@mcp-abap-adt/proxy 0.1.4 → 0.1.8

package/dist/lib/stores.js

@@ -1,22 +1,135 @@
 "use strict";
 /**
  * Platform-specific stores for proxy
- * Uses FileServiceKeyStore and either FileSessionStore or SafeSessionStore
+ * Uses XsuaaServiceKeyStore and either XsuaaSessionStore or SafeXsuaaSessionStore
  * depending on the unsafe configuration parameter
  */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getPlatformStores = getPlatformStores;
-const auth_broker_1 = require("@mcp-abap-adt/auth-broker");
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
+/**
+ * Get platform-specific default paths for service keys and sessions
+ *
+ * Priority (matching mcp-abap-adt logic):
+ * 1. AUTH_BROKER_PATH environment variable
+ * 2. Platform-specific standard paths (only if no env paths were found):
+ *    - Unix: ~/.config/mcp-abap-adt/{subfolder}
+ *    - Windows: %USERPROFILE%\Documents\mcp-abap-adt\{subfolder}
+ * 3. Current working directory (process.cwd())
+ *
+ * @param subfolder Subfolder name ('service-keys' or 'sessions')
+ * @returns Array of resolved absolute paths
+ */
+function getPlatformPaths(subfolder) {
+    const paths = [];
+    const isWindows = process.platform === 'win32';
+    // Priority 1: AUTH_BROKER_PATH environment variable
+    const envPath = process.env.AUTH_BROKER_PATH;
+    if (envPath) {
+        // Support both colon (Unix) and semicolon (Windows) separators
+        const envPaths = envPath
+            .split(/[:;]/)
+            .map((p) => p.trim())
+            .filter((p) => p.length > 0);
+        paths.push(...envPaths.map((p) => path.resolve(p)));
+    }
+    // Priority 2: Platform-specific standard paths
+    // Only add platform-specific paths if no custom paths were provided (matching mcp-abap-adt logic)
+    if (paths.length === 0) {
+        const homeDir = os.homedir();
+        if (isWindows) {
+            // Windows: %USERPROFILE%\Documents\mcp-abap-adt\{subfolder}
+            const basePath = path.join(homeDir, 'Documents', 'mcp-abap-adt');
+            if (subfolder) {
+                paths.push(path.join(basePath, subfolder));
+            }
+            else {
+                paths.push(basePath);
+            }
+        }
+        else {
+            // Unix (Linux/macOS): ~/.config/mcp-abap-adt/{subfolder}
+            const basePath = path.join(homeDir, '.config', 'mcp-abap-adt');
+            if (subfolder) {
+                paths.push(path.join(basePath, subfolder));
+            }
+            else {
+                paths.push(basePath);
+            }
+        }
+    }
+    // Priority 3: Current working directory (always added as fallback)
+    paths.push(process.cwd());
+    // Remove duplicates while preserving order
+    const uniquePaths = [];
+    const seen = new Set();
+    for (const p of paths) {
+        const normalized = path.normalize(p);
+        if (!seen.has(normalized)) {
+            seen.add(normalized);
+            uniquePaths.push(normalized);
+        }
+    }
+    return uniquePaths;
+}
 /**
  * Get platform-specific stores
- * Returns stores based on configuration:
- * - If unsafe=true: uses FileSessionStore (persists to disk)
- * - If unsafe=false: uses SafeSessionStore (in-memory, secure)
- * @param unsafe If true, use FileSessionStore. If false, use SafeSessionStore (default).
+ * Returns XSUAA stores for BTP authentication:
+ * - If unsafe=true: uses XsuaaSessionStore (persists to disk)
+ * - If unsafe=false: uses SafeXsuaaSessionStore (in-memory, secure)
+ * - Service key store: XsuaaServiceKeyStore
+ * @param unsafe If true, use XsuaaSessionStore. If false, use SafeXsuaaSessionStore (default).
  */
 async function getPlatformStores(unsafe = false) {
+    // Get platform-specific paths for service keys and sessions
+    const serviceKeyPaths = getPlatformPaths('service-keys');
+    const sessionPaths = getPlatformPaths('sessions');
+    // Stores only support a single directory, use the first path
+    const firstServiceKeyPath = serviceKeyPaths[0] || process.cwd();
+    const firstSessionPath = sessionPaths[0] || process.cwd();
+    const serviceKeyStore = new auth_stores_1.XsuaaServiceKeyStore(firstServiceKeyPath);
+    // Note: XSUAA stores require defaultServiceUrl (cannot be obtained from service key)
+    // For now, we use empty string as placeholder - it will be set when session is created
+    const sessionStore = unsafe
+        ? new auth_stores_1.XsuaaSessionStore(firstSessionPath, '')
+        : new auth_stores_1.SafeXsuaaSessionStore('');
     return {
-        serviceKeyStore: new auth_broker_1.FileServiceKeyStore(),
-        sessionStore: unsafe ? new auth_broker_1.FileSessionStore() : new auth_broker_1.SafeSessionStore(),
+        serviceKeyStore,
+        sessionStore,
     };
 }

package/dist/lib/transportConfig.d.ts

@@ -1,7 +1,7 @@
 /**
  * Transport Configuration - Parse and manage transport settings
  */
-export type TransportType = "stdio" | "streamable-http" | "sse";
+export type TransportType = 'stdio' | 'streamable-http' | 'sse';
 export interface TransportConfig {
     type: TransportType;
     host?: string;

package/dist/lib/transportConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"transportConfig.d.ts","sourceRoot":"","sources":["../../src/lib/transportConfig.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,eAAe,CAgGtD"}
+{"version":3,"file":"transportConfig.d.ts","sourceRoot":"","sources":["../../src/lib/transportConfig.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,iBAAiB,GAAG,KAAK,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,aAAa,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,4BAA4B,CAAC,EAAE,OAAO,CAAC;CACxC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,IAAI,eAAe,CAkItD"}

package/dist/lib/transportConfig.js

@@ -13,70 +13,84 @@ function parseTransportConfig() {
     let transportType = null;
     for (let i = 0; i < args.length; i++) {
         const arg = args[i];
-        if (arg.startsWith("--transport=")) {
-            const value = arg.split("=")[1].toLowerCase();
-            if (value === "stdio" || value === "streamable-http" || value === "http" || value === "sse") {
-                transportType = value === "http" ? "streamable-http" : value;
+        if (arg.startsWith('--transport=')) {
+            const value = arg.split('=')[1].toLowerCase();
+            if (value === 'stdio' ||
+                value === 'streamable-http' ||
+                value === 'http' ||
+                value === 'sse') {
+                transportType =
+                    value === 'http' ? 'streamable-http' : value;
             }
         }
-        if (arg === "--transport" && i + 1 < args.length) {
+        if (arg === '--transport' && i + 1 < args.length) {
             const value = args[i + 1].toLowerCase();
-            if (value === "stdio" || value === "streamable-http" || value === "http" || value === "sse") {
-                transportType = value === "http" ? "streamable-http" : value;
+            if (value === 'stdio' ||
+                value === 'streamable-http' ||
+                value === 'http' ||
+                value === 'sse') {
+                transportType =
+                    value === 'http' ? 'streamable-http' : value;
             }
         }
-        if (arg === "--http")
-            transportType = "streamable-http";
-        if (arg === "--stdio")
-            transportType = "stdio";
-        if (arg === "--sse")
-            transportType = "sse";
+        if (arg === '--http')
+            transportType = 'streamable-http';
+        if (arg === '--stdio')
+            transportType = 'stdio';
+        if (arg === '--sse')
+            transportType = 'sse';
     }
     // Check environment variable
     if (!transportType && process.env.MCP_TRANSPORT) {
         const envTransport = process.env.MCP_TRANSPORT.toLowerCase();
-        if (envTransport === "stdio" || envTransport === "streamable-http" || envTransport === "http" || envTransport === "sse") {
-            transportType = envTransport === "http" ? "streamable-http" : envTransport;
+        if (envTransport === 'stdio' ||
+            envTransport === 'streamable-http' ||
+            envTransport === 'http' ||
+            envTransport === 'sse') {
+            transportType =
+                envTransport === 'http'
+                    ? 'streamable-http'
+                    : envTransport;
         }
     }
     // Auto-detect stdio mode: if stdin is not a TTY, we're likely in stdio mode
     if (!transportType && !process.stdin.isTTY) {
-        transportType = "stdio";
+        transportType = 'stdio';
     }
     // Default to streamable-http if not specified
     if (!transportType) {
-        transportType = "streamable-http";
+        transportType = 'streamable-http';
     }
     // Parse SSE config
-    if (transportType === "sse") {
-        const port = parseInt(getArgValue("--sse-port") || process.env.MCP_SSE_PORT || "3002", 10);
-        const host = getArgValue("--sse-host") || process.env.MCP_SSE_HOST || "0.0.0.0";
+    if (transportType === 'sse') {
+        const port = parseInt(getArgValue('--sse-port') || process.env.MCP_SSE_PORT || '3002', 10);
+        const host = getArgValue('--sse-host') || process.env.MCP_SSE_HOST || '0.0.0.0';
         return {
-            type: "sse",
+            type: 'sse',
             host,
             port,
-            allowedOrigins: parseListOption("--sse-allowed-origins", "MCP_SSE_ALLOWED_ORIGINS"),
-            allowedHosts: parseListOption("--sse-allowed-hosts", "MCP_SSE_ALLOWED_HOSTS"),
-            enableDnsRebindingProtection: parseBooleanOption("--sse-enable-dns-protection", "MCP_SSE_ENABLE_DNS_PROTECTION", false),
+            allowedOrigins: parseListOption('--sse-allowed-origins', 'MCP_SSE_ALLOWED_ORIGINS'),
+            allowedHosts: parseListOption('--sse-allowed-hosts', 'MCP_SSE_ALLOWED_HOSTS'),
+            enableDnsRebindingProtection: parseBooleanOption('--sse-enable-dns-protection', 'MCP_SSE_ENABLE_DNS_PROTECTION', false),
         };
     }
     // Parse HTTP/streamable-http config
-    if (transportType === "streamable-http") {
-        const port = parseInt(getArgValue("--http-port") || process.env.MCP_HTTP_PORT || "3001", 10);
-        const host = getArgValue("--http-host") || process.env.MCP_HTTP_HOST || "0.0.0.0";
+    if (transportType === 'streamable-http') {
+        const port = parseInt(getArgValue('--http-port') || process.env.MCP_HTTP_PORT || '3001', 10);
+        const host = getArgValue('--http-host') || process.env.MCP_HTTP_HOST || '0.0.0.0';
         return {
-            type: "streamable-http",
+            type: 'streamable-http',
             host,
             port,
-            enableJsonResponse: parseBooleanOption("--http-json-response", "MCP_HTTP_ENABLE_JSON_RESPONSE", false),
-            allowedOrigins: parseListOption("--http-allowed-origins", "MCP_HTTP_ALLOWED_ORIGINS"),
-            allowedHosts: parseListOption("--http-allowed-hosts", "MCP_HTTP_ALLOWED_HOSTS"),
-            enableDnsRebindingProtection: parseBooleanOption("--http-enable-dns-protection", "MCP_HTTP_ENABLE_DNS_PROTECTION", false),
+            enableJsonResponse: parseBooleanOption('--http-json-response', 'MCP_HTTP_ENABLE_JSON_RESPONSE', false),
+            allowedOrigins: parseListOption('--http-allowed-origins', 'MCP_HTTP_ALLOWED_ORIGINS'),
+            allowedHosts: parseListOption('--http-allowed-hosts', 'MCP_HTTP_ALLOWED_HOSTS'),
+            enableDnsRebindingProtection: parseBooleanOption('--http-enable-dns-protection', 'MCP_HTTP_ENABLE_DNS_PROTECTION', false),
         };
     }
     // Stdio config (no additional options)
     return {
-        type: "stdio",
+        type: 'stdio',
     };
 }
 /**
@@ -89,7 +103,7 @@ function getArgValue(argName) {
             return args[i + 1];
         }
         if (args[i].startsWith(`${argName}=`)) {
-            return args[i].split("=")[1];
+            return args[i].split('=')[1];
         }
     }
     return undefined;
@@ -100,11 +114,11 @@ function getArgValue(argName) {
 function parseBooleanOption(argName, envName, defaultValue) {
     const argValue = getArgValue(argName);
     if (argValue !== undefined) {
-        return argValue.toLowerCase() === "true" || argValue === "1";
+        return argValue.toLowerCase() === 'true' || argValue === '1';
     }
     const envValue = process.env[envName];
     if (envValue !== undefined) {
-        return envValue.toLowerCase() === "true" || envValue === "1";
+        return envValue.toLowerCase() === 'true' || envValue === '1';
     }
     return defaultValue;
 }
@@ -114,11 +128,17 @@ function parseBooleanOption(argName, envName, defaultValue) {
 function parseListOption(argName, envName) {
     const argValue = getArgValue(argName);
     if (argValue) {
-        return argValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+        return argValue
+            .split(',')
+            .map((s) => s.trim())
+            .filter((s) => s.length > 0);
     }
     const envValue = process.env[envName];
     if (envValue) {
-        return envValue.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+        return envValue
+            .split(',')
+            .map((s) => s.trim())
+            .filter((s) => s.length > 0);
     }
     return undefined;
 }

package/dist/proxy/btpProxy.d.ts

@@ -0,0 +1,102 @@
+/**
+ * BTP Proxy - Proxies requests to MCP servers with JWT authentication
+ *
+ * For requests with x-btp-destination, proxies to target MCP server
+ * with JWT token from auth-broker (XSUAA/BTP)
+ */
+import { AuthBroker } from '@mcp-abap-adt/auth-broker';
+import { type ProxyConfig } from '../lib/config.js';
+import type { RoutingDecision } from '../router/headerAnalyzer.js';
+/**
+ * Check if error messages should be written to stderr
+ * Only output in verbose mode and not in test environment
+ */
+export declare function shouldWriteStderr(): boolean;
+export interface GenericProxyRequest {
+    method: string;
+    url?: string;
+    data?: unknown;
+    id?: string | number | null;
+    [key: string]: unknown;
+}
+export type ProxyRequest = GenericProxyRequest;
+export interface ProxyResponse {
+    jsonrpc: string;
+    id?: string | number | null;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+        data?: unknown;
+    };
+}
+/**
+ * BTP Proxy Client
+ */
+export declare class BtpProxy {
+    private axiosInstance;
+    private defaultBtpAuthBroker;
+    private btpAuthBrokers;
+    private tokenCache;
+    private readonly TOKEN_CACHE_TTL;
+    private circuitBreaker;
+    private config;
+    private unsafe;
+    constructor(defaultBtpAuthBroker: AuthBroker, config?: Partial<ProxyConfig>);
+    /**
+     * Initialize authentication for destination (eager auth)
+     * This triggers the browser authentication flow immediately if needed.
+     */
+    initialize(destination: string): Promise<void>;
+    /**
+     * Get or create BTP auth broker for specific destination
+     * If destination is not provided, returns default broker
+     * If broker doesn't exist in map, creates new one and stores it
+     */
+    private getOrCreateBtpAuthBroker;
+    /**
+     * Helper to ensure valid serviceUrl in session if override provided
+     */
+    private ensureSessionServiceUrl;
+    /**
+     * Get JWT token for BTP destination from auth-broker with retry and token refresh
+     * @param destination Destination name
+     * @param forceRefresh Force token refresh
+     */
+    private getJwtToken;
+    /**
+     * Helper function to extract string value from header (handles arrays)
+     */
+    private getHeaderValue;
+    /**
+     * Build proxy request with JWT token (BTP authentication only)
+     *
+     * Process flow:
+     *
+     * 1. BTP Authentication (XSUAA):
+     *    1.1 If x-btp-destination header exists:
+     *        - Check map for broker with key = destination, get or create, save to map
+     *        - Get token from xsuaa broker
+     *        - Add/replace Authorization: Bearer <token> header
+     *    1.2 If header doesn't exist but --btp parameter exists:
+     *        - Use destination from parameter, get or create broker, save to map
+     *        - Get token from xsuaa broker
+     *        - Add/replace Authorization: Bearer <token> header
+     *    1.3 If neither header nor parameter:
+     *        - Do nothing, pass request further
+     */
+    private buildProxyRequest;
+    /**
+     * Proxy MCP request to target server with retry, circuit breaker, and error handling
+     */
+    proxyRequest(originalRequest: ProxyRequest, routingDecision: RoutingDecision, originalHeaders: Record<string, string | string[] | undefined>): Promise<ProxyResponse>;
+    /**
+     * Create a new BtpProxy instance
+     */
+    static create(config?: Partial<ProxyConfig>): Promise<BtpProxy>;
+}
+/**
+ * Factory function to create BtpProxy
+ */
+export declare function createBtpProxy(config?: Partial<ProxyConfig>): Promise<BtpProxy>;
+//# sourceMappingURL=btpProxy.d.ts.map

package/dist/proxy/btpProxy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAYrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA4CnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3D;;;;OAIG;YACW,wBAAwB;IAqFtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;YACW,WAAW;IAwHzB;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IA8JzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CAyB7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}