@mcp-abap-adt/proxy 0.1.1

package/dist/router/directCloudRouter.js

@@ -0,0 +1,179 @@
+"use strict";
+/**
+ * Direct Cloud Router - Routes requests directly to cloud ABAP systems
+ *
+ * For requests with x-sap-destination (not "sk"), routes directly to cloud ABAP
+ * using the same approach as mcp-abap-adt
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createDirectCloudConfig = createDirectCloudConfig;
+exports.getDirectCloudConnection = getDirectCloudConnection;
+const connection_1 = require("@mcp-abap-adt/connection");
+const logger_js_1 = require("../lib/logger.js");
+/**
+ * Convert validated auth config to direct cloud config
+ */
+function createDirectCloudConfig(routingDecision, headers) {
+    const validatedConfig = routingDecision.validationResult?.config;
+    if (!validatedConfig) {
+        logger_js_1.logger.warn("No validated config available for direct cloud routing", {
+            type: "DIRECT_CLOUD_CONFIG_ERROR",
+            strategy: routingDecision.strategy,
+        });
+        return null;
+    }
+    // Extract SAP URL
+    let sapUrl = validatedConfig.sapUrl;
+    const destination = routingDecision.btpDestination || routingDecision.mcpDestination;
+    if (!sapUrl && destination) {
+        // For destination-based auth, URL comes from destination service key
+        // We'll need to load it from AuthBroker
+        // For now, return null and let the caller handle it
+        logger_js_1.logger.debug("SAP URL not in validated config, will load from destination", {
+            destination: destination,
+        });
+    }
+    // Convert xsuaa to jwt (they're the same for connection purposes)
+    const authType = validatedConfig.authType === "xsuaa" ? "jwt" : validatedConfig.authType;
+    const config = {
+        sapUrl: sapUrl || "", // Will be loaded from destination if needed
+        destination: validatedConfig.destination || destination,
+        authType: authType,
+        sapClient: validatedConfig.sapClient,
+    };
+    // Add JWT-specific fields
+    if (validatedConfig.authType === "jwt" || validatedConfig.authType === "xsuaa") {
+        config.jwtToken = validatedConfig.jwtToken;
+        config.refreshToken = validatedConfig.refreshToken;
+        config.uaaUrl = validatedConfig.uaaUrl;
+        config.uaaClientId = validatedConfig.uaaClientId;
+        config.uaaClientSecret = validatedConfig.uaaClientSecret;
+    }
+    // Add basic auth fields
+    if (validatedConfig.authType === "basic") {
+        config.username = validatedConfig.username;
+        config.password = validatedConfig.password;
+    }
+    return config;
+}
+/**
+ * Connection cache for direct cloud connections
+ */
+const connectionCache = new Map();
+/**
+ * Generate cache key for connection
+ */
+function generateConnectionCacheKey(sessionId, config) {
+    const crypto = require("crypto");
+    const hash = crypto.createHash("sha256");
+    hash.update(sessionId);
+    hash.update(config.sapUrl);
+    hash.update(config.destination || "");
+    hash.update(config.authType);
+    hash.update(config.sapClient || "");
+    return hash.digest("hex");
+}
+/**
+ * Clean up old connections from cache
+ */
+function cleanupConnectionCache() {
+    const now = new Date();
+    const maxAge = 60 * 60 * 1000; // 1 hour
+    for (const [key, entry] of connectionCache.entries()) {
+        const age = now.getTime() - entry.lastUsed.getTime();
+        if (age > maxAge) {
+            logger_js_1.logger.debug("Cleaning up old connection cache entry", {
+                type: "CONNECTION_CACHE_CLEANUP",
+                key: key.substring(0, 16),
+            });
+            connectionCache.delete(key);
+        }
+    }
+}
+/**
+ * Get or create ABAP connection for direct cloud routing
+ */
+async function getDirectCloudConnection(sessionId, config, authBroker) {
+    // Clean up old entries periodically
+    if (connectionCache.size > 100) {
+        cleanupConnectionCache();
+    }
+    const cacheKey = generateConnectionCacheKey(sessionId, config);
+    let entry = connectionCache.get(cacheKey);
+    // If we have a destination and no SAP URL, load it from AuthBroker
+    if (config.destination && !config.sapUrl && authBroker) {
+        try {
+            // Get token from AuthBroker (this will also provide the SAP URL from destination)
+            const token = await authBroker.getToken(config.destination);
+            config.jwtToken = token;
+            // Load destination config to get SAP URL from AuthBroker
+            // AuthBroker stores session data, we can access it through the broker
+            // For now, we'll rely on the token being valid and the URL being set from destination
+            // The actual URL will be loaded when we create the connection
+        }
+        catch (error) {
+            logger_js_1.logger.error("Failed to load destination config from AuthBroker", {
+                type: "AUTH_BROKER_LOAD_ERROR",
+                destination: config.destination,
+                error: error instanceof Error ? error.message : String(error),
+            });
+            throw error;
+        }
+    }
+    if (!entry || entry.configSignature !== cacheKey) {
+        logger_js_1.logger.debug("Creating new direct cloud connection", {
+            type: "DIRECT_CLOUD_CONNECTION_CREATE",
+            sessionId: sessionId.substring(0, 8),
+            destination: config.destination,
+            sapUrl: config.sapUrl,
+        });
+        // Dispose old connection if exists
+        if (entry) {
+            // Connection disposal will be handled by connection package
+        }
+        // Create SAP config for connection
+        const sapConfig = {
+            url: config.sapUrl,
+            authType: config.authType,
+            jwtToken: config.jwtToken,
+            refreshToken: config.refreshToken,
+            username: config.username,
+            password: config.password,
+            sapClient: config.sapClient,
+            uaaUrl: config.uaaUrl,
+            uaaClientId: config.uaaClientId,
+            uaaClientSecret: config.uaaClientSecret,
+        };
+        // Create connection
+        const connectionSessionId = `mcp-proxy-direct-${sessionId}`;
+        const sessionStorage = new connection_1.FileSessionStorage();
+        const connection = (0, connection_1.createAbapConnection)(sapConfig, logger_js_1.logger, // Use our logger
+        sessionStorage, connectionSessionId);
+        // Connect
+        try {
+            await connection.connect();
+        }
+        catch (error) {
+            logger_js_1.logger.error("Failed to connect to cloud ABAP", {
+                type: "DIRECT_CLOUD_CONNECTION_ERROR",
+                error: error instanceof Error ? error.message : String(error),
+                destination: config.destination,
+            });
+            throw error;
+        }
+        entry = {
+            connection,
+            configSignature: cacheKey,
+            lastUsed: new Date(),
+        };
+        connectionCache.set(cacheKey, entry);
+    }
+    else {
+        entry.lastUsed = new Date();
+        logger_js_1.logger.debug("Reusing cached direct cloud connection", {
+            type: "DIRECT_CLOUD_CONNECTION_REUSE",
+            sessionId: sessionId.substring(0, 8),
+        });
+    }
+    return entry.connection;
+}

package/dist/router/headerAnalyzer.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Header Analyzer - Analyzes HTTP headers to determine routing strategy
+ */
+import { IncomingHttpHeaders } from "http";
+import { HeaderValidationResult } from "@mcp-abap-adt/header-validator";
+export declare enum RoutingStrategy {
+    /** Proxy request with JWT authentication */
+    PROXY = "proxy",
+    /** Unknown/unsupported - should not route */
+    UNKNOWN = "unknown"
+}
+export interface RoutingDecision {
+    strategy: RoutingStrategy;
+    btpDestination?: string;
+    mcpDestination?: string;
+    mcpUrl?: string;
+    reason: string;
+    validationResult?: HeaderValidationResult;
+}
+/**
+ * Analyze headers and extract routing information
+ * Proxy needs either:
+ * - x-btp-destination (or --btp): destination for BTP Cloud authorization token (Authorization: Bearer) and MCP server URL
+ * - x-mcp-destination (or --mcp): destination for SAP ABAP connection (SAP headers) - can be used without BTP for local testing
+ *
+ * Also supports:
+ * - x-mcp-url (or --mcp-url): direct MCP server URL (used when no BTP destination is provided, for local testing)
+ *
+ * Command-line overrides:
+ * - --btp=<destination>: overrides x-btp-destination header
+ * - --mcp=<destination>: overrides x-mcp-destination header
+ * - --mcp-url=<url>: overrides x-mcp-url header (for local testing without BTP)
+ *
+ * MCP server URL is obtained from:
+ * - x-mcp-url header or --mcp-url parameter (if provided) - takes precedence
+ * - service key for x-btp-destination (via auth-broker) if BTP destination is present
+ * - service key for x-mcp-destination (via auth-broker) if only MCP destination is present
+ */
+export declare function analyzeHeaders(headers: IncomingHttpHeaders, configOverrides?: {
+    btpDestination?: string;
+    mcpDestination?: string;
+    mcpUrl?: string;
+}): RoutingDecision;
+/**
+ * Check if headers indicate a request that should be proxied
+ */
+export declare function shouldProxy(headers: IncomingHttpHeaders): boolean;
+//# sourceMappingURL=headerAnalyzer.d.ts.map

package/dist/router/headerAnalyzer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"headerAnalyzer.d.ts","sourceRoot":"","sources":["../../src/router/headerAnalyzer.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EAA2C,sBAAsB,EAAE,MAAM,gCAAgC,CAAC;AAGjH,oBAAY,eAAe;IACzB,4CAA4C;IAC5C,KAAK,UAAU;IACf,6CAA6C;IAC7C,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,eAAe,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;CAC3C;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,mBAAmB,EAC5B,eAAe,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF,eAAe,CAyFjB;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAGjE"}

package/dist/router/headerAnalyzer.js

@@ -0,0 +1,124 @@
+"use strict";
+/**
+ * Header Analyzer - Analyzes HTTP headers to determine routing strategy
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RoutingStrategy = void 0;
+exports.analyzeHeaders = analyzeHeaders;
+exports.shouldProxy = shouldProxy;
+const header_validator_1 = require("@mcp-abap-adt/header-validator");
+const logger_js_1 = require("../lib/logger.js");
+var RoutingStrategy;
+(function (RoutingStrategy) {
+    /** Proxy request with JWT authentication */
+    RoutingStrategy["PROXY"] = "proxy";
+    /** Unknown/unsupported - should not route */
+    RoutingStrategy["UNKNOWN"] = "unknown";
+})(RoutingStrategy || (exports.RoutingStrategy = RoutingStrategy = {}));
+/**
+ * Analyze headers and extract routing information
+ * Proxy needs either:
+ * - x-btp-destination (or --btp): destination for BTP Cloud authorization token (Authorization: Bearer) and MCP server URL
+ * - x-mcp-destination (or --mcp): destination for SAP ABAP connection (SAP headers) - can be used without BTP for local testing
+ *
+ * Also supports:
+ * - x-mcp-url (or --mcp-url): direct MCP server URL (used when no BTP destination is provided, for local testing)
+ *
+ * Command-line overrides:
+ * - --btp=<destination>: overrides x-btp-destination header
+ * - --mcp=<destination>: overrides x-mcp-destination header
+ * - --mcp-url=<url>: overrides x-mcp-url header (for local testing without BTP)
+ *
+ * MCP server URL is obtained from:
+ * - x-mcp-url header or --mcp-url parameter (if provided) - takes precedence
+ * - service key for x-btp-destination (via auth-broker) if BTP destination is present
+ * - service key for x-mcp-destination (via auth-broker) if only MCP destination is present
+ */
+function analyzeHeaders(headers, configOverrides) {
+    // Validate headers using header-validator
+    const validationResult = (0, header_validator_1.validateAuthHeaders)(headers);
+    const validatedConfig = validationResult.config;
+    // Helper function to extract string value from header (handles arrays)
+    const getHeaderValue = (headerValue) => {
+        if (!headerValue)
+            return undefined;
+        if (Array.isArray(headerValue)) {
+            return headerValue[0]?.trim();
+        }
+        return typeof headerValue === "string" ? headerValue.trim() : undefined;
+    };
+    // Extract authorization destination for BTP Cloud (x-btp-destination)
+    // Command-line parameter --btp takes precedence over header
+    const btpDestinationHeader = getHeaderValue(headers["x-btp-destination"]);
+    const extractedBtpDestination = configOverrides?.btpDestination
+        ? configOverrides.btpDestination
+        : btpDestinationHeader;
+    // Extract destination for SAP ABAP connection (x-mcp-destination)
+    // Command-line parameter --mcp takes precedence over header
+    const mcpDestinationHeader = getHeaderValue(headers["x-mcp-destination"]);
+    const extractedMcpDestination = configOverrides?.mcpDestination
+        ? configOverrides.mcpDestination
+        : mcpDestinationHeader;
+    // Extract direct MCP server URL (x-mcp-url)
+    // Command-line parameter --mcp-url takes precedence over header
+    const mcpUrlHeader = getHeaderValue(headers["x-mcp-url"]);
+    const extractedMcpUrl = configOverrides?.mcpUrl
+        ? configOverrides.mcpUrl
+        : mcpUrlHeader;
+    // Allow proxying if either:
+    // 1. BTP destination is present, OR
+    // 2. MCP destination is present, OR
+    // 3. MCP URL is provided (for local testing without BTP)
+    // This enables local testing without BTP authentication
+    if (!extractedBtpDestination && !extractedMcpDestination && !extractedMcpUrl) {
+        logger_js_1.logger.warn("Neither x-btp-destination/x-mcp-destination/x-mcp-url header nor --btp/--mcp/--mcp-url parameter is provided", {
+            headers: Object.keys(headers).filter(k => k.toLowerCase().startsWith("x-")),
+            hasBtpConfigOverride: !!configOverrides?.btpDestination,
+            hasMcpConfigOverride: !!configOverrides?.mcpDestination,
+            hasMcpUrlConfigOverride: !!configOverrides?.mcpUrl,
+        });
+        return {
+            strategy: RoutingStrategy.UNKNOWN,
+            reason: "Either x-btp-destination/--btp, x-mcp-destination/--mcp, or x-mcp-url/--mcp-url parameter is required for proxying",
+            validationResult,
+        };
+    }
+    // If only MCP URL is provided without destination, we still need either mcpDestination or btpDestination
+    // unless mcpUrl is a full URL that can be used directly
+    if (!extractedBtpDestination && !extractedMcpDestination && extractedMcpUrl) {
+        // This is OK - we can use mcpUrl directly for local testing
+        logger_js_1.logger.debug("Using MCP URL directly for local testing (no destination required)", {
+            type: "MCP_URL_DIRECT",
+            mcpUrl: extractedMcpUrl,
+        });
+    }
+    // If x-btp-destination is present, we can proxy with BTP authentication (URL will be obtained from service key)
+    // If only x-mcp-destination is present, we can proxy without BTP authentication (for local testing)
+    // If x-mcp-url is provided, we can use it directly (for local testing)
+    logger_js_1.logger.debug("Routing decision: PROXY", {
+        btpDestination: extractedBtpDestination,
+        mcpDestination: extractedMcpDestination,
+        mcpUrl: extractedMcpUrl || "not provided",
+        priority: validatedConfig?.priority,
+    });
+    const reason = extractedBtpDestination
+        ? `Proxying to MCP server from BTP destination "${extractedBtpDestination}"${extractedMcpDestination ? ` with MCP destination "${extractedMcpDestination}"` : ''}`
+        : extractedMcpUrl
+            ? `Proxying to MCP server at "${extractedMcpUrl}" (no BTP authentication - local testing mode)${extractedMcpDestination ? ` with MCP destination "${extractedMcpDestination}"` : ''}`
+            : `Proxying to MCP server with MCP destination "${extractedMcpDestination}" (no BTP authentication - local testing mode)`;
+    return {
+        strategy: RoutingStrategy.PROXY,
+        btpDestination: extractedBtpDestination, // Optional - only used if provided
+        mcpDestination: extractedMcpDestination, // Optional - only used if provided
+        mcpUrl: extractedMcpUrl, // Optional - direct URL if provided (takes precedence)
+        reason,
+        validationResult,
+    };
+}
+/**
+ * Check if headers indicate a request that should be proxied
+ */
+function shouldProxy(headers) {
+    const decision = analyzeHeaders(headers);
+    return decision.strategy === RoutingStrategy.PROXY;
+}

package/dist/router/localBasicRouter.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Local Basic Router - Handles basic authentication requests locally
+ *
+ * For requests with x-sap-auth-type: "basic", handles locally without proxying
+ */
+import { IncomingHttpHeaders } from "http";
+import { AbapConnection } from "@mcp-abap-adt/connection";
+import { RoutingDecision } from "./headerAnalyzer.js";
+export interface LocalBasicConfig {
+    sapUrl: string;
+    username: string;
+    password: string;
+    sapClient?: string;
+}
+/**
+ * Convert validated auth config to local basic config
+ */
+export declare function createLocalBasicConfig(routingDecision: RoutingDecision, headers: IncomingHttpHeaders): LocalBasicConfig | null;
+/**
+ * Get or create ABAP connection for local basic auth
+ */
+export declare function getLocalBasicConnection(sessionId: string, config: LocalBasicConfig): Promise<AbapConnection>;
+//# sourceMappingURL=localBasicRouter.d.ts.map

package/dist/router/localBasicRouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localBasicRouter.d.ts","sourceRoot":"","sources":["../../src/router/localBasicRouter.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,MAAM,CAAC;AAC3C,OAAO,EAAwB,cAAc,EAAsB,MAAM,0BAA0B,CAAC;AAEpG,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtD,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,eAAe,EAAE,eAAe,EAChC,OAAO,EAAE,mBAAmB,GAC3B,gBAAgB,GAAG,IAAI,CAkCzB;AA2CD;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC,cAAc,CAAC,CAoEzB"}

package/dist/router/localBasicRouter.js

@@ -0,0 +1,140 @@
+"use strict";
+/**
+ * Local Basic Router - Handles basic authentication requests locally
+ *
+ * For requests with x-sap-auth-type: "basic", handles locally without proxying
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createLocalBasicConfig = createLocalBasicConfig;
+exports.getLocalBasicConnection = getLocalBasicConnection;
+const connection_1 = require("@mcp-abap-adt/connection");
+const logger_js_1 = require("../lib/logger.js");
+/**
+ * Convert validated auth config to local basic config
+ */
+function createLocalBasicConfig(routingDecision, headers) {
+    const validatedConfig = routingDecision.validationResult?.config;
+    if (!validatedConfig) {
+        logger_js_1.logger.warn("No validated config available for local basic routing", {
+            type: "LOCAL_BASIC_CONFIG_ERROR",
+            strategy: routingDecision.strategy,
+        });
+        return null;
+    }
+    if (validatedConfig.authType !== "basic") {
+        logger_js_1.logger.warn("Config is not basic auth type", {
+            type: "LOCAL_BASIC_CONFIG_TYPE_ERROR",
+            authType: validatedConfig.authType,
+        });
+        return null;
+    }
+    if (!validatedConfig.sapUrl || !validatedConfig.username || !validatedConfig.password) {
+        logger_js_1.logger.warn("Missing required fields for basic auth", {
+            type: "LOCAL_BASIC_CONFIG_MISSING",
+            hasUrl: !!validatedConfig.sapUrl,
+            hasUsername: !!validatedConfig.username,
+            hasPassword: !!validatedConfig.password,
+        });
+        return null;
+    }
+    return {
+        sapUrl: validatedConfig.sapUrl,
+        username: validatedConfig.username,
+        password: validatedConfig.password,
+        sapClient: validatedConfig.sapClient,
+    };
+}
+/**
+ * Connection cache for local basic connections
+ */
+const connectionCache = new Map();
+/**
+ * Generate cache key for connection
+ */
+function generateConnectionCacheKey(sessionId, config) {
+    const crypto = require("crypto");
+    const hash = crypto.createHash("sha256");
+    hash.update(sessionId);
+    hash.update(config.sapUrl);
+    hash.update(config.username);
+    hash.update(config.sapClient || "");
+    return hash.digest("hex");
+}
+/**
+ * Clean up old connections from cache
+ */
+function cleanupConnectionCache() {
+    const now = new Date();
+    const maxAge = 60 * 60 * 1000; // 1 hour
+    for (const [key, entry] of connectionCache.entries()) {
+        const age = now.getTime() - entry.lastUsed.getTime();
+        if (age > maxAge) {
+            logger_js_1.logger.debug("Cleaning up old local basic connection cache entry", {
+                type: "LOCAL_BASIC_CACHE_CLEANUP",
+                key: key.substring(0, 16),
+            });
+            connectionCache.delete(key);
+        }
+    }
+}
+/**
+ * Get or create ABAP connection for local basic auth
+ */
+async function getLocalBasicConnection(sessionId, config) {
+    // Clean up old entries periodically
+    if (connectionCache.size > 100) {
+        cleanupConnectionCache();
+    }
+    const cacheKey = generateConnectionCacheKey(sessionId, config);
+    let entry = connectionCache.get(cacheKey);
+    if (!entry || entry.configSignature !== cacheKey) {
+        logger_js_1.logger.debug("Creating new local basic connection", {
+            type: "LOCAL_BASIC_CONNECTION_CREATE",
+            sessionId: sessionId.substring(0, 8),
+            sapUrl: config.sapUrl,
+        });
+        // Dispose old connection if exists
+        if (entry) {
+            // Connection disposal will be handled by connection package
+        }
+        // Create SAP config for connection
+        const sapConfig = {
+            url: config.sapUrl,
+            authType: "basic",
+            username: config.username,
+            password: config.password,
+            client: config.sapClient,
+        };
+        // Create connection
+        const connectionSessionId = `mcp-proxy-basic-${sessionId}`;
+        const sessionStorage = new connection_1.FileSessionStorage();
+        const connection = (0, connection_1.createAbapConnection)(sapConfig, logger_js_1.logger, // Use our logger
+        sessionStorage, connectionSessionId);
+        // Connect
+        try {
+            await connection.connect();
+        }
+        catch (error) {
+            logger_js_1.logger.error("Failed to connect to ABAP with basic auth", {
+                type: "LOCAL_BASIC_CONNECTION_ERROR",
+                error: error instanceof Error ? error.message : String(error),
+                sapUrl: config.sapUrl,
+            });
+            throw error;
+        }
+        entry = {
+            connection,
+            configSignature: cacheKey,
+            lastUsed: new Date(),
+        };
+        connectionCache.set(cacheKey, entry);
+    }
+    else {
+        entry.lastUsed = new Date();
+        logger_js_1.logger.debug("Reusing cached local basic connection", {
+            type: "LOCAL_BASIC_CONNECTION_REUSE",
+            sessionId: sessionId.substring(0, 8),
+        });
+    }
+    return entry.connection;
+}

package/dist/router/requestInterceptor.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Request Interceptor - Intercepts and analyzes MCP requests
+ */
+import { IncomingMessage } from "http";
+import { RoutingDecision } from "./headerAnalyzer.js";
+export interface InterceptedRequest {
+    method: string;
+    url: string;
+    headers: Record<string, string | string[] | undefined>;
+    body?: any;
+    routingDecision: RoutingDecision;
+    sessionId?: string;
+    clientId?: string;
+}
+/**
+ * Intercept and analyze incoming HTTP request
+ */
+export declare function interceptRequest(req: IncomingMessage, body?: any, configOverrides?: {
+    btpDestination?: string;
+    mcpDestination?: string;
+    mcpUrl?: string;
+}): InterceptedRequest;
+/**
+ * Check if request requires SAP configuration
+ * Only tools/call requires SAP config - all other methods don't
+ */
+export declare function requiresSapConfig(body: any): boolean;
+/**
+ * Sanitize headers for logging (remove sensitive data)
+ */
+export declare function sanitizeHeadersForLogging(headers: Record<string, string | string[] | undefined>): Record<string, string>;
+//# sourceMappingURL=requestInterceptor.d.ts.map

package/dist/router/requestInterceptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestInterceptor.d.ts","sourceRoot":"","sources":["../../src/router/requestInterceptor.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,eAAe,EAAE,MAAM,MAAM,CAAC;AACvC,OAAO,EAAkB,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAGtE,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC;IACvD,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,eAAe,EAAE,eAAe,CAAC;IACjC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,eAAe,EACpB,IAAI,CAAC,EAAE,GAAG,EACV,eAAe,CAAC,EAAE;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GACtF,kBAAkB,CAuCpB;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,GAAG,GAAG,OAAO,CAOpD;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GACrD,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBxB"}

package/dist/router/requestInterceptor.js

@@ -0,0 +1,82 @@
+"use strict";
+/**
+ * Request Interceptor - Intercepts and analyzes MCP requests
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.interceptRequest = interceptRequest;
+exports.requiresSapConfig = requiresSapConfig;
+exports.sanitizeHeadersForLogging = sanitizeHeadersForLogging;
+const headerAnalyzer_js_1 = require("./headerAnalyzer.js");
+const logger_js_1 = require("../lib/logger.js");
+/**
+ * Intercept and analyze incoming HTTP request
+ */
+function interceptRequest(req, body, configOverrides) {
+    // Extract headers
+    const headers = {};
+    for (const [key, value] of Object.entries(req.headers)) {
+        headers[key] = value;
+    }
+    // Analyze headers for routing decision (with config overrides)
+    const routingDecision = (0, headerAnalyzer_js_1.analyzeHeaders)(req.headers, configOverrides);
+    // Extract session ID if present
+    const sessionId = (req.headers["x-session-id"] ||
+        req.headers["mcp-session-id"] ||
+        req.headers["x-mcp-session-id"]);
+    // Generate client ID
+    const clientId = `${req.socket.remoteAddress}:${req.socket.remotePort}`;
+    // Log intercepted request
+    logger_js_1.logger.debug("Request intercepted", {
+        type: "REQUEST_INTERCEPTED",
+        method: req.method,
+        url: req.url,
+        clientId,
+        sessionId,
+        routingStrategy: routingDecision.strategy,
+        routingReason: routingDecision.reason,
+    });
+    return {
+        method: req.method || "GET",
+        url: req.url || "/",
+        headers,
+        body,
+        routingDecision,
+        sessionId,
+        clientId,
+    };
+}
+/**
+ * Check if request requires SAP configuration
+ * Only tools/call requires SAP config - all other methods don't
+ */
+function requiresSapConfig(body) {
+    if (!body || typeof body !== "object") {
+        return false;
+    }
+    const method = body.method;
+    return method === "tools/call";
+}
+/**
+ * Sanitize headers for logging (remove sensitive data)
+ */
+function sanitizeHeadersForLogging(headers) {
+    const sanitized = {};
+    const sensitiveKeys = [
+        "authorization",
+        "x-sap-jwt-token",
+        "x-sap-refresh-token",
+        "x-sap-password",
+        "x-sap-uaa-client-secret",
+    ];
+    for (const [key, value] of Object.entries(headers)) {
+        if (sensitiveKeys.includes(key.toLowerCase())) {
+            sanitized[key] = "[REDACTED]";
+        }
+        else {
+            sanitized[key] = Array.isArray(value)
+                ? value.join(", ")
+                : (value || "");
+        }
+    }
+    return sanitized;
+}