abap-local-client 1.0.0

package/config-manager.mjs

@@ -0,0 +1,278 @@
+/**
+ * Configuration Manager — Encrypted local store for MCP API key & SAP systems
+ *
+ * Uses Windows DPAPI via @primno/dpapi to encrypt/decrypt a JSON file.
+ * The file is stored at %APPDATA%/abap-local-client/config.json (or
+ * ABAP_CONFIG_DIR if set).
+ *
+ * Config structure:
+ * {
+ *   "mcpApiKey": "arc_local_...",
+ *   "systems": {
+ *     "systemId": {
+ *       "authMode": "basic|spnego|x509|saml|snc",
+ *       "connection": { ... mode-specific fields ... },
+ *       "enabled": true
+ *     }
+ *   },
+ *   "enableArcanumFallback": false,   // if true, fall back to Arcanum for unknown systems
+ *   "reconnectDelayMs": 5000
+ * }
+ */
+
+import { createRequire } from 'module';
+import path from 'path';
+import fs from 'fs';
+import os from 'os';
+
+const require = createRequire(import.meta.url);
+
+let dpapi = null;
+if (process.platform === 'win32') {
+    try {
+        dpapi = require('@primno/dpapi');
+    } catch (e) {
+        console.warn('⚠️  @primno/dpapi not available — config will be stored UNENCRYPTED.');
+    }
+} else {
+    console.warn('⚠️  DPAPI is Windows-only — config will be stored UNENCRYPTED.');
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Path resolution
+// ════════════════════════════════════════════════════════════════════════════
+
+function getConfigDir() {
+    if (process.env.ABAP_CONFIG_DIR) {
+        return process.env.ABAP_CONFIG_DIR;
+    }
+    // Windows: %APPDATA%\abap-local-client
+    // Fallback: ~/.abap-local-client
+    if (process.env.APPDATA) {
+        return path.join(process.env.APPDATA, 'abap-local-client');
+    }
+    return path.join(os.homedir(), '.abap-local-client');
+}
+
+function getConfigPath() {
+    return path.join(getConfigDir(), 'config.json');
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  DPAPI helpers
+// ════════════════════════════════════════════════════════════════════════════
+
+function dpapiEncrypt(plainText) {
+    if (!dpapi) return plainText;  // no encryption available
+    const buf = Buffer.from(plainText, 'utf8');
+    const enc = dpapi.default.protectData(buf, null, 'CurrentUser');
+    return enc.toString('base64');
+}
+
+function dpapiDecrypt(base64Text) {
+    if (!dpapi) return base64Text;  // not encrypted
+    const buf = Buffer.from(base64Text, 'base64');
+    const dec = dpapi.default.unprotectData(buf, null, 'CurrentUser');
+    return Buffer.from(dec).toString('utf8');
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Default config
+// ════════════════════════════════════════════════════════════════════════════
+
+function defaultConfig() {
+    return {
+        mcpApiKey: '',
+        wsUrl: 'ws://localhost:8080',
+        systems: {},
+        enableArcanumFallback: false,
+        reconnectDelayMs: 5000,
+    };
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Public API
+// ════════════════════════════════════════════════════════════════════════════
+
+export function loadConfig() {
+    const configPath = getConfigPath();
+
+    if (!fs.existsSync(configPath)) {
+        return defaultConfig();
+    }
+
+    const encryptedContent = fs.readFileSync(configPath, 'utf8');
+    if (!encryptedContent.trim()) {
+        return defaultConfig();
+    }
+
+    let jsonText;
+    try {
+        jsonText = dpapiDecrypt(encryptedContent);
+    } catch (e) {
+        console.error(`❌ Failed to decrypt config: ${e.message}`);
+        console.error('   Possibly from a different user or machine. Starting with empty config.');
+        return defaultConfig();
+    }
+
+    try {
+        const parsed = JSON.parse(jsonText);
+        const defaults = defaultConfig();
+        return { ...defaults, ...parsed };
+    } catch (e) {
+        console.error(`❌ Failed to parse config JSON: ${e.message}`);
+        return defaultConfig();
+    }
+}
+
+function saveConfig(config) {
+    const configDir = getConfigDir();
+    if (!fs.existsSync(configDir)) {
+        fs.mkdirSync(configDir, { recursive: true });
+    }
+
+    const jsonText = JSON.stringify(config, null, 2);
+    const encryptedContent = dpapiEncrypt(jsonText);
+    fs.writeFileSync(getConfigPath(), encryptedContent, 'utf8');
+}
+
+// ── MCP API Key ────────────────────────────────────────────────────────────
+
+export function getMcpApiKey() {
+    const config = loadConfig();
+    return config.mcpApiKey || '';
+}
+
+export function setMcpApiKey(key) {
+    const config = loadConfig();
+    config.mcpApiKey = key;
+    saveConfig(config);
+}
+
+// ── System management ──────────────────────────────────────────────────────
+
+/**
+ * Get a single system config by ID.
+ * @returns {object|null}
+ */
+export function getSystem(systemId) {
+    const config = loadConfig();
+    return config.systems[systemId] || null;
+}
+
+/**
+ * List all systems (optionally filtered by enabled status).
+ * @returns {{ systemId: string, authMode: string, enabled: boolean }[]}
+ */
+export function listSystems(filterEnabled = false) {
+    const config = loadConfig();
+    return Object.entries(config.systems)
+        .filter(([, sys]) => !filterEnabled || sys.enabled !== false)
+        .map(([id, sys]) => ({
+            systemId: id,
+            authMode: sys.authMode || 'basic',
+            enabled: sys.enabled !== false,
+        }));
+}
+
+/**
+ * Add or update a system.
+ * @param {string} systemId
+ * @param {object} systemConfig  - { authMode, connection, enabled }
+ */
+export function addOrUpdateSystem(systemId, systemConfig) {
+    const config = loadConfig();
+    config.systems[systemId] = {
+        authMode: systemConfig.authMode || 'basic',
+        connection: systemConfig.connection || {},
+        enabled: systemConfig.enabled !== false,
+    };
+    saveConfig(config);
+}
+
+/**
+ * Remove a system by ID.
+ * @param {string} systemId
+ */
+export function removeSystem(systemId) {
+    const config = loadConfig();
+    delete config.systems[systemId];
+    saveConfig(config);
+}
+
+/**
+ * Enable or disable a system.
+ * @param {string} systemId
+ * @param {boolean} enabled
+ */
+export function setSystemEnabled(systemId, enabled) {
+    const config = loadConfig();
+    if (!config.systems[systemId]) {
+        throw new Error(`System "${systemId}" not found`);
+    }
+    config.systems[systemId].enabled = !!enabled;
+    saveConfig(config);
+}
+
+/**
+ * Check if a system is enabled.
+ * @param {string} systemId
+ * @returns {boolean}
+ */
+export function isSystemEnabled(systemId) {
+    const sys = getSystem(systemId);
+    return sys ? sys.enabled !== false : false;
+}
+
+// ── Arcanum fallback ──────────────────────────────────────────────────────
+
+export function getArcanumFallback() {
+    const config = loadConfig();
+    return config.enableArcanumFallback === true;
+}
+
+export function setArcanumFallback(enabled) {
+    const config = loadConfig();
+    config.enableArcanumFallback = !!enabled;
+    saveConfig(config);
+}
+
+// ── Reconnect delay ────────────────────────────────────────────────────────
+
+export function getReconnectDelay() {
+    const config = loadConfig();
+    return config.reconnectDelayMs || 5000;
+}
+
+function setReconnectDelay(ms) {
+    const config = loadConfig();
+    config.reconnectDelayMs = ms;
+    saveConfig(config);
+}
+
+// ── WebSocket URL ──────────────────────────────────────────────────────────
+
+export function getWsUrl() {
+    const config = loadConfig();
+    return config.wsUrl || 'ws://localhost:8080';
+}
+
+export function setWsUrl(url) {
+    const config = loadConfig();
+    config.wsUrl = url;
+    saveConfig(config);
+}
+
+// ── Config path (for diagnostics) ──────────────────────────────────────────
+
+export function getConfigFilePath() {
+    return getConfigPath();
+}
+
+/**
+ * Check if a configuration file exists and is initialized.
+ * @returns {boolean}
+ */
+export function isConfigInitialized() {
+    return fs.existsSync(getConfigPath());
+}

package/package.json

@@ -0,0 +1,46 @@
+{
+  "name": "abap-local-client",
+  "version": "1.0.0",
+  "description": "SAP Local Client — WebSocket bridge with Basic, SPNEGO, X.509, SAML & SNC authentication",
+  "main": "sso-sap-client.mjs",
+  "type": "module",
+  "scripts": {
+    "start": "node sso-sap-client.mjs",
+    "dev": "node sso-sap-client.mjs",
+    "sso": "node sso-sap-client.mjs",
+    "rfc": "node saprouter-client.mjs",
+    "kill": "node kill-client.js",
+    "test": "node test-integration.mjs",
+    "prepublishOnly": "node test-integration.mjs"
+  },
+  "keywords": [
+    "sap",
+    "abap",
+    "adt",
+    "sso",
+    "kerberos",
+    "spnego",
+    "x509",
+    "saml",
+    "snc",
+    "websocket",
+    "mcp",
+    "s4hana"
+  ],
+  "author": "NUMEN IT",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/fgalastri/abap-client-auth.git"
+  },
+  "dependencies": {
+    "@primno/dpapi": "^2.0.1",
+    "axios": "^1.7.9",
+    "fast-xml-parser": "^5.3.5",
+    "kerberos": "^7.0.0",
+    "koffi": "^2.15.3",
+    "node-forge": "^1.4.0",
+    "puppeteer": "^25.2.0",
+    "ws": "^8.18.0"
+  }
+}

package/saml-login.mjs

@@ -0,0 +1,372 @@
+/**
+ * SAML 2.0 Browser-Based Login Module (Puppeteer-backed)
+ *
+ * Uses headless Chrome to complete the SAML SSO flow exactly like Eclipse ADT:
+ *  1. Launch Chromium
+ *  2. Navigate to SAP Fiori Launchpad (triggers SAML redirect to IdP)
+ *  3. User authenticates via IdP (SAP IAS, Azure AD, Okta, etc.)
+ *  4. IdP returns SAML assertion → SAP sets session cookies
+ *  5. We capture the cookies from the browser context
+ *  6. Return cookies for ADT REST calls
+ *
+ * Supports both headless (CI) and headed (user needs to interact with IdP MFA).
+ */
+
+import puppeteer from 'puppeteer';
+import https from 'https';
+import { createRequire } from 'module';
+const require = createRequire(import.meta.url);
+
+// ════════════════════════════════════════════════════════════════════════════
+//  SAML Login — main flow
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Perform SAML 2.0 browser-based login and return SAP session cookies.
+ *
+ * @param {Object} opts
+ * @param {string}  opts.sapBaseUrl    - Full HTTPS URL (e.g. "https://my413614.s4hana.cloud.sap")
+ * @param {string}  [opts.sapClient]   - SAP client/mandant (default "100")
+ * @param {string}  [opts.sapLanguage] - SAP logon language (default "EN")
+ * @param {boolean} [opts.headless]    - Run browser headless (default false for initial login)
+ * @param {number}  [opts.timeoutMs]   - Max wait time (default 120000 = 2 min)
+ * @param {function} [opts.onStatus]   - Callback for status messages (msg => void)
+ * @returns {Promise<{ cookies: string, csrfToken: string|null, allCookies: Array }>}
+ */
+export async function samlLogin(opts) {
+    const {
+        sapBaseUrl,
+        sapClient  = '100',
+        sapLanguage = 'EN',
+        headless   = false,
+        timeoutMs  = 120_000,
+        onStatus   = () => {},
+    } = opts;
+
+    const loginStartUrl = `${sapBaseUrl}/sap/bc/ui2/flp?sap-client=${sapClient}&sap-language=${sapLanguage}`;
+
+    onStatus(`SAP: ${sapBaseUrl} (client ${sapClient})`);
+    onStatus(`Launching browser...`);
+
+    const browser = await puppeteer.launch({
+        headless: headless ? 'new' : false,
+        args: [
+            '--disable-blink-features=AutomationControlled',
+            '--disable-infobars',
+            '--window-size=1280,800',
+        ],
+    });
+
+    try {
+        const context = browser.defaultBrowserContext();
+        const page = await browser.newPage();
+
+        // Set a reasonable viewport
+        await page.setViewport({ width: 1280, height: 800 });
+
+        // Listen for all responses — capture Set-Cookie headers at each step
+        const cookieMap = new Map();
+
+        page.on('response', (response) => {
+            const headers = response.headers();
+            const setCookie = headers['set-cookie'];
+            if (setCookie) {
+                const cookies = Array.isArray(setCookie) ? setCookie : [setCookie];
+                for (const c of cookies) {
+                    const pair = c.split(';')[0].trim();
+                    if (!pair) continue;
+                    const [name, ...rest] = pair.split('=');
+                    const value = rest.join('=');
+                    cookieMap.set(name, value);
+                }
+            }
+        });
+
+        onStatus(`Navigating to SAP Fiori Launchpad...`);
+        onStatus(`URL: ${loginStartUrl}`);
+
+        // Use 'domcontentloaded' instead of 'networkidle2' because SAML redirects
+        // across multiple domains (SAP → IdP → SAP) which never stabilizes.
+        await page.goto(loginStartUrl, {
+            waitUntil: 'domcontentloaded',
+            timeout: 30_000,
+        });
+
+        const currentUrl = page.url();
+        onStatus(`Landed at: ${currentUrl.substring(0, 120)}...`);
+
+        // Wait for the user to complete SAML authentication.
+        // The SAML flow goes: SAP FLP → redirect to IdP → user authenticates →
+        // IdP POST SAML assertion to SAP → SAP sets cookies → redirect to FLP.
+        //
+        // We detect completion by checking if the page URL is back on SAP
+        // AND SAP session cookies exist.
+        const extendedTimeout = timeoutMs;
+        onStatus(`Waiting for SAML login (timeout: ${extendedTimeout / 1000}s)...`);
+        onStatus(`  Please complete login in the browser window.`);
+
+        try {
+            await page.waitForFunction(
+                (baseUrl) => {
+                    const url = window.location.href;
+                    const onSAP = url.includes(baseUrl.replace('https://', ''));
+                    const hasCookies = document.cookie.length > 0 &&
+                        (document.cookie.includes('SAP_SESSION') ||
+                         document.cookie.includes('MYSAPSSO2') ||
+                         document.cookie.includes('sap-usercontext') ||
+                         document.cookie.includes('SAP_SSO') ||
+                         document.cookie.includes('JSESSIONID'));
+                    if (onSAP && hasCookies) {
+                        console.log('[puppeteer] Login detected: url=' + url.substring(0,60) + ' cookies=yes');
+                        return true;
+                    }
+                    return false;
+                },
+                { timeout: extendedTimeout, polling: 2000 },
+                sapBaseUrl
+            );
+            onStatus('SAML/SSO authentication completed.');
+        } catch (err) {
+            onStatus(`WaitForFunction timed out — checking cookies...`);
+            const pageCookies = await context.cookies();
+            onStatus(`  Browser has ${pageCookies.length} cookies for current domain`);
+            if (pageCookies.length === 0) {
+                throw new Error(
+                    'SAML login did not complete. The browser should be open — ' +
+                    'please log in via the IdP login page that appeared.\n' +
+                    'After login, the script will detect the session cookies automatically.\n' +
+                    'If the IdP page did not load, check the SAP URL: ' + sapBaseUrl
+                );
+            }
+            onStatus('Some cookies were captured — proceeding.');
+        }
+
+        // Wait a moment for all cookies to settle
+        await new Promise(r => setTimeout(r, 2000));
+
+        // Collect all cookies from the browser context
+        const allCookies = await context.cookies();
+
+        // Build cookie string for ADT calls
+        const safpCookieNames = [
+            'SAP_SESSION', 'MYSAPSSO2', 'SAP_SSO',
+            'sap-usercontext', 'JSESSIONID',
+            'SAP_SESSIONID_JV9_080', 'SAP_SESSIONID_JV9',
+        ];
+
+        const sapCookies = allCookies
+            .filter(c => {
+                // Include recognized SAP cookies OR any cookie set by the SAP domain
+                const isSAPCookie = safpCookieNames.some(n =>
+                    c.name.startsWith(n) || c.name === n
+                );
+                const fromSAPDomain = c.domain &&
+                    c.domain.includes(new URL(sapBaseUrl).hostname.replace('https://', '').split('.')[0]);
+                return isSAPCookie || fromSAPDomain;
+            })
+            .map(c => `${c.name}=${c.value}`);
+
+        const cookieString = sapCookies.join('; ');
+
+        if (!cookieString) {
+            // Broader fallback: include all cookies
+            const allCookieString = allCookies.map(c => `${c.name}=${c.value}`).join('; ');
+            if (!allCookieString) {
+                throw new Error('No cookies captured from browser session.');
+            }
+            onStatus('⚠️  No recognized SAP cookies — using all available cookies.');
+            return {
+                cookies: allCookieString,
+                csrfToken: null,
+                allCookies,
+            };
+        }
+
+        // Fetch CSRF token using the captured cookies
+        let csrfToken = null;
+        try {
+            const csrfResp = await fetchCsrfTokenViaNode(
+                sapBaseUrl, sapClient, sapLanguage, cookieString
+            );
+            if (csrfResp) {
+                csrfToken = csrfResp;
+                onStatus(`CSRF token: ${csrfToken.substring(0, 15)}...`);
+            }
+        } catch (err) {
+            onStatus(`⚠️  Could not fetch CSRF token: ${err.message}`);
+        }
+
+        onStatus(`Captured ${sapCookies.length} SAP cookies`);
+        for (const c of sapCookies) {
+            onStatus(`  ${c.split('=')[0]}`);
+        }
+
+        return { cookies: cookieString, csrfToken, allCookies };
+
+    } finally {
+        await browser.close();
+    }
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  CSRF token fetch (using Node https, not browser)
+// ════════════════════════════════════════════════════════════════════════════
+
+async function fetchCsrfTokenViaNode(baseUrl, client, language, cookieString) {
+    const url = new URL('/sap/bc/adt/discovery', baseUrl);
+
+    return new Promise((resolve, reject) => {
+        const req = https.request({
+            hostname: url.hostname,
+            port:     url.port || 443,
+            path:     url.pathname,
+            method:   'GET',
+            headers: {
+                'Accept':           'application/atomsvc+xml',
+                'sap-client':       client,
+                'sap-language':     language,
+                'X-CSRF-Token':     'Fetch',
+                'Cookie':           cookieString,
+            },
+        }, (res) => {
+            const token = res.headers['x-csrf-token'];
+            if (token) {
+                resolve(token);
+            } else {
+                // Consume body
+                res.resume();
+                res.on('end', () => resolve(null));
+            }
+        });
+        req.on('error', reject);
+        req.setTimeout(15000, () => { req.destroy(); reject(new Error('CSRF fetch timeout')); });
+        req.end();
+    });
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  SamlSession — HTTP session backed by SAML cookies
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * SamlSession manages ADT HTTP calls using SAML session cookies.
+ *
+ * Usage:
+ *   const s = new SamlSession(axios, sapBaseUrl, sapClient);
+ *   await s.init();  // opens browser for SAML login (headed or headless)
+ *   const r = await s.get('/sap/bc/adt/discovery');
+ */
+export class SamlSession {
+    /**
+     * @param {object}  axios      - Axios instance
+     * @param {string}  sapBaseUrl - SAP HTTPS base URL
+     * @param {string}  [sapClient='100']
+     * @param {{ language?: string, headless?: boolean, timeoutMs?: number, onStatus?: function }} [opts]
+     */
+    constructor(axios, sapBaseUrl, sapClient = '100', opts = {}) {
+        this.axios = axios;
+        this.sapBaseUrl = sapBaseUrl;
+        this.sapClient = sapClient;
+        this.language = opts.language || 'EN';
+        this.headless = opts.headless !== false;  // default headless for CI
+        this.timeoutMs = opts.timeoutMs || 120_000;
+        this.onStatus = opts.onStatus || (() => {});
+
+        this.cookies = null;
+        this.csrfToken = null;
+        this.authenticated = false;
+    }
+
+    /** Open browser for SAML login and store session cookies. */
+    async init() {
+        const result = await samlLogin({
+            sapBaseUrl:  this.sapBaseUrl,
+            sapClient:   this.sapClient,
+            sapLanguage: this.language,
+            headless:    this.headless,
+            timeoutMs:   this.timeoutMs,
+            onStatus:    this.onStatus,
+        });
+
+        this.cookies = result.cookies;
+        this.csrfToken = result.csrfToken;
+
+        if (!this.cookies) {
+            throw new Error('SAML login did not return session cookies');
+        }
+
+        this.authenticated = true;
+        return this.cookies;
+    }
+
+    /** Build headers. */
+    _headers(extra = {}) {
+        const h = {
+            'sap-client':   this.sapClient,
+            'sap-language': this.language,
+            ...extra,
+        };
+        if (this.cookies) {
+            h['Cookie'] = this.cookies;
+        }
+        return h;
+    }
+
+    /** Refresh CSRF token. */
+    async refreshCsrf() {
+        const resp = await this.axios({
+            method: 'GET',
+            url: `${this.sapBaseUrl}/sap/bc/adt/discovery`,
+            headers: this._headers({
+                'Accept': 'application/atomsvc+xml',
+                'X-CSRF-Token': 'Fetch',
+            }),
+        });
+        if (resp.headers['x-csrf-token']) {
+            this.csrfToken = resp.headers['x-csrf-token'];
+        }
+        return this.csrfToken;
+    }
+
+    /** GET request. */
+    async get(path, headers = {}) {
+        return this.axios({
+            method: 'GET',
+            url: `${this.sapBaseUrl}${path}`,
+            headers: this._headers(headers),
+            maxRedirects: 0,
+        });
+    }
+
+    /** POST request (auto-injects CSRF token). */
+    async post(path, data, headers = {}) {
+        if (!this.csrfToken) await this.refreshCsrf();
+        return this.axios({
+            method: 'POST',
+            url: `${this.sapBaseUrl}${path}`,
+            headers: this._headers({
+                'Content-Type': 'application/xml',
+                'X-CSRF-Token': this.csrfToken,
+                ...headers,
+            }),
+            data,
+            maxRedirects: 0,
+        });
+    }
+
+    /** PUT request (auto-injects CSRF token). */
+    async put(path, data, headers = {}) {
+        if (!this.csrfToken) await this.refreshCsrf();
+        return this.axios({
+            method: 'PUT',
+            url: `${this.sapBaseUrl}${path}`,
+            headers: this._headers({
+                'Content-Type': 'application/xml',
+                'X-CSRF-Token': this.csrfToken,
+                ...headers,
+            }),
+            data,
+            maxRedirects: 0,
+        });
+    }
+}