cap-mcp-guard 0.2.0 → 0.3.0

package/lib/core/odata-batch.js

@@ -1,161 +0,0 @@
-'use strict';
-
-/**
- * A minimal reader/writer for the classic OData V2 `$batch` wire format:
- * a `multipart/mixed` body whose parts are either a single embedded HTTP
- * request/response (`Content-Type: application/http`) or a nested
- * `multipart/mixed` "changeset" grouping several write operations
- * atomically. Not a general-purpose MIME implementation — just enough
- * structure to zip a batch's requests to its responses by position and
- * mask each response's JSON body in place.
- *
- * Responses are re-serialized canonically (consistent CRLF line endings,
- * consistent header ordering per part) rather than byte-for-byte
- * preserved — that's syntactically equivalent multipart/mixed, which is
- * all any compliant OData client relies on; it does not reproduce the
- * exact original bytes.
- *
- * Pure — no I/O, no HTTP framework dependency.
- */
-
-function toText(value) {
-  return Buffer.isBuffer(value) ? value.toString('utf8') : String(value ?? '');
-}
-
-/**
- * @param {string} contentType a Content-Type header value
- * @returns {string|undefined} the `boundary` parameter, unquoted
- */
-function extractBoundary(contentType) {
-  const m = /boundary=("?)([^;"]+)\1/i.exec(contentType || '');
-  return m ? m[2] : undefined;
-}
-
-/** Splits a multipart body into its raw part strings, boundary markers stripped. */
-function splitMultipart(rawBody, boundary) {
-  const text = toText(rawBody);
-  const marker = `--${boundary}`;
-  const segments = text.split(marker);
-
-  const parts = [];
-  for (let i = 1; i < segments.length; i++) {
-    const segment = segments[i];
-    if (segment.startsWith('--')) break; // the closing "--boundary--" marker
-
-    const trimmed = segment.replace(/^\r?\n/, '').replace(/\r?\n$/, '');
-    if (trimmed.length) parts.push(trimmed);
-  }
-  return parts;
-}
-
-function splitHeadersAndBody(text) {
-  const m = /\r?\n\r?\n/.exec(text);
-  if (!m) return { headerBlock: text, body: '' };
-  return { headerBlock: text.slice(0, m.index), body: text.slice(m.index + m[0].length) };
-}
-
-function parseHeaderBlock(headerBlock) {
-  const headers = {};
-  for (const line of headerBlock.split(/\r?\n/)) {
-    const m = /^([^:]+):\s*(.*)$/.exec(line);
-    if (m) headers[m[1].trim().toLowerCase()] = m[2].trim();
-  }
-  return headers;
-}
-
-/** One embedded `application/http` part: a request-line/status-line, headers, and a body. */
-function parseHttpEnvelope(text, { isResponse }) {
-  const { headerBlock, body } = splitHeadersAndBody(text);
-  const [firstLine, ...headerLines] = headerBlock.split(/\r?\n/);
-
-  if (isResponse) {
-    const m = /^HTTP\/[\d.]+\s+(\d+)\s*(.*)$/.exec((firstLine || '').trim());
-    return {
-      kind: 'single',
-      status: m ? Number(m[1]) : 200,
-      statusText: m ? m[2].trim() : 'OK',
-      headerLines: headerLines.filter((l) => l.trim().length > 0),
-      body
-    };
-  }
-
-  const m = /^(\S+)\s+(\S+)\s+HTTP\/[\d.]+$/.exec((firstLine || '').trim());
-  return {
-    kind: 'single',
-    method: m ? m[1] : undefined,
-    url: m ? m[2] : undefined,
-    headerLines: headerLines.filter((l) => l.trim().length > 0),
-    body
-  };
-}
-
-/** Parses one top-level (or changeset-nested) batch part, recursing into changesets. */
-function parseBatchPart(rawPart, { isResponse }) {
-  const { headerBlock, body } = splitHeadersAndBody(rawPart);
-  const headers = parseHeaderBlock(headerBlock);
-  const contentType = headers['content-type'] || '';
-
-  if (/multipart\/mixed/i.test(contentType)) {
-    const nestedBoundary = extractBoundary(contentType);
-    return {
-      kind: 'changeset',
-      boundary: nestedBoundary,
-      parts: nestedBoundary ? splitMultipart(body, nestedBoundary).map((p) => parseBatchPart(p, { isResponse })) : []
-    };
-  }
-
-  return parseHttpEnvelope(body, { isResponse });
-}
-
-/**
- * @param {string|Buffer} rawBody the $batch request body
- * @param {string} boundary from the request's Content-Type header
- * @returns {object[]} tree of `{ kind: 'single', method, url, ... } | { kind: 'changeset', boundary, parts }`
- */
-function parseBatchRequests(rawBody, boundary) {
-  return splitMultipart(rawBody, boundary).map((p) => parseBatchPart(p, { isResponse: false }));
-}
-
-/**
- * @param {string|Buffer} rawBody the $batch response body
- * @param {string} boundary from the response's Content-Type header
- * @returns {object[]} tree of `{ kind: 'single', status, statusText, headerLines, body } | { kind: 'changeset', boundary, parts }`
- */
-function parseBatchResponses(rawBody, boundary) {
-  return splitMultipart(rawBody, boundary).map((p) => parseBatchPart(p, { isResponse: true }));
-}
-
-function serializeEnvelope(envelope) {
-  const startLine = `HTTP/1.1 ${envelope.status} ${envelope.statusText}`;
-  const headerText = envelope.headerLines.map((l) => `${l}\r\n`).join('');
-  return `${startLine}\r\n${headerText}\r\n${envelope.body}`;
-}
-
-/**
- * Re-serializes a (possibly mutated) response tree — see parseBatchResponses()
- * — back into a valid `multipart/mixed` body using `boundary`.
- *
- * @param {object[]} items as returned by parseBatchResponses()
- * @param {string} boundary
- * @returns {string}
- */
-function serializeBatchResponses(items, boundary) {
-  let out = '';
-
-  for (const item of items) {
-    out += `--${boundary}\r\n`;
-
-    if (item.kind === 'changeset') {
-      out += `Content-Type: multipart/mixed; boundary=${item.boundary}\r\n\r\n`;
-      out += serializeBatchResponses(item.parts, item.boundary);
-    } else {
-      out += `Content-Type: application/http\r\nContent-Transfer-Encoding: binary\r\n\r\n`;
-      out += `${serializeEnvelope(item)}\r\n`;
-    }
-  }
-
-  out += `--${boundary}--\r\n`;
-  return out;
-}
-
-module.exports = { extractBoundary, splitMultipart, parseBatchRequests, parseBatchResponses, serializeBatchResponses };

package/lib/core/odata.js

@@ -1,178 +0,0 @@
-'use strict';
-
-const { resolveEntityForPath, resolveExpandTarget } = require('./edm');
-
-const ODATA_SYSTEM_SEGMENTS = new Set(['$metadata', '$batch']);
-
-const METHOD_TO_OPERATION = {
-  GET: 'READ',
-  POST: 'CREATE',
-  PUT: 'UPDATE',
-  PATCH: 'UPDATE',
-  MERGE: 'UPDATE',
-  DELETE: 'DELETE'
-};
-
-/**
- * Resolves the OData entity-set (or navigation property) name a request
- * targets, from its URL path alone — no service metadata ($metadata/CSDL)
- * is consulted. Works for both OData V2 (`/sap/opu/odata/sap/ZGW_SRV/Products`)
- * and V4 (`/odata/v4/browse/Books(201)`) path conventions: it's the last
- * path segment, with any `(key)` predicate stripped.
- *
- * Returns undefined for OData system resources ($metadata, $batch) since
- * those don't map to a single configurable entity.
- *
- * Pure function, no HTTP framework dependency.
- *
- * @param {string} url request path or full URL (query string is ignored)
- * @returns {string|undefined}
- */
-function resolveEntitySet(url) {
-  if (!url) return undefined;
-
-  const pathOnly = url.split('?')[0];
-  const segments = pathOnly.split('/').filter(Boolean);
-  if (segments.length === 0) return undefined;
-
-  const last = segments[segments.length - 1].replace(/\(.*$/, '');
-  if (!last || ODATA_SYSTEM_SEGMENTS.has(last) || last.startsWith('$')) return undefined;
-
-  return last;
-}
-
-/**
- * Maps an HTTP method onto the same CQN-style operation vocabulary the
- * guard already uses for CAP requests (READ/CREATE/UPDATE/DELETE, see
- * lib/adapters/cap.js's resolveOperation) — so one cap-mcp-guard.yaml
- * applies unchanged whether traffic arrives via CAP's before/after hooks
- * or raw OData HTTP.
- *
- * @param {string} method
- * @returns {string|undefined}
- */
-function resolveOperation(method) {
-  return METHOD_TO_OPERATION[(method || '').toUpperCase()];
-}
-
-/**
- * @param {string} url
- * @returns {boolean} true for a $batch request (OData V2 and V4 both use
- *   this convention). Its body is a multipart mix of sub-requests this
- *   module does not decode, so per-entity masking does not reach inside it
- *   — see README "Limitations".
- */
-function isBatchRequest(url) {
-  if (!url) return false;
-  const pathOnly = url.split('?')[0];
-  return pathOnly.split('/').filter(Boolean).pop() === '$batch';
-}
-
-/**
- * Extracts the row objects an OData JSON response body carries, regardless
- * of whether it's a V2 collection (`{ d: { results: [...] } }`), a V2
- * single entity (`{ d: {...} }`), a V4 collection (`{ value: [...] }`), or
- * a V4 single entity (a bare entity object carrying `@odata.context`).
- *
- * The returned rows are the SAME object references found inside `body` —
- * mutating a returned row mutates the response body in place, mirroring
- * how CAP's `after` handlers mutate results in place (see
- * lib/core/interceptor.js's applyMask).
- *
- * @param {*} body parsed JSON response body
- * @returns {object[]} row objects (empty array if the shape is unrecognized)
- */
-function extractResultRows(body) {
-  if (!body || typeof body !== 'object') return [];
-
-  if (Array.isArray(body.value)) return body.value;
-  if (body.d && Array.isArray(body.d.results)) return body.d.results;
-  if (body.d && typeof body.d === 'object') return [body.d];
-  if ('@odata.context' in body) return [body];
-
-  return [];
-}
-
-/**
- * Resolves the FULL request path (every segment, not just the last) into
- * a policy-config-friendly entity name. Without `edm`, this is exactly
- * resolveEntitySet()'s single-last-segment heuristic — unchanged behavior.
- * With `edm` (see lib/core/edm.js's parseMetadata()), the whole path is
- * walked hop-by-hop through navigation properties, so a deep path like
- * `Books(201)/author` resolves to `author`'s real target entity instead
- * of the literal string `"author"`.
- *
- * @param {string} url
- * @param {object} [edm] see lib/core/edm.js parseMetadata()
- * @returns {string|undefined}
- */
-function resolveEntityPath(url, edm) {
-  if (!edm) return resolveEntitySet(url);
-  if (!url) return undefined;
-
-  const pathOnly = url.split('?')[0];
-  const segments = pathOnly
-    .split('/')
-    .filter(Boolean)
-    .map((s) => s.replace(/\(.*$/, ''))
-    .filter((s) => s && !ODATA_SYSTEM_SEGMENTS.has(s) && !s.startsWith('$'));
-
-  return resolveEntityForPath(edm, segments);
-}
-
-function nestedRowsFor(row, navName) {
-  const value = row && typeof row === 'object' ? row[navName] : undefined;
-
-  if (Array.isArray(value)) return value;
-  if (value && Array.isArray(value.results)) return value.results; // OData V2 expand shape
-  if (value && typeof value === 'object' && !('__deferred' in value)) return [value];
-
-  return [];
-}
-
-/**
- * Walks a parsed OData response body and groups every row it contains —
- * the top-level collection/entity plus every `$expand`'ed nested
- * entity/collection reachable through `expandTree` — by the entity name
- * masking rules should be looked up under. Each group's rows are the SAME
- * object references found inside `body` (see extractResultRows), so
- * masking a group's rows mutates the response body in place.
- *
- * Without an `edm`, a nested entity's name is just its nav-property name
- * as it appears in `$expand` — good enough when cap-mcp-guard.yaml happens
- * to key an entity by that same name, but not a real entity-set/type
- * resolution. Pass `edm` (see lib/core/edm.js) to resolve nav properties
- * to their real target entity instead.
- *
- * @param {*} body parsed JSON response body
- * @param {string} rootEntity entity name for the top-level rows
- * @param {object} [expandTree] see lib/core/edm.js parseExpandOption()
- * @param {object} [edm] see lib/core/edm.js parseMetadata()
- * @returns {{ entity: string, rows: object[] }[]}
- */
-function collectMaskableGroups(body, rootEntity, expandTree = {}, edm) {
-  const groups = [];
-
-  function walk(rows, entityName, tree) {
-    if (rows.length) groups.push({ entity: entityName, rows });
-
-    for (const [navName, subTree] of Object.entries(tree)) {
-      const nestedEntity = edm ? resolveExpandTarget(edm, entityName, navName) : navName;
-      const nestedRows = rows.flatMap((row) => nestedRowsFor(row, navName));
-
-      walk(nestedRows, nestedEntity, subTree);
-    }
-  }
-
-  walk(extractResultRows(body), rootEntity, expandTree);
-  return groups;
-}
-
-module.exports = {
-  resolveEntitySet,
-  resolveOperation,
-  isBatchRequest,
-  extractResultRows,
-  resolveEntityPath,
-  collectMaskableGroups
-};