arc-1 1.5.2 → 1.7.0

package/dist/adt/http.js

@@ -9,15 +9,19 @@ import { Agent, Client } from 'undici';
 import { getCurrentContext } from '../server/context.js';
 import { logger } from '../server/logger.js';
 import { traceHeaders } from '../server/trace-context.js';
+import { acceptFallback } from './accept-fallback.js';
 import { connectivityProxyResponse, prepareBoundedResponse } from './bounded-response.js';
 import { resolveCookies } from './cookies.js';
 import { resolveAcceptType, resolveContentType } from './discovery.js';
 import { AdtApiError, AdtNetworkError, AdtResponseLimitError } from './errors.js';
 import { awaitWithinRequestBudget, requestBudgetSignal, requestSignal, sleepWithinRequestBudget, throwIfRequestCancelled, withoutResponseBudget, } from './http-deadline.js';
+import { parseRetryAfter } from './http-retry-after.js';
 import { prepareDataPreviewWireBody } from './http-wire-body.js';
-import { legacyContentHandlerFallback } from './legacy-content-handler.js';
+import { legacyContentHandlerFallback, rejectEmptyAdtHtmlResponse } from './legacy-content-handler.js';
 import { fetchWithAttemptBudget } from './request-attempt-budget.js';
+import { hasSecuritySessionCookie, SecuritySessionGate } from './security-session-gate.js';
 import { resolveSapUserAgent } from './user-agent.js';
+export { parseRetryAfter } from './http-retry-after.js';
 /**
  * Opt-in wire-level debug logging.
  *
@@ -103,6 +107,8 @@ export class AdtHttpClient {
     dbRetryInProgress = false;
     /** Set after a 401 clears stale cookies — triggers file reload on the next request */
     cookiesCleared = false;
+    /** Keeps a cold client at one SAP security session (see security-session-gate.ts). */
+    securitySessionGate = new SecuritySessionGate();
     /** Shared by stateful clones so one rejected Basic credential cannot fan out internally. */
     authenticationAttemptState;
     constructor(config, authenticationAttemptState) {
@@ -235,6 +241,8 @@ export class AdtHttpClient {
                 }
                 if (!options?.signal && options?.deadline === undefined)
                     throw error;
+                if (options?.signal?.aborted)
+                    throwIfRequestCancelled(options);
                 const cause = error instanceof Error ? error : new Error(String(error));
                 throw new AdtNetworkError(cause.message, cause);
             }
@@ -273,6 +281,7 @@ export class AdtHttpClient {
     /** Inner request method — CSRF, retries, content negotiation */
     async requestInner(method, path, body, contentType, extraHeaders, options) {
         throwIfRequestCancelled(options);
+        const expectBody = method !== 'HEAD';
         // Auto-fetch CSRF token for modifying requests
         if (isModifyingMethod(method) && !this.csrfToken) {
             await this.fetchCsrfToken(withoutResponseBudget(options));
@@ -350,7 +359,16 @@ export class AdtHttpClient {
         if (this.config.sapConnectivityAuth && !this.config.ppProxyAuth) {
             headers['SAP-Connectivity-Authentication'] = this.config.sapConnectivityAuth;
         }
-        const url = this.buildUrl(path);
+        // Quick-fix lookup includes queries (#993); old revision feeds append source paths to them. Use context headers.
+        const sapContextInHeaders = (method === 'POST' && path.startsWith('/sap/bc/adt/quickfixes/proposals/')) ||
+            (method === 'GET' && /^\/sap\/bc\/adt\/[^?#]+\/versions$/.test(path));
+        if (sapContextInHeaders) {
+            if (this.config.client)
+                headers['sap-client'] = this.config.client;
+            if (this.config.language)
+                headers['sap-language'] = this.config.language;
+        }
+        const url = this.buildUrl(path, sapContextInHeaders);
         const httpStart = Date.now();
         // Per-request guards to prevent infinite retry loops
         const retryTransientErrors = options?.retryTransientErrors !== false;
@@ -358,10 +376,8 @@ export class AdtHttpClient {
         let authRetried = false;
         let retried429 = false;
         try {
-            let response = await this.doFetch(url, method, headers, wireBody, options);
+            let response = await this.doFetch(url, method, headers, wireBody, options, this.config.retryUnauthorized !== false);
             let responseBody = await response.text();
-            // Persist any Set-Cookie headers from the response
-            this.storeCookies(response);
             // Detect broken DB connection on the assigned work process.
             // SAP's ICM routes all requests with the same session cookie to the same
             // work process. If that WP has a broken HANA connection, every request fails
@@ -403,8 +419,7 @@ export class AdtHttpClient {
                     }
                     const retryResp = await this.doFetch(url, method, headers, wireBody, options);
                     const retryBody = await retryResp.text();
-                    this.storeCookies(retryResp);
-                    const retryResult = this.handleResponse(retryResp.status, retryResp.headers, retryBody, path);
+                    const retryResult = this.handleResponse(retryResp.status, retryResp.headers, retryBody, path, expectBody);
                     logger.emitAudit({
                         timestamp: new Date().toISOString(),
                         level: 'info',
@@ -437,9 +452,9 @@ export class AdtHttpClient {
                     errorBody: `503 Service Unavailable — retrying in ${Math.round(jitterMs)}ms (${source})`,
                 });
                 await sleepWithinRequestBudget(jitterMs, options);
+                this.refreshSessionHeaders(method, headers);
                 const retryResp = await this.doFetch(url, method, headers, wireBody, options);
                 const retryBody = await retryResp.text();
-                this.storeCookies(retryResp);
                 logger.emitAudit({
                     timestamp: new Date().toISOString(),
                     level: retryResp.status === 503 ? 'warn' : 'info',
@@ -450,7 +465,7 @@ export class AdtHttpClient {
                     durationMs: Date.now() - httpStart,
                     errorBody: `503 retry completed (${retryResp.status})`,
                 });
-                return this.handleResponse(retryResp.status, retryResp.headers, retryBody, path);
+                return this.handleResponse(retryResp.status, retryResp.headers, retryBody, path, expectBody);
             }
             // Handle 429 Too Many Requests — emitted by SAP Web Dispatcher, BTP API
             // Management, or any upstream gateway throttling us. Honors Retry-After when present;
@@ -469,9 +484,9 @@ export class AdtHttpClient {
                     errorBody: `429 Too Many Requests — retrying in ${Math.round(jitterMs)}ms (${source})`,
                 });
                 await sleepWithinRequestBudget(jitterMs, options);
+                this.refreshSessionHeaders(method, headers);
                 const retryResp = await this.doFetch(url, method, headers, wireBody, options);
                 const retryBody = await retryResp.text();
-                this.storeCookies(retryResp);
                 logger.emitAudit({
                     timestamp: new Date().toISOString(),
                     level: retryResp.status === 429 ? 'warn' : 'info',
@@ -482,7 +497,7 @@ export class AdtHttpClient {
                     durationMs: Date.now() - httpStart,
                     errorBody: `429 retry completed (${retryResp.status})`,
                 });
-                return this.handleResponse(retryResp.status, retryResp.headers, retryBody, path);
+                return this.handleResponse(retryResp.status, retryResp.headers, retryBody, path, expectBody);
             }
             // Handle 401 session timeout — reset session and retry once.
             // Uses per-request guard (not instance-level) so concurrent requests each get their own retry.
@@ -500,8 +515,6 @@ export class AdtHttpClient {
                     durationMs: Date.now() - httpStart,
                     errorBody: '401 session expired — resetting session and retrying',
                 });
-                // Clear session to force fresh authentication
-                this.resetSession();
                 // Pick up an out-of-band rotated cookie file so the call that observes the
                 // expiry can recover; the lazy `cookiesCleared` reload stays the fallback.
                 // `cookieFile`, not `isCookieAuthMode()` — cookieString has nothing to re-read,
@@ -531,7 +544,6 @@ export class AdtHttpClient {
                 }
                 response = await this.doFetch(url, method, headers, wireBody, options);
                 responseBody = await response.text();
-                this.storeCookies(response);
                 logger.emitAudit({
                     timestamp: new Date().toISOString(),
                     level: 'info',
@@ -560,20 +572,9 @@ export class AdtHttpClient {
                 if (csrfRefreshedCookieHeader) {
                     headers.Cookie = csrfRefreshedCookieHeader;
                 }
-                const retryResponse = await this.doFetch(url, method, headers, wireBody, options);
-                const retryBody = await retryResponse.text();
-                this.storeCookies(retryResponse);
-                const result = this.handleResponse(retryResponse.status, retryResponse.headers, retryBody, path);
-                logger.emitAudit({
-                    timestamp: new Date().toISOString(),
-                    level: 'info',
-                    event: 'http_request',
-                    method,
-                    path,
-                    statusCode: retryResponse.status,
-                    durationMs: Date.now() - httpStart,
-                });
-                return result;
+                response = await this.doFetch(url, method, headers, wireBody, options);
+                responseBody = await response.text();
+                // A refreshed session can still need legacy content negotiation below (#996).
             }
             // Retry negotiation once, including the narrowly matched NW 7.40 handler error.
             const legacyFallback = legacyContentHandlerFallback(response.status, responseBody, method, negotiationKey, headers);
@@ -586,25 +587,11 @@ export class AdtHttpClient {
                     headersChanged = true;
                 }
                 else if (response.status === 406) {
-                    // Server rejected our Accept header — try fallback
-                    const inferred = inferAcceptFromError(responseBody);
-                    if (inferred && inferred !== fallbackHeaders.Accept) {
-                        fallbackHeaders.Accept = inferred;
+                    const fallback = acceptFallback(responseBody, fallbackHeaders.Accept, method, negotiationKey);
+                    if (fallback) {
+                        fallbackHeaders.Accept = fallback;
                         headersChanged = true;
                     }
-                    else if (fallbackHeaders.Accept &&
-                        fallbackHeaders.Accept !== '*/*' &&
-                        fallbackHeaders.Accept !== 'application/xml') {
-                        // Fall back to generic XML first
-                        fallbackHeaders.Accept = 'application/xml';
-                        headersChanged = true;
-                    }
-                    else if (fallbackHeaders.Accept === 'application/xml') {
-                        // application/xml was already rejected — fall back to wildcard
-                        fallbackHeaders.Accept = '*/*';
-                        headersChanged = true;
-                    }
-                    // If Accept is already */* and no inferred type, no useful fallback — skip retry
                 }
                 else {
                     // 415: Server rejected our Content-Type — try fallbacks:
@@ -634,15 +621,10 @@ export class AdtHttpClient {
                         durationMs: Date.now() - httpStart,
                         errorBody: `Content negotiation ${response.status} — retrying with fallback headers`,
                     });
+                    this.refreshSessionHeaders(method, fallbackHeaders);
                     const retryResp = await this.doFetch(url, method, fallbackHeaders, wireBody, options);
                     const retryBody = await retryResp.text();
-                    this.storeCookies(retryResp);
-                    // Store CSRF token from retry response
-                    const retryToken = retryResp.headers.get('x-csrf-token');
-                    if (retryToken && retryToken !== 'Required') {
-                        this.csrfToken = retryToken;
-                    }
-                    const retryResult = this.handleResponse(retryResp.status, retryResp.headers, retryBody, path);
+                    const retryResult = this.handleResponse(retryResp.status, retryResp.headers, retryBody, path, expectBody);
                     const currentContentType = contentType ?? headers['Content-Type'];
                     const negotiated = {};
                     if (retryAccept !== headers.Accept) {
@@ -669,12 +651,7 @@ export class AdtHttpClient {
                 }
                 // No meaningful header change — fall through to normal error handling
             }
-            // Store CSRF token from response
-            const responseToken = response.headers.get('x-csrf-token');
-            if (responseToken && responseToken !== 'Required') {
-                this.csrfToken = responseToken;
-            }
-            const result = this.handleResponse(response.status, response.headers, responseBody, path);
+            const result = this.handleResponse(response.status, response.headers, responseBody, path, expectBody);
             logger.emitAudit({
                 timestamp: new Date().toISOString(),
                 level: 'debug',
@@ -724,6 +701,8 @@ export class AdtHttpClient {
             }
             if (err instanceof AdtNetworkError || err instanceof AdtResponseLimitError)
                 throw err;
+            if (options?.signal?.aborted)
+                throwIfRequestCancelled(options);
             const message = err instanceof Error ? err.message : String(err);
             throw new AdtNetworkError(message, err instanceof Error ? err : undefined);
         }
@@ -762,7 +741,7 @@ export class AdtHttpClient {
         }
     }
     /** Handle response: throw on error status, return normalized response */
-    handleResponse(status, headers, body, path) {
+    handleResponse(status, headers, body, path, expectBody = true) {
         const contentType = headers.get('content-type')?.toLowerCase();
         const isDiscovery = ['/sap/bc/adt/core/discovery', '/sap/bc/adt/discovery'].includes(path.split('?', 1)[0]);
         if (status === 200 &&
@@ -775,6 +754,8 @@ export class AdtHttpClient {
             this.notifyUnauthorized(path);
             throw new AdtApiError('ADT call returned HTML login page — authentication required. If using cookies, they may have expired. If using Basic auth, credentials may be invalid or not authorized for ADT (S_ADT_RES missing). If on an SSO-only system, try SAP_DISABLE_SAML=true or see docs/enterprise-auth.md. Re-run arc-1 after fixing.', 401, path, body.slice(0, 500));
         }
+        if (expectBody)
+            rejectEmptyAdtHtmlResponse(status, contentType, body, path);
         if (status >= 400) {
             if (status === 401) {
                 this.notifyUnauthorized(path);
@@ -829,12 +810,6 @@ export class AdtHttpClient {
         if (this.cookiesCleared && this.isCookieAuthMode()) {
             this.reloadCookiesFromSource();
         }
-        // A token only counts as proof when the response itself succeeded: SAP returns one on
-        // failures too, and the old code accepted a token from a 401 — masking the auth error.
-        const usableToken = (response) => {
-            const token = response.headers.get('x-csrf-token')?.trim();
-            return response.ok && token && token.toLowerCase() !== 'required' ? token : undefined;
-        };
         // Every probe keeps the same identity, current cookies and caller's request budget.
         const probe = async (method) => {
             const cookieHeader = this.composeCookieHeader();
@@ -844,7 +819,6 @@ export class AdtHttpClient {
                 delete headers.Cookie;
             const started = Date.now();
             const response = await this.doFetch(this.buildUrl(path), method, headers, undefined, options);
-            this.storeCookies(response);
             logger.emitAudit({
                 timestamp: new Date().toISOString(),
                 level: 'debug',
@@ -853,13 +827,13 @@ export class AdtHttpClient {
                 path,
                 statusCode: response.status,
                 durationMs: Date.now() - started,
-                success: !!usableToken(response),
-                adtMode: this.config.sessionType ?? 'unspecified',
-                hasContext: /(?:^|;\s*)sap-contextid=/.test(cookieHeader ?? ''),
+                success: !!usableCsrfToken(response),
+                adtMode: headers['X-sap-adt-sessiontype'] === undefined ? 'unspecified' : (this.config.sessionType ?? 'unspecified'),
+                hasContext: /(?:^|;\s*)sap-contextid=/.test(headers.Cookie ?? ''),
             });
-            if (method === 'GET' && response.status === 200 && !usableToken(response)) {
-                // Preserve the login-page check even when an old handler reports HTTP 200.
-                this.handleResponse(response.status, response.headers, await response.text(), path);
+            if (method === 'GET' && response.status === 200 && !usableCsrfToken(response)) {
+                // Check login pages, but preserve the header-only legacy discovery fallback.
+                this.handleResponse(response.status, response.headers, await response.text(), path, false);
             }
             // Only headers are needed; release GET bodies before a fallback or return.
             if (!response.bodyUsed)
@@ -888,16 +862,23 @@ export class AdtHttpClient {
             // The tested 7.50/7.58/8.16 systems returned HEAD 400 with a token; GET returned 200.
             // Retry these HEAD refusals or a successful response without a token on the same path.
             // A successful HEAD with a usable token remains the one-request fast path.
-            if ([400, 403, 405].includes(response.status) || (response.ok && !usableToken(response))) {
+            const headStatus = response.status;
+            if ([400, 403, 405].includes(response.status) || (response.ok && !usableCsrfToken(response))) {
+                response = await probe('GET');
+            }
+            // Both stateful discovery probes can fail on affected routes (#1044). Bootstrap once
+            // without that header; keep identity/cookies and subsequent lock/write requests stateful.
+            if (this.config.sessionType === 'stateful' && headStatus === 400 && response.status === 400) {
+                delete headers['X-sap-adt-sessiontype'];
                 response = await probe('GET');
             }
             // Older ADT handlers may return an empty 200 for a missing core resource (#817).
             // A real auth/server failure must not be hidden by trying another endpoint.
-            if (response.status === 404 || response.status === 405 || (response.ok && !usableToken(response))) {
+            if (response.status === 404 || response.status === 405 || (response.ok && !usableCsrfToken(response))) {
                 path = '/sap/bc/adt/discovery';
                 response = await probe('GET');
             }
-            const token = usableToken(response);
+            const token = usableCsrfToken(response);
             if (!token) {
                 if (response.status === 401) {
                     if (this.isCookieAuthMode())
@@ -910,12 +891,13 @@ export class AdtHttpClient {
                 }
                 throw new AdtApiError(`No CSRF token in response (HTTP ${response.status})`, response.status, path);
             }
-            this.csrfToken = token;
             return path;
         }
         catch (err) {
             if (err instanceof AdtApiError || err instanceof AdtNetworkError)
                 throw err;
+            if (options?.signal?.aborted)
+                throwIfRequestCancelled(options);
             const message = err instanceof Error ? err.message : String(err);
             throw new AdtNetworkError(`CSRF token fetch failed: ${message}`, err instanceof Error ? err : undefined);
         }
@@ -954,8 +936,7 @@ export class AdtHttpClient {
      */
     clearCookiesAndMark() {
         this.config.cookies = {};
-        this.cookieJar.clear();
-        this.csrfToken = '';
+        this.resetSession();
         this.cookiesCleared = true;
     }
     /**
@@ -1004,6 +985,7 @@ export class AdtHttpClient {
     resetSession() {
         this.cookieJar.clear();
         this.csrfToken = '';
+        this.securitySessionGate.reset();
     }
     /**
      * Build the `Cookie` request header by merging the static `config.cookies`
@@ -1036,11 +1018,18 @@ export class AdtHttpClient {
             return undefined;
         return Array.from(merged, ([name, value]) => `${name}=${value}`).join('; ');
     }
+    /** Read the current pair together after a wait or a response that can rotate the session. */
+    refreshSessionHeaders(method, headers) {
+        const cookie = this.composeCookieHeader();
+        if (cookie)
+            headers.Cookie = cookie;
+        else
+            delete headers.Cookie;
+        if (isModifyingMethod(method))
+            headers['X-CSRF-Token'] = this.csrfToken;
+    }
     storeCookies(response) {
-        const setCookieHeaders = response.headers.getSetCookie();
-        if (!setCookieHeaders || setCookieHeaders.length === 0)
-            return;
-        for (const cookie of setCookieHeaders) {
+        for (const cookie of response.headers.getSetCookie() ?? []) {
             // Set-Cookie: name=value; Path=/; HttpOnly; ...
             const nameValue = cookie.split(';')[0];
             if (!nameValue)
@@ -1053,18 +1042,18 @@ export class AdtHttpClient {
             this.cookieJar.set(name, value);
         }
     }
-    /** Build full URL with sap-client and sap-language query params */
-    buildUrl(path) {
+    /** Add SAP context query params unless the caller sends that context in headers. */
+    buildUrl(path, sapContextInHeaders = false) {
         const base = this.config.baseUrl.replace(/\/$/, '');
         const normalizedPath = path.startsWith('/') ? path : `/${path}`;
         const url = new URL(base + normalizedPath);
-        if (this.config.client) {
+        if (this.config.client && !sapContextInHeaders) {
             url.searchParams.set('sap-client', this.config.client);
         }
-        if (this.config.language) {
+        if (this.config.language && !sapContextInHeaders) {
             url.searchParams.set('sap-language', this.config.language);
         }
-        if (this.config.disableSaml) {
+        if (this.config.disableSaml && !sapContextInHeaders) {
             url.searchParams.set('saml2', 'disabled');
         }
         return url.toString();
@@ -1101,7 +1090,37 @@ export class AdtHttpClient {
      * Node 22's built-in fetch embeds an older undici version whose dispatcher
      * interface is incompatible with npm undici@8 Agent/ProxyAgent instances.
      */
-    async doFetch(url, method, headers, body, options) {
+    async doFetch(url, method, headers, body, options, resetOnUnauthorized = false) {
+        const cookieNames = () => [...this.cookieJar.keys(), ...Object.keys(this.config.cookies ?? {})];
+        const response = await this.securitySessionGate.run(() => hasSecuritySessionCookie(cookieNames()), async (waited) => {
+            const generation = this.securitySessionGate.generation;
+            if (waited) {
+                // A preceding response may have replaced both fields while this send waited.
+                // Keep the refreshed pair for this logical request's negotiation/retry paths too.
+                this.refreshSessionHeaders(method, headers);
+            }
+            const response = await this.sendRequest(url, method, headers, body, options);
+            const fetchingCsrf = headers['X-CSRF-Token']?.toLowerCase() === 'fetch';
+            if (generation === this.securitySessionGate.generation) {
+                // Store once at the headers boundary, before releasing the bootstrap owner.
+                this.storeCookies(response);
+                // Ordinary responses (including 404) can carry a token without proving a Fetch probe succeeded.
+                const token = fetchingCsrf ? usableCsrfToken(response) : response.headers.get('x-csrf-token');
+                if (token && token !== 'Required')
+                    this.csrfToken = token;
+                // Reset before releasing waiters; a slow 401 body must not clear their new session.
+                if (resetOnUnauthorized && response.status === 401)
+                    this.resetSession();
+            }
+            else if (fetchingCsrf) {
+                await response.body?.cancel();
+                throw new AdtNetworkError('SAP session changed during CSRF bootstrap. Retry the request.');
+            }
+            return response;
+        }, options);
+        return prepareBoundedResponse(response, url, options);
+    }
+    async sendRequest(url, method, headers, body, options) {
         throwIfRequestCancelled(options);
         // Forward the caller's W3C trace context to SAP so one trace spans agent → ARC-1 → SAP.
         // Empty unless the MCP client sent a valid `traceparent`; ARC-1 never originates a trace.
@@ -1128,7 +1147,7 @@ export class AdtHttpClient {
                 ...(dispatcher ? { dispatcher } : {}),
             }, options?.attemptBudget));
         }
-        return prepareBoundedResponse(response, url, options);
+        return response;
     }
     /**
      * Execute an HTTP request through the BTP connectivity proxy using standard
@@ -1212,52 +1231,10 @@ export class AdtHttpClient {
 function isModifyingMethod(method) {
     return ['POST', 'PUT', 'DELETE', 'PATCH'].includes(method.toUpperCase());
 }
-/**
- * Parse RFC 7231 `Retry-After` header into a delay in milliseconds.
- *
- * Accepts both forms allowed by the spec:
- * - delta-seconds (e.g. `"5"`)
- * - HTTP-date (e.g. `"Wed, 12 May 2026 14:30:00 GMT"`)
- *
- * On missing, NaN, malformed, past-date, or negative input, falls back to `fallbackMs`.
- * Always clamps to `[0, 60_000]` ms so a misbehaving gateway can't stall us indefinitely
- * and a too-small/past value can't degenerate into a hot retry loop.
- *
- * Returns `{ delayMs, source }` — `source: 'header' | 'fallback'` lets audit events
- * record whether the delay came from the server or from our jitter floor (useful for
- * capacity tuning).
- */
-export function parseRetryAfter(header, fallbackMs) {
-    const clamp = (ms) => Math.max(0, Math.min(60_000, ms));
-    if (header == null || header === '') {
-        return { delayMs: clamp(fallbackMs), source: 'fallback' };
-    }
-    const trimmed = header.trim();
-    // delta-seconds form: integer (and only digits, optionally signed)
-    if (/^-?\d+$/.test(trimmed)) {
-        const seconds = Number.parseInt(trimmed, 10);
-        if (Number.isFinite(seconds)) {
-            return { delayMs: clamp(seconds * 1000), source: 'header' };
-        }
-        return { delayMs: clamp(fallbackMs), source: 'fallback' };
-    }
-    // HTTP-date form
-    const epochMs = Date.parse(trimmed);
-    if (Number.isFinite(epochMs)) {
-        return { delayMs: clamp(epochMs - Date.now()), source: 'header' };
-    }
-    return { delayMs: clamp(fallbackMs), source: 'fallback' };
-}
-/**
- * Try to extract an accepted media type from a SAP 406 error response body.
- *
- * SAP sometimes includes the expected media type in error text, e.g.:
- *   "...expected application/vnd.sap.adt.transportorganizertree.v1+xml..."
- * Returns the extracted media type or undefined if none found.
- */
-function inferAcceptFromError(body) {
-    const match = body.match(/application\/[\w.+-]+(?:\/[\w.+-]+)?/);
-    return match?.[0];
+/** A token on an unsuccessful response is not proof of authentication. */
+function usableCsrfToken(response) {
+    const token = response.headers.get('x-csrf-token')?.trim();
+    return response.ok && token && token.toLowerCase() !== 'required' ? token : undefined;
 }
 /**
  * Distinguish a real SAP logon page from a legitimate HTML response payload.