@sap/cds-dk 10.0.6 → 10.1.0

package/lib/mtx/auth_manager.js

@@ -1,5 +1,5 @@
 const cds = require('../cds');
-const { SettingsManager } = require('./settings_manager');
+const { SettingsManager, OAUTH_PATH, OAUTH_PATH_LEGACY_TOKEN } = require('./settings_manager');
 const { ParamCollection } = require('./params');
 const { getMessage } = require('./util/logging');
 const { buildResponseError, buildNetworkError, parseResponseBody } = require('./util/request');
@@ -39,28 +39,107 @@ function reqParams(method, params) {
     const url = params.get('tokenUrl');
     const d = {};
     const ignored = {};
-    if (params.has('subdomain')) {
-        d.subdomain = params.get('subdomain');
-    }
-    if (params.has('refreshToken')) {
-        d.refresh_token = params.get('refreshToken');
-        const param = ['passcode', 'clientid'].find(param => params.has(param));
-        if (param) {
-            ignored[param] = 'refresh token is present';
+    const headers = { 'content-type': 'application/x-www-form-urlencoded' };
+    const tls = {};
+    if (params.get('directUaa')) {
+        d.grant_type = 'client_credentials';
+        d.client_id = params.get('clientid');
+        if (params.has('key')) {
+            tls.cert = params.get('certificate');
+            tls.key = params.get('key');
+        } else {
+            const encoded = Buffer.from(`${params.get('clientid')}:${params.get('clientsecret')}`).toString('base64');
+            headers.Authorization = `Basic ${encoded}`;
+        }
+    } else {
+        if (params.has('subdomain')) {
+            d.subdomain = params.get('subdomain');
+        }
+        if (params.has('refreshToken')) {
+            d.refresh_token = params.get('refreshToken');
+            const param = ['passcode', 'clientid'].find(param => params.has(param));
+            if (param) {
+                ignored[param] = 'refresh token is present';
+            }
+        } else if (params.has('passcode')) {
+            d.passcode = params.get('passcode');
+        } else if (params.has('clientsecret')) {
+            d.clientid = params.get('clientid');
+            d.clientsecret = params.get('clientsecret');
         }
-    } else if (params.has('passcode')) {
-        d.passcode = params.get('passcode');
-    } else if (params.has('clientsecret')) {
-        d.clientid = params.get('clientid');
-        d.clientsecret = params.get('clientsecret');
-    } else if (params.has('key')) {
-        d.clientid = params.get('clientid');
-        d.key = params.get('key');
     }
     const data = new URLSearchParams(d).toString();
-    return method === 'post'
-        ? { url, data, ignored }
-        : { url: `${url}?${data}`, data: undefined, ignored };
+    const req = method === 'post'
+        ? { url, data, method, headers, ...tls }
+        : { url: `${url}?${data}`, data: undefined, method, headers, ...tls };
+    return { req, ignored };
+}
+
+function toResponse(res, body) {
+    const status = res.statusCode;
+    return {
+        ok: status >= 200 && status < 300,
+        status,
+        statusText: res.statusMessage ?? '',
+        headers: { get: name => res.headers[name.toLowerCase()] },
+        json: async () => JSON.parse(body),
+        text: async () => body
+    };
+}
+
+function postTokenViaMtls(url, data, headers, { cert, key }) {
+    const https = require('node:https');
+    const u = new URL(url);
+    return new Promise((resolve, reject) => {
+        const request = https.request({
+            hostname: u.hostname,
+            port: u.port || 443,
+            path: `${u.pathname}${u.search}`,
+            method: 'POST',
+            headers,
+            cert,
+            key
+        }, res => {
+            let body = '';
+            res.setEncoding('utf8');
+            res.on('data', chunk => { body += chunk; });
+            res.on('end', () => resolve(toResponse(res, body)));
+        });
+        request.on('error', reject);
+        if (data) {
+            request.write(data);
+        }
+        request.end();
+    });
+}
+
+async function postTokenTo(req, params) {
+    const { url, data, method, headers, cert, key } = req;
+    DEBUG?.(`Getting authentication token from ${method.toUpperCase()} ${params.obfuscateQueryParams(url)}`);
+    const response = cert
+        ? await postTokenViaMtls(url, data, headers, { cert, key })
+        : await fetch(url, {
+            method: method.toUpperCase(),
+            body: data,
+            headers
+        });
+    if (!response.ok) {
+        throw await buildResponseError(method, url, response);
+    }
+    return parseResponseBody(response);
+}
+
+async function postToken(req, params) {
+    try {
+        return await postTokenTo(req, params);
+    } catch (e) {
+        if (e.status !== 404 || !req.url.includes(OAUTH_PATH)) {
+            throw e;
+        }
+        req.url = req.url.replace(OAUTH_PATH, OAUTH_PATH_LEGACY_TOKEN);
+        DEBUG?.(`Token endpoint not found, retrying against legacy path ${params.obfuscateQueryParams(req.url)}`);
+        return postTokenTo(req, params);
+    }
 }
 
 async function fetchToken(params) {
@@ -71,29 +150,16 @@ async function fetchToken(params) {
     let responseData, error;
     const method = 'post';
     do {
-        const { url, data, ignored } = reqParams(method, params);
+        const { req, ignored } = reqParams(method, params);
         if (Object.keys(ignored).length) {
             console.log(`Ignoring parameters for fetching token: ${Object.entries(ignored).map(([param, reason]) => `${param} (${reason})`).join(', ')}.`);
         }
-        DEBUG?.(`Getting authentication token from ${method.toUpperCase()} ${params.obfuscateQueryParams(url)}`);
         error = undefined;
         try {
-            const response = await fetch(url, {
-                method: method.toUpperCase(),
-                body: data,
-                headers: { 'content-type': 'application/x-www-form-urlencoded' }
-            });
-            if (!response.ok) {
-                throw await buildResponseError(method, url, response);
-            }
-            responseData = await parseResponseBody(response);
+            responseData = await postToken(req, params);
             break;
         } catch (e) {
-            if (e.status) {
-                error = e;
-            } else {
-                error = buildNetworkError(method, url, e);
-            }
+            error = e.status ? e : buildNetworkError(method, req.url, e);
             DEBUG?.(`HTTP status ${error.status}`);
             if (params.has('refreshToken')) {
                 DEBUG?.('Discarding invalid refresh token');
@@ -122,7 +188,7 @@ async function fetchToken(params) {
                 message += `. Ensure the client credentials are correct`;
             }
         } else {
-            message = 'error on token request';
+            message = 'token request failed';
         }
         throw new Error(message + '.', { cause: error });
     }

package/lib/mtx/params.js

@@ -178,7 +178,8 @@ class BasicParams {
         this.password               = new Param('password',               undefined, { obfuscate: ObfuscationLevel.full });
         this.clientid               = new Param('clientid',               undefined);
         this.clientsecret           = new Param('clientsecret',           undefined, { obfuscate: ObfuscationLevel.partial });
-        this.key                    = new Param('key',                    undefined, { obfuscate: ObfuscationLevel.partial }); // private key of client certificate
+        this.certificate            = new Param('certificate',            undefined, { obfuscate: ObfuscationLevel.partial }); // client certificate for mTLS
+        this.key                    = new Param('key',                    undefined, { obfuscate: ObfuscationLevel.partial }); // private key of the client certificate
         this.tokenStorage           = new Param('tokenStorage',           undefined, { allowedValues: ['plain', 'keyring'] });
         this.clearOtherTokenStorage = new Param('clearOtherTokenStorage', false, { internal: true });
         this.plain                  = new Param('plain',                  false, { internal: true }); // for backward compatibility - superseded by tokenStorage
@@ -195,7 +196,6 @@ class BasicParams {
     }
 }
 
-// TODO pass these as extra arguments to lib functions
 /**
  * All known params including those needed for specific commands.
  */
@@ -216,6 +216,7 @@ class AllParams extends BasicParams {
 
         // `login` PARAMS
         this.skipToken              = new Param('skipToken',              false, { internal: true });
+        this.directUaa              = new Param('directUaa',              false, { internal: true }); // client-credentials login goes directly to the authorization server
         this.saveRefreshToken       = new Param('saveRefreshToken',       false, { internal: true });
 
         // `logout` PARAMS

package/lib/mtx/settings_manager.js

@@ -34,9 +34,10 @@ const KEYRING_DESC = {
 };
 
 const MTX_FULLY_QUALIFIED = 'com.sap.cds.mtx';
-const OAUTH_PATH_LEGACY = '/mtx/v1/oauth/token';
-const OAUTH_PATH = '/-/cds/login/token';
-const OAUTH_META_PATH = '/-/cds/login/authorization-metadata';
+const OAUTH_PATH_LEGACY_TOKEN = '/-/cds/login/token';
+const OAUTH_PATH = '/-/cds/login/grant';
+const OAUTH_META_PATH = '/-/cds/login/grant-metadata';
+const OAUTH_UAA_PATH = '/oauth/token';
 
 const SETTINGS_DIR = path.join(os.homedir(), CONFIG_SUBDIRS[os.platform()] || '', MTX_FULLY_QUALIFIED);
 const SETTINGS_FILE = 'projects.json';
@@ -102,12 +103,40 @@ async function getTokenUrl(params, renewUrl) {
     if (!params.has('appUrl')) {
         throw 'Failed to determine token URL: app URL not given';
     }
+    if (params.has('clientid')) {
+        return deriveUaaTokenUrl(params);
+    }
     return appUrlWith(OAUTH_PATH, params);
 }
 
-async function fetchPasscodeUrl(params) {
+function uaaTokenUrl(passcodeUrl, { mtls } = {}) {
+    const url = new URL(passcodeUrl);
+    url.pathname = url.pathname.replace(/\/passcode\/*$/, '').replace(/\/+$/, '') + OAUTH_UAA_PATH;
+    url.search = '';
+    if (mtls) {
+        url.hostname = url.hostname.replace(/\.authentication\./, '.authentication.cert.');
+    }
+    return url.toString();
+}
+
+async function deriveUaaTokenUrl(params) {
+    const mtls = params.has('key');
+    const metadata = await fetchAuthMetadata(params);
+    const announced = mtls ? metadata?.cert_token_url : metadata?.token_url;
+    const passcodeUrl = metadata?.passcode_url;
+    const tokenUrl = announced ?? (passcodeUrl && uaaTokenUrl(passcodeUrl, { mtls }));
+    if (!tokenUrl) {
+        throw 'Cannot determine the authorization server for client-credentials login. ' +
+            'Ensure MTX is running with extensibility enabled and up to date.';
+    }
+    params.set('directUaa', true);
+    DEBUG?.(`Derived authorization-server token URL for ${mtls ? 'mTLS' : 'client-credentials'} login: ${tokenUrl}`);
+    return tokenUrl;
+}
+
+async function fetchAuthMetadata(params) {
     let fetchUrl = appUrlWith(OAUTH_META_PATH, params);
-    DEBUG?.(`Trying to get passcode URL from GET`, fetchUrl);
+    DEBUG?.(`Trying to get authorization metadata from GET`, fetchUrl);
     if (params.has('subdomain')) {
         const u = new URL(fetchUrl);
         u.searchParams.set('subdomain', params.get('subdomain'));
@@ -124,10 +153,10 @@ async function fetchPasscodeUrl(params) {
         if (error.status === 404) {
             DEBUG?.(`Request unsupported by server, ignoring (${error.message.replace(/ *Details:.*/s, '')})`);
         } else if (error.status) {
-            DEBUG?.(getMessage(`Getting passcode URL failed`, { error }));
+            DEBUG?.(getMessage(`Getting authorization metadata failed`, { error }));
         } else {
             const netError = buildNetworkError('GET', fetchUrl, error);
-            DEBUG?.(getMessage(`Getting passcode URL failed`, { error: netError }));
+            DEBUG?.(getMessage(`Getting authorization metadata failed`, { error: netError }));
         }
         return undefined;
     }
@@ -139,7 +168,7 @@ async function fetchPasscodeUrl(params) {
         DEBUG?.(`Unsupported signed metadata received. Since these should take precedence, ignoring response.`);
         return undefined;
     }
-    return responseData.passcode_url;
+    return responseData;
 }
 
 function getKeyringAccountName(params) {
@@ -289,8 +318,9 @@ class SettingsManager {
         }
         async function updateTokenUrl() {
             const tokenUrl = secure(params.get('tokenUrl'), 'token URL');
+            const machineLogin = params.has('clientid');
             const renewUrl = !logout && !params.get('skipToken')
-                && (!tokenUrl || tokenUrl.includes('//-/cds') || tokenUrl.includes(OAUTH_PATH_LEGACY)
+                && (machineLogin || !tokenUrl || tokenUrl.includes('//-/cds') || !tokenUrl.includes(OAUTH_PATH)
                     || params.get('appUrl') !== loadedSettings.get('appUrl')
                     || params.get('subdomain') !== loadedSettings.get('subdomain'));
             if (renewUrl) {
@@ -303,7 +333,6 @@ class SettingsManager {
                 }
             }
         }
-
         await updateAppUrl();
         await updateTokenUrl();
     }
@@ -353,16 +382,9 @@ class SettingsManager {
                 throw 'Clientsecret cannot be empty';
             }
         }
-        async function addKey() {
-            params.set('key', await Question.askQuestion('key: ', undefined, true));
-            console.log();
-            if (params.get('key') === '') {
-                throw 'Key cannot be empty';
-            }
-        }
         async function addPasscode() {
             if (!params.has('passcodeUrl')) {
-                const passcodeUrl = await fetchPasscodeUrl(params);
+                const passcodeUrl = (await fetchAuthMetadata(params))?.passcode_url;
                 if (passcodeUrl) {
                     params.set('passcodeUrl', passcodeUrl);
                 }
@@ -440,15 +462,8 @@ class SettingsManager {
             return;
         }
 
-        if (params.get('clientid') && !logout) {
-            if (params.has('key')) {
-                if (params.get('key') === 'ask') {
-                    params.delete('key');
-                    await addKey();
-                }
-            } else if (!params.has('clientsecret')) {
-                await addClientSecret();
-            }
+        if (params.get('clientid') && !logout && !params.has('clientsecret') && !params.has('key')) {
+            await addClientSecret();
         }
 
         await addAuthSettings();
@@ -714,5 +729,7 @@ class SettingsManager {
 module.exports = {
     SettingsManager,
     other,
-    notifyLogin
+    notifyLogin,
+    OAUTH_PATH,
+    OAUTH_PATH_LEGACY_TOKEN
 };

package/lib/mtx/tenant_action.js

@@ -20,7 +20,6 @@ const DEFAULT_LOCALHOST_PASSWORD = '';
 
 module.exports = class TenantAction {
 
-    // TODO JSDoc
     /**
      * @param command {string} the command to execute: 'subscribe', 'upgrade' or 'unsubscribe'
      */

package/lib/mtx/util/credentials.js

@@ -0,0 +1,62 @@
+const CLIENT_ID_ENV = 'CDS_LOGIN_CLIENT_ID';
+const CLIENT_SECRET_ENV = 'CDS_LOGIN_CLIENT_SECRET';
+const CLIENT_CERT_ENV = 'CDS_LOGIN_CLIENT_CERT';
+const CLIENT_KEY_ENV = 'CDS_LOGIN_CLIENT_KEY';
+
+function clientId(inlineId) {
+    const clientid = inlineId ?? process.env[CLIENT_ID_ENV];
+    if (!clientid) {
+        throw `Client ID required: pass it as --client <id> or via the ${CLIENT_ID_ENV} environment variable.`;
+    }
+    return clientid;
+}
+
+function splitFirst(value, separator) {
+    const i = value.indexOf(separator);
+    return i === -1 ? [value, undefined] : [value.slice(0, i), value.slice(i + separator.length)];
+}
+
+/**
+ * Resolve `--client` credentials, each part falling back to the environment
+ * (`CDS_LOGIN_CLIENT_ID`/`CDS_LOGIN_CLIENT_SECRET`). Splits on the first colon only;
+ * an empty client ID (`:secret`) is rejected.
+ * @returns {{ clientid?: string, clientsecret?: string }}
+ */
+function clientCredentials(clientOption) {
+    if (!clientOption) {
+        return {};
+    }
+    const [id, secret] = typeof clientOption === 'string' ? splitFirst(clientOption, ':') : [];
+    return { clientid: clientId(id), clientsecret: secret ?? process.env[CLIENT_SECRET_ENV] };
+}
+
+/**
+ * Resolve `--mtls` credentials: client ID inline or from `CDS_LOGIN_CLIENT_ID`,
+ * certificate and key only from `CDS_LOGIN_CLIENT_CERT`/`CDS_LOGIN_CLIENT_KEY`.
+ * An inline `:key` is rejected.
+ * @returns {{ clientid?: string, certificate?: string, key?: string }}
+ */
+function clientCertificate(mtlsOption) {
+    if (!mtlsOption) {
+        return {};
+    }
+    if (typeof mtlsOption === 'string' && mtlsOption.includes(':')) {
+        throw `The client key cannot be passed on the command line. Pass only the client ID as --mtls <id>, and provide the certificate and key via the ${CLIENT_CERT_ENV} and ${CLIENT_KEY_ENV} environment variables.`;
+    }
+    const id = typeof mtlsOption === 'string' ? mtlsOption : undefined;
+    const certificate = process.env[CLIENT_CERT_ENV];
+    const key = process.env[CLIENT_KEY_ENV];
+    if (!certificate || !key) {
+        throw `Client certificate and key required: set the ${CLIENT_CERT_ENV} and ${CLIENT_KEY_ENV} environment variables.`;
+    }
+    return { clientid: clientId(id), certificate, key };
+}
+
+module.exports = {
+    clientCredentials,
+    clientCertificate,
+    CLIENT_ID_ENV,
+    CLIENT_SECRET_ENV,
+    CLIENT_CERT_ENV,
+    CLIENT_KEY_ENV
+};

package/node_modules/@cap-js/openapi/lib/compile/csdl.js

@@ -14,7 +14,7 @@ const CDS_TERMS = Object.freeze({
     Core: ['AcceptableMediaTypes', 'Computed', 'ComputedDefaultValue', 'DefaultNamespace', 'Description', 'Example', 'Immutable', 'LongDescription',
         'MediaType', 'OptionalParameter', 'Permissions', 'SchemaVersion'],
     JSON: ['Schema'],
-    Validation: ['AllowedValues', 'Exclusive', 'Maximum', 'Minimum', 'Pattern']
+    Validation: ['AllowedValues', 'Exclusive', 'Maximum', 'MaxItems', 'Minimum', 'MinItems', 'Pattern']
 })
 
 /**
@@ -168,7 +168,7 @@ class CSDLMeta {
 
     /**
      * Construct map of qualified term names
-     * @param {object} alias Map of namespace or alias to alias
+     * @param {*} alias Map of namespace or alias to alias
      */
     #getVocabularies(alias) {
         Object.keys(CDS_TERMS).forEach(vocab => {
@@ -187,7 +187,7 @@ class CSDLMeta {
     /**
      * Find model element by qualified name
      * @param {string} qname Qualified name of model element
-     * @return {object} Model element
+     * @return {*} Model element
      */
     modelElement(qname) {
         const q = nameParts(qname);