@sap/cds-dk 6.0.4 → 6.1.1

package/lib/client/settings_manager.js

@@ -9,9 +9,10 @@ const { getAppFromSuggestions, getAppName, getSubdomain } = require('./helper/cf
 const isBas = require('./helper/env_helper');
 const Logger = require('./helper/logging');
 const Question = require('./helper/question');
-const { defaultSchema, extractSubdomain, schemaRegex } = require('./helper/url_helper');
+const { httpSchema, httpsSchema, extractSubdomain, schemaRegex, localhostRegex } = require('./helper/url_helper');
 const { ParamCollection, Persistence } = require('./params');
 const { capitalize } = require('./helper/string_helper');
+const axios = require('axios');
 
 const CONFIG_SUBDIRS = {
     linux: '.config',
@@ -31,7 +32,8 @@ const KEYRING_DESC = {
 }
 
 const MTX_FULLY_QUALIFIED = 'com.sap.cds.mtx';
-const OAUTH_PATH = '/mtx/v1/oauth/token';
+const OAUTH_PATH_OLD_MTX = '/mtx/v1/oauth/token';
+const OAUTH_PATH_STREAMLINED_MTX = '/-/cds/login/token';
 
 const SETTINGS_DIR = path.join(os.homedir(), CONFIG_SUBDIRS[os.platform()] || '', MTX_FULLY_QUALIFIED);
 const SETTINGS_FILE = 'projects.json';
@@ -88,7 +90,7 @@ async function getSubdomainFromCfAndNotify(appName) {
     return subdomain;
 }
 
-function getTokenBaseUrl(params, renewUrl) {
+async function getTokenBaseUrl(params, renewUrl) {
     if (params.has('tokenUrl') && !renewUrl) {
         return params.get('tokenUrl');
     }
@@ -96,8 +98,30 @@ function getTokenBaseUrl(params, renewUrl) {
         throw new Error('Failed to determine token URL: app URL not given');
     }
     const baseUrl = new URL(params.get('appUrl'));
-    baseUrl.pathname = baseUrl.pathname.replace(/\/?$/, OAUTH_PATH);
-    return baseUrl.toString();
+    const cleanPathname = pathname => baseUrl.pathname.replace(/\/?$/, pathname);
+    const getBaseUrl = pathname => {
+        const url = new URL(baseUrl.toString());
+        url.pathname = cleanPathname(pathname);
+        return url;
+    };
+
+    let existingPath;
+    const oauthPaths = [OAUTH_PATH_STREAMLINED_MTX/*, OAUTH_PATH_OLD_MTX*/]; // The old MTX does not support HEAD requests
+    for (const path of oauthPaths) {
+        try {
+            await axios.head(getBaseUrl(path).toString());
+            existingPath = path;
+            break;
+        } catch (e) {
+            if (e.response?.status === 404) {
+                continue;
+            } else {
+                throw Error(`Failed with root cause ${e.message}`);
+            }
+        }
+    }
+    existingPath = existingPath ?? OAUTH_PATH_OLD_MTX;
+    return getBaseUrl(existingPath).toString();
 }
 
 function getKeyringAccountName(params) {
@@ -134,7 +158,16 @@ class SettingsManager {
     static async saveSettings(params) {
         Logger.debug(`Saving settings for project ${params.get('projectFolder')}`);
 
-        await this._saveToFile(params.get('projectFolder'), params.toValueMap(Persistence.setting));
+        const paramsMap = params.toValueMap(Persistence.setting);
+        if (localhostRegex.test(params.get('appUrl'))) {
+            Logger.log(`Saving username${(params.get('isEmptyPassword') ? ' and empty-password hint' : '')} with project settings.`);
+        } else {
+            // Save only against localhost for security reasons.
+            Logger.debug('Not saving username because app is not recognized to run on localhost.');
+            delete paramsMap.username;
+            delete paramsMap.isEmptyPassword;
+        }
+        await this._saveToFile(params.get('projectFolder'), paramsMap);
 
         if (!params.has('token')) {
             return;
@@ -173,15 +206,22 @@ class SettingsManager {
 
     static async updateUrls(params, logout, loadedAppUrl) {
         async function addAppUrlAndSubdomain() {
-            if (params.has('appUrl') && !schemaRegex.test(params.get('appUrl'))) {
-                params.set('appUrl', defaultSchema + params.get('appUrl'));
-                Logger.debug(`Added schema to app URL: ${params.get('appUrl')}`);
+            if (params.has('appUrl')) {
+                const appUrl = params.get('appUrl');
+                if (!schemaRegex.test(appUrl)) {
+                    if (localhostRegex.test(appUrl)) {
+                        params.set('appUrl', httpSchema + appUrl);
+                    } else {
+                        params.set('appUrl', httpsSchema + appUrl);
+                    }
+                    Logger.debug(`Added schema to app URL: ${params.get('appUrl')}`);
+                }
             }
             if (!logout) {
                 if (!params.has('appUrl')) {
                     Logger.debug('App URL not given');
                     await getAppUrlAndSubdomainFromSuggestions(params);
-                } else if (!params.has('subdomain')) {
+                } else if (!params.has('subdomain') && !localhostRegex.test(params.get('appUrl'))) {
                     Logger.debug('Subdomain not given');
                     const appName = await getAppName(params.get('appUrl'));
                     if (appName) {
@@ -193,24 +233,25 @@ class SettingsManager {
                 throw new Error('App URL not given. Please specify it or log in to Cloud Foundry and repeat this command.');
             }
             if (!params.has('subdomain')) {
-                params.set('subdomain', extractSubdomain(params.get('appUrl')));
-                if (!params.has('subdomain')) {
+                const subdomain = extractSubdomain(params.get('appUrl'));
+                if (!subdomain) {
                     throw new Error('Subdomain not given');
                 }
-                Logger.log(`Subdomain determined from app URL: ${params.get('subdomain')}`);
+                params.set('subdomain', subdomain);
+                Logger.log(`Subdomain determined from app URL: ${subdomain}`);
             }
         }
-        function renewTokenUrl() {
+        async function renewTokenUrl() {
             const renewUrl = params.get('appUrl') !== loadedAppUrl;
             if (!params.get('tokenUrl') || renewUrl) {
-                params.set('tokenUrl', getTokenBaseUrl(params, renewUrl));
+                params.set('tokenUrl', await getTokenBaseUrl(params, renewUrl));
             }
         }
 
         await addAppUrlAndSubdomain();
 
         if (!logout) {
-            renewTokenUrl();
+            await renewTokenUrl();
         }
     }
 
@@ -236,13 +277,16 @@ class SettingsManager {
 
     static async addAuth(params, logout) {
         async function addPassword() {
-            params.set('password', await Question.askQuestion('Password: ', undefined, true));
-            if (params.get('password') === '') {
-                throw new Error('Password cannot be empty');
+            if (params.get('isEmptyPassword')) {
+                params.set('password', '');
+            } else {
+                params.set('password', await Question.askQuestion('Password: ', undefined, true));
+                console.log();
             }
         }
         async function addClientSecret() {
             params.set('clientsecret', await Question.askQuestion('clientsecret: ', undefined, true));
+            console.log();
             if (params.get('clientsecret') === '') {
                 throw new Error('clientsecret cannot be empty');
             }
@@ -250,7 +294,7 @@ class SettingsManager {
         async function addPasscode() {
             const prompt = `Passcode${params.get('passcodeUrl') ? ' (visit ' + params.get('passcodeUrl') + ' to generate)' : ''}: `;
             params.set('passcode', await Question.askQuestion(prompt, undefined, true));
-            console.log(); // DON'T: process.stdout.write('\n');
+            console.log();
             if (params.get('passcode') === '') {
                 throw new Error('Passcode cannot be empty');
             }
@@ -288,10 +332,19 @@ class SettingsManager {
         }
 
         if (params.has('username')) {
-            if (!params.get('password') && !logout) {
+            if (!params.has('password') && !logout) {
                 await addPassword();
             }
+            if (params.get('password') === '') {
+                params.set('isEmptyPassword', true);
+                // TODO check password only in production env
+                // throw new Error('Password cannot be empty');
+            } else {
+                params.delete('isEmptyPassword');
+            }
             return;
+        } else {
+            params.delete('isEmptyPassword');
         }
 
         if (params.get('clientid') && !params.get('clientsecret') && !logout) {