@mcp-abap-adt/header-validator 0.1.1 → 0.1.3

package/CHANGELOG.md

@@ -5,6 +5,52 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.3] - 2025-12-01
+
+### Fixed
+- **x-mcp-destination validation** – fixed issue where `x-mcp-destination` header incorrectly required `x-sap-url`:
+  - `x-mcp-destination` now works identically to `x-sap-destination` - URL is automatically derived from service key
+  - `x-sap-url` is now optional for `x-mcp-destination` (and will be ignored with a warning if provided)
+  - Fixed validation logic to check `x-mcp-destination` immediately after `x-sap-destination`, regardless of `x-sap-url` presence
+  - This fixes issues on Windows where `x-mcp-destination` was being ignored
+
+### Changed
+- **Header case handling** – improved header value extraction to check both lowercase and original case:
+  - `getHeaderValue()` now checks lowercase first (Node.js normalizes headers), then original case for compatibility
+  - Both `validateSapDestinationAuth()` and `validateMcpDestinationAuth()` check headers in both cases
+  - Better cross-platform compatibility, especially for Windows
+
+- **Validation order** – improved validation priority logic:
+  - `x-mcp-destination` is now checked immediately after `x-sap-destination`, before checking for `x-sap-url`
+  - This ensures destination-based authentication is prioritized correctly
+  - URL validation only happens for non-destination authentication methods
+
+- **Documentation updates** – updated architecture documentation:
+  - Updated `ARCHITECTURE.md` to reflect that `x-sap-url` is not required for `x-mcp-destination`
+  - Updated `PRIORITY_DIAGRAM.md` with correct header requirements
+  - Updated examples to show `x-mcp-destination` without `x-sap-url`
+
+### Added
+- **Test coverage** – added tests for new validation behavior:
+  - Test for `x-mcp-destination` without `x-sap-url` (should work)
+  - Test for warning when `x-sap-url` is provided with `x-mcp-destination`
+  - Updated existing tests to reflect new validation logic
+
+## [0.1.2] - 2025-11-30
+
+### Changed
+- **Improved header validation logic** - Absence of headers is no longer treated as an error (allows .env file usage)
+- **MCP destination validation** - `validateMcpDestinationAuth` now accepts optional `sapUrl` parameter and validates it internally
+- **Better error handling** - Validator returns empty errors array when no headers provided (not an error, user may use .env file)
+
+### Fixed
+- **Test updates** - Updated tests to reflect new validation logic where missing headers are not errors
+
+## [0.1.1] - 2025-11-30
+
+### Fixed
+- Initial published version
+
 ## [0.1.0] - 2025-11-30
 
 ### Added

package/dist/headerValidator.js

@@ -12,9 +12,15 @@ exports.validateAuthHeaders = validateAuthHeaders;
 const types_1 = require("./types");
 /**
  * Extract header value (handles array values)
+ * Node.js normalizes headers to lowercase, but check both cases for safety
  */
 function getHeaderValue(headers, name) {
-    const value = headers[name];
+    // Try lowercase first (Node.js normalizes to lowercase)
+    let value = headers[name.toLowerCase()];
+    // If not found, try original case (for compatibility)
+    if (!value) {
+        value = headers[name];
+    }
     if (!value) {
         return undefined;
     }
@@ -41,7 +47,8 @@ function isValidUrl(url) {
  * URL is taken from destination (service key or .env), not from x-sap-url header
  */
 function validateSapDestinationAuth(headers) {
-    const destinationRaw = headers['x-sap-destination'];
+    // Check both lowercase and original case (Node.js normalizes to lowercase, but check both for safety)
+    const destinationRaw = headers['x-sap-destination'] || headers['X-SAP-Destination'];
     if (!destinationRaw) {
         return null;
     }
@@ -94,9 +101,12 @@ function validateSapDestinationAuth(headers) {
 /**
  * Validate MCP destination-based authentication (medium-high priority)
  * x-mcp-destination - uses AuthBroker, always JWT (no x-sap-auth-type needed)
+ * URL is taken from destination (service key or .env), not from x-sap-url header
+ * x-sap-url is optional - if provided, it will be ignored (warning issued)
  */
 function validateMcpDestinationAuth(headers, sapUrl) {
-    const destinationRaw = headers['x-mcp-destination'];
+    // Check both lowercase and original case (Node.js normalizes to lowercase, but check both for safety)
+    const destinationRaw = headers['x-mcp-destination'] || headers['X-MCP-Destination'];
     if (!destinationRaw) {
         return null;
     }
@@ -109,11 +119,15 @@ function validateMcpDestinationAuth(headers, sapUrl) {
         return {
             priority: types_1.AuthMethodPriority.NONE,
             authType: 'jwt', // MCP destination always uses JWT
-            sapUrl,
+            sapUrl: '', // URL will be loaded from destination
             errors,
             warnings,
         };
     }
+    // Warning if x-sap-url is provided (URL comes from destination, not header)
+    if (sapUrl) {
+        warnings.push('x-sap-url is ignored when x-mcp-destination is present (URL is loaded from destination service key or .env file)');
+    }
     // Warning if x-sap-auth-type is provided (not needed for x-mcp-destination)
     const authType = getHeaderValue(headers, 'x-sap-auth-type');
     if (authType) {
@@ -129,7 +143,7 @@ function validateMcpDestinationAuth(headers, sapUrl) {
     return {
         priority: types_1.AuthMethodPriority.MCP_DESTINATION,
         authType: 'jwt', // Always JWT for x-mcp-destination
-        sapUrl,
+        sapUrl: '', // URL will be loaded from destination (service key or .env)
         sapClient,
         destination,
         errors,
@@ -224,11 +238,11 @@ function validateBasicAuth(headers, sapUrl, authType) {
  * @returns Validation result with prioritized authentication configuration
  */
 function validateAuthHeaders(headers) {
-    // No headers provided
+    // No headers provided - this is not an error, user may be using .env file
     if (!headers) {
         return {
             isValid: false,
-            errors: ['No headers provided'],
+            errors: [],
             warnings: [],
         };
     }
@@ -255,15 +269,35 @@ function validateAuthHeaders(headers) {
             };
         }
     }
-    // For other auth methods, x-sap-url is required
+    // Check for MCP destination (doesn't require x-sap-url, URL comes from destination)
     const sapUrl = getHeaderValue(headers, 'x-sap-url');
-    // Validate required headers
+    const mcpDestinationConfig = validateMcpDestinationAuth(headers, sapUrl);
+    if (mcpDestinationConfig) {
+        // MCP destination found - URL comes from destination, not header
+        if (mcpDestinationConfig.errors.length === 0) {
+            return {
+                isValid: true,
+                config: mcpDestinationConfig,
+                errors: [],
+                warnings: mcpDestinationConfig.warnings,
+            };
+        }
+        else {
+            // Has errors, continue to check other methods or return error
+            return {
+                isValid: false,
+                errors: mcpDestinationConfig.errors,
+                warnings: mcpDestinationConfig.warnings,
+            };
+        }
+    }
+    // For other auth methods, x-sap-url is required
     if (!sapUrl) {
-        errors.push('x-sap-url header is required when x-sap-destination is not present');
+        // If no auth headers at all, return empty result (not an error - may use .env file)
         return {
             isValid: false,
-            errors,
-            warnings,
+            errors: [],
+            warnings: [],
         };
     }
     // Validate URL format
@@ -277,11 +311,6 @@ function validateAuthHeaders(headers) {
     }
     // Try to validate authentication methods in priority order
     const configs = [];
-    // 2. MCP destination-based auth (medium-high priority) - doesn't require x-sap-auth-type
-    const mcpDestinationConfig = validateMcpDestinationAuth(headers, sapUrl);
-    if (mcpDestinationConfig) {
-        configs.push(mcpDestinationConfig);
-    }
     // 3. Other auth methods require x-sap-auth-type
     const sapAuthType = getHeaderValue(headers, 'x-sap-auth-type');
     if (sapAuthType) {
@@ -325,9 +354,12 @@ function validateAuthHeaders(headers) {
                 errors.push('Basic authentication requires x-sap-login and x-sap-password headers');
             }
         }
-        else if (mcpDestinationConfig && mcpDestinationConfig.errors.length > 0) {
-            // MCP destination was found but has errors
-            errors.push(...mcpDestinationConfig.errors);
+        else {
+            // Check if MCP destination was found but has errors
+            const mcpConfig = validateMcpDestinationAuth(headers, sapUrl);
+            if (mcpConfig && mcpConfig.errors.length > 0) {
+                errors.push(...mcpConfig.errors);
+            }
         }
         return {
             isValid: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/header-validator",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "description": "Header validator for MCP ABAP ADT - validates and prioritizes authentication headers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",