 'x-sap-client');
+    // Optional: x-sap-login and x-sap-password (for cloud systems)
+    const username = getHeaderValue(headers, 'x-sap-login');
+    const password = getHeaderValue(headers, 'x-sap-password');
+    // Warning if x-sap-url is provided (URL comes from destination, not header)
+    const sapUrl = getHeaderValue(headers, 'x-sap-url');
+    if (sapUrl) {
+        warnings.push('x-sap-url is ignored when x-sap-destination is present (URL is loaded from destination service key or .env file)');
+    }
+    // Warning if direct JWT token is also provided (destination takes priority)
+    const jwtToken = getHeaderValue(headers, 'x-sap-jwt-token');
+    if (jwtToken) {
+        warnings.push('x-sap-jwt-token is ignored when x-sap-destination is present (destination-based auth takes priority)');
+    }
+    // Warning if auth-type is provided (not needed for x-sap-destination)
+    const authType = getHeaderValue(headers, 'x-sap-auth-type');
+    if (authType) {
+        warnings.push('x-sap-auth-type is ignored when x-sap-destination is present (always uses JWT)');
+    }
+    return {
+        priority: types_1.AuthMethodPriority.SAP_DESTINATION,
+        authType: 'jwt', // Always JWT for x-sap-destination
+        sapUrl: '', // URL will be loaded from destination (service key or .env)
+        sapClient,
+        destination,
+        username,
+        password,
+        errors,
+        warnings,
+    };
+}
+/**
+ * Validate MCP destination-based authentication (medium-high priority)
+ * x-mcp-destination - uses AuthBroker, always JWT (no x-sap-auth-type needed)
+ */
+function validateMcpDestinationAuth(headers, sapUrl) {
+    const destinationRaw = headers['x-mcp-destination'];
+    if (!destinationRaw) {
+        return null;
+    }
+    const destination = getHeaderValue(headers, 'x-mcp-destination');
+    const errors = [];
+    const warnings = [];
+    // Validate destination name (check if empty after trim)
+    if (!destination || destination.length === 0) {
+        errors.push('x-mcp-destination header is empty');
+        return {
+            priority: types_1.AuthMethodPriority.NONE,
+            authType: 'jwt', // MCP destination always uses JWT
+            sapUrl,
+            errors,
+            warnings,
+        };
+    }
+    // Warning if x-sap-auth-type is provided (not needed for x-mcp-destination)
+    const authType = getHeaderValue(headers, 'x-sap-auth-type');
+    if (authType) {
+        warnings.push('x-sap-auth-type is ignored when x-mcp-destination is present (always uses JWT)');
+    }
+    // Extract optional SAP client
+    const sapClient = getHeaderValue(headers, 'x-sap-client');
+    // Warning if direct JWT token is also provided (destination takes priority)
+    const jwtToken = getHeaderValue(headers, 'x-sap-jwt-token');
+    if (jwtToken) {
+        warnings.push('x-sap-jwt-token is ignored when x-mcp-destination is present (destination-based auth takes priority)');
+    }
+    return {
+        priority: types_1.AuthMethodPriority.MCP_DESTINATION,
+        authType: 'jwt', // Always JWT for x-mcp-destination
+        sapUrl,
+        sapClient,
+        destination,
+        errors,
+        warnings,
+    };
+}
+/**
+ * Validate direct JWT authentication (medium priority)
+ */
+function validateDirectJwtAuth(headers, sapUrl, authType) {
+    if (authType !== 'jwt' && authType !== 'xsuaa') {
+        return null;
+    }
+    const jwtToken = getHeaderValue(headers, 'x-sap-jwt-token');
+    if (!jwtToken) {
+        return null;
+    }
+    const errors = [];
+    const warnings = [];
+    // Validate JWT token format (basic check - should start with eyJ)
+    if (jwtToken.length < 10) {
+        errors.push('x-sap-jwt-token appears to be invalid (too short)');
+    }
+    // Extract optional tokens and UAA config
+    const refreshToken = getHeaderValue(headers, 'x-sap-refresh-token');
+    const uaaUrl = getHeaderValue(headers, 'x-sap-uaa-url') || getHeaderValue(headers, 'uaa-url');
+    const uaaClientId = getHeaderValue(headers, 'x-sap-uaa-client-id') || getHeaderValue(headers, 'uaa-client-id');
+    const uaaClientSecret = getHeaderValue(headers, 'x-sap-uaa-client-secret') || getHeaderValue(headers, 'uaa-client-secret');
+    // Extract optional SAP client
+    const sapClient = getHeaderValue(headers, 'x-sap-client');
+    return {
+        priority: types_1.AuthMethodPriority.DIRECT_JWT,
+        authType,
+        sapUrl,
+        sapClient,
+        jwtToken,
+        refreshToken,
+        uaaUrl,
+        uaaClientId,
+        uaaClientSecret,
+        errors,
+        warnings,
+    };
+}
+/**
+ * Validate basic authentication (lowest priority)
+ */
+function validateBasicAuth(headers, sapUrl, authType) {
+    if (authType !== 'basic') {
+        return null;
+    }
+    const usernameRaw = headers['x-sap-login'];
+    const passwordRaw = headers['x-sap-password'];
+    if (!usernameRaw || !passwordRaw) {
+        return null;
+    }
+    const username = getHeaderValue(headers, 'x-sap-login');
+    const password = getHeaderValue(headers, 'x-sap-password');
+    const errors = [];
+    const warnings = [];
+    // Validate username and password (check if empty after trim)
+    if (!username || username.length === 0) {
+        errors.push('x-sap-login header is empty');
+    }
+    if (!password || password.length === 0) {
+        errors.push('x-sap-password header is empty');
+    }
+    // Return config with errors if validation failed
+    if (errors.length > 0) {
+        return {
+            priority: types_1.AuthMethodPriority.NONE,
+            authType,
+            sapUrl,
+            errors,
+            warnings,
+        };
+    }
+    return {
+        priority: types_1.AuthMethodPriority.BASIC,
+        authType,
+        sapUrl,
+        username,
+        password,
+        errors,
+        warnings,
+    };
+}
+/**
+ * Validate and prioritize authentication headers
+ *
+ * @param headers HTTP headers
+ * @returns Validation result with prioritized authentication configuration
+ */
+function validateAuthHeaders(headers) {
+    // No headers provided
+    if (!headers) {
+        return {
+            isValid: false,
+            errors: ['No headers provided'],
+            warnings: [],
+        };
+    }
+    const errors = [];
+    const warnings = [];
+    // Check for SAP destination first (doesn't require x-sap-url)
+    const sapDestinationConfig = validateSapDestinationAuth(headers);
+    if (sapDestinationConfig) {
+        // SAP destination found - URL comes from destination, not header
+        if (sapDestinationConfig.errors.length === 0) {
+            return {
+                isValid: true,
+                config: sapDestinationConfig,
+                errors: [],
+                warnings: sapDestinationConfig.warnings,
+            };
+        }
+        else {
+            // Has errors, continue to check other methods or return error
+            return {
+                isValid: false,
+                errors: sapDestinationConfig.errors,
+                warnings: sapDestinationConfig.warnings,
+            };
+        }
+    }
+    // For other auth methods, x-sap-url is required
+    const sapUrl = getHeaderValue(headers, 'x-sap-url');
+    // Validate required headers
+    if (!sapUrl) {
+        errors.push('x-sap-url header is required when x-sap-destination is not present');
+        return {
+            isValid: false,
+            errors,
+            warnings,
+        };
+    }
+    // Validate URL format
+    if (!isValidUrl(sapUrl)) {
+        errors.push(`x-sap-url is not a valid URL: ${sapUrl}`);
+        return {
+            isValid: false,
+            errors,
+            warnings,
+        };
+    }
+    // Try to validate authentication methods in priority order
+    const configs = [];
+    // 2. MCP destination-based auth (medium-high priority) - doesn't require x-sap-auth-type
+    const mcpDestinationConfig = validateMcpDestinationAuth(headers, sapUrl);
+    if (mcpDestinationConfig) {
+        configs.push(mcpDestinationConfig);
+    }
+    // 3. Other auth methods require x-sap-auth-type
+    const sapAuthType = getHeaderValue(headers, 'x-sap-auth-type');
+    if (sapAuthType) {
+        // Validate auth type
+        const validAuthTypes = ['jwt', 'xsuaa', 'basic'];
+        const authType = sapAuthType.toLowerCase();
+        if (!validAuthTypes.includes(authType)) {
+            errors.push(`x-sap-auth-type must be one of: ${validAuthTypes.join(', ')}, got: ${sapAuthType}`);
+        }
+        else {
+            // Only validate direct JWT and basic auth if MCP destination is not present
+            // (MCP destination already handled above)
+            if (!mcpDestinationConfig) {
+                // 4. Direct JWT auth (medium priority)
+                const jwtConfig = validateDirectJwtAuth(headers, sapUrl, authType);
+                if (jwtConfig) {
+                    configs.push(jwtConfig);
+                }
+                // 5. Basic auth (lowest priority)
+                const basicConfig = validateBasicAuth(headers, sapUrl, authType);
+                if (basicConfig) {
+                    configs.push(basicConfig);
+                }
+            }
+        }
+    }
+    else {
+        // No auth-type provided - check if we have MCP destination or need to error
+        if (!mcpDestinationConfig && !sapDestinationConfig) {
+            errors.push('x-sap-auth-type header is required when x-sap-destination and x-mcp-destination are not present');
+        }
+    }
+    // No valid authentication method found
+    if (configs.length === 0) {
+        if (sapAuthType) {
+            const authType = sapAuthType.toLowerCase();
+            if (authType === 'jwt' || authType === 'xsuaa') {
+                errors.push('JWT authentication requires either x-sap-destination, x-mcp-destination, or x-sap-jwt-token header');
+            }
+            else if (authType === 'basic') {
+                errors.push('Basic authentication requires x-sap-login and x-sap-password headers');
+            }
+        }
+        else if (mcpDestinationConfig && mcpDestinationConfig.errors.length > 0) {
+            // MCP destination was found but has errors
+            errors.push(...mcpDestinationConfig.errors);
+        }
+        return {
+            isValid: false,
+            errors,
+            warnings,
+        };
+    }
+    // Select highest priority configuration
+    const selectedConfig = configs.reduce((prev, current) => current.priority > prev.priority ? current : prev);
+    // Check for conflicts (multiple auth methods with same priority shouldn't happen, but check anyway)
+    const samePriorityConfigs = configs.filter(c => c.priority === selectedConfig.priority);
+    if (samePriorityConfigs.length > 1) {
+        warnings.push(`Multiple authentication methods with same priority detected, using: ${types_1.AuthMethodPriority[selectedConfig.priority]}`);
+    }
+    // Merge errors and warnings
+    const allErrors = [...errors, ...selectedConfig.errors];
+    const allWarnings = [...warnings, ...selectedConfig.warnings];
+    return {
+        isValid: allErrors.length === 0,
+        config: selectedConfig,
+        errors: allErrors,
+        warnings: allWarnings,
+    };
+}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Header validator for MCP ABAP ADT
+ *
+ * Validates and prioritizes authentication headers for MCP ABAP ADT servers
+ */
+export { validateAuthHeaders } from './headerValidator';
+export * from './types';

package/dist/index.js

@@ -0,0 +1,25 @@
+"use strict";
+/**
+ * Header validator for MCP ABAP ADT
+ *
+ * Validates and prioritizes authentication headers for MCP ABAP ADT servers
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateAuthHeaders = void 0;
+var headerValidator_1 = require("./headerValidator");
+Object.defineProperty(exports, "validateAuthHeaders", { enumerable: true, get: function () { return headerValidator_1.validateAuthHeaders; } });
+__exportStar(require("./types"), exports);

package/dist/types.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Types for header validator
+ */
+/**
+ * Authentication type
+ */
+export type AuthType = 'jwt' | 'xsuaa' | 'basic';
+/**
+ * Authentication method priority
+ * Higher number = higher priority
+ */
+export declare enum AuthMethodPriority {
+    SAP_DESTINATION = 4,// x-sap-destination (uses AuthBroker, JWT only)
+    MCP_DESTINATION = 3,// x-mcp-destination + x-sap-auth-type=jwt (uses AuthBroker)
+    DIRECT_JWT = 2,// x-sap-jwt-token + x-sap-auth-type=jwt
+    BASIC = 1,// x-sap-login + x-sap-password + x-sap-auth-type=basic
+    NONE = 0
+}
+/**
+ * Validated authentication configuration
+ */
+export interface ValidatedAuthConfig {
+    /** Authentication method priority */
+    priority: AuthMethodPriority;
+    /** Authentication type */
+    authType: AuthType;
+    /** SAP URL */
+    sapUrl: string;
+    /** SAP Client (optional) */
+    sapClient?: string;
+    /** Destination name (for destination-based auth: x-sap-destination or x-mcp-destination) */
+    destination?: string;
+    /** JWT token (for direct JWT auth) */
+    jwtToken?: string;
+    /** Refresh token (optional, for JWT auth) */
+    refreshToken?: string;
+    /** UAA URL (optional, for JWT auth) */
+    uaaUrl?: string;
+    /** UAA Client ID (optional, for JWT auth) */
+    uaaClientId?: string;
+    /** UAA Client Secret (optional, for JWT auth) */
+    uaaClientSecret?: string;
+    /** Username (for basic auth) */
+    username?: string;
+    /** Password (for basic auth) */
+    password?: string;
+    /** Validation errors (if any) */
+    errors: string[];
+    /** Warnings (if any) */
+    warnings: string[];
+}
+/**
+ * Header validation result
+ */
+export interface HeaderValidationResult {
+    /** Is configuration valid? */
+    isValid: boolean;
+    /** Validated authentication configuration */
+    config?: ValidatedAuthConfig;
+    /** Validation errors */
+    errors: string[];
+    /** Warnings */
+    warnings: string[];
+}

package/dist/types.js

@@ -0,0 +1,18 @@
+"use strict";
+/**
+ * Types for header validator
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthMethodPriority = void 0;
+/**
+ * Authentication method priority
+ * Higher number = higher priority
+ */
+var AuthMethodPriority;
+(function (AuthMethodPriority) {
+    AuthMethodPriority[AuthMethodPriority["SAP_DESTINATION"] = 4] = "SAP_DESTINATION";
+    AuthMethodPriority[AuthMethodPriority["MCP_DESTINATION"] = 3] = "MCP_DESTINATION";
+    AuthMethodPriority[AuthMethodPriority["DIRECT_JWT"] = 2] = "DIRECT_JWT";
+    AuthMethodPriority[AuthMethodPriority["BASIC"] = 1] = "BASIC";
+    AuthMethodPriority[AuthMethodPriority["NONE"] = 0] = "NONE"; // No valid authentication
+})(AuthMethodPriority || (exports.AuthMethodPriority = AuthMethodPriority = {}));

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@mcp-abap-adt/header-validator",
+  "version": "0.1.0",
+  "description": "Header validator for MCP ABAP ADT - validates and prioritizes authentication headers",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
+  ],
+  "keywords": [
+    "abap",
+    "sap",
+    "adt",
+    "mcp",
+    "header",
+    "validator",
+    "authentication",
+    "abap-adt"
+  ],
+  "author": "Oleksii Kyslytsia <oleksij.kyslytsja@gmail.com>",
+  "license": "MIT",
+  "homepage": "https://github.com/fr0ster/mcp-abap-adt-header-validator#readme",
+  "bugs": {
+    "url": "https://github.com/fr0ster/mcp-abap-adt-header-validator/issues"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/fr0ster/mcp-abap-adt-header-validator.git"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "scripts": {
+    "clean": "rm -rf dist tsconfig.tsbuildinfo",
+    "build": "npm run clean --silent && npx tsc -p tsconfig.json",
+    "build:fast": "npx tsc -p tsconfig.json",
+    "test": "jest",
+    "test:check": "npx tsc --noEmit",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "devDependencies": {
+    "@types/jest": "^30.0.0",
+    "@types/node": "^24.2.1",
+    "jest": "^30.2.0",
+    "ts-jest": "^29.2.5",
+    "typescript": "^5.9.2"
+  }
+}