@sap-ux/odata-service-inquirer 2.4.5 → 2.4.6

package/dist/prompts/connectionValidator.d.ts

@@ -1,4 +1,4 @@
-import type { AxiosRequestConfig, CatalogService, ODataService, ServiceInfo, ServiceProvider } from '@sap-ux/axios-extension';
+import type { AxiosRequestConfig, CatalogService, ODataService, ProviderConfiguration, ServiceInfo, ServiceProvider } from '@sap-ux/axios-extension';
 import { ODataVersion } from '@sap-ux/axios-extension';
 import { type Destination } from '@sap-ux/btp-utils';
 import { ERROR_TYPE } from '@sap-ux/inquirer-common';
@@ -38,12 +38,19 @@ export declare class ConnectionValidator {
     private _connectedUserName;
     private _connectedSystemName;
     private _refreshToken;
+    private _ignoreCertError;
+    /**
+     * Get the ignoreCertError value.
+     *
+     * @returns the ignoreCertError value, true indicates that cert errors may have been ignored
+     */
+    get ignoreCertError(): boolean | undefined;
     /**
      * Getter for the axios configuration.
      *
      * @returns the axios configuration
      */
-    get axiosConfig(): AxiosRequestConfig;
+    get axiosConfig(): AxiosRequestConfig & ProviderConfiguration;
     /**
      * Get the odata service instance.
      *
@@ -181,6 +188,15 @@ export declare class ConnectionValidator {
      * @param resetValidity if true, the validity information will be reset also
      */
     resetConnectionState(resetValidity?: boolean): void;
+    /**
+     * When the env has set `NODE_TLS_REJECT_UNAUTHORIZED=0` we make an intial request to check for cert errors.
+     * We log these errors to the console so the user is informed of the risks.
+     *
+     * @param axiosConfig the axios request configuration for Abap on prem connection
+     * @param odataVersion the odata version to restrict the catalog requests if only a specific version is required
+     * @returns true if the cert error should be ignored based on the environment setting `NODE_TLS_REJECT_UNAUTHORIZED=0`
+     */
+    private shouldIgnoreCertError;
     /**
      * Create the connection for a system url, the specified axios config or the specified service info.
      *

package/dist/prompts/connectionValidator.js

@@ -12,8 +12,14 @@ const i18n_1 = require("../i18n");
 const types_1 = require("../types");
 const logger_helper_1 = __importDefault(require("./logger-helper"));
 const prompt_helpers_1 = require("./prompt-helpers");
-// Cert errors that may be ignored by prompt user
-const ignorableCertErrors = [inquirer_common_1.ERROR_TYPE.CERT_SELF_SIGNED, inquirer_common_1.ERROR_TYPE.CERT_SELF_SIGNED_CERT_IN_CHAIN];
+// Cert errors that may be ignored by the ignore cert errors prompt and NODE_TLS_REJECT_UNAUTHORIZED=0 setting
+const ignorableCertErrors = [
+    inquirer_common_1.ERROR_TYPE.CERT_SELF_SIGNED,
+    inquirer_common_1.ERROR_TYPE.CERT_SELF_SIGNED_CERT_IN_CHAIN,
+    inquirer_common_1.ERROR_TYPE.CERT_EXPIRED,
+    inquirer_common_1.ERROR_TYPE.CERT_UKNOWN_OR_INVALID,
+    inquirer_common_1.ERROR_TYPE.INVALID_SSL_CERTIFICATE
+];
 /**
  * Class that can be used to determine the connectivity using a service url, system url, or service info (UAA Key details) or reentrance ticket.
  * This will determine if if the service/catalog is reachable, authentication is required and generates ting messages to guide the user.
@@ -41,6 +47,16 @@ class ConnectionValidator {
     _connectedUserName;
     _connectedSystemName;
     _refreshToken;
+    // For the current validated URL connection attempts will ignore cert errors
+    _ignoreCertError;
+    /**
+     * Get the ignoreCertError value.
+     *
+     * @returns the ignoreCertError value, true indicates that cert errors may have been ignored
+     */
+    get ignoreCertError() {
+        return this._ignoreCertError;
+    }
     /**
      * Getter for the axios configuration.
      *
@@ -204,6 +220,7 @@ class ConnectionValidator {
         this.validity.reachable = true;
         this.validity.urlFormat = true;
         this.validity.authRequired = true;
+        // Do we need to explictly set the ignore cert error flag with an existing connection or are we calling checkUrl() again?
         if (backendSystem?.authenticationType === 'reentranceTicket') {
             this.systemAuthType = 'reentranceTicket';
         }
@@ -265,10 +282,6 @@ class ConnectionValidator {
                 throw e;
             }
         }
-        finally {
-            // Reset global cert validation
-            ConnectionValidator.setGlobalRejectUnauthorized(true);
-        }
     }
     /**
      * Create the axios configuration object for the service or system connection.
@@ -304,6 +317,11 @@ class ConnectionValidator {
      * @param servicePath the service path without the origin
      */
     async createOdataServiceConnection(axiosConfig, servicePath) {
+        if (await this.shouldIgnoreCertError(axiosConfig)) {
+            this._ignoreCertError = true;
+            axiosConfig.ignoreCertErrors = true;
+            ConnectionValidator.setGlobalRejectUnauthorized(false);
+        }
         this._axiosConfig = axiosConfig;
         this._serviceProvider = (0, axios_extension_1.create)(this._axiosConfig);
         this._odataService = this._serviceProvider.service(servicePath);
@@ -324,10 +342,41 @@ class ConnectionValidator {
         this._connectedUserName = undefined;
         this._refreshToken = undefined;
         this._connectedSystemName = undefined;
+        this._ignoreCertError = undefined;
         if (resetValidity) {
             this.resetValidity();
         }
     }
+    /**
+     * When the env has set `NODE_TLS_REJECT_UNAUTHORIZED=0` we make an intial request to check for cert errors.
+     * We log these errors to the console so the user is informed of the risks.
+     *
+     * @param axiosConfig the axios request configuration for Abap on prem connection
+     * @param odataVersion the odata version to restrict the catalog requests if only a specific version is required
+     * @returns true if the cert error should be ignored based on the environment setting `NODE_TLS_REJECT_UNAUTHORIZED=0`
+     */
+    async shouldIgnoreCertError(axiosConfig, odataVersion) {
+        logger_helper_1.default.logger.debug(`ConnectionValidator.shouldIgnoreCertError() - url: ${axiosConfig.baseURL}`);
+        let shouldIgnoreCertError = false;
+        const nodeAllowBadCerts = process.env.NODE_TLS_REJECT_UNAUTHORIZED === '0';
+        if (nodeAllowBadCerts) {
+            try {
+                const odataVerCatalog = !odataVersion || odataVersion === axios_extension_1.ODataVersion.v2 ? axios_extension_1.ODataVersion.v2 : axios_extension_1.ODataVersion.v4;
+                const abapProvider = (0, axios_extension_1.createForAbap)(axiosConfig);
+                logger_helper_1.default.attachAxiosLogger(abapProvider.interceptors);
+                await abapProvider.catalog(odataVerCatalog).listServices();
+            }
+            catch (error) {
+                const errorType = inquirer_common_1.ErrorHandler.getErrorType(error?.response?.status ?? error?.code);
+                if (error?.isAxiosError && ignorableCertErrors.includes(errorType)) {
+                    logger_helper_1.default.logger.warn((0, i18n_1.t)('warnings.certificateErrors', { url: axiosConfig?.baseURL, error: errorType }));
+                    logger_helper_1.default.logger.warn((0, i18n_1.t)('warnings.allowingUnauthorizedCertsNode'));
+                    shouldIgnoreCertError = true;
+                }
+            }
+        }
+        return shouldIgnoreCertError;
+    }
     /**
      * Create the connection for a system url, the specified axios config or the specified service info.
      *
@@ -353,6 +402,13 @@ class ConnectionValidator {
             this._serviceProvider = (0, axios_extension_1.createForDestination)({}, destination);
         }
         else if (axiosConfig) {
+            // Abap-on-prem on VSCode specific handling of cert errors from system connections.
+            // Make an additional request to log any cert errors that we are going to ignore so the user is informed of the risks.
+            if (await this.shouldIgnoreCertError(axiosConfig, odataVersion)) {
+                this._ignoreCertError = true;
+                axiosConfig.ignoreCertErrors = true;
+                ConnectionValidator.setGlobalRejectUnauthorized(false);
+            }
             this._axiosConfig = axiosConfig;
             this._serviceProvider = (0, axios_extension_1.createForAbap)(axiosConfig);
         }
@@ -397,6 +453,19 @@ class ConnectionValidator {
         // as the user may not be authorized for the v2 catalog specifically.
         const shouldFallbackToV4 = statusCode && !v4Requested && (errorType === inquirer_common_1.ERROR_TYPE.NOT_FOUND || errorType === inquirer_common_1.ERROR_TYPE.AUTH);
         if (this._catalogV4 && shouldFallbackToV4) {
+            // The v2 catalog was not available therefore cert errors will not have been seen (hidden by 404), only abap on prem uses axiosConfig directly
+            if (this._axiosConfig && (await this.shouldIgnoreCertError(this._axiosConfig, axios_extension_1.ODataVersion.v4))) {
+                this._ignoreCertError = true;
+                ConnectionValidator.setGlobalRejectUnauthorized(false);
+                this._axiosConfig = {
+                    ...this._axiosConfig,
+                    ignoreCertErrors: true
+                };
+                // Re-create the service provider with the updated config
+                this._serviceProvider = (0, axios_extension_1.createForAbap)(this._axiosConfig);
+                this._catalogV4 = this._serviceProvider.catalog(axios_extension_1.ODataVersion.v4);
+                logger_helper_1.default.attachAxiosLogger(this._serviceProvider.interceptors);
+            }
             try {
                 await this._catalogV4.listServices();
             }
@@ -770,7 +839,7 @@ class ConnectionValidator {
             }
             this.systemAuthType = 'basic';
             const status = await this.checkUrl(urlObject, username, password, {
-                ignoreCertError,
+                ignoreCertError: ignoreCertError,
                 isSystem,
                 odataVersion
             });

package/dist/prompts/datasources/sap-system/service-selection/service-helper.js

@@ -245,6 +245,7 @@ async function validateService(service, connectionValidator, requiredOdataVersio
     utils_1.PromptState.odataService.servicePath = service.servicePath;
     utils_1.PromptState.odataService.origin = origin;
     utils_1.PromptState.odataService.sapClient = connectionValidator.validatedClient;
+    utils_1.PromptState.odataService.ignoreCertError = connectionValidator.ignoreCertError;
     return {
         validationResult: true,
         hasAnnotations: !!utils_1.PromptState.odataService.annotations && utils_1.PromptState.odataService.annotations.length > 0,
@@ -282,7 +283,7 @@ async function getSelectedServiceMessage(serviceChoices, selectedService, connec
     if (serviceChoices?.length === 0) {
         if (requiredOdataVersion) {
             return {
-                message: (0, i18n_1.t)('prompts.warnings.noServicesAvailableForOdataVersion', {
+                message: (0, i18n_1.t)('warnings.noServicesAvailableForOdataVersion', {
                     odataVersion: requiredOdataVersion
                 }),
                 severity: yeoman_ui_types_1.Severity.warning
@@ -290,7 +291,7 @@ async function getSelectedServiceMessage(serviceChoices, selectedService, connec
         }
         else {
             return {
-                message: (0, i18n_1.t)('prompts.warnings.noServicesAvailable'),
+                message: (0, i18n_1.t)('warnings.noServicesAvailable'),
                 severity: yeoman_ui_types_1.Severity.warning
             };
         }
@@ -301,7 +302,7 @@ async function getSelectedServiceMessage(serviceChoices, selectedService, connec
             // Warn if odata service is version is '2' and no annotations are present
             if (!hasAnnotations) {
                 return {
-                    message: (0, i18n_1.t)('prompts.warnings.noAnnotations'),
+                    message: (0, i18n_1.t)('warnings.noAnnotations'),
                     severity: yeoman_ui_types_1.Severity.warning
                 };
             }
@@ -312,14 +313,14 @@ async function getSelectedServiceMessage(serviceChoices, selectedService, connec
             const result = (0, service_helpers_1.showCollabDraftWarning)(showCollabDraftWarnOptions.edmx);
             if (result) {
                 return {
-                    message: (0, i18n_1.t)('prompts.warnings.collaborativeDraftMessage'),
+                    message: (0, i18n_1.t)('warnings.collaborativeDraftMessage'),
                     severity: yeoman_ui_types_1.Severity.warning
                 };
             }
         }
         if (serviceType && serviceType !== axios_extension_1.ServiceType.UI) {
             return {
-                message: (0, i18n_1.t)('prompts.warnings.nonUIServiceTypeWarningMessage', { serviceType: 'A2X' }),
+                message: (0, i18n_1.t)('warnings.nonUIServiceTypeWarningMessage', { serviceType: 'A2X' }),
                 severity: yeoman_ui_types_1.Severity.warning
             };
         }

package/dist/prompts/datasources/sap-system/shared-prompts/shared-prompts.js

@@ -9,6 +9,7 @@ const utils_1 = require("../../../../utils");
 const types_2 = require("../new-system/types");
 const prompt_helpers_1 = require("../prompt-helpers");
 const validators_1 = require("../validators");
+const yeoman_ui_types_1 = require("@sap-devx/yeoman-ui-types");
 /**
  * Convert the system connection scheme (Service Key, Rentrance Ticket, etc) to the store specific authentication type.
  * Note the absence of CF Discovery, in this case the service key file (UAA) is also used for the Abap connectivity.
@@ -74,6 +75,14 @@ function getSystemUrlQuestion(connectValidator, promptNamespace, requiredOdataVe
                 }
             }
             return valResult;
+        },
+        additionalMessages: () => {
+            if (connectValidator.ignoreCertError) {
+                return {
+                    message: (0, i18n_1.t)('warnings.certErrorIgnoredByNodeSetting'),
+                    severity: yeoman_ui_types_1.Severity.warning
+                };
+            }
         }
     };
     return newSystemUrlQuestion;

package/dist/prompts/datasources/sap-system/system-selection/questions.js

@@ -132,6 +132,12 @@ async function getSystemConnectionQuestions(connectionValidator, promptOptions,
                         severity: yeoman_ui_types_1.Severity.information
                     };
                 }
+                if (connectionValidator.ignoreCertError) {
+                    return {
+                        message: (0, i18n_1.t)('warnings.certErrorIgnoredByNodeSetting'),
+                        severity: yeoman_ui_types_1.Severity.warning
+                    };
+                }
             }
         }
     ];

package/dist/prompts/datasources/service-url/questions.js

@@ -49,7 +49,7 @@ function getServiceUrlPrompt(connectValidator, requiredVersion, showCollabDraftW
                     const valResult = await (0, validators_1.validateService)(url, {
                         odataService: connectValidator.odataService,
                         axiosConfig: connectValidator.axiosConfig
-                    }, requiredVersion);
+                    }, requiredVersion, connectValidator.ignoreCertError);
                     showAnnotationWarning = !!valResult.showAnnotationWarning;
                     convertedMetadata = valResult.convertedMetadata;
                     return valResult.validationResult;
@@ -58,7 +58,7 @@ function getServiceUrlPrompt(connectValidator, requiredVersion, showCollabDraftW
             }
             return urlValidationState;
         },
-        additionalMessages: () => getAdditionalMessages(showAnnotationWarning, showCollabDraftWarn, convertedMetadata)
+        additionalMessages: () => getAdditionalMessages(showAnnotationWarning, showCollabDraftWarn, convertedMetadata, connectValidator.ignoreCertError)
     };
 }
 /**
@@ -68,18 +68,25 @@ function getServiceUrlPrompt(connectValidator, requiredVersion, showCollabDraftW
  * @param showCollabDraftWarn true to show collaborative draft warning, this will be shown only if `showAnnotationWarning` is false
  *  and determines that collaborative draft is not enabled
  * @param convertedMetadata provided to avoid reparsing the metadata
+ * @param showNodeCertWarning
  * @returns
  */
-function getAdditionalMessages(showAnnotationWarning, showCollabDraftWarn, convertedMetadata) {
+function getAdditionalMessages(showAnnotationWarning, showCollabDraftWarn, convertedMetadata, showNodeCertWarning) {
+    if (showNodeCertWarning) {
+        return {
+            message: (0, i18n_1.t)('warnings.certErrorIgnoredByNodeSetting'),
+            severity: yeoman_ui_types_1.Severity.warning
+        };
+    }
     if (showAnnotationWarning) {
         return {
-            message: (0, i18n_1.t)('prompts.warnings.noAnnotations'),
+            message: (0, i18n_1.t)('warnings.noAnnotations'),
             severity: yeoman_ui_types_1.Severity.warning
         };
     }
     if (convertedMetadata && showCollabDraftWarn && (0, service_helpers_1.showCollabDraftWarning)(convertedMetadata)) {
         return {
-            message: (0, i18n_1.t)('prompts.warnings.collaborativeDraftMessage'),
+            message: (0, i18n_1.t)('warnings.collaborativeDraftMessage'),
             severity: yeoman_ui_types_1.Severity.warning
         };
     }
@@ -97,7 +104,7 @@ function getIgnoreCertErrorsPrompt(connectValidator, requiredVersion, showCollab
     let convertedMetadata;
     return {
         when: ({ serviceUrl }) => {
-            if (serviceUrl && connectValidator.validity.canSkipCertError) {
+            if (serviceUrl && connectValidator.validity.canSkipCertError && !connectValidator.ignoreCertError) {
                 return true;
             }
             return false;
@@ -112,7 +119,7 @@ function getIgnoreCertErrorsPrompt(connectValidator, requiredVersion, showCollab
                 return false;
             }
             if (ignoreCertError) {
-                logger_helper_1.default.logger.warn((0, i18n_1.t)('prompts.validationMessages.warningCertificateValidationDisabled'));
+                logger_helper_1.default.logger.warn((0, i18n_1.t)('warnings.warningCertificateValidationDisabled'));
             }
             const validUrl = await connectValidator.validateUrl(serviceUrl, {
                 ignoreCertError,
@@ -154,7 +161,7 @@ function getCliIgnoreCertValidatePrompt(connectValidator, requiredVersion) {
                     throw new Error((0, i18n_1.t)('errors.exitingGeneration', { exitReason: (0, i18n_1.t)('errors.certValidationRequired') }));
                 }
                 // If the user choose to ignore cert errors, we need to re-validate
-                logger_helper_1.default.logger.warn((0, i18n_1.t)('prompts.validationMessages.warningCertificateValidationDisabled'));
+                logger_helper_1.default.logger.warn((0, i18n_1.t)('warnings.warningCertificateValidationDisabled'));
                 // Re-check if auth required as the cert error would have prevented this check earlier
                 const validUrl = await connectValidator.validateUrl(serviceUrl, {
                     ignoreCertError,
@@ -233,7 +240,7 @@ function getPasswordPrompt(connectValidator, requiredVersion, showCollabDraftWar
                 const valResult = await (0, validators_1.validateService)(serviceUrl, {
                     odataService: connectValidator.odataService,
                     axiosConfig: connectValidator.axiosConfig
-                }, requiredVersion, ignoreCertError);
+                }, requiredVersion, ignoreCertError || connectValidator.ignoreCertError);
                 showAnnotationWarning = !!valResult.showAnnotationWarning;
                 convertedMetadata = valResult.convertedMetadata;
                 return valResult.validationResult;

package/dist/translations/odata-service-inquirer.i18n.json

@@ -57,16 +57,8 @@
             "metadataInvalid": "The service metadata is invalid.",
             "metadataFilePathNotValid": "Metadata file does not exist or is not accessible. Please specify a valid file path.",
             "capProjectNotFound": "The folder you have selected does not seem to contain a valid CAP project. Please check and try again.",
-            "warningCertificateValidationDisabled": "User has disabled certificate validation",
             "annotationsNotFound": "Annotations not found for specified service"
         },
-        "warnings": {
-            "nonUIServiceTypeWarningMessage": "Please note that {{serviceType}} services, or not classified services, are not intended to be used for the generation of SAP Fiori UI applications",
-            "noServicesAvailable": "No services available for the selected system, see logs for further details.",
-            "noServicesAvailableForOdataVersion": "There are no V{{odataVersion}} OData services available from the selected system and the template you have chosen supports V{{odataVersion}} OData services only",
-            "noAnnotations": "No backend annotations associated with this service were retrieved and may result in an invalid application being created",
-            "collaborativeDraftMessage": "The selected service is draft enabled but does not support collaborative draft."
-        },
         "systemUrl": {
             "message": "System URL",
             "description": "Enter the URL of the SAP System",
@@ -229,7 +221,16 @@
         "v2CatalogServiceNoAnnotations": "Error creating v2 catalog service object, annotations will not be available: {{-error}}"
     },
     "warnings": {
-        "largeMetadataDocument": "The metadata for this OData service is significantly large. It may take some time before this operation completes."
+        "largeMetadataDocument": "The metadata for this OData service is significantly large. It may take some time before this operation completes.",
+        "warningCertificateValidationDisabled": "User has disabled certificate validation",
+        "nonUIServiceTypeWarningMessage": "Please note that {{serviceType}} services, or not classified services, are not intended to be used for the generation of SAP Fiori UI applications",
+        "noServicesAvailable": "No services available for the selected system, see logs for further details.",
+        "noServicesAvailableForOdataVersion": "There are no V{{odataVersion}} OData services available from the selected system and the template you have chosen supports V{{odataVersion}} OData services only",
+        "noAnnotations": "No backend annotations associated with this service were retrieved and may result in an invalid application being created",
+        "collaborativeDraftMessage": "The selected service is draft enabled but does not support collaborative draft.",
+        "certificateErrors": "A certificate error occurred when connecting to the host: {{-url}}. Certificate error: {{error}}.",
+        "allowingUnauthorizedCertsNode": "Setting the `NODE_TLS_REJECT_UNAUTHORIZED` environment variable to `0` makes TLS connections and HTTPS requests insecure by disabling certificate verification. It is important to understand the security risks when using this setting.",
+        "certErrorIgnoredByNodeSetting": "An SSL certificate error is being ignored by the 'NODE_TLS_REJECT_UNAUTHORIZED=0' Node.js setting. This makes TLS connections and HTTPS requests insecure by disabling certificate verification. For details of the certification error, see the logs."
     },
     "texts": {
         "suggestedSystemNameClient": ", client {{client}}",

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sap-ux/odata-service-inquirer",
   "description": "Prompts module that can prompt users for inputs required for odata service writing",
-  "version": "2.4.5",
+  "version": "2.4.6",
   "repository": {
     "type": "git",
     "url": "https://github.com/SAP/open-ux-tools.git",
@@ -33,7 +33,7 @@
     "@sap-ux/fiori-generator-shared": "0.12.1",
     "@sap-ux/guided-answers-helper": "0.3.0",
     "@sap-ux/telemetry": "0.6.1",
-    "@sap-ux/inquirer-common": "0.7.1",
+    "@sap-ux/inquirer-common": "0.7.2",
     "@sap-ux/logger": "0.7.0",
     "@sap-ux/project-access": "1.30.1",
     "@sap-ux/project-input-validator": "0.6.1",