@mcp-abap-adt/header-validator 0.1.6 → 0.1.7

package/CHANGELOG.md

@@ -7,6 +7,35 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.1.7] - 2025-01-XX
+
+### Added
+- **Header Sets Documentation**: Added comprehensive documentation section on header sets in `USAGE.md`
+  - **Set 1: Basic Authentication Set** - Documents that `x-sap-login`, `x-sap-password`, and `x-sap-auth-type: basic` must be provided together
+  - **Set 2: UAA Refresh Token Set** - Documents that UAA headers (`x-sap-uaa-url`, `x-sap-uaa-client-id`, `x-sap-uaa-client-secret`) must be provided together when used (optional)
+  - **Set 3: Direct JWT Authentication** - Documents minimal set requirements for JWT authentication
+  - Includes validation rules, examples, and error scenarios for each set
+
+### Changed
+- **Header Constants Migration**: Replaced all hardcoded header strings with constants from `@mcp-abap-adt/interfaces`
+  - Updated `@mcp-abap-adt/interfaces` dependency from `^0.1.1` to `^0.1.2`
+  - All header references now use constants (e.g., `HEADER_SAP_LOGIN`, `HEADER_SAP_PASSWORD`, `HEADER_SAP_AUTH_TYPE`, etc.)
+  - Improved type safety and consistency across packages
+
+### Fixed
+- **Basic Auth Validation**: Enhanced validation to ensure `x-sap-login` and `x-sap-password` are provided together as a cohesive set
+  - Validation now checks if either header is present, both must be present
+  - Improved error messages for missing basic auth headers
+- **UAA Headers Validation**: Enhanced validation for UAA refresh token headers
+  - Added warning when UAA headers are partially provided
+  - Clarified that UAA headers are optional and only used for token refresh
+  - UAA headers do not affect authorization validation
+
+### Technical
+- **Test Updates**: Updated all tests to use header constants instead of hardcoded strings
+- **Jest Configuration**: Updated Jest to version 30.2.0 and ts-jest to 29.2.5 (aligned with auth-providers package)
+- **Dependencies**: Added `jest-util@^30.2.0` as dev dependency to resolve Jest compatibility issues
+
 ## [0.1.6] - 2025-12-05
 
 ### Changed

package/dist/headerValidator.d.ts

@@ -1,8 +1,12 @@
 /**
  * Header validator for MCP ABAP ADT authentication headers
  *
- * Validates and prioritizes authentication headers according to:
- * 1. Destination-based auth (x-mcp-destination) - highest priority
+ * Provides validation functions for different contexts:
+ * - MCP server headers: x-sap-destination, x-mcp-destination, x-sap-url, x-sap-jwt-token, etc.
+ * - Proxy headers: x-btp-destination, x-mcp-destination, x-mcp-url
+ *
+ * MCP authentication headers are validated and prioritized according to:
+ * 1. Destination-based auth (x-sap-destination, x-mcp-destination) - highest priority
  * 2. Direct JWT token (x-sap-jwt-token) - medium priority
  * 3. Basic auth (x-sap-login + x-sap-password) - lowest priority
  */
@@ -15,3 +19,52 @@ import type { HeaderValidationResult } from './types';
  * @returns Validation result with prioritized authentication configuration
  */
 export declare function validateAuthHeaders(headers?: IncomingHttpHeaders): HeaderValidationResult;
+/**
+ * Proxy Header Validation
+ *
+ * Functions to validate proxy-specific headers (x-btp-destination, x-mcp-destination, x-mcp-url)
+ * These are separate from MCP authentication headers and used for proxy routing decisions.
+ */
+export interface ProxyHeaderValidationResult {
+    isValid: boolean;
+    hasBtpDestination: boolean;
+    hasMcpDestination: boolean;
+    hasMcpUrl: boolean;
+    errors: string[];
+    warnings: string[];
+}
+/**
+ * Validate proxy routing headers
+ *
+ * Checks for proxy-specific headers:
+ * - x-btp-destination: BTP Cloud authorization destination
+ * - x-mcp-destination: SAP ABAP connection destination
+ * - x-mcp-url: Direct MCP server URL
+ *
+ * @param headers HTTP headers
+ * @returns Validation result indicating which proxy headers are present
+ */
+export declare function validateProxyHeaders(headers?: IncomingHttpHeaders): ProxyHeaderValidationResult;
+/**
+ * Check if headers indicate a proxy request
+ *
+ * A request is considered a proxy request if it has at least one of:
+ * - x-btp-destination
+ * - x-mcp-destination
+ * - x-mcp-url
+ *
+ * @param headers HTTP headers
+ * @returns true if headers indicate a proxy request
+ */
+export declare function isProxyRequest(headers?: IncomingHttpHeaders): boolean;
+/**
+ * Check if headers indicate an MCP server request (not proxy)
+ *
+ * An MCP server request has MCP authentication headers but no proxy headers:
+ * - Has x-sap-destination, x-mcp-destination, x-sap-url, x-sap-jwt-token, etc.
+ * - Does NOT have x-btp-destination or x-mcp-url (proxy-specific)
+ *
+ * @param headers HTTP headers
+ * @returns true if headers indicate an MCP server request
+ */
+export declare function isMcpServerRequest(headers?: IncomingHttpHeaders): boolean;

package/dist/headerValidator.js

@@ -2,13 +2,20 @@
 /**
  * Header validator for MCP ABAP ADT authentication headers
  *
- * Validates and prioritizes authentication headers according to:
- * 1. Destination-based auth (x-mcp-destination) - highest priority
+ * Provides validation functions for different contexts:
+ * - MCP server headers: x-sap-destination, x-mcp-destination, x-sap-url, x-sap-jwt-token, etc.
+ * - Proxy headers: x-btp-destination, x-mcp-destination, x-mcp-url
+ *
+ * MCP authentication headers are validated and prioritized according to:
+ * 1. Destination-based auth (x-sap-destination, x-mcp-destination) - highest priority
  * 2. Direct JWT token (x-sap-jwt-token) - medium priority
  * 3. Basic auth (x-sap-login + x-sap-password) - lowest priority
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.validateAuthHeaders = validateAuthHeaders;
+exports.validateProxyHeaders = validateProxyHeaders;
+exports.isProxyRequest = isProxyRequest;
+exports.isMcpServerRequest = isMcpServerRequest;
 const interfaces_1 = require("@mcp-abap-adt/interfaces");
 /**
  * Extract header value (handles array values)
@@ -48,47 +55,47 @@ function isValidUrl(url) {
  */
 function validateSapDestinationAuth(headers) {
     // Check both lowercase and original case (Node.js normalizes to lowercase, but check both for safety)
-    const destinationRaw = headers['x-sap-destination'] || headers['X-SAP-Destination'];
+    const destinationRaw = headers[interfaces_1.HEADER_SAP_DESTINATION_SERVICE.toLowerCase()] || headers[interfaces_1.HEADER_SAP_DESTINATION_SERVICE];
     if (!destinationRaw) {
         return null;
     }
-    const destination = getHeaderValue(headers, 'x-sap-destination');
+    const destination = getHeaderValue(headers, interfaces_1.HEADER_SAP_DESTINATION_SERVICE);
     const errors = [];
     const warnings = [];
     // Validate destination name (check if empty after trim)
     if (!destination || destination.length === 0) {
-        errors.push('x-sap-destination header is empty');
+        errors.push(`${interfaces_1.HEADER_SAP_DESTINATION_SERVICE} header is empty`);
         return {
             priority: interfaces_1.AuthMethodPriority.NONE,
-            authType: 'jwt', // SAP destination always uses JWT
+            authType: interfaces_1.AUTH_TYPE_JWT, // SAP destination always uses JWT
             sapUrl: '', // URL will be loaded from destination
             errors,
             warnings,
         };
     }
     // Extract optional SAP client
-    const sapClient = getHeaderValue(headers, 'x-sap-client');
+    const sapClient = getHeaderValue(headers, interfaces_1.HEADER_SAP_CLIENT);
     // Optional: x-sap-login and x-sap-password (for cloud systems)
-    const username = getHeaderValue(headers, 'x-sap-login');
-    const password = getHeaderValue(headers, 'x-sap-password');
+    const username = getHeaderValue(headers, interfaces_1.HEADER_SAP_LOGIN);
+    const password = getHeaderValue(headers, interfaces_1.HEADER_SAP_PASSWORD);
     // Warning if x-sap-url is provided (URL comes from destination, not header)
-    const sapUrl = getHeaderValue(headers, 'x-sap-url');
+    const sapUrl = getHeaderValue(headers, interfaces_1.HEADER_SAP_URL);
     if (sapUrl) {
-        warnings.push('x-sap-url is ignored when x-sap-destination is present (URL is loaded from destination service key or .env file)');
+        warnings.push(`${interfaces_1.HEADER_SAP_URL} is ignored when ${interfaces_1.HEADER_SAP_DESTINATION_SERVICE} is present (URL is loaded from destination service key or .env file)`);
     }
     // Warning if direct JWT token is also provided (destination takes priority)
-    const jwtToken = getHeaderValue(headers, 'x-sap-jwt-token');
+    const jwtToken = getHeaderValue(headers, interfaces_1.HEADER_SAP_JWT_TOKEN);
     if (jwtToken) {
-        warnings.push('x-sap-jwt-token is ignored when x-sap-destination is present (destination-based auth takes priority)');
+        warnings.push(`${interfaces_1.HEADER_SAP_JWT_TOKEN} is ignored when ${interfaces_1.HEADER_SAP_DESTINATION_SERVICE} is present (destination-based auth takes priority)`);
     }
     // Warning if auth-type is provided (not needed for x-sap-destination)
-    const authType = getHeaderValue(headers, 'x-sap-auth-type');
+    const authType = getHeaderValue(headers, interfaces_1.HEADER_SAP_AUTH_TYPE);
     if (authType) {
-        warnings.push('x-sap-auth-type is ignored when x-sap-destination is present (always uses JWT)');
+        warnings.push(`${interfaces_1.HEADER_SAP_AUTH_TYPE} is ignored when ${interfaces_1.HEADER_SAP_DESTINATION_SERVICE} is present (always uses JWT)`);
     }
     return {
         priority: interfaces_1.AuthMethodPriority.SAP_DESTINATION,
-        authType: 'jwt', // Always JWT for x-sap-destination
+        authType: interfaces_1.AUTH_TYPE_JWT, // Always JWT for x-sap-destination
         sapUrl: '', // URL will be loaded from destination (service key or .env)
         sapClient,
         destination,
@@ -106,19 +113,19 @@ function validateSapDestinationAuth(headers) {
  */
 function validateMcpDestinationAuth(headers, sapUrl) {
     // Check both lowercase and original case (Node.js normalizes to lowercase, but check both for safety)
-    const destinationRaw = headers['x-mcp-destination'] || headers['X-MCP-Destination'];
+    const destinationRaw = headers[interfaces_1.HEADER_MCP_DESTINATION.toLowerCase()] || headers[interfaces_1.HEADER_MCP_DESTINATION];
     if (!destinationRaw) {
         return null;
     }
-    const destination = getHeaderValue(headers, 'x-mcp-destination');
+    const destination = getHeaderValue(headers, interfaces_1.HEADER_MCP_DESTINATION);
     const errors = [];
     const warnings = [];
     // Validate destination name (check if empty after trim)
     if (!destination || destination.length === 0) {
-        errors.push('x-mcp-destination header is empty');
+        errors.push(`${interfaces_1.HEADER_MCP_DESTINATION} header is empty`);
         return {
             priority: interfaces_1.AuthMethodPriority.NONE,
-            authType: 'jwt', // MCP destination always uses JWT
+            authType: interfaces_1.AUTH_TYPE_JWT, // MCP destination always uses JWT
             sapUrl: '', // URL will be loaded from destination
             errors,
             warnings,
@@ -126,23 +133,23 @@ function validateMcpDestinationAuth(headers, sapUrl) {
     }
     // Warning if x-sap-url is provided (URL comes from destination, not header)
     if (sapUrl) {
-        warnings.push('x-sap-url is ignored when x-mcp-destination is present (URL is loaded from destination service key or .env file)');
+        warnings.push(`${interfaces_1.HEADER_SAP_URL} is ignored when ${interfaces_1.HEADER_MCP_DESTINATION} is present (URL is loaded from destination service key or .env file)`);
     }
     // Warning if x-sap-auth-type is provided (not needed for x-mcp-destination)
-    const authType = getHeaderValue(headers, 'x-sap-auth-type');
+    const authType = getHeaderValue(headers, interfaces_1.HEADER_SAP_AUTH_TYPE);
     if (authType) {
-        warnings.push('x-sap-auth-type is ignored when x-mcp-destination is present (always uses JWT)');
+        warnings.push(`${interfaces_1.HEADER_SAP_AUTH_TYPE} is ignored when ${interfaces_1.HEADER_MCP_DESTINATION} is present (always uses JWT)`);
     }
     // Extract optional SAP client
-    const sapClient = getHeaderValue(headers, 'x-sap-client');
+    const sapClient = getHeaderValue(headers, interfaces_1.HEADER_SAP_CLIENT);
     // Warning if direct JWT token is also provided (destination takes priority)
-    const jwtToken = getHeaderValue(headers, 'x-sap-jwt-token');
+    const jwtToken = getHeaderValue(headers, interfaces_1.HEADER_SAP_JWT_TOKEN);
     if (jwtToken) {
-        warnings.push('x-sap-jwt-token is ignored when x-mcp-destination is present (destination-based auth takes priority)');
+        warnings.push(`${interfaces_1.HEADER_SAP_JWT_TOKEN} is ignored when ${interfaces_1.HEADER_MCP_DESTINATION} is present (destination-based auth takes priority)`);
     }
     return {
         priority: interfaces_1.AuthMethodPriority.MCP_DESTINATION,
-        authType: 'jwt', // Always JWT for x-mcp-destination
+        authType: interfaces_1.AUTH_TYPE_JWT, // Always JWT for x-mcp-destination
         sapUrl: '', // URL will be loaded from destination (service key or .env)
         sapClient,
         destination,
@@ -152,12 +159,16 @@ function validateMcpDestinationAuth(headers, sapUrl) {
 }
 /**
  * Validate direct JWT authentication (medium priority)
+ *
+ * For authorization, only x-sap-jwt-token is required.
+ * UAA headers (x-sap-uaa-url, x-sap-uaa-client-id, x-sap-uaa-client-secret) are optional
+ * and only used for token refresh - they are a separate set of headers.
  */
 function validateDirectJwtAuth(headers, sapUrl, authType) {
-    if (authType !== 'jwt' && authType !== 'xsuaa') {
+    if (authType !== interfaces_1.AUTH_TYPE_JWT && authType !== interfaces_1.AUTH_TYPE_XSUAA) {
         return null;
     }
-    const jwtToken = getHeaderValue(headers, 'x-sap-jwt-token');
+    const jwtToken = getHeaderValue(headers, interfaces_1.HEADER_SAP_JWT_TOKEN);
     if (!jwtToken) {
         return null;
     }
@@ -165,15 +176,23 @@ function validateDirectJwtAuth(headers, sapUrl, authType) {
     const warnings = [];
     // Validate JWT token format (basic check - should start with eyJ)
     if (jwtToken.length < 10) {
-        errors.push('x-sap-jwt-token appears to be invalid (too short)');
+        errors.push(`${interfaces_1.HEADER_SAP_JWT_TOKEN} appears to be invalid (too short)`);
+    }
+    // Extract optional refresh token
+    const refreshToken = getHeaderValue(headers, interfaces_1.HEADER_SAP_REFRESH_TOKEN);
+    // Extract optional UAA config (for token refresh only - separate set of headers)
+    // These are optional and don't affect authorization validation
+    const uaaUrl = getHeaderValue(headers, interfaces_1.HEADER_SAP_UAA_URL) || getHeaderValue(headers, interfaces_1.HEADER_UAA_URL);
+    const uaaClientId = getHeaderValue(headers, interfaces_1.HEADER_SAP_UAA_CLIENT_ID) || getHeaderValue(headers, interfaces_1.HEADER_UAA_CLIENT_ID);
+    const uaaClientSecret = getHeaderValue(headers, interfaces_1.HEADER_SAP_UAA_CLIENT_SECRET) || getHeaderValue(headers, interfaces_1.HEADER_UAA_CLIENT_SECRET);
+    // Validate UAA config completeness if any UAA header is present
+    if (uaaUrl || uaaClientId || uaaClientSecret) {
+        if (!uaaUrl || !uaaClientId || !uaaClientSecret) {
+            warnings.push(`UAA headers (${interfaces_1.HEADER_SAP_UAA_URL}, ${interfaces_1.HEADER_SAP_UAA_CLIENT_ID}, ${interfaces_1.HEADER_SAP_UAA_CLIENT_SECRET}) should be provided together for token refresh`);
+        }
     }
-    // Extract optional tokens and UAA config
-    const refreshToken = getHeaderValue(headers, 'x-sap-refresh-token');
-    const uaaUrl = getHeaderValue(headers, 'x-sap-uaa-url') || getHeaderValue(headers, 'uaa-url');
-    const uaaClientId = getHeaderValue(headers, 'x-sap-uaa-client-id') || getHeaderValue(headers, 'uaa-client-id');
-    const uaaClientSecret = getHeaderValue(headers, 'x-sap-uaa-client-secret') || getHeaderValue(headers, 'uaa-client-secret');
     // Extract optional SAP client
-    const sapClient = getHeaderValue(headers, 'x-sap-client');
+    const sapClient = getHeaderValue(headers, interfaces_1.HEADER_SAP_CLIENT);
     return {
         priority: interfaces_1.AuthMethodPriority.DIRECT_JWT,
         authType,
@@ -192,24 +211,24 @@ function validateDirectJwtAuth(headers, sapUrl, authType) {
  * Validate basic authentication (lowest priority)
  */
 function validateBasicAuth(headers, sapUrl, authType) {
-    if (authType !== 'basic') {
+    if (authType !== interfaces_1.AUTH_TYPE_BASIC) {
         return null;
     }
-    const usernameRaw = headers['x-sap-login'];
-    const passwordRaw = headers['x-sap-password'];
+    const usernameRaw = headers[interfaces_1.HEADER_SAP_LOGIN.toLowerCase()] || headers[interfaces_1.HEADER_SAP_LOGIN];
+    const passwordRaw = headers[interfaces_1.HEADER_SAP_PASSWORD.toLowerCase()] || headers[interfaces_1.HEADER_SAP_PASSWORD];
     if (!usernameRaw || !passwordRaw) {
         return null;
     }
-    const username = getHeaderValue(headers, 'x-sap-login');
-    const password = getHeaderValue(headers, 'x-sap-password');
+    const username = getHeaderValue(headers, interfaces_1.HEADER_SAP_LOGIN);
+    const password = getHeaderValue(headers, interfaces_1.HEADER_SAP_PASSWORD);
     const errors = [];
     const warnings = [];
     // Validate username and password (check if empty after trim)
     if (!username || username.length === 0) {
-        errors.push('x-sap-login header is empty');
+        errors.push(`${interfaces_1.HEADER_SAP_LOGIN} header is empty`);
     }
     if (!password || password.length === 0) {
-        errors.push('x-sap-password header is empty');
+        errors.push(`${interfaces_1.HEADER_SAP_PASSWORD} header is empty`);
     }
     // Return config with errors if validation failed
     if (errors.length > 0) {
@@ -270,7 +289,7 @@ function validateAuthHeaders(headers) {
         }
     }
     // Check for MCP destination (doesn't require x-sap-url, URL comes from destination)
-    const sapUrl = getHeaderValue(headers, 'x-sap-url');
+    const sapUrl = getHeaderValue(headers, interfaces_1.HEADER_SAP_URL);
     const mcpDestinationConfig = validateMcpDestinationAuth(headers, sapUrl);
     if (mcpDestinationConfig) {
         // MCP destination found - URL comes from destination, not header
@@ -302,7 +321,7 @@ function validateAuthHeaders(headers) {
     }
     // Validate URL format
     if (!isValidUrl(sapUrl)) {
-        errors.push(`x-sap-url is not a valid URL: ${sapUrl}`);
+        errors.push(`${interfaces_1.HEADER_SAP_URL} is not a valid URL: ${sapUrl}`);
         return {
             isValid: false,
             errors,
@@ -311,16 +330,32 @@ function validateAuthHeaders(headers) {
     }
     // Try to validate authentication methods in priority order
     const configs = [];
+    // Check if basic auth headers are present (x-sap-login, x-sap-password)
+    // These should come together with x-sap-auth-type: basic
+    const hasSapLogin = !!getHeaderValue(headers, interfaces_1.HEADER_SAP_LOGIN);
+    const hasSapPassword = !!getHeaderValue(headers, interfaces_1.HEADER_SAP_PASSWORD);
+    const hasBasicAuthHeaders = hasSapLogin || hasSapPassword;
+    if (hasBasicAuthHeaders && (!hasSapLogin || !hasSapPassword)) {
+        errors.push(`${interfaces_1.HEADER_SAP_LOGIN} and ${interfaces_1.HEADER_SAP_PASSWORD} must be provided together`);
+    }
     // 3. Other auth methods require x-sap-auth-type
-    const sapAuthType = getHeaderValue(headers, 'x-sap-auth-type');
+    const sapAuthType = getHeaderValue(headers, interfaces_1.HEADER_SAP_AUTH_TYPE);
     if (sapAuthType) {
         // Validate auth type
-        const validAuthTypes = ['jwt', 'xsuaa', 'basic'];
+        const validAuthTypes = [interfaces_1.AUTH_TYPE_JWT, interfaces_1.AUTH_TYPE_XSUAA, interfaces_1.AUTH_TYPE_BASIC];
         const authType = sapAuthType.toLowerCase();
         if (!validAuthTypes.includes(authType)) {
-            errors.push(`x-sap-auth-type must be one of: ${validAuthTypes.join(', ')}, got: ${sapAuthType}`);
+            errors.push(`${interfaces_1.HEADER_SAP_AUTH_TYPE} must be one of: ${validAuthTypes.join(', ')}, got: ${sapAuthType}`);
         }
         else {
+            // Check if basic auth headers are present but auth-type is not basic
+            if (hasBasicAuthHeaders && authType !== interfaces_1.AUTH_TYPE_BASIC) {
+                warnings.push(`${interfaces_1.HEADER_SAP_LOGIN} and ${interfaces_1.HEADER_SAP_PASSWORD} are present but ${interfaces_1.HEADER_SAP_AUTH_TYPE} is not "${interfaces_1.AUTH_TYPE_BASIC}"`);
+            }
+            // Check if auth-type is basic but headers are missing
+            if (authType === interfaces_1.AUTH_TYPE_BASIC && !hasBasicAuthHeaders) {
+                errors.push(`${interfaces_1.HEADER_SAP_AUTH_TYPE} is "${interfaces_1.AUTH_TYPE_BASIC}" but ${interfaces_1.HEADER_SAP_LOGIN} and ${interfaces_1.HEADER_SAP_PASSWORD} are missing`);
+            }
             // Only validate direct JWT and basic auth if MCP destination is not present
             // (MCP destination already handled above)
             if (!mcpDestinationConfig) {
@@ -338,20 +373,25 @@ function validateAuthHeaders(headers) {
         }
     }
     else {
-        // No auth-type provided - check if we have MCP destination or need to error
-        if (!mcpDestinationConfig && !sapDestinationConfig) {
-            errors.push('x-sap-auth-type header is required when x-sap-destination and x-mcp-destination are not present');
+        // No auth-type provided
+        // If basic auth headers are present, auth-type must be basic
+        if (hasBasicAuthHeaders) {
+            errors.push(`${interfaces_1.HEADER_SAP_AUTH_TYPE} must be "${interfaces_1.AUTH_TYPE_BASIC}" when ${interfaces_1.HEADER_SAP_LOGIN} and ${interfaces_1.HEADER_SAP_PASSWORD} are present`);
+        }
+        else if (!mcpDestinationConfig && !sapDestinationConfig) {
+            // No auth-type and no destination - error
+            errors.push(`${interfaces_1.HEADER_SAP_AUTH_TYPE} header is required when ${interfaces_1.HEADER_SAP_DESTINATION_SERVICE} and ${interfaces_1.HEADER_MCP_DESTINATION} are not present`);
         }
     }
     // No valid authentication method found
     if (configs.length === 0) {
         if (sapAuthType) {
             const authType = sapAuthType.toLowerCase();
-            if (authType === 'jwt' || authType === 'xsuaa') {
-                errors.push('JWT authentication requires either x-sap-destination, x-mcp-destination, or x-sap-jwt-token header');
+            if (authType === interfaces_1.AUTH_TYPE_JWT || authType === interfaces_1.AUTH_TYPE_XSUAA) {
+                errors.push(`JWT authentication requires either ${interfaces_1.HEADER_SAP_DESTINATION_SERVICE}, ${interfaces_1.HEADER_MCP_DESTINATION}, or ${interfaces_1.HEADER_SAP_JWT_TOKEN} header`);
             }
-            else if (authType === 'basic') {
-                errors.push('Basic authentication requires x-sap-login and x-sap-password headers');
+            else if (authType === interfaces_1.AUTH_TYPE_BASIC) {
+                errors.push(`Basic authentication requires ${interfaces_1.HEADER_SAP_LOGIN} and ${interfaces_1.HEADER_SAP_PASSWORD} headers`);
             }
         }
         else {
@@ -384,3 +424,105 @@ function validateAuthHeaders(headers) {
         warnings: allWarnings,
     };
 }
+/**
+ * Validate proxy routing headers
+ *
+ * Checks for proxy-specific headers:
+ * - x-btp-destination: BTP Cloud authorization destination
+ * - x-mcp-destination: SAP ABAP connection destination
+ * - x-mcp-url: Direct MCP server URL
+ *
+ * @param headers HTTP headers
+ * @returns Validation result indicating which proxy headers are present
+ */
+function validateProxyHeaders(headers) {
+    const errors = [];
+    const warnings = [];
+    if (!headers) {
+        return {
+            isValid: false,
+            hasBtpDestination: false,
+            hasMcpDestination: false,
+            hasMcpUrl: false,
+            errors: [],
+            warnings: [],
+        };
+    }
+    const btpDestination = getHeaderValue(headers, interfaces_1.HEADER_BTP_DESTINATION);
+    const mcpDestination = getHeaderValue(headers, interfaces_1.HEADER_MCP_DESTINATION);
+    const mcpUrl = getHeaderValue(headers, interfaces_1.HEADER_MCP_URL);
+    const hasBtpDestination = !!btpDestination;
+    const hasMcpDestination = !!mcpDestination;
+    const hasMcpUrl = !!mcpUrl;
+    // Validate destination names if present
+    if (hasBtpDestination && (!btpDestination || btpDestination.trim().length === 0)) {
+        errors.push(`${interfaces_1.HEADER_BTP_DESTINATION} header is empty`);
+    }
+    if (hasMcpDestination && (!mcpDestination || mcpDestination.trim().length === 0)) {
+        errors.push(`${interfaces_1.HEADER_MCP_DESTINATION} header is empty`);
+    }
+    // Validate mcpUrl format if present
+    if (hasMcpUrl) {
+        if (!isValidUrl(mcpUrl)) {
+            errors.push(`${interfaces_1.HEADER_MCP_URL} is not a valid URL: ${mcpUrl}`);
+        }
+    }
+    // At least one proxy header should be present for proxy routing
+    const hasAnyProxyHeader = hasBtpDestination || hasMcpDestination || hasMcpUrl;
+    if (!hasAnyProxyHeader) {
+        warnings.push(`No proxy headers found (${interfaces_1.HEADER_BTP_DESTINATION}, ${interfaces_1.HEADER_MCP_DESTINATION}, or ${interfaces_1.HEADER_MCP_URL})`);
+    }
+    return {
+        isValid: errors.length === 0,
+        hasBtpDestination,
+        hasMcpDestination,
+        hasMcpUrl,
+        errors,
+        warnings,
+    };
+}
+/**
+ * Check if headers indicate a proxy request
+ *
+ * A request is considered a proxy request if it has at least one of:
+ * - x-btp-destination
+ * - x-mcp-destination
+ * - x-mcp-url
+ *
+ * @param headers HTTP headers
+ * @returns true if headers indicate a proxy request
+ */
+function isProxyRequest(headers) {
+    if (!headers) {
+        return false;
+    }
+    const validation = validateProxyHeaders(headers);
+    return validation.hasBtpDestination || validation.hasMcpDestination || validation.hasMcpUrl;
+}
+/**
+ * Check if headers indicate an MCP server request (not proxy)
+ *
+ * An MCP server request has MCP authentication headers but no proxy headers:
+ * - Has x-sap-destination, x-mcp-destination, x-sap-url, x-sap-jwt-token, etc.
+ * - Does NOT have x-btp-destination or x-mcp-url (proxy-specific)
+ *
+ * @param headers HTTP headers
+ * @returns true if headers indicate an MCP server request
+ */
+function isMcpServerRequest(headers) {
+    if (!headers) {
+        return false;
+    }
+    // Check for MCP authentication headers
+    const hasSapDestination = !!getHeaderValue(headers, interfaces_1.HEADER_SAP_DESTINATION_SERVICE);
+    const hasMcpDestination = !!getHeaderValue(headers, interfaces_1.HEADER_MCP_DESTINATION);
+    const hasSapUrl = !!getHeaderValue(headers, interfaces_1.HEADER_SAP_URL);
+    const hasSapJwtToken = !!getHeaderValue(headers, interfaces_1.HEADER_SAP_JWT_TOKEN);
+    // Check for proxy-specific headers
+    const hasBtpDestination = !!getHeaderValue(headers, interfaces_1.HEADER_BTP_DESTINATION);
+    const hasMcpUrl = !!getHeaderValue(headers, interfaces_1.HEADER_MCP_URL);
+    // MCP server request has MCP auth headers but no proxy headers
+    const hasMcpAuthHeaders = hasSapDestination || hasMcpDestination || hasSapUrl || hasSapJwtToken;
+    const hasProxyHeaders = hasBtpDestination || hasMcpUrl;
+    return hasMcpAuthHeaders && !hasProxyHeaders;
+}

package/dist/index.d.ts

@@ -3,5 +3,5 @@
  *
  * Validates and prioritizes authentication headers for MCP ABAP ADT servers
  */
-export { validateAuthHeaders } from './headerValidator';
+export { validateAuthHeaders, validateProxyHeaders, isProxyRequest, isMcpServerRequest, type ProxyHeaderValidationResult, } from './headerValidator';
 export * from './types';

package/dist/index.js

@@ -19,7 +19,10 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.validateAuthHeaders = void 0;
+exports.isMcpServerRequest = exports.isProxyRequest = exports.validateProxyHeaders = exports.validateAuthHeaders = void 0;
 var headerValidator_1 = require("./headerValidator");
 Object.defineProperty(exports, "validateAuthHeaders", { enumerable: true, get: function () { return headerValidator_1.validateAuthHeaders; } });
+Object.defineProperty(exports, "validateProxyHeaders", { enumerable: true, get: function () { return headerValidator_1.validateProxyHeaders; } });
+Object.defineProperty(exports, "isProxyRequest", { enumerable: true, get: function () { return headerValidator_1.isProxyRequest; } });
+Object.defineProperty(exports, "isMcpServerRequest", { enumerable: true, get: function () { return headerValidator_1.isMcpServerRequest; } });
 __exportStar(require("./types"), exports);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/header-validator",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "Header validator for MCP ABAP ADT - validates and prioritizes authentication headers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -37,7 +37,7 @@
     "clean": "rm -rf dist tsconfig.tsbuildinfo",
     "build": "npm run clean --silent && npx tsc -p tsconfig.json",
     "build:fast": "npx tsc -p tsconfig.json",
-    "test": "jest",
+    "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "test:check": "npx tsc --noEmit",
     "prepublishOnly": "npm run build"
   },
@@ -45,12 +45,13 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@mcp-abap-adt/interfaces": "^0.1.1"
+    "@mcp-abap-adt/interfaces": "^0.1.2"
   },
   "devDependencies": {
     "@types/jest": "^30.0.0",
     "@types/node": "^24.2.1",
     "jest": "^30.2.0",
+    "jest-util": "^30.2.0",
     "ts-jest": "^29.2.5",
     "typescript": "^5.9.2"
   }