abap-local-client 1.0.0

package/README.md

@@ -0,0 +1,22 @@
+# abap-client-auth
+
+SAP Local Client — WebSocket bridge with Basic, SPNEGO, X.509, SAML & SNC authentication.
+
+## Authentication Methods
+
+| Method | File | Description |
+|--------|------|-------------|
+| Basic Auth | `basic-auth.mjs` | Username/password via HTTP Basic header |
+| SPNEGO | `spnego-auth.mjs` | Kerberos/SPNEGO ticket-based auth |
+| X.509 | `x509-auth.mjs` | Client certificate auth |
+| SAML | `saml-login.mjs` | Browser-based SAML SSO |
+| SNC | `snc-auth.mjs` | Secure Network Communication for RFC |
+| SSO Client | `sso-sap-client.mjs` | Main entry point combining all methods |
+
+## Configuration
+
+Uses `config-manager.mjs` for centralized configuration management.
+
+## License
+
+MIT

package/basic-auth.mjs

@@ -0,0 +1,197 @@
+/**
+ * Basic HTTP Authentication Session
+ *
+ * Wraps an axios instance with HTTP Basic Auth pre-configured, managing
+ * CSRF tokens and cookies automatically — the same interface as
+ * SpnegoSession, X509Session, and SamlSession.
+ *
+ * This is the most common authentication scenario: username + password.
+ */
+
+import https from 'https';
+
+export class BasicSession {
+    /**
+     * @param {object}  axios     - Axios instance
+     * @param {string}  sapBaseUrl - SAP HTTPS base URL (e.g. "https://host:44301")
+     * @param {string}  sapClient  - SAP client/mandant
+     * @param {string}  username   - SAP username
+     * @param {string}  password   - SAP password
+     * @param {{ language?: string, rejectUnauthorized?: boolean, timeout?: number }} [opts]
+     */
+    constructor(axios, sapBaseUrl, sapClient, username, password, opts = {}) {
+        this.axios = axios;
+        this.sapBaseUrl = sapBaseUrl;
+        this.sapClient = sapClient;
+        this.username = username;
+        this.password = password;
+        this.language = opts.language || 'EN';
+
+        this.csrfToken = null;
+        this.authenticated = false;
+        this.cookies = new Map();   // cookie jar: name → value
+
+        // Build the Basic auth header value once
+        this._basicAuth = Buffer.from(`${username}:${password}`).toString('base64');
+
+        // Create a dedicated axios instance with pre-configured headers and auth
+        this._client = axios.create({
+            baseURL: sapBaseUrl,
+            timeout: opts.timeout || 60_000,
+            headers: {
+                'sap-client':       sapClient,
+                'sap-language':     this.language,
+                'Accept':           'application/xml,text/plain,*/*',
+                'X-sap-adt-sessiontype': 'stateful',
+                'Authorization':    `Basic ${this._basicAuth}`,
+            },
+            httpsAgent: new https.Agent({
+                rejectUnauthorized: opts.rejectUnauthorized === true,  // default false, like old client
+                keepAlive: true,
+            }),
+        });
+
+        // Response interceptor: capture cookies and CSRF token
+        this._client.interceptors.response.use(
+            (response) => {
+                // Harvest Set-Cookie headers
+                const setCookie = response.headers['set-cookie'];
+                if (setCookie) {
+                    const list = Array.isArray(setCookie) ? setCookie : [setCookie];
+                    for (const c of list) {
+                        const pair = c.split(';')[0].trim();
+                        if (!pair) continue;
+                        const [name, ...rest] = pair.split('=');
+                        this.cookies.set(name, rest.join('='));
+                    }
+                }
+                // Extract CSRF token
+                if (response.headers['x-csrf-token']) {
+                    this.csrfToken = response.headers['x-csrf-token'];
+                }
+                return response;
+            },
+            (error) => {
+                // On 401/403, clear session (match old client behavior)
+                if (error.response && (error.response.status === 401 || error.response.status === 403)) {
+                    this.clearSession();
+                }
+                return Promise.reject(error);
+            }
+        );
+    }
+
+    /** Fetch CSRF token and validate the connection. */
+    async init() {
+        try {
+            const resp = await this._client({
+                method: 'GET',
+                url: '/sap/bc/adt/discovery',
+                headers: {
+                    'Accept':           'application/atomsvc+xml',
+                    'X-CSRF-Token':     'Fetch',
+                },
+                validateStatus: () => true,
+            });
+
+            if (resp.status >= 200 && resp.status < 300) {
+                if (resp.headers['x-csrf-token']) {
+                    this.csrfToken = resp.headers['x-csrf-token'];
+                }
+                this.authenticated = true;
+                return resp;
+            }
+
+            // Discovery returned non-2xx — session invalid, but don't throw.
+            // Mark as not authenticated; first real call may still work.
+            console.warn(`   ⚠️  Basic Auth init: HTTP ${resp.status}`);
+            return resp;
+        } catch (err) {
+            console.warn(`   ⚠️  Basic Auth init failed: ${err.message}`);
+            // Don't throw — session may still work on first real call.
+            // The error will surface naturally when get()/post()/put() are called.
+        }
+    }
+
+    /** Clear cookies and CSRF token on session error. */
+    clearSession() {
+        this.cookies.clear();
+        this.csrfToken = null;
+    }
+
+    /** Refresh CSRF token. */
+    async refreshCsrf() {
+        const resp = await this._client({
+            method: 'GET',
+            url: '/sap/bc/adt/discovery',
+            headers: {
+                'Accept':       'application/atomsvc+xml',
+                'X-CSRF-Token': 'Fetch',
+            },
+        });
+        if (resp.headers['x-csrf-token']) {
+            this.csrfToken = resp.headers['x-csrf-token'];
+        }
+        return this.csrfToken;
+    }
+
+    /** GET request. */
+    async get(path, extraHeaders = {}) {
+        return this._client({
+            method: 'GET',
+            url: path,
+            headers: this._headers(path, extraHeaders),
+        });
+    }
+
+    /** POST request (auto-injects CSRF token). */
+    async post(path, data, extraHeaders = {}) {
+        if (!this.csrfToken) await this.refreshCsrf();
+        return this._client({
+            method: 'POST',
+            url: path,
+            headers: this._headers(path, {
+                'Content-Type': 'application/xml',
+                'X-CSRF-Token': this.csrfToken,
+                ...extraHeaders,
+            }),
+            data,
+        });
+    }
+
+    /** PUT request (auto-injects CSRF token). */
+    async put(path, data, extraHeaders = {}) {
+        if (!this.csrfToken) await this.refreshCsrf();
+        return this._client({
+            method: 'PUT',
+            url: path,
+            headers: this._headers(path, {
+                'Content-Type': 'application/xml',
+                'X-CSRF-Token': this.csrfToken,
+                ...extraHeaders,
+            }),
+            data,
+        });
+    }
+
+    /**
+     * Build headers for a request.
+     * Merges extra headers; forces sap-client and sap-language from the session,
+     * and injects cookies from the cookie jar.
+     */
+    _headers(_path, extra = {}) {
+        const h = {
+            'sap-client':   this.sapClient,
+            'sap-language': this.language,
+            ...extra,
+        };
+        // Inject cookies from jar (SAP session cookies)
+        if (this.cookies.size > 0) {
+            const cookieStr = Array.from(this.cookies.entries())
+                .map(([name, value]) => `${name}=${value}`)
+                .join('; ');
+            h['Cookie'] = cookieStr;
+        }
+        return h;
+    }
+}

package/bin/cli.cjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// abap-local-client entry point (CommonJS wrapper for ESM package)
+(async () => {
+    await import('../sso-sap-client.mjs');
+})().catch(err => {
+    console.error('Failed to start abap-local-client:', err.message);
+    process.exit(1);
+});

package/bin/config.cjs

@@ -0,0 +1,8 @@
+#!/usr/bin/env node
+// abap-local-config entry point (CommonJS wrapper for ESM package)
+(async () => {
+    await import('../config-cli.mjs');
+})().catch(err => {
+    console.error('Failed to start abap-local-config:', err.message);
+    process.exit(1);
+});

package/config-cli.mjs

@@ -0,0 +1,325 @@
+#!/usr/bin/env node
+/**
+ * Configuration CLI — Manage the encrypted SAP system configuration.
+ *
+ * Usage:
+ *   node config-cli.mjs set-mcp-key <apiKey>
+ *   node config-cli.mjs add-system <id> <authMode> [--key value]...
+ *   node config-cli.mjs list-systems
+ *   node config-cli.mjs remove-system <id>
+ *   node config-cli.mjs enable-system <id>
+ *   node config-cli.mjs disable-system <id>
+ *   node config-cli.mjs show-config
+ *   node config-cli.mjs arcanum-fallback <on|off>
+ */
+
+import * as config from './config-manager.mjs';
+import { createInterface } from 'readline';
+
+function readStdin() {
+    return new Promise((resolve) => {
+        const rl = createInterface({ input: process.stdin, terminal: false });
+        let data = '';
+        rl.on('line', (line) => data += line);
+        rl.on('close', () => resolve(data.trim()));
+    });
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Argument parsing
+// ════════════════════════════════════════════════════════════════════════════
+
+const args = process.argv.slice(2);
+const command = args[0];
+
+function usage() {
+    console.log(`
+SAP Local Client — Configuration Manager
+
+Usage:
+  node config-cli.mjs set-mcp-key <apiKey>
+      Set the MCP Cloud API key (used for WebSocket auth).
+      If no argument, reads from stdin (hidden echo).
+
+  node config-cli.mjs set-ws-url <url>
+      Set the MCP Cloud WebSocket URL.
+      Examples:
+        node config-cli.mjs set-ws-url ws://localhost:8080
+        node config-cli.mjs set-ws-url wss://abap-mcp.mcps.b2rise.com/ws
+
+  node config-cli.mjs add-system <id> <authMode> [options...]
+      Add or update a SAP system.
+      authMode: basic | spnego | x509 | saml | snc
+
+      For basic:
+        --host <host> --port <port> --client <client>
+        --username <user> --password <pass> [--saprouter <string>] [--language <lang>]
+
+      For spnego:
+        --host <host> --port <port> --client <client>
+        [--service-principal <spn>] [--language <lang>]
+
+      For x509:
+        --host <host> --port <port> --client <client>
+        --ca-cert <pem> --ca-key <pem> --login-id <identifier>
+        [--language <lang>]
+
+      For saml:
+        --base-url <url> --client <client>
+        [--headless] [--timeout-ms <ms>] [--language <lang>]
+
+      For snc:
+        --host <host> --sysnr <sysnr> --client <client>
+        --snc-partner-name <name> [--snc-my-name <name>]
+        [--snc-qop <qop>] [--snc-lib <path>] [--username <user>]
+        [--saprouter <string>] [--language <lang>]
+
+  node config-cli.mjs list-systems
+      List all configured systems.
+
+  node config-cli.mjs remove-system <id>
+      Remove a system.
+
+  node config-cli.mjs enable-system <id>
+  node config-cli.mjs disable-system <id>
+      Enable or disable a system.
+
+  node config-cli.mjs show-config
+      Show the full configuration (API key and passwords REDACTED).
+
+  node config-cli.mjs arcanum-fallback <on|off>
+      Enable or disable Arcanum fallback for unknown system IDs.
+
+Config file: ${config.getConfigFilePath()}
+`);
+}
+
+function parseKeyValue(args) {
+    const map = {};
+    for (let i = 0; i < args.length; i++) {
+        if (args[i].startsWith('--')) {
+            const key = args[i].slice(2).replace(/-/g, '_');
+            const nextArg = args[i + 1];
+            // A standalone `--flag` with no value = boolean true
+            if (!nextArg || nextArg.startsWith('--')) {
+                map[key] = 'true';
+            } else {
+                map[key] = nextArg;
+                i++;
+            }
+        }
+    }
+    return map;
+}
+
+function redact(str) {
+    if (!str || str.length <= 4) return '***';
+    return str.substring(0, 2) + '***' + str.substring(str.length - 2);
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Commands
+// ════════════════════════════════════════════════════════════════════════════
+
+switch (command) {
+    // ── set-mcp-key ─────────────────────────────────────────────────────────
+    case 'set-mcp-key': {
+        let apiKey = args[1];
+        if (!apiKey) {
+            console.log('Enter MCP API key (input will NOT be echoed):');
+            apiKey = await readStdin();
+        }
+        if (!apiKey) {
+            console.error('No API key provided.');
+            process.exit(1);
+        }
+        config.setMcpApiKey(apiKey);
+        console.log('✅ MCP API key saved.');
+        break;
+    }
+
+    // ── add-system ─────────────────────────────────────────────────────────
+    case 'add-system': {
+        const systemId = args[1];
+        const authMode = args[2];
+        if (!systemId || !authMode) {
+            console.error('Usage: node config-cli.mjs add-system <id> <authMode> [options...]');
+            process.exit(1);
+        }
+
+        const validModes = ['basic', 'spnego', 'x509', 'saml', 'snc'];
+        if (!validModes.includes(authMode)) {
+            console.error(`Invalid auth mode: ${authMode}. Use: ${validModes.join(', ')}`);
+            process.exit(1);
+        }
+
+        const opts = parseKeyValue(args.slice(3));
+
+        // Build connection object based on auth mode
+        let connection = {};
+        switch (authMode) {
+            case 'basic':
+                connection = {
+                    host: opts.host || 'localhost',
+                    port: opts.port || '44301',
+                    client: opts.client || '100',
+                    username: opts.username || '',
+                    password: opts.password || '',
+                    saprouter: opts.saprouter || '',
+                    language: opts.language || 'EN',
+                };
+                break;
+            case 'spnego':
+                connection = {
+                    host: opts.host || '',
+                    port: opts.port || '44301',
+                    client: opts.client || '100',
+                    servicePrincipal: opts.service_principal || '',
+                    language: opts.language || 'EN',
+                };
+                break;
+            case 'x509':
+                connection = {
+                    host: opts.host || '',
+                    port: opts.port || '44301',
+                    client: opts.client || '100',
+                    caCertPem: opts.ca_cert || '',
+                    caKeyPem: opts.ca_key || '',
+                    loginIdentifier: opts.login_id || '',
+                    validityMinutes: parseInt(opts.validity_minutes || '5', 10),
+                    language: opts.language || 'EN',
+                };
+                break;
+            case 'saml':
+                connection = {
+                    baseUrl: opts.base_url || '',
+                    client: opts.client || '100',
+                    headless: opts.headless === 'true',
+                    loginTimeoutMs: parseInt(opts.timeout_ms || '600000', 10),
+                    language: opts.language || 'EN',
+                };
+                break;
+            case 'snc':
+                connection = {
+                    host: opts.host || '',
+                    sysnr: opts.sysnr || '00',
+                    client: opts.client || '100',
+                    username: opts.username || '',
+                    saprouter: opts.saprouter || '',
+                    sncPartnerName: opts.snc_partner_name || '',
+                    sncMyName: opts.snc_my_name || '',
+                    sncQop: opts.snc_qop || '3',
+                    sncLib: opts.snc_lib || '',
+                    language: opts.language || 'EN',
+                };
+                break;
+        }
+
+        config.addOrUpdateSystem(systemId, { authMode, connection, enabled: true });
+        console.log(`✅ System "${systemId}" (${authMode}) saved.`);
+        break;
+    }
+
+    // ── list-systems ───────────────────────────────────────────────────────
+    case 'list-systems': {
+        const systems = config.listSystems();
+        if (systems.length === 0) {
+            console.log('No systems configured.');
+        } else {
+            console.log(`Configured systems (${systems.length}):\n`);
+            console.log('  ID                  AUTH MODE    ENABLED');
+            console.log('  ──────────────────  ───────────  ───────');
+            for (const s of systems) {
+                console.log(`  ${s.systemId.padEnd(20)} ${s.authMode.padEnd(12)} ${s.enabled ? 'yes' : 'no'}`);
+            }
+            console.log('');
+        }
+        break;
+    }
+
+    // ── remove-system ──────────────────────────────────────────────────────
+    case 'remove-system': {
+        const systemId = args[1];
+        if (!systemId) {
+            console.error('Usage: node config-cli.mjs remove-system <id>');
+            process.exit(1);
+        }
+        config.removeSystem(systemId);
+        console.log(`✅ System "${systemId}" removed.`);
+        break;
+    }
+
+    // ── enable-system / disable-system ─────────────────────────────────────
+    case 'enable-system':
+    case 'disable-system': {
+        const systemId = args[1];
+        if (!systemId) {
+            console.error(`Usage: node config-cli.mjs ${command} <id>`);
+            process.exit(1);
+        }
+        const enabled = command === 'enable-system';
+        config.setSystemEnabled(systemId, enabled);
+        console.log(`✅ System "${systemId}" ${enabled ? 'enabled' : 'disabled'}.`);
+        break;
+    }
+
+    // ── show-config ───────────────────────────────────────────────────────
+    case 'show-config': {
+        const cfg = config.loadConfig();
+        console.log(`Config file: ${config.getConfigFilePath()}`);
+        console.log(`MCP API key:  ${cfg.mcpApiKey ? redact(cfg.mcpApiKey) : '(not set)'}`);
+        console.log(`WS URL:       ${cfg.wsUrl || 'ws://localhost:8080'}`);
+        console.log(`Arcanum:      ${cfg.enableArcanumFallback ? 'ON' : 'OFF'}`);
+        console.log(`Reconnect:    ${cfg.reconnectDelayMs}ms`);
+        console.log('');
+
+        const sysIds = Object.keys(cfg.systems);
+        if (sysIds.length === 0) {
+            console.log('No systems configured.');
+        } else {
+            for (const id of sysIds) {
+                const sys = cfg.systems[id];
+                const conn = { ...sys.connection };
+                // Redact sensitive fields
+                if (conn.password) conn.password = redact(conn.password);
+                if (conn.caCertPem) conn.caCertPem = conn.caCertPem.substring(0, 40) + '...';
+                if (conn.caKeyPem) conn.caKeyPem = '***REDACTED***';
+                console.log(`[${id}]  auth: ${sys.authMode}  enabled: ${sys.enabled !== false}`);
+                console.log(`       ${JSON.stringify(conn)}`);
+                console.log('');
+            }
+        }
+        break;
+    }
+
+    // ── arcanum-fallback ───────────────────────────────────────────────────
+    case 'arcanum-fallback': {
+        const value = args[1];
+        if (!value || (value !== 'on' && value !== 'off')) {
+            console.error('Usage: node config-cli.mjs arcanum-fallback <on|off>');
+            process.exit(1);
+        }
+        config.setArcanumFallback(value === 'on');
+        console.log(`✅ Arcanum fallback: ${value.toUpperCase()}`);
+        break;
+    }
+
+    // ── set-ws-url ──────────────────────────────────────────────────────────
+    case 'set-ws-url': {
+        const url = args[1];
+        if (!url) {
+            console.error('Usage: node config-cli.mjs set-ws-url <url>');
+            console.error('  local:  ws://localhost:8080');
+            console.error('  cloud:  wss://abap-mcp.mcps.b2rise.com/ws');
+            process.exit(1);
+        }
+        config.setWsUrl(url);
+        console.log(`✅ WS URL: ${url}`);
+        break;
+    }
+
+    // ── help / default ─────────────────────────────────────────────────────
+    default:
+        usage();
+        break;
+}