@mcp-abap-adt/header-validator 0.1.2 → 0.1.3

package/CHANGELOG.md

@@ -5,6 +5,37 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.1.3] - 2025-12-01
+
+### Fixed
+- **x-mcp-destination validation** – fixed issue where `x-mcp-destination` header incorrectly required `x-sap-url`:
+  - `x-mcp-destination` now works identically to `x-sap-destination` - URL is automatically derived from service key
+  - `x-sap-url` is now optional for `x-mcp-destination` (and will be ignored with a warning if provided)
+  - Fixed validation logic to check `x-mcp-destination` immediately after `x-sap-destination`, regardless of `x-sap-url` presence
+  - This fixes issues on Windows where `x-mcp-destination` was being ignored
+
+### Changed
+- **Header case handling** – improved header value extraction to check both lowercase and original case:
+  - `getHeaderValue()` now checks lowercase first (Node.js normalizes headers), then original case for compatibility
+  - Both `validateSapDestinationAuth()` and `validateMcpDestinationAuth()` check headers in both cases
+  - Better cross-platform compatibility, especially for Windows
+
+- **Validation order** – improved validation priority logic:
+  - `x-mcp-destination` is now checked immediately after `x-sap-destination`, before checking for `x-sap-url`
+  - This ensures destination-based authentication is prioritized correctly
+  - URL validation only happens for non-destination authentication methods
+
+- **Documentation updates** – updated architecture documentation:
+  - Updated `ARCHITECTURE.md` to reflect that `x-sap-url` is not required for `x-mcp-destination`
+  - Updated `PRIORITY_DIAGRAM.md` with correct header requirements
+  - Updated examples to show `x-mcp-destination` without `x-sap-url`
+
+### Added
+- **Test coverage** – added tests for new validation behavior:
+  - Test for `x-mcp-destination` without `x-sap-url` (should work)
+  - Test for warning when `x-sap-url` is provided with `x-mcp-destination`
+  - Updated existing tests to reflect new validation logic
+
 ## [0.1.2] - 2025-11-30
 
 ### Changed

package/dist/headerValidator.js

@@ -12,9 +12,15 @@ exports.validateAuthHeaders = validateAuthHeaders;
 const types_1 = require("./types");
 /**
  * Extract header value (handles array values)
+ * Node.js normalizes headers to lowercase, but check both cases for safety
  */
 function getHeaderValue(headers, name) {
-    const value = headers[name];
+    // Try lowercase first (Node.js normalizes to lowercase)
+    let value = headers[name.toLowerCase()];
+    // If not found, try original case (for compatibility)
+    if (!value) {
+        value = headers[name];
+    }
     if (!value) {
         return undefined;
     }
@@ -41,7 +47,8 @@ function isValidUrl(url) {
  * URL is taken from destination (service key or .env), not from x-sap-url header
  */
 function validateSapDestinationAuth(headers) {
-    const destinationRaw = headers['x-sap-destination'];
+    // Check both lowercase and original case (Node.js normalizes to lowercase, but check both for safety)
+    const destinationRaw = headers['x-sap-destination'] || headers['X-SAP-Destination'];
     if (!destinationRaw) {
         return null;
     }
@@ -94,10 +101,12 @@ function validateSapDestinationAuth(headers) {
 /**
  * Validate MCP destination-based authentication (medium-high priority)
  * x-mcp-destination - uses AuthBroker, always JWT (no x-sap-auth-type needed)
- * x-sap-url is required for MCP destination (unlike x-sap-destination)
+ * URL is taken from destination (service key or .env), not from x-sap-url header
+ * x-sap-url is optional - if provided, it will be ignored (warning issued)
  */
 function validateMcpDestinationAuth(headers, sapUrl) {
-    const destinationRaw = headers['x-mcp-destination'];
+    // Check both lowercase and original case (Node.js normalizes to lowercase, but check both for safety)
+    const destinationRaw = headers['x-mcp-destination'] || headers['X-MCP-Destination'];
     if (!destinationRaw) {
         return null;
     }
@@ -110,21 +119,14 @@ function validateMcpDestinationAuth(headers, sapUrl) {
         return {
             priority: types_1.AuthMethodPriority.NONE,
             authType: 'jwt', // MCP destination always uses JWT
-            sapUrl: sapUrl || '',
+            sapUrl: '', // URL will be loaded from destination
             errors,
             warnings,
         };
     }
-    // x-sap-url is required for MCP destination
-    if (!sapUrl) {
-        errors.push('x-sap-url header is required when x-mcp-destination is present');
-        return {
-            priority: types_1.AuthMethodPriority.NONE,
-            authType: 'jwt',
-            sapUrl: '',
-            errors,
-            warnings,
-        };
+    // Warning if x-sap-url is provided (URL comes from destination, not header)
+    if (sapUrl) {
+        warnings.push('x-sap-url is ignored when x-mcp-destination is present (URL is loaded from destination service key or .env file)');
     }
     // Warning if x-sap-auth-type is provided (not needed for x-mcp-destination)
     const authType = getHeaderValue(headers, 'x-sap-auth-type');
@@ -141,7 +143,7 @@ function validateMcpDestinationAuth(headers, sapUrl) {
     return {
         priority: types_1.AuthMethodPriority.MCP_DESTINATION,
         authType: 'jwt', // Always JWT for x-mcp-destination
-        sapUrl,
+        sapUrl: '', // URL will be loaded from destination (service key or .env)
         sapClient,
         destination,
         errors,
@@ -267,53 +269,48 @@ function validateAuthHeaders(headers) {
             };
         }
     }
-    // For other auth methods, x-sap-url is required (but MCP destination can work without it if URL is optional)
+    // Check for MCP destination (doesn't require x-sap-url, URL comes from destination)
     const sapUrl = getHeaderValue(headers, 'x-sap-url');
-    // Check for MCP destination (requires x-sap-url header)
-    if (sapUrl) {
-        // Validate URL format first
-        if (!isValidUrl(sapUrl)) {
-            errors.push(`x-sap-url is not a valid URL: ${sapUrl}`);
+    const mcpDestinationConfig = validateMcpDestinationAuth(headers, sapUrl);
+    if (mcpDestinationConfig) {
+        // MCP destination found - URL comes from destination, not header
+        if (mcpDestinationConfig.errors.length === 0) {
             return {
-                isValid: false,
-                errors,
-                warnings,
+                isValid: true,
+                config: mcpDestinationConfig,
+                errors: [],
+                warnings: mcpDestinationConfig.warnings,
             };
         }
-        const mcpDestinationConfig = validateMcpDestinationAuth(headers, sapUrl);
-        if (mcpDestinationConfig) {
-            if (mcpDestinationConfig.errors.length === 0) {
-                return {
-                    isValid: true,
-                    config: mcpDestinationConfig,
-                    errors: [],
-                    warnings: mcpDestinationConfig.warnings,
-                };
-            }
-            else {
-                return {
-                    isValid: false,
-                    errors: mcpDestinationConfig.errors,
-                    warnings: mcpDestinationConfig.warnings,
-                };
-            }
+        else {
+            // Has errors, continue to check other methods or return error
+            return {
+                isValid: false,
+                errors: mcpDestinationConfig.errors,
+                warnings: mcpDestinationConfig.warnings,
+            };
         }
     }
-    // If no auth headers at all, return empty result (not an error - may use .env file)
+    // For other auth methods, x-sap-url is required
     if (!sapUrl) {
+        // If no auth headers at all, return empty result (not an error - may use .env file)
         return {
             isValid: false,
             errors: [],
             warnings: [],
         };
     }
+    // Validate URL format
+    if (!isValidUrl(sapUrl)) {
+        errors.push(`x-sap-url is not a valid URL: ${sapUrl}`);
+        return {
+            isValid: false,
+            errors,
+            warnings,
+        };
+    }
     // Try to validate authentication methods in priority order
     const configs = [];
-    // 2. MCP destination-based auth (medium-high priority) - doesn't require x-sap-auth-type
-    const mcpDestinationConfig = validateMcpDestinationAuth(headers, sapUrl);
-    if (mcpDestinationConfig) {
-        configs.push(mcpDestinationConfig);
-    }
     // 3. Other auth methods require x-sap-auth-type
     const sapAuthType = getHeaderValue(headers, 'x-sap-auth-type');
     if (sapAuthType) {
@@ -357,9 +354,12 @@ function validateAuthHeaders(headers) {
                 errors.push('Basic authentication requires x-sap-login and x-sap-password headers');
             }
         }
-        else if (mcpDestinationConfig && mcpDestinationConfig.errors.length > 0) {
-            // MCP destination was found but has errors
-            errors.push(...mcpDestinationConfig.errors);
+        else {
+            // Check if MCP destination was found but has errors
+            const mcpConfig = validateMcpDestinationAuth(headers, sapUrl);
+            if (mcpConfig && mcpConfig.errors.length > 0) {
+                errors.push(...mcpConfig.errors);
+            }
         }
         return {
             isValid: false,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/header-validator",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Header validator for MCP ABAP ADT - validates and prioritizes authentication headers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",