abap-local-client 1.4.16 → 1.4.17

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "abap-local-client",
-  "version": "1.4.16",
+  "version": "1.4.17",
   "description": "SAP Local Client — WebSocket bridge with Basic, SPNEGO, X.509, SAML & SNC authentication",
   "main": "sso-sap-client.mjs",
   "type": "module",

package/sso-sap-client.mjs

@@ -517,10 +517,11 @@ class LockManager {
 // ════════════════════════════════════════════════════════════════════════════
 
 class SAPClient {
-  constructor(sessionEntry) {
+  constructor(sessionEntry, onSessionCleared) {
     this.session = sessionEntry;
     this.csrfToken = null;
     this.cookies = new Map();
+    this.onSessionCleared = onSessionCleared || null;
 
     const conn = sessionEntry.sysConfig?.connection || {};
     const baseUrl = `https://${conn.host}:${conn.port || '44301'}`;
@@ -576,8 +577,20 @@ class SAPClient {
         return response;
       },
       error => {
-        if (error.response?.status === 401 || error.response?.status === 403) {
-          console.error(`   ⚠️  Session error (${error.response.status}) - clearing...`);
+        // NOTE: only 401 (true auth/session failure) wipes the session here.
+        // 403 is deliberately NOT treated as "session invalid" — SAP ADT also
+        // returns 403 for business-logic errors that have nothing to do with
+        // the HTTP session (e.g. "object locked by another user", missing
+        // authorization for a specific object, or "CSRF token required").
+        // Blindly clearing cookies/CSRF on every 403 used to nuke a perfectly
+        // valid stateful session in the middle of a lock/save/activate flow,
+        // orphaning any lock the client held (SAP kept the enqueue tied to the
+        // now-discarded session/cookie, while the client silently opened a
+        // brand-new anonymous session for the next call). CSRF-required 403s
+        // are instead handled locally with a scoped refresh+retry in
+        // _executeCallspecViaHTTP.
+        if (error.response?.status === 401) {
+          console.error(`   ⚠️  Session error (401) - clearing...`);
           this.clearSession();
         }
         return Promise.reject(error);
@@ -677,7 +690,7 @@ class SAPClient {
     }
   }
 
-  async _executeCallspecViaHTTP(callspec) {
+  async _executeCallspecViaHTTP(callspec, isCsrfRetry = false) {
     const { method, url, headers, extract_from_response } = callspec;
     let finalUrl = url;
     let finalHeaders = { ...headers };
@@ -768,6 +781,22 @@ class SAPClient {
       return { success: !hasErrors && response.status >= 200 && response.status < 300, status: response.status, statusText: response.statusText, headers: response.headers, data: { raw: response.data, ...extractedData }, ...(errorMessages.length > 0 && { error: `SAP validation failed: ${errorMessages.join('; ')}`, errorDetails: errorMessages }) };
     } catch (error) {
       const status = error.response?.status;
+
+      // ── CSRF-required retry (scoped, one-shot) ──────────────────────────
+      // SAP responds 403 with `x-csrf-token: Required` when the cached token
+      // is stale/missing — this is NOT a session-invalidating error, it just
+      // means we need a fresh token. Refresh it and retry this one request
+      // exactly once, instead of relying on the (now-removed) blanket
+      // session wipe that used to happen for every 403 in the interceptor.
+      const csrfHeader = (error.response?.headers?.['x-csrf-token'] || '').toLowerCase();
+      if (status === 403 && csrfHeader === 'required' && !isCsrfRetry) {
+        console.warn('   🔄 CSRF token rejected (Required) — refreshing token and retrying once...');
+        this.csrfToken = null;
+        await this.fetchCsrfToken();
+        if (this.csrfToken) return this._executeCallspecViaHTTP(callspec, true);
+        console.error('   ❌ CSRF refresh failed — no token obtained, giving up on retry');
+      }
+
       console.error(`   ❌ HTTP ${status || 'network error'}: ${error.message}`);
       if (error.response?.headers) {
         console.error(`   ❌ RESPONSE HEADERS:`);
@@ -803,7 +832,17 @@ class SAPClient {
     catch (error) { if (error.response?.headers['x-csrf-token']) this.csrfToken = error.response.headers['x-csrf-token']; }
   }
 
-  clearSession() { this.csrfToken = null; this.cookies.clear(); console.log('   🧹 Session cleared'); }
+  clearSession() {
+    this.csrfToken = null;
+    this.cookies.clear();
+    console.log('   🧹 Session cleared');
+    // The stateful ADT session that owned any cached locks is gone — a lock
+    // handle cached against it is now orphaned, so tell the caller to drop it
+    // too (mirrors the RFC-side stale-lock cleanup on 423).
+    if (this.onSessionCleared) {
+      try { this.onSessionCleared(); } catch { /* best-effort */ }
+    }
+  }
 
   async ping() {
     try { const r = await this.client.get('/sap/bc/adt/compatibility/graph', { timeout: 5000 }); return { success: true, status: r.status }; }
@@ -821,6 +860,8 @@ class WebSocketClient {
     this.sapClient = null;
     this.reconnectTimer = null;
     this.keepAliveTimer = null;
+    this.wsPingTimer = null;
+    this.isAlive = false;
     this.isReconnecting = false;
     this.lockManager = new LockManager();
     this.currentSystemId = null;
@@ -831,7 +872,10 @@ class WebSocketClient {
     if (!sid) { console.error('❌ No system selected'); return false; }
     try {
         const sessionEntry = await getSessionForSystem(sid);
-        this.sapClient = new SAPClient(sessionEntry);
+        this.sapClient = new SAPClient(sessionEntry, () => {
+          this.lockManager.clearAll();
+          console.log('   🗑️  Lock cache cleared (HTTP session was reset — cached locks are now orphaned)');
+        });
         console.log(`✅ SAPClient initialized for ${sid}`);
         return true;
     } catch (err) {
@@ -849,10 +893,12 @@ class WebSocketClient {
     console.log(`\n🔌 Connecting to MCP Cloud...`);
     console.log(`   URL: ${WS_URL}`);
     this.ws = new WebSocket(WS_URL, { headers: { 'Authorization': `Bearer ${MCP_API_KEY}` } });
+    this.isAlive = true;
     this.ws.on('open', () => this.onOpen());
     this.ws.on('message', (data) => this.onMessage(data));
     this.ws.on('error', (error) => this.onError(error));
     this.ws.on('close', () => this.onClose());
+    this.ws.on('pong', () => { this.isAlive = true; });
   }
 
   onOpen() {
@@ -860,6 +906,7 @@ class WebSocketClient {
     if (this.reconnectTimer) { clearTimeout(this.reconnectTimer); this.reconnectTimer = null; }
     this.isReconnecting = false;
     this.startKeepAlive();
+    this.startWsPing();
   }
 
   startKeepAlive() {
@@ -872,6 +919,24 @@ class WebSocketClient {
 
   stopKeepAlive() { if (this.keepAliveTimer) { clearInterval(this.keepAliveTimer); this.keepAliveTimer = null; } }
 
+  // WebSocket-frame-level heartbeat (independent of the SAP keepalive above).
+  // Tunnels/proxies (e.g. ngrok) silently drop idle connections that have no
+  // traffic for a while. Sending a ping every WS_PING_INTERVAL ms keeps the
+  // tunnel alive and — if a pong doesn't come back in time — proactively
+  // terminates the dead socket so reconnection kicks in immediately instead
+  // of waiting for the OS to notice the broken connection.
+  startWsPing() {
+    if (this.wsPingTimer) clearInterval(this.wsPingTimer);
+    this.wsPingTimer = setInterval(() => {
+      if (!this.ws || this.ws.readyState !== WebSocket.OPEN) return;
+      if (!this.isAlive) { console.log('   💔 No pong received — terminating stale connection'); this.ws.terminate(); return; }
+      this.isAlive = false;
+      this.ws.ping();
+    }, parseInt(env.WS_PING_INTERVAL || '20000', 10));
+  }
+
+  stopWsPing() { if (this.wsPingTimer) { clearInterval(this.wsPingTimer); this.wsPingTimer = null; } }
+
   async onMessage(data) {
     let message;
     try { message = JSON.parse(data.toString()); } catch { return; }
@@ -1147,19 +1212,20 @@ class WebSocketClient {
 
   onClose() {
     console.log(`\n⚠️  Disconnected`);
-    this.ws = null; this.stopKeepAlive();
+    this.ws = null; this.stopKeepAlive(); this.stopWsPing();
     if (this.sapClient) this.sapClient.clearSession();
     this.lockManager.clearAll();
     if (!this.isReconnecting && !this.reconnectTimer) {
-      console.log(`   Reconnecting in 5s...`);
+      const delayMs = parseInt(env.WS_RECONNECT_DELAY || '2000', 10);
+      console.log(`   Reconnecting in ${(delayMs / 1000).toFixed(1)}s...`);
       this.isReconnecting = true;
-      this.reconnectTimer = setTimeout(() => { this.isReconnecting = false; this.connect(); }, 5000);
+      this.reconnectTimer = setTimeout(() => { this.isReconnecting = false; this.connect(); }, delayMs);
     }
   }
 
   disconnect() {
     if (this.reconnectTimer) { clearTimeout(this.reconnectTimer); this.reconnectTimer = null; }
-    this.isReconnecting = false; this.stopKeepAlive();
+    this.isReconnecting = false; this.stopKeepAlive(); this.stopWsPing();
     if (this.ws) { this.ws.close(); this.ws = null; }
   }
 }