@sap/cli-core 2025.16.0 → 2025.17.0

package/CHANGELOG.md

@@ -5,6 +5,20 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 2025.17.0
+
+### Changed
+
+- **Enhanced TLS configuration for improved security.** The CLI now uses TLS 1.2 by default for all HTTPS requests, ensuring secure communication with servers. Users can adjust the TLS version if needed using the `--tls-version` flag with options "TLSv1.2" or "TLSv1.3".
+
+### Added
+
+- **New environment variable `CLI_LEGACY_TLS_DETECTION`.** When set to `"true"`, this disables TLS version enforcement and lets Node.js decide the default TLS version. This provides compatibility with older Node.js versions or specific environments where TLS version enforcement might cause issues.
+
+### Fixed
+
+- The CLI now correctly handles the secrets overwrite confirmation when using the `--secrets-file` option. If the cached secret already exists the user is prompted to confirm whether to overwrite the existing secret or not. If the user chooses to overwrite, the CLI deletes the existing secret and continues with the default login process.
+
 ## 2025.13.0
 
 ### Changed

package/cache/secrets/SecretsStorageImpl.d.ts

@@ -21,5 +21,4 @@ export declare class SecretsStorageImpl implements SecretsStorage {
     private removeUnknownPropertiesFromSecrets;
     synchronizeSecretsToStorage(): Promise<void>;
     getAllSecrets(): ReadonlyArray<Secret>;
-    hasSecretForTenant(tenantUrl: string): boolean;
 }

package/cache/secrets/SecretsStorageImpl.js

@@ -142,8 +142,5 @@ class SecretsStorageImpl {
     getAllSecrets() {
         return this.secrets;
     }
-    hasSecretForTenant(tenantUrl) {
-        return this.secrets.some((secret) => secret.tenantUrl === tenantUrl);
-    }
 }
 exports.SecretsStorageImpl = SecretsStorageImpl;

package/commands/handler/authentication/oauth/index.d.ts

@@ -1,2 +1,2 @@
 import { Handler } from "../../../../types";
-export declare const create: (overrideExisting?: boolean) => Handler;
+export declare const create: () => Handler;

package/commands/handler/authentication/oauth/index.js

@@ -9,9 +9,9 @@ const tokenProvider_1 = require("./tokenProvider");
 const checkOptionsExistence_1 = require("../../checkOptionsExistence");
 const constants_1 = require("../../../../constants");
 const core_1 = require("../../../../config/core");
-const create = (overrideExisting = false) => {
+const create = () => {
     if ((0, core_1.getAuthenticationMethods)().includes(constants_1.AuthenticationMethod.oauth)) {
-        return (0, error_1.create)("failed to handle OAuth authorization", (0, next_1.create)("commands.handler.authentication.oauth", (0, checkOptionsExistence_1.create)(constants_1.OPTION_PASSCODE), (0, secretsProvider_1.create)(), (0, tokenProvider_1.create)(overrideExisting)));
+        return (0, error_1.create)("failed to handle OAuth authorization", (0, next_1.create)("commands.handler.authentication.oauth", (0, checkOptionsExistence_1.create)(constants_1.OPTION_PASSCODE), (0, secretsProvider_1.create)(), (0, tokenProvider_1.create)()));
     }
     return (0, fail_1.create)();
 };

package/commands/handler/authentication/oauth/tokenProvider/getToken.d.ts

@@ -1,2 +1,2 @@
 import { Handler } from "../../../../../types";
-export declare const create: (overrideExisting?: boolean) => Handler;
+export declare const create: () => Handler;

package/commands/handler/authentication/oauth/tokenProvider/getToken.js

@@ -10,13 +10,12 @@ const utils_1 = require("../utils");
 const utils_2 = require("./utils");
 const SecretsStorageSingleton_1 = require("../../../../../cache/secrets/SecretsStorageSingleton");
 const getLogger = () => (0, logger_1.get)("commands.handler.authentication.oauth.tokenProvider.getToken");
-const createGetTokenHandler = (overrideExisting) => {
+const createGetTokenHandler = () => {
     const handler = async () => async () => {
         const { info: logInfo, debug } = getLogger();
         logInfo("checking token existence");
         const secrets = await SecretsStorageSingleton_1.SecretsStorageSingleton.SINGLETON.getDefaultSecret();
-        if (overrideExisting || (!secrets.access_token && !secrets.refresh_token)) {
-            debug(`access token not available or overrideExisting=${overrideExisting}, retrieving token from server`);
+        if (!secrets.access_token && !secrets.refresh_token) {
             if (secrets.authorization_flow === types_1.GrantType.authorization_code) {
                 const code = await (0, utils_2.getCode)(secrets.authorization_url, secrets.client_id);
                 debug("code received, reading token");
@@ -38,5 +37,5 @@ const createGetTokenHandler = (overrideExisting) => {
     };
     return handler;
 };
-const create = (overrideExisting = false) => (0, next_1.create)("commands.handler.authentication.oauth.tokenProvider.getToken", (0, options_1.create)(constants_1.OPTION_CODE), createGetTokenHandler(overrideExisting));
+const create = () => (0, next_1.create)("commands.handler.authentication.oauth.tokenProvider.getToken", (0, options_1.create)(constants_1.OPTION_CODE), createGetTokenHandler());
 exports.create = create;

package/commands/handler/authentication/oauth/tokenProvider/index.d.ts

@@ -1,2 +1,2 @@
 import { Handler } from "../../../../../types";
-export declare const create: (overrideExisting?: boolean) => Handler;
+export declare const create: () => Handler;

package/commands/handler/authentication/oauth/tokenProvider/index.js

@@ -7,5 +7,5 @@ const or_1 = require("../../../or");
 const refreshToken_1 = require("./refreshToken");
 const setAuthorization_1 = require("./setAuthorization");
 const getToken_1 = require("./getToken");
-const create = (overrideExisting = false) => (0, error_1.create)("failed to handle token", (0, next_1.create)("commands.handler.authentication.oauth.tokenProvider", (0, or_1.create)("commands.handler.authentication.oauth.tokenProvider", (0, getToken_1.create)(overrideExisting), (0, refreshToken_1.create)(true)), (0, setAuthorization_1.create)()));
+const create = () => (0, error_1.create)("failed to handle token", (0, next_1.create)("commands.handler.authentication.oauth.tokenProvider", (0, or_1.create)("commands.handler.authentication.oauth.tokenProvider", (0, getToken_1.create)(), (0, refreshToken_1.create)(true)), (0, setAuthorization_1.create)()));
 exports.create = create;

package/commands/handler/fetch/utils.js

@@ -226,7 +226,7 @@ const buildHttpConfig = async (method, path, parameterMappings) => {
         },
     };
     if ((0, utils_1.getAuthenticationMethod)() === constants_1.AuthenticationMethod.oauth) {
-        delete httpConfig.headers.publicfqdn;
+        delete httpConfig.headers?.publicfqdn;
     }
     return httpConfig;
 };

package/commands/login.command.js

@@ -56,23 +56,28 @@ const fetchSupportedBrowsers = async () => {
 const saveSecrets = async () => async () => {
     await SecretsStorageSingleton_1.SecretsStorageSingleton.SINGLETON.synchronizeSecretsToStorage();
 };
-const warnIfSecretExists = async () => {
+const warnIfSecretExistsInCache = async () => {
     return async () => {
         const logger = getLogger();
         const tenantUrl = (0, utils_1.getTenantUrl)();
         const secretsStorage = SecretsStorageSingleton_1.SecretsStorageSingleton.SINGLETON;
-        if (secretsStorage.hasSecretForTenant &&
-            secretsStorage.hasSecretForTenant(tenantUrl)) {
+        // Default secret is from cache since secrets file and options aren't loaded yet
+        const cachedSecret = await secretsStorage.getDefaultSecret();
+        if (cachedSecret) {
             const shouldOverwrite = await confirmSecretsOverwrite(tenantUrl);
             logger.debug(`user response for overwriting secrets for tenant ${tenantUrl}: ${shouldOverwrite}`);
             if (!shouldOverwrite) {
                 const message = `Aborted: Secret for tenant ${tenantUrl} already exists and will not be overwritten.`;
                 logger.warn(message);
-                // Do not throw, just log and return
+                // Stop proceeding with the login process as a secret for the tenant already exists
                 return;
             }
+            logger.info(`Overwriting existing secret for tenant ${tenantUrl}. Proceeding with login.`);
+            // Remove the cached secret to allow the new one to be created
+            secretsStorage.deleteSecretById(cachedSecret.id);
+            logger.debug(`Existing secret for tenant ${tenantUrl} has been removed.`);
         }
-        throw new Error(`Warning: Previous login secrets for tenant ${tenantUrl} will be removed and overwritten with new credentials.`);
+        throw new Error(`Login secret for tenant ${tenantUrl} must be loaded.`);
     };
 };
 const loginCommand = {
@@ -92,12 +97,13 @@ const loginCommand = {
         { ...constants_1.OPTION_CODE, hidden: false },
         { ...constants_1.OPTION_REFRESH_TOKEN, hidden: false },
         { ...constants_1.OPTION_SECRETS_FILE, hidden: false },
+        { ...constants_1.OPTION_TLS_VERSION, hidden: false },
         {
             ...constants_1.OPTION_BROWSER,
             choices: fetchSupportedBrowsers,
             default: openUtils_1.getDefaultBrowser,
         },
         { ...constants_1.OPTION_AUTHORIZATION_FLOW, hidden: false },
-    ]), (0, handler_1.createMandatoryOptionsHandler)(), exports.verifyHost, (0, handler_1.createOrHandler)("commands.login", warnIfSecretExists, (0, handler_1.createNextHandler)("commands.login", (0, handler_1.createOauthHandler)(true), initializeCache, saveSecrets))),
+    ]), (0, handler_1.createMandatoryOptionsHandler)(), exports.verifyHost, (0, handler_1.createOrHandler)("commands.login", warnIfSecretExistsInCache, (0, handler_1.createNextHandler)("commands.login", (0, handler_1.createOauthHandler)(), initializeCache, saveSecrets))),
 };
 exports.default = loginCommand;

package/constants.d.ts

@@ -1,5 +1,7 @@
+import { SecureVersion } from "tls";
 import { Option } from "./types";
 export declare const VERSION: string;
+export declare const DEFAULT_TLS_VERSION: SecureVersion;
 export type CoreConfiguration = {
     getName: () => string;
     getPackageName: () => string;
@@ -60,3 +62,4 @@ export declare const OPTION_FILE_PATH: Option;
 export declare const OPTION_INPUT: Option;
 export declare const OPTION_BROWSER: Option;
 export declare const OPTION_AUTHORIZATION_FLOW: Option;
+export declare const OPTION_TLS_VERSION: Option;

package/constants.js

@@ -3,11 +3,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.OPTION_AUTHORIZATION_FLOW = exports.OPTION_BROWSER = exports.OPTION_INPUT = exports.OPTION_FILE_PATH = exports.OPTION_OPTIONS_FILE = exports.CONFIG_PASSCODE_FUNCTION = exports.OPTION_PASSCODE = exports.OPTION_CODE = exports.OPTION_SECRETS_FILE = exports.OPTION_EXPIRES_IN = exports.OPTION_REFRESH_TOKEN = exports.OPTION_ACCESS_TOKEN = exports.OPTION_TOKEN_URL = exports.OPTION_AUTHORIZATION_URL = exports.OPTION_CLIENT_SECRET = exports.OPTION_CLIENT_ID = exports.OPTION_FORCE = exports.OPTION_VERBOSE = exports.OPTION_NO_PRETTY = exports.OPTION_OUTPUT = exports.OPTION_LOGIN_ID = exports.OPTION_HOST = exports.OPTION_HELP = exports.OPTION_VERSION = exports.CACHE_SECRETS_FILE = exports.PATH_TO_ERROR_HTML = exports.PATH_TO_SUCCESS_HTML = exports.X_OUTPUT_FILE_NAME = exports.X_DSP_API_DEPRECATED_PROPERTIES = exports.X_CSRF_TOKEN = exports.DISCOVERY_METADATA_PATH = exports.SEGMENTS_TO_REMOVE_FOR_PASSCODE_AUTH = exports.CLI_GENERIC_OPTIONS_HELP = exports.CLI_SUPPORTED_AUTHENTICATION_METHODS = exports.CLI_DEPRECATION_MESSAGE = exports.CLI_DEPRECATED = exports.CLI_VERSION = exports.CLI_SAP_HELP = exports.CLI_DISCOVERY_PATHS = exports.CLI_DESCRIPTION = exports.CLI_PACKAGE_NAME = exports.CLI_NAME = exports.ROOT_COMMAND = exports.AuthenticationMethod = exports.DISCOVERY_DOCUMENT_PREFIX = exports.VERSION = void 0;
+exports.OPTION_TLS_VERSION = exports.OPTION_AUTHORIZATION_FLOW = exports.OPTION_BROWSER = exports.OPTION_INPUT = exports.OPTION_FILE_PATH = exports.OPTION_OPTIONS_FILE = exports.CONFIG_PASSCODE_FUNCTION = exports.OPTION_PASSCODE = exports.OPTION_CODE = exports.OPTION_SECRETS_FILE = exports.OPTION_EXPIRES_IN = exports.OPTION_REFRESH_TOKEN = exports.OPTION_ACCESS_TOKEN = exports.OPTION_TOKEN_URL = exports.OPTION_AUTHORIZATION_URL = exports.OPTION_CLIENT_SECRET = exports.OPTION_CLIENT_ID = exports.OPTION_FORCE = exports.OPTION_VERBOSE = exports.OPTION_NO_PRETTY = exports.OPTION_OUTPUT = exports.OPTION_LOGIN_ID = exports.OPTION_HOST = exports.OPTION_HELP = exports.OPTION_VERSION = exports.CACHE_SECRETS_FILE = exports.PATH_TO_ERROR_HTML = exports.PATH_TO_SUCCESS_HTML = exports.X_OUTPUT_FILE_NAME = exports.X_DSP_API_DEPRECATED_PROPERTIES = exports.X_CSRF_TOKEN = exports.DISCOVERY_METADATA_PATH = exports.SEGMENTS_TO_REMOVE_FOR_PASSCODE_AUTH = exports.CLI_GENERIC_OPTIONS_HELP = exports.CLI_SUPPORTED_AUTHENTICATION_METHODS = exports.CLI_DEPRECATION_MESSAGE = exports.CLI_DEPRECATED = exports.CLI_VERSION = exports.CLI_SAP_HELP = exports.CLI_DISCOVERY_PATHS = exports.CLI_DESCRIPTION = exports.CLI_PACKAGE_NAME = exports.CLI_NAME = exports.ROOT_COMMAND = exports.AuthenticationMethod = exports.DISCOVERY_DOCUMENT_PREFIX = exports.DEFAULT_TLS_VERSION = exports.VERSION = void 0;
 const path_1 = __importDefault(require("path"));
 const types_1 = require("./types");
 const utils_1 = require("./utils/utils");
 exports.VERSION = (0, utils_1.getVersion)();
+exports.DEFAULT_TLS_VERSION = "TLSv1.2";
 exports.DISCOVERY_DOCUMENT_PREFIX = "discovery-";
 var AuthenticationMethod;
 (function (AuthenticationMethod) {
@@ -227,3 +228,11 @@ exports.OPTION_AUTHORIZATION_FLOW = {
     required: true,
     hidden: true,
 };
+exports.OPTION_TLS_VERSION = {
+    longName: "tls-version",
+    description: "specifies the TLS version to use for HTTPS connections",
+    args: [{ name: "version" }],
+    choices: [exports.DEFAULT_TLS_VERSION, "TLSv1.3"],
+    default: exports.DEFAULT_TLS_VERSION,
+    hidden: true,
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sap/cli-core",
-  "version": "2025.16.0",
+  "version": "2025.17.0",
   "description": "Command-Line Interface (CLI) Core Module",
   "license": "SEE LICENSE IN LICENSE",
   "author": "SAP SE",

package/utils/http/httpsAgent.d.ts

@@ -0,0 +1,6 @@
+import https from "https";
+import tls from "tls";
+export declare const getTlsVersion: () => tls.SecureVersion;
+export declare const isLegacyTlsDetectionEnabled: () => boolean;
+export declare const createTlsAgentOptions: () => https.AgentOptions;
+export declare const createHttpsAgent: (proxy?: string) => https.Agent;

package/utils/http/httpsAgent.js

@@ -0,0 +1,54 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHttpsAgent = exports.createTlsAgentOptions = exports.isLegacyTlsDetectionEnabled = exports.getTlsVersion = void 0;
+const https_1 = __importDefault(require("https"));
+const https_proxy_agent_1 = require("https-proxy-agent");
+const constants_1 = require("../../constants");
+const logger_1 = require("../../logger");
+const options_1 = require("../options");
+const getLogger = () => (0, logger_1.get)("http");
+const getTlsVersion = () => {
+    return (0, options_1.getOptionValueFromConfig)(constants_1.OPTION_TLS_VERSION, constants_1.DEFAULT_TLS_VERSION);
+};
+exports.getTlsVersion = getTlsVersion;
+const isLegacyTlsDetectionEnabled = () => {
+    return process.env.CLI_LEGACY_TLS_DETECTION === "true";
+};
+exports.isLegacyTlsDetectionEnabled = isLegacyTlsDetectionEnabled;
+const createTlsAgentOptions = () => {
+    const { debug } = getLogger();
+    if ((0, exports.isLegacyTlsDetectionEnabled)()) {
+        debug("using legacy TLS detection - letting Node.js decide default TLS version");
+        return {
+            rejectUnauthorized: true,
+        };
+    }
+    const tlsVersion = (0, exports.getTlsVersion)();
+    debug(`configuring HTTPS agent with TLS version: ${tlsVersion}`);
+    const agentOptions = {
+        minVersion: tlsVersion,
+        maxVersion: tlsVersion,
+        rejectUnauthorized: true,
+    };
+    debug("HTTPS agent options:", JSON.stringify(agentOptions, null, 2));
+    return agentOptions;
+};
+exports.createTlsAgentOptions = createTlsAgentOptions;
+const createHttpsAgent = (proxy) => {
+    const { debug } = getLogger();
+    const agentOptions = (0, exports.createTlsAgentOptions)();
+    let agent;
+    if (proxy) {
+        agent = new https_proxy_agent_1.HttpsProxyAgent(proxy, agentOptions);
+        debug(`created HttpsProxyAgent with proxy: ${proxy}`);
+    }
+    else {
+        agent = new https_1.default.Agent(agentOptions);
+        debug("created https.Agent with TLS configuration");
+    }
+    return agent;
+};
+exports.createHttpsAgent = createHttpsAgent;

package/utils/http/index.js

@@ -5,13 +5,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.fetch = exports.DEFAULTS = void 0;
 const axios_1 = __importDefault(require("axios"));
-const https_proxy_agent_1 = require("https-proxy-agent");
 const config_1 = require("../../config");
-const logger_1 = require("../../logger");
-const constants_1 = require("../../constants");
-const utils_1 = require("./utils");
 const core_1 = require("../../config/core");
-const utils_2 = require("../../logger/utils");
+const constants_1 = require("../../constants");
+const logger_1 = require("../../logger");
+const utils_1 = require("../../logger/utils");
+const httpsAgent_1 = require("./httpsAgent");
+const utils_2 = require("./utils");
 exports.DEFAULTS = {
     maxBodyLength: -1,
     maxContentLength: -1,
@@ -36,18 +36,21 @@ const getCsrfTokenFromConfig = () => {
 const fetch = async (config) => {
     const cnfg = (0, config_1.get)();
     const logger = getLogger();
-    const { debug, output, trace, error } = logger;
+    const { debug, trace, error } = logger;
     try {
-        (0, utils_2.logVerbose)(logger, "%s %s", config.method.toUpperCase(), config.url);
+        (0, utils_1.logVerbose)(logger, "%s %s", config.method.toUpperCase(), config.url);
         debug("http config: %s", JSON.stringify(config));
-        const httpsAgent = HTTPS_PROXY ? new https_proxy_agent_1.HttpsProxyAgent(HTTPS_PROXY) : null;
-        if (httpsAgent && cnfg.verbose) {
-            output(`using https proxy agent for https proxy`);
+        const httpsAgent = (0, httpsAgent_1.createHttpsAgent)(HTTPS_PROXY);
+        if (HTTPS_PROXY) {
+            (0, utils_1.logVerbose)(logger, "using https proxy agent for https proxy");
             debug(`using https proxy agent for https proxy ${HTTPS_PROXY}`);
         }
         else {
             debug("no https proxy defined via environment variable https_proxy");
         }
+        const tlsVersion = (0, httpsAgent_1.getTlsVersion)();
+        const useLegacyTls = (0, httpsAgent_1.isLegacyTlsDetectionEnabled)();
+        debug(`TLS configuration - version: ${tlsVersion}, legacy detection: ${useLegacyTls}`);
         const res = await (0, axios_1.default)({
             httpsAgent,
             proxy: false,
@@ -60,8 +63,8 @@ const fetch = async (config) => {
             },
         });
         if (cnfg.verbose) {
-            (0, utils_2.logVerbose)(logger, "%d %s", res.status, res.statusText);
-            (0, utils_1.printCorrelationId)(res);
+            (0, utils_1.logVerbose)(logger, "%d %s", res.status, res.statusText);
+            (0, utils_2.printCorrelationId)(res);
         }
         trace("response", res);
         setEtag(res.headers);
@@ -70,8 +73,8 @@ const fetch = async (config) => {
     catch (err) {
         error("error while executing http request", err.toString(), err.response);
         if (cnfg.verbose) {
-            (0, utils_1.printError)(err);
-            (0, utils_1.printCorrelationId)(err.response);
+            (0, utils_2.printError)(err);
+            (0, utils_2.printCorrelationId)(err.response);
         }
         setEtag(err.response?.headers);
         throw err;