@mcp-abap-adt/proxy 1.5.0 → 1.6.0

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.6.0] - 2026-06-04
+
+### Added
+- **Environment-variable interpolation in config + `.env` support.** Config string values (and `--header` values) may now contain `${VAR}` / `${VAR:-default}` placeholders, resolved from `process.env` and an explicitly-pointed `.env` file. This makes `defaultHeaders` the per-user auth-injection point for ABAP credentials (`x-sap-login` / `x-sap-password`) on shared servers like `cloud-llm-hub` — **without** storing secrets as plaintext in the YAML. (#4, #5)
+  - `.env` source is explicit only: `envFile: <path>` in the config (resolved relative to the config file's directory) or `--env-file <path>` on the command line (overrides `envFile`). There is no `cwd` auto-discovery.
+  - Resolution priority: `process.env` → `.env` → `${VAR:-default}`. `process.env` wins over the `.env` file.
+  - **Fail-fast:** a `${VAR}` without a default that cannot be resolved aborts startup with an error naming the variable and the field it came from, so a request never silently goes out with an empty credential.
+  - `Authorization` remains proxy-managed (destination JWT) and cannot be set via `defaultHeaders`.
+
 ## [1.5.0] - 2026-06-02
 
 ### Added

package/README.md

@@ -98,7 +98,7 @@ For detailed setup instructions for Cline and GitHub Copilot, see the **[Client
 
 MCP clients like Cline and Claude Code cannot set arbitrary request headers. Use default headers to inject SAP-specific headers (e.g. `x-sap-destination`, `x-sap-client`) that the target MCP server requires.
 
-Client-supplied headers always take precedence over defaults.
+Precedence: client-supplied request headers always win over `defaultHeaders`. `Authorization` is the exception — it is always managed by the proxy (replaced with the destination JWT) and **cannot** be set via `defaultHeaders`.
 
 Via YAML config (`defaultHeaders` map):
 ```yaml
@@ -109,6 +109,28 @@ defaultHeaders:
   x-sap-client: "100"
 ```
 
+**Per-user ABAP credentials.** `defaultHeaders` is the supported place to supply your own SAP login/password for on-premise / `NoAuthentication` destinations. The upstream `cloud-llm-hub` is a **shared** server with no default service user, so it expects each caller's own `x-sap-login` / `x-sap-password` on every request. Because the proxy runs **locally on each user's machine**, it carries *your* identity.
+
+Do not hardcode secrets. Reference environment variables with `${VAR}` (or `${VAR:-default}`); values are resolved from `process.env` or an explicitly-pointed `.env` file:
+
+```yaml
+btpDestination: mcp
+envFile: secrets.env            # resolved relative to this config file's dir
+defaultHeaders:
+  x-sap-destination: S4HANA_E19
+  x-sap-login: ${SAP_USER}
+  x-sap-password: ${SAP_PASSWORD}
+```
+
+`secrets.env` (user-local, `chmod 600`, never committed):
+
+```dotenv
+SAP_USER=MY_SAP_USER
+SAP_PASSWORD=my-sap-password
+```
+
+Resolution order is `process.env` → `.env` → `${VAR:-default}`. `process.env` wins; an unresolved `${VAR}` without a default fails the proxy at startup. Override the `.env` path at launch with `--env-file <path>`. This closes both auth layers from one local config: the **service layer** (`Authorization: Bearer <JWT>`, from the destination service key) and the **ABAP layer** (`x-sap-login` / `x-sap-password`).
+
 Via CLI (`--header`, repeatable):
 ```bash
 mcp-abap-adt-proxy --btp=mcp --url=https://example.com \

package/bin/mcp-abap-adt-proxy.js

@@ -56,9 +56,13 @@ Options:
                            Useful for direct OData service testing or non-standard MCP URLs
   --config=<file>, -c     Load configuration from YAML or JSON file
                            Alternative to command-line parameters
+  --env-file=<path>        Load a .env file for ${VAR} interpolation in config/headers
+                           Overrides the config's "envFile" field
   --unsafe                 Enable file-based session storage (persists tokens to disk)
   --header key=value       Add default header to every forwarded request (repeatable)
+                           Values support ${VAR} / ${VAR:-default} interpolation
                            Example: --header x-sap-destination=S4HANA
+                           Example: --header x-sap-password=${SAP_PASSWORD}
   --help, -h              Show this help message
   --version, -v           Show version number
 

package/dist/lib/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGxC,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CAyB3D;AAwED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,mBAAmB,CAQrB;AAgBD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AA4ID;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAUD;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAoDA"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/lib/config.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IAEjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAGxC,MAAM,CAAC,EAAE,OAAO,CAAC;IAEjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAG/B,OAAO,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,MAAM,CAAC;IACzE,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED;;;;;;;GAOG;AACH,wBAAgB,UAAU,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,WAAW,CAoC3D;AAwED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,sBAAsB,CACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,mBAAmB,CAQrB;AAkCD;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAYhC;AAmJD;;GAEG;AACH,wBAAgB,aAAa,IAAI,MAAM,GAAG,SAAS,CAElD;AAUD;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,GAAG;IACnD,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAoDA"}

package/dist/lib/config.js

@@ -44,6 +44,7 @@ exports.validateConfig = validateConfig;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const yaml = __importStar(require("js-yaml"));
+const envInterpolation_js_1 = require("./envInterpolation.js");
 /**
  * Load configuration from file if --config is provided, otherwise from environment variables and command line
  * Supports both JSON and YAML formats
@@ -64,7 +65,12 @@ function loadConfig(configPath) {
                 throw new Error(`Config file not found: ${finalConfigPath}`);
             }
             const fileConfig = loadConfigFile(finalConfigPath);
-            const base = applyDefaults(fileConfig);
+            const envFilePath = resolveEnvFilePath(fileConfig, finalConfigPath);
+            const envFileMap = envFilePath ? (0, envInterpolation_js_1.loadEnvFile)(envFilePath) : {};
+            const lookup = (0, envInterpolation_js_1.buildLookup)(envFileMap);
+            const interpolated = (0, envInterpolation_js_1.interpolateConfig)(fileConfig, lookup);
+            delete interpolated.envFile;
+            const base = applyDefaults(interpolated);
             const cli = readCliOverrides();
             return mergeCliOverrides(base, cli, finalConfigPath);
         }
@@ -155,6 +161,21 @@ function loadConfigFile(filePath) {
         return JSON.parse(configContent);
     }
 }
+/**
+ * Resolve the .env path for the file-config path: --env-file wins (relative to
+ * cwd); otherwise the YAML `envFile` field, resolved relative to the config
+ * file's directory. Returns undefined when neither is set.
+ */
+function resolveEnvFilePath(rawConfig, configPath) {
+    const cliEnvFile = getArgValue('--env-file');
+    if (cliEnvFile !== undefined)
+        return path.resolve(cliEnvFile);
+    const yamlEnvFile = rawConfig.envFile;
+    if (typeof yamlEnvFile === 'string') {
+        return path.resolve(path.dirname(configPath), yamlEnvFile);
+    }
+    return undefined;
+}
 /**
  * Load raw config from file for transport field extraction
  */
@@ -210,17 +231,20 @@ function loadFromEnv() {
     const browserAuthPort = browserAuthPortStr
         ? parseInt(browserAuthPortStr, 10)
         : undefined;
-    // Parse repeatable --header key=value arguments
+    // Parse repeatable --header key=value arguments, interpolating ${VAR}
     const headerArgs = getAllArgValues('--header');
     let defaultHeaders;
     if (headerArgs.length > 0) {
+        const cliEnvFile = getArgValue('--env-file');
+        const envFileMap = cliEnvFile ? (0, envInterpolation_js_1.loadEnvFile)(path.resolve(cliEnvFile)) : {};
+        const lookup = (0, envInterpolation_js_1.buildLookup)(envFileMap);
         defaultHeaders = {};
         for (const arg of headerArgs) {
             const eqIndex = arg.indexOf('=');
             if (eqIndex > 0) {
                 const key = arg.substring(0, eqIndex).toLowerCase();
-                const value = arg.substring(eqIndex + 1);
-                defaultHeaders[key] = value;
+                const rawValue = arg.substring(eqIndex + 1);
+                defaultHeaders[key] = (0, envInterpolation_js_1.interpolateString)(rawValue, lookup, `--header ${key}`);
             }
         }
     }

package/dist/lib/envInterpolation.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Environment-variable interpolation for proxy configuration.
+ * Supports ${VAR} and ${VAR:-default} in string values.
+ */
+/**
+ * Resolve ${VAR} / ${VAR:-default} placeholders in a single string.
+ * Empty-string follows bash `:-` semantics: an empty value falls back to the
+ * default when one is given. A ${VAR} without a default that resolves to
+ * undefined throws, naming the variable and the field it came from.
+ */
+export declare function interpolateString(input: string, lookup: (key: string) => string | undefined, fieldPath: string): string;
+/**
+ * Recursively interpolate all string values in a parsed config object.
+ * Objects/arrays are walked; non-string scalars are returned unchanged.
+ * The field path (e.g. `defaultHeaders.x-sap-password`) is threaded through for
+ * error messages.
+ */
+export declare function interpolateConfig(value: unknown, lookup: (key: string) => string | undefined, path?: string): unknown;
+/**
+ * Parse a .env file into a flat map. Throws if the path is given but missing —
+ * a specified-yet-absent secret source is a configuration error, not a no-op.
+ */
+export declare function loadEnvFile(envFilePath: string): Record<string, string>;
+/**
+ * Build a lookup over process.env (highest priority) then the parsed .env map.
+ */
+export declare function buildLookup(envFileMap: Record<string, string>): (key: string) => string | undefined;
+//# sourceMappingURL=envInterpolation.d.ts.map

package/dist/lib/envInterpolation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"envInterpolation.d.ts","sourceRoot":"","sources":["../../src/lib/envInterpolation.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC3C,SAAS,EAAE,MAAM,GAChB,MAAM,CAiBR;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,OAAO,EACd,MAAM,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,EAC3C,IAAI,SAAK,GACR,OAAO,CAiBT;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAKvE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GACjC,CAAC,GAAG,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAGrC"}

package/dist/lib/envInterpolation.js

@@ -0,0 +1,103 @@
+"use strict";
+/**
+ * Environment-variable interpolation for proxy configuration.
+ * Supports ${VAR} and ${VAR:-default} in string values.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.interpolateString = interpolateString;
+exports.interpolateConfig = interpolateConfig;
+exports.loadEnvFile = loadEnvFile;
+exports.buildLookup = buildLookup;
+const fs = __importStar(require("node:fs"));
+const dotenv = __importStar(require("dotenv"));
+const PLACEHOLDER = /\$\{([A-Za-z_][A-Za-z0-9_]*)(?::-([^}]*))?\}/g;
+/**
+ * Resolve ${VAR} / ${VAR:-default} placeholders in a single string.
+ * Empty-string follows bash `:-` semantics: an empty value falls back to the
+ * default when one is given. A ${VAR} without a default that resolves to
+ * undefined throws, naming the variable and the field it came from.
+ */
+function interpolateString(input, lookup, fieldPath) {
+    return input.replace(PLACEHOLDER, (_match, name, defaultVal) => {
+        const value = lookup(name);
+        const isEmpty = value === undefined || value === '';
+        if (defaultVal !== undefined) {
+            return isEmpty ? defaultVal : value;
+        }
+        if (value === undefined) {
+            throw new Error(`Config references undefined env variable: ${name} (referenced in ${fieldPath})`);
+        }
+        return value;
+    });
+}
+/**
+ * Recursively interpolate all string values in a parsed config object.
+ * Objects/arrays are walked; non-string scalars are returned unchanged.
+ * The field path (e.g. `defaultHeaders.x-sap-password`) is threaded through for
+ * error messages.
+ */
+function interpolateConfig(value, lookup, path = '') {
+    if (typeof value === 'string') {
+        return interpolateString(value, lookup, path || '(root)');
+    }
+    if (Array.isArray(value)) {
+        return value.map((item, i) => interpolateConfig(item, lookup, `${path}[${i}]`));
+    }
+    if (value !== null && typeof value === 'object') {
+        const out = {};
+        for (const [key, val] of Object.entries(value)) {
+            out[key] = interpolateConfig(val, lookup, path ? `${path}.${key}` : key);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Parse a .env file into a flat map. Throws if the path is given but missing —
+ * a specified-yet-absent secret source is a configuration error, not a no-op.
+ */
+function loadEnvFile(envFilePath) {
+    if (!fs.existsSync(envFilePath)) {
+        throw new Error(`env file not found: ${envFilePath}`);
+    }
+    return dotenv.parse(fs.readFileSync(envFilePath, 'utf-8'));
+}
+/**
+ * Build a lookup over process.env (highest priority) then the parsed .env map.
+ */
+function buildLookup(envFileMap) {
+    return (key) => process.env[key] ?? envFileMap[key];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/proxy",
-  "version": "1.5.0",
+  "version": "1.6.0",
   "description": "MCP proxy server for SAP ABAP ADT - proxies local requests to cloud-llm-hub with JWT authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -71,6 +71,7 @@
     "@mcp-abap-adt/logger": "^0.1.4",
     "@modelcontextprotocol/sdk": "^1.26.0",
     "axios": "^1.15.1",
+    "dotenv": "^17.4.2",
     "js-yaml": "^4.1.1",
     "zod": "^4.3.6"
   },