abap-local-client 1.0.0

package/x509-auth.mjs

@@ -0,0 +1,395 @@
+/**
+ * X.509 Principal Propagation Authentication Module
+ *
+ * Generates ephemeral X.509 client certificates signed by a trusted CA.
+ * The certificate Common Name (CN) carries the login identifier — SAP's
+ * CERTRULE transaction maps it to an ABAP user.
+ *
+ * Implements the same pattern as AWS Q Developer ABAP Accelerator's
+ * CertificateAuthProvider, adapted to Node.js using node-forge.
+ *
+ * Also supports SNC (Secure Network Communication) via RFC:
+ *   SNC_MODE=1, SNC_MYNAME=p:CN=<cn>, SNC_LIB=<path to sapcrypto.dll>
+ */
+
+import forge from 'node-forge';
+
+const { pki, md, asn1, util } = forge;
+
+// ════════════════════════════════════════════════════════════════════════════
+//  CA Certificate Management
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Load a CA certificate and private key from PEM strings.
+ *
+ * @param {string} caCertPem  - CA certificate in PEM format
+ * @param {string} caKeyPem   - CA private key in PEM format
+ * @returns {{ caCert: forge.pki.Certificate, caKey: forge.pki.PrivateKey }}
+ */
+export function loadCA(caCertPem, caKeyPem) {
+    const caCert = pki.certificateFromPem(caCertPem);
+    const caKey = pki.privateKeyFromPem(caKeyPem);
+    return { caCert, caKey };
+}
+
+/**
+ * Extract DN components from a CA certificate.
+ *
+ * @param {forge.pki.Certificate} caCert
+ * @returns {{ cn?: string, o?: string, ou?: string, c?: string, st?: string, l?: string }}
+ */
+export function extractCADN(caCert) {
+    const attrs = caCert.subject.attributes.reduce((acc, a) => {
+        if (a.name && a.value) acc[a.name.toLowerCase()] = a.value;
+        return acc;
+    }, {});
+    return {
+        cn:  attrs.cn,
+        o:   attrs.o,
+        ou:  attrs.ou,
+        c:   attrs.c,
+        st:  attrs.st,
+        l:   attrs.l,
+    };
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Ephemeral Certificate Generation
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Generate an ephemeral X.509 client certificate signed by the CA.
+ *
+ * Mirroring AWS Q's CertificateAuthProvider.generate_ephemeral_certificate().
+ *
+ * @param {Object} opts
+ * @param {forge.pki.Certificate} opts.caCert   - CA certificate
+ * @param {forge.pki.PrivateKey}   opts.caKey    - CA private key
+ * @param {string}  opts.loginIdentifier         - Value for CN (email, UPN, etc.)
+ * @param {number}  [opts.validityMinutes=5]     - Certificate lifetime
+ * @param {string}  [opts.country]               - C  (fallback: from CA cert)
+ * @param {string}  [opts.organization]          - O  (fallback: from CA cert)
+ * @param {string}  [opts.organizationalUnit]    - OU (fallback: from CA cert)
+ * @returns {{ certPem: string, keyPem: string, cn: string }}
+ */
+export function generateEphemeralCertificate(opts) {
+    const {
+        caCert,
+        caKey,
+        loginIdentifier,
+        validityMinutes = 5,
+    } = opts;
+
+    const caDN = extractCADN(caCert);
+
+    // Generate client key pair (RSA 2048)
+    const keys = pki.rsa.generateKeyPair(2048);
+    const clientKey = keys.privateKey;
+    const clientPub = keys.publicKey;
+
+    // Build subject DN (inherit from CA, override CN with login identifier)
+    const cn = loginIdentifier.substring(0, 64);  // SAP limit for CN
+    const c  = opts.country           || caDN.c  || 'BR';
+    const o  = opts.organization      || caDN.o  || caDN.cn || 'Default Org';
+    const ou = opts.organizationalUnit || caDN.ou || '';
+
+    const subjectAttrs = [
+        { name: 'commonName',             value: cn },
+        { name: 'organizationName',       value: o },
+        { name: 'countryName',            value: c },
+    ];
+    if (ou) {
+        subjectAttrs.splice(1, 0, { name: 'organizationalUnitName', value: ou });
+    }
+
+    // Build certificate
+    const cert = pki.createCertificate();
+    cert.publicKey = clientPub;
+    cert.serialNumber = util.bytesToHex(
+        forge.random.getBytesSync(16)
+    );
+
+    const now = new Date();
+    cert.validity.notBefore = now;
+    cert.validity.notAfter = new Date(
+        now.getTime() + validityMinutes * 60 * 1000
+    );
+
+    cert.setSubject(subjectAttrs);
+    cert.setIssuer(caCert.subject.attributes);
+
+    cert.setExtensions([
+        {
+            name: 'basicConstraints',
+            cA: false,
+        },
+        {
+            name: 'keyUsage',
+            digitalSignature: true,
+            keyEncipherment: true,
+        },
+        {
+            name: 'extKeyUsage',
+            clientAuth: true,
+        },
+        {
+            name: 'nsCertType',
+            client: true,
+        },
+    ]);
+
+    // Sign with CA key (SHA-256)
+    cert.sign(caKey, md.sha256.create());
+
+    return {
+        certPem: pki.certificateToPem(cert),
+        keyPem:  pki.privateKeyToPem(clientKey),
+        cn,
+    };
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  HTTP Client with Mutual TLS (mTLS)
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Create an HTTPS agent configured with a client certificate.
+ *
+ * @param {string} certPem - Client certificate PEM
+ * @param {string} keyPem  - Client private key PEM
+ * @param {boolean} [rejectUnauthorized=true] - Verify server cert
+ * @returns {import('https').Agent}
+ */
+export function createMTLSAgent(certPem, keyPem, rejectUnauthorized = true) {
+    const https = require('https');
+    return new https.Agent({
+        cert: certPem,
+        key:  keyPem,
+        rejectUnauthorized,
+        keepAlive: true,
+    });
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  X509Session — session with X.509 mTLS Principal Propagation
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * X509Session manages an HTTP session using mutual TLS with ephemeral
+ * client certificates. Certificates are regenerated before expiry.
+ *
+ * Usage:
+ *   const s = new X509Session(axios, caCertPem, caKeyPem, loginId);
+ *   await s.init();
+ *   const r = await s.get('/sap/bc/adt/discovery');
+ */
+export class X509Session {
+    /**
+     * @param {object}  axios     - Axios instance
+     * @param {string}  caCertPem - CA certificate PEM
+     * @param {string}  caKeyPem  - CA private key PEM
+     * @param {string}  loginId   - Login identifier (email, UPN, username)
+     * @param {{ baseUrl?: string, client?: string, language?: string, validityMinutes?: number, rejectUnauthorized?: boolean }} [opts]
+     */
+    constructor(axios, caCertPem, caKeyPem, loginId, opts = {}) {
+        this.axios = axios;
+        this.caCertPem = caCertPem;
+        this.caKeyPem  = caKeyPem;
+        this.loginId   = loginId;
+        this.baseUrl        = opts.baseUrl  || '';
+        this.client         = opts.client   || '100';
+        this.language       = opts.language || 'EN';
+        this.validityMinutes = opts.validityMinutes || 5;
+        this.rejectUnauthorized = opts.rejectUnauthorized !== false;
+
+        this.certPem   = null;
+        this.keyPem    = null;
+        this.csrfToken = null;
+        this.httpsAgent = null;
+        this.expiresAt = null;
+    }
+
+    /** Generate a new certificate and create HTTPS agent. */
+    _refreshCert() {
+        const { caCert, caKey } = loadCA(this.caCertPem, this.caKeyPem);
+        const { certPem, keyPem } = generateEphemeralCertificate({
+            caCert,
+            caKey,
+            loginIdentifier: this.loginId,
+            validityMinutes: this.validityMinutes,
+        });
+        this.certPem = certPem;
+        this.keyPem  = keyPem;
+        this.httpsAgent = createMTLSAgent(certPem, keyPem, this.rejectUnauthorized);
+        this.expiresAt = Date.now() + this.validityMinutes * 60 * 1000;
+    }
+
+    /** Ensure we have a valid certificate. */
+    _ensureCert() {
+        if (!this.certPem || (this.expiresAt && Date.now() > this.expiresAt - 60_000)) {
+            this._refreshCert();
+        }
+    }
+
+    /** Initialize session by hitting the discovery endpoint. */
+    async init() {
+        this._refreshCert();
+
+        const resp = await this.axios({
+            method: 'GET',
+            url: `${this.baseUrl}/sap/bc/adt/discovery`,
+            headers: {
+                'Accept': 'application/atomsvc+xml',
+                'sap-client': this.client,
+                'sap-language': this.language,
+            },
+            httpsAgent: this.httpsAgent,
+            validateStatus: () => true,
+        });
+
+        if (resp.status < 200 || resp.status >= 300) {
+            throw new Error(
+                `X.509 Principal Propagation failed: HTTP ${resp.status}` +
+                (resp.data ? ` — ${JSON.stringify(resp.data).substring(0, 200)}` : '')
+            );
+        }
+
+        const csrf = resp.headers['x-csrf-token'];
+        if (csrf) this.csrfToken = csrf;
+
+        return resp;
+    }
+
+    /** Build headers for requests. */
+    _headers(extra = {}) {
+        return {
+            'sap-client':   this.client,
+            'sap-language': this.language,
+            ...extra,
+        };
+    }
+
+    /** Refresh CSRF token. */
+    async refreshCsrf() {
+        this._ensureCert();
+        const resp = await this.axios({
+            method: 'GET',
+            url: `${this.baseUrl}/sap/bc/adt/discovery`,
+            headers: this._headers({
+                'X-CSRF-Token': 'Fetch',
+                'Accept': 'application/atomsvc+xml',
+            }),
+            httpsAgent: this.httpsAgent,
+        });
+        if (resp.headers['x-csrf-token']) {
+            this.csrfToken = resp.headers['x-csrf-token'];
+        }
+        return this.csrfToken;
+    }
+
+    /** GET request. */
+    async get(path, headers = {}) {
+        this._ensureCert();
+        return this.axios({
+            method: 'GET',
+            url: `${this.baseUrl}${path}`,
+            headers: this._headers(headers),
+            httpsAgent: this.httpsAgent,
+        });
+    }
+
+    /** POST request (auto-injects CSRF token). */
+    async post(path, data, headers = {}) {
+        this._ensureCert();
+        if (!this.csrfToken) await this.refreshCsrf();
+        return this.axios({
+            method: 'POST',
+            url: `${this.baseUrl}${path}`,
+            headers: this._headers({
+                'Content-Type': 'application/xml',
+                'X-CSRF-Token': this.csrfToken,
+                ...headers,
+            }),
+            data,
+            httpsAgent: this.httpsAgent,
+        });
+    }
+
+    /** PUT request (auto-injects CSRF token). */
+    async put(path, data, headers = {}) {
+        this._ensureCert();
+        if (!this.csrfToken) await this.refreshCsrf();
+        return this.axios({
+            method: 'PUT',
+            url: `${this.baseUrl}${path}`,
+            headers: this._headers({
+                'Content-Type': 'application/xml',
+                'X-CSRF-Token': this.csrfToken,
+                ...headers,
+            }),
+            data,
+            httpsAgent: this.httpsAgent,
+        });
+    }
+}
+
+// ════════════════════════════════════════════════════════════════════════════
+//  Self-signed CA generation (for testing / development)
+// ════════════════════════════════════════════════════════════════════════════
+
+/**
+ * Generate a self-signed CA certificate for testing purposes.
+ *
+ * The CA can be imported into SAP STRUST (transaction code STRUST)
+ * and the cert's CN attribute used in CERTRULE to map to ABAP users.
+ *
+ * @param {Object} opts
+ * @param {string} [opts.cn='SAP MCP CA']     - CA Common Name
+ * @param {string} [opts.o='SAP MCP']          - Organization
+ * @param {string} [opts.c='BR']               - Country
+ * @param {number} [opts.validityYears=10]     - CA validity
+ * @returns {{ caCertPem: string, caKeyPem: string }}
+ */
+export function generateCA(opts = {}) {
+    const {
+        cn = 'SAP MCP CA',
+        o  = 'SAP MCP',
+        c  = 'BR',
+        validityYears = 10,
+    } = opts;
+
+    const keys = pki.rsa.generateKeyPair(2048);
+    const cert = pki.createCertificate();
+    cert.publicKey = keys.publicKey;
+    cert.serialNumber = '01';
+
+    const now = new Date();
+    cert.validity.notBefore = now;
+    cert.validity.notAfter = new Date(
+        now.getFullYear() + validityYears, now.getMonth(), now.getDate()
+    );
+
+    cert.setSubject([
+        { name: 'commonName',       value: cn },
+        { name: 'organizationName', value: o },
+        { name: 'countryName',      value: c },
+    ]);
+    cert.setIssuer(cert.subject.attributes);
+
+    cert.setExtensions([
+        { name: 'basicConstraints', cA: true, pathLenConstraint: 0 },
+        {
+            name: 'keyUsage',
+            keyCertSign: true,
+            cRLSign: true,
+        },
+    ]);
+
+    cert.sign(keys.privateKey, md.sha256.create());
+
+    return {
+        caCertPem: pki.certificateToPem(cert),
+        caKeyPem:  pki.privateKeyToPem(keys.privateKey),
+    };
+}