cap-mcp-guard 0.2.0 → 0.3.1

package/lib/core/edm.js

@@ -1,241 +0,0 @@
-'use strict';
-
-/**
- * A hand-rolled, regex-based reader for OData `$metadata` documents (EDMX/
- * CSDL XML, V2 or V4) — not a general-purpose XML/EDM implementation, just
- * enough structure (entity sets, entity types, navigation properties) to
- * resolve a URL path or a `$expand` nav-property name down to the entity
- * name cap-mcp-guard.yaml keys entities by. Good enough for the
- * well-formed $metadata documents SAP/CAP services actually emit.
- *
- * Pure — no I/O. Fetching `$metadata` over the network is the caller's
- * responsibility (see lib/adapters/odata.js's `metadataXml`/`edm` options);
- * keeping that out of this module means it stays synchronous and
- * dependency-free.
- */
-
-function matchAll(pattern, text) {
-  const results = [];
-  const re = new RegExp(pattern, 'g');
-  let m;
-  while ((m = re.exec(text))) results.push(m);
-  return results;
-}
-
-function getAttr(tagAttrs, name) {
-  const m = new RegExp(`\\b${name}\\s*=\\s*"([^"]*)"`).exec(tagAttrs);
-  return m ? m[1] : undefined;
-}
-
-function unwrapCollection(type) {
-  const m = /^Collection\(([^)]+)\)$/.exec(type || '');
-  return m ? { target: m[1], isCollection: true } : { target: type, isCollection: false };
-}
-
-function unqualifiedName(fqName) {
-  if (!fqName) return fqName;
-  const idx = fqName.lastIndexOf('.');
-  return idx === -1 ? fqName : fqName.slice(idx + 1);
-}
-
-/**
- * Parses an EDMX/CSDL XML string into a minimal EDM model.
- *
- * @param {string} xml
- * @returns {{
- *   entityTypes: Record<string, { navigationProperties: Record<string, { target: string, isCollection?: boolean }> }>,
- *   entitySets: Record<string, string>,
- *   entityTypeToSet: Record<string, string>
- * }}
- */
-function parseMetadata(xml) {
-  const entityTypes = {};
-  const entitySets = {};
-  const entityTypeToSet = {};
-
-  const schemaBlocks = matchAll('<Schema\\b([^>]*)>([\\s\\S]*?)</Schema>', xml);
-
-  for (const schemaMatch of schemaBlocks) {
-    const namespace = getAttr(schemaMatch[1], 'Namespace');
-    const schemaBody = schemaMatch[2];
-    if (!namespace) continue;
-
-    // V2 only: NavigationProperty indirects through Relationship/ToRole to
-    // an <Association>'s <End Role="..." Type="...">. V4 NavigationProperty
-    // carries its target Type directly, no association needed.
-    const associations = {};
-    for (const assocMatch of matchAll('<Association\\b[^>]*Name="([^"]*)"[^>]*>([\\s\\S]*?)</Association>', schemaBody)) {
-      const fqName = `${namespace}.${assocMatch[1]}`;
-      const roles = {};
-      for (const endMatch of matchAll('<End\\b([^>]*?)/?>', assocMatch[2])) {
-        const role = getAttr(endMatch[1], 'Role');
-        const type = getAttr(endMatch[1], 'Type');
-        if (role && type) roles[role] = type;
-      }
-      associations[fqName] = roles;
-    }
-
-    for (const entityTypeMatch of matchAll('<EntityType\\b([^>]*)>([\\s\\S]*?)</EntityType>', schemaBody)) {
-      const localName = getAttr(entityTypeMatch[1], 'Name');
-      if (!localName) continue;
-      const fqName = `${namespace}.${localName}`;
-      const body = entityTypeMatch[2];
-
-      const navigationProperties = {};
-      for (const navMatch of matchAll('<NavigationProperty\\b([^>]*?)/?>', body)) {
-        const attrs = navMatch[1];
-        const navName = getAttr(attrs, 'Name');
-        if (!navName) continue;
-
-        const typeAttr = getAttr(attrs, 'Type');
-        if (typeAttr) {
-          navigationProperties[navName] = unwrapCollection(typeAttr);
-          continue;
-        }
-
-        const relationship = getAttr(attrs, 'Relationship');
-        const toRole = getAttr(attrs, 'ToRole');
-        const target = relationship && toRole && associations[relationship] && associations[relationship][toRole];
-        if (target) {
-          navigationProperties[navName] = { target, isCollection: undefined };
-        }
-      }
-
-      entityTypes[fqName] = { navigationProperties };
-    }
-
-    for (const setMatch of matchAll('<EntitySet\\b([^>]*?)/?>', schemaBody)) {
-      const attrs = setMatch[1];
-      const setName = getAttr(attrs, 'Name');
-      const entityType = getAttr(attrs, 'EntityType');
-      if (!setName || !entityType) continue;
-
-      entitySets[setName] = entityType;
-      if (!entityTypeToSet[entityType]) entityTypeToSet[entityType] = setName;
-    }
-  }
-
-  return { entityTypes, entitySets, entityTypeToSet };
-}
-
-/** An entity set name when one maps to this type, else its bare local name. */
-function toDisplayName(edm, fqTypeName) {
-  return (edm.entityTypeToSet && edm.entityTypeToSet[fqTypeName]) || unqualifiedName(fqTypeName);
-}
-
-/**
- * Resolves already-split, already-`(key)`-stripped, $-segment-free URL path
- * segments against a parsed EDM, walking navigation properties hop by hop
- * from the first segment that matches a known entity set (segments before
- * that — a service mount path like `odata/v4/browse` — are ignored, so
- * this works regardless of where the service is mounted).
- *
- * Falls back to the last path segment (matching lib/core/odata.js's
- * no-metadata resolveEntitySet() heuristic) when no segment matches a
- * known entity set, and to the raw segment name at any hop whose nav
- * property isn't described in the EDM — a `$metadata` document that
- * doesn't fully describe every segment shouldn't break resolution for the
- * segments it DOES know about.
- *
- * @param {object} edm see parseMetadata()
- * @param {string[]} segments
- * @returns {string|undefined}
- */
-function resolveEntityForPath(edm, segments) {
-  if (!segments.length) return undefined;
-
-  const startIndex = segments.findIndex((s) => Object.prototype.hasOwnProperty.call(edm.entitySets, s));
-  if (startIndex === -1) return segments[segments.length - 1];
-
-  let currentType = edm.entitySets[segments[startIndex]];
-  let displayName = toDisplayName(edm, currentType);
-
-  for (let i = startIndex + 1; i < segments.length; i++) {
-    const entityType = currentType && edm.entityTypes[currentType];
-    const nav = entityType && entityType.navigationProperties[segments[i]];
-
-    if (!nav) {
-      displayName = segments[i];
-      currentType = undefined;
-      continue;
-    }
-
-    currentType = nav.target;
-    displayName = toDisplayName(edm, currentType);
-  }
-
-  return displayName;
-}
-
-/**
- * Resolves a `$expand`'ed navigation-property name to its target entity's
- * policy-config-friendly name, given the (already-resolved) entity name of
- * the row it hangs off of. Falls back to the raw nav-property name when
- * the parent entity or the nav property itself isn't described in the EDM.
- *
- * @param {object} edm
- * @param {string} parentEntityName as returned by resolveEntityForPath() or
- *   a previous resolveExpandTarget() call
- * @param {string} navPropName
- * @returns {string}
- */
-function resolveExpandTarget(edm, parentEntityName, navPropName) {
-  const parentType =
-    edm.entitySets[parentEntityName] ||
-    Object.keys(edm.entityTypes).find((fq) => toDisplayName(edm, fq) === parentEntityName);
-
-  const entityType = parentType && edm.entityTypes[parentType];
-  const nav = entityType && entityType.navigationProperties[navPropName];
-
-  return nav ? toDisplayName(edm, nav.target) : navPropName;
-}
-
-/**
- * Parses an OData `$expand` query-option value into a tree of nav-property
- * names to recurse into — e.g. `"author,genre($expand=parent)"` becomes
- * `{ author: {}, genre: { parent: {} } }`. Only a nested `$expand=` option
- * is honored inside a parenthesized nav property; other nested options
- * (`$select`, `$filter`, ...) don't change which nested entities show up
- * in the response body, so they're ignored.
- *
- * @param {string} expandParam raw (already URL-decoded) $expand value
- * @returns {object} nested tree, `{}` for an empty/missing value
- */
-function parseExpandOption(expandParam) {
-  const tree = {};
-  if (!expandParam) return tree;
-
-  const parts = [];
-  let depth = 0;
-  let start = 0;
-  for (let i = 0; i < expandParam.length; i++) {
-    const ch = expandParam[i];
-    if (ch === '(') depth++;
-    else if (ch === ')') depth--;
-    else if (ch === ',' && depth === 0) {
-      parts.push(expandParam.slice(start, i));
-      start = i + 1;
-    }
-  }
-  parts.push(expandParam.slice(start));
-
-  for (const rawPart of parts) {
-    const part = rawPart.trim();
-    if (!part) continue;
-
-    const parenIdx = part.indexOf('(');
-    if (parenIdx === -1) {
-      tree[part] = tree[part] || {};
-      continue;
-    }
-
-    const navName = part.slice(0, parenIdx).trim();
-    const inner = part.slice(parenIdx + 1, part.lastIndexOf(')'));
-    const nestedExpandMatch = /\$expand=([^;]*)/.exec(inner);
-    tree[navName] = parseExpandOption(nestedExpandMatch ? nestedExpandMatch[1] : '');
-  }
-
-  return tree;
-}
-
-module.exports = { parseMetadata, resolveEntityForPath, resolveExpandTarget, parseExpandOption };

package/lib/core/odata-batch.js

@@ -1,161 +0,0 @@
-'use strict';
-
-/**
- * A minimal reader/writer for the classic OData V2 `$batch` wire format:
- * a `multipart/mixed` body whose parts are either a single embedded HTTP
- * request/response (`Content-Type: application/http`) or a nested
- * `multipart/mixed` "changeset" grouping several write operations
- * atomically. Not a general-purpose MIME implementation — just enough
- * structure to zip a batch's requests to its responses by position and
- * mask each response's JSON body in place.
- *
- * Responses are re-serialized canonically (consistent CRLF line endings,
- * consistent header ordering per part) rather than byte-for-byte
- * preserved — that's syntactically equivalent multipart/mixed, which is
- * all any compliant OData client relies on; it does not reproduce the
- * exact original bytes.
- *
- * Pure — no I/O, no HTTP framework dependency.
- */
-
-function toText(value) {
-  return Buffer.isBuffer(value) ? value.toString('utf8') : String(value ?? '');
-}
-
-/**
- * @param {string} contentType a Content-Type header value
- * @returns {string|undefined} the `boundary` parameter, unquoted
- */
-function extractBoundary(contentType) {
-  const m = /boundary=("?)([^;"]+)\1/i.exec(contentType || '');
-  return m ? m[2] : undefined;
-}
-
-/** Splits a multipart body into its raw part strings, boundary markers stripped. */
-function splitMultipart(rawBody, boundary) {
-  const text = toText(rawBody);
-  const marker = `--${boundary}`;
-  const segments = text.split(marker);
-
-  const parts = [];
-  for (let i = 1; i < segments.length; i++) {
-    const segment = segments[i];
-    if (segment.startsWith('--')) break; // the closing "--boundary--" marker
-
-    const trimmed = segment.replace(/^\r?\n/, '').replace(/\r?\n$/, '');
-    if (trimmed.length) parts.push(trimmed);
-  }
-  return parts;
-}
-
-function splitHeadersAndBody(text) {
-  const m = /\r?\n\r?\n/.exec(text);
-  if (!m) return { headerBlock: text, body: '' };
-  return { headerBlock: text.slice(0, m.index), body: text.slice(m.index + m[0].length) };
-}
-
-function parseHeaderBlock(headerBlock) {
-  const headers = {};
-  for (const line of headerBlock.split(/\r?\n/)) {
-    const m = /^([^:]+):\s*(.*)$/.exec(line);
-    if (m) headers[m[1].trim().toLowerCase()] = m[2].trim();
-  }
-  return headers;
-}
-
-/** One embedded `application/http` part: a request-line/status-line, headers, and a body. */
-function parseHttpEnvelope(text, { isResponse }) {
-  const { headerBlock, body } = splitHeadersAndBody(text);
-  const [firstLine, ...headerLines] = headerBlock.split(/\r?\n/);
-
-  if (isResponse) {
-    const m = /^HTTP\/[\d.]+\s+(\d+)\s*(.*)$/.exec((firstLine || '').trim());
-    return {
-      kind: 'single',
-      status: m ? Number(m[1]) : 200,
-      statusText: m ? m[2].trim() : 'OK',
-      headerLines: headerLines.filter((l) => l.trim().length > 0),
-      body
-    };
-  }
-
-  const m = /^(\S+)\s+(\S+)\s+HTTP\/[\d.]+$/.exec((firstLine || '').trim());
-  return {
-    kind: 'single',
-    method: m ? m[1] : undefined,
-    url: m ? m[2] : undefined,
-    headerLines: headerLines.filter((l) => l.trim().length > 0),
-    body
-  };
-}
-
-/** Parses one top-level (or changeset-nested) batch part, recursing into changesets. */
-function parseBatchPart(rawPart, { isResponse }) {
-  const { headerBlock, body } = splitHeadersAndBody(rawPart);
-  const headers = parseHeaderBlock(headerBlock);
-  const contentType = headers['content-type'] || '';
-
-  if (/multipart\/mixed/i.test(contentType)) {
-    const nestedBoundary = extractBoundary(contentType);
-    return {
-      kind: 'changeset',
-      boundary: nestedBoundary,
-      parts: nestedBoundary ? splitMultipart(body, nestedBoundary).map((p) => parseBatchPart(p, { isResponse })) : []
-    };
-  }
-
-  return parseHttpEnvelope(body, { isResponse });
-}
-
-/**
- * @param {string|Buffer} rawBody the $batch request body
- * @param {string} boundary from the request's Content-Type header
- * @returns {object[]} tree of `{ kind: 'single', method, url, ... } | { kind: 'changeset', boundary, parts }`
- */
-function parseBatchRequests(rawBody, boundary) {
-  return splitMultipart(rawBody, boundary).map((p) => parseBatchPart(p, { isResponse: false }));
-}
-
-/**
- * @param {string|Buffer} rawBody the $batch response body
- * @param {string} boundary from the response's Content-Type header
- * @returns {object[]} tree of `{ kind: 'single', status, statusText, headerLines, body } | { kind: 'changeset', boundary, parts }`
- */
-function parseBatchResponses(rawBody, boundary) {
-  return splitMultipart(rawBody, boundary).map((p) => parseBatchPart(p, { isResponse: true }));
-}
-
-function serializeEnvelope(envelope) {
-  const startLine = `HTTP/1.1 ${envelope.status} ${envelope.statusText}`;
-  const headerText = envelope.headerLines.map((l) => `${l}\r\n`).join('');
-  return `${startLine}\r\n${headerText}\r\n${envelope.body}`;
-}
-
-/**
- * Re-serializes a (possibly mutated) response tree — see parseBatchResponses()
- * — back into a valid `multipart/mixed` body using `boundary`.
- *
- * @param {object[]} items as returned by parseBatchResponses()
- * @param {string} boundary
- * @returns {string}
- */
-function serializeBatchResponses(items, boundary) {
-  let out = '';
-
-  for (const item of items) {
-    out += `--${boundary}\r\n`;
-
-    if (item.kind === 'changeset') {
-      out += `Content-Type: multipart/mixed; boundary=${item.boundary}\r\n\r\n`;
-      out += serializeBatchResponses(item.parts, item.boundary);
-    } else {
-      out += `Content-Type: application/http\r\nContent-Transfer-Encoding: binary\r\n\r\n`;
-      out += `${serializeEnvelope(item)}\r\n`;
-    }
-  }
-
-  out += `--${boundary}--\r\n`;
-  return out;
-}
-
-module.exports = { extractBoundary, splitMultipart, parseBatchRequests, parseBatchResponses, serializeBatchResponses };

package/lib/core/odata.js

@@ -1,178 +0,0 @@
-'use strict';
-
-const { resolveEntityForPath, resolveExpandTarget } = require('./edm');
-
-const ODATA_SYSTEM_SEGMENTS = new Set(['$metadata', '$batch']);
-
-const METHOD_TO_OPERATION = {
-  GET: 'READ',
-  POST: 'CREATE',
-  PUT: 'UPDATE',
-  PATCH: 'UPDATE',
-  MERGE: 'UPDATE',
-  DELETE: 'DELETE'
-};
-
-/**
- * Resolves the OData entity-set (or navigation property) name a request
- * targets, from its URL path alone — no service metadata ($metadata/CSDL)
- * is consulted. Works for both OData V2 (`/sap/opu/odata/sap/ZGW_SRV/Products`)
- * and V4 (`/odata/v4/browse/Books(201)`) path conventions: it's the last
- * path segment, with any `(key)` predicate stripped.
- *
- * Returns undefined for OData system resources ($metadata, $batch) since
- * those don't map to a single configurable entity.
- *
- * Pure function, no HTTP framework dependency.
- *
- * @param {string} url request path or full URL (query string is ignored)
- * @returns {string|undefined}
- */
-function resolveEntitySet(url) {
-  if (!url) return undefined;
-
-  const pathOnly = url.split('?')[0];
-  const segments = pathOnly.split('/').filter(Boolean);
-  if (segments.length === 0) return undefined;
-
-  const last = segments[segments.length - 1].replace(/\(.*$/, '');
-  if (!last || ODATA_SYSTEM_SEGMENTS.has(last) || last.startsWith('$')) return undefined;
-
-  return last;
-}
-
-/**
- * Maps an HTTP method onto the same CQN-style operation vocabulary the
- * guard already uses for CAP requests (READ/CREATE/UPDATE/DELETE, see
- * lib/adapters/cap.js's resolveOperation) — so one cap-mcp-guard.yaml
- * applies unchanged whether traffic arrives via CAP's before/after hooks
- * or raw OData HTTP.
- *
- * @param {string} method
- * @returns {string|undefined}
- */
-function resolveOperation(method) {
-  return METHOD_TO_OPERATION[(method || '').toUpperCase()];
-}
-
-/**
- * @param {string} url
- * @returns {boolean} true for a $batch request (OData V2 and V4 both use
- *   this convention). Its body is a multipart mix of sub-requests this
- *   module does not decode, so per-entity masking does not reach inside it
- *   — see README "Limitations".
- */
-function isBatchRequest(url) {
-  if (!url) return false;
-  const pathOnly = url.split('?')[0];
-  return pathOnly.split('/').filter(Boolean).pop() === '$batch';
-}
-
-/**
- * Extracts the row objects an OData JSON response body carries, regardless
- * of whether it's a V2 collection (`{ d: { results: [...] } }`), a V2
- * single entity (`{ d: {...} }`), a V4 collection (`{ value: [...] }`), or
- * a V4 single entity (a bare entity object carrying `@odata.context`).
- *
- * The returned rows are the SAME object references found inside `body` —
- * mutating a returned row mutates the response body in place, mirroring
- * how CAP's `after` handlers mutate results in place (see
- * lib/core/interceptor.js's applyMask).
- *
- * @param {*} body parsed JSON response body
- * @returns {object[]} row objects (empty array if the shape is unrecognized)
- */
-function extractResultRows(body) {
-  if (!body || typeof body !== 'object') return [];
-
-  if (Array.isArray(body.value)) return body.value;
-  if (body.d && Array.isArray(body.d.results)) return body.d.results;
-  if (body.d && typeof body.d === 'object') return [body.d];
-  if ('@odata.context' in body) return [body];
-
-  return [];
-}
-
-/**
- * Resolves the FULL request path (every segment, not just the last) into
- * a policy-config-friendly entity name. Without `edm`, this is exactly
- * resolveEntitySet()'s single-last-segment heuristic — unchanged behavior.
- * With `edm` (see lib/core/edm.js's parseMetadata()), the whole path is
- * walked hop-by-hop through navigation properties, so a deep path like
- * `Books(201)/author` resolves to `author`'s real target entity instead
- * of the literal string `"author"`.
- *
- * @param {string} url
- * @param {object} [edm] see lib/core/edm.js parseMetadata()
- * @returns {string|undefined}
- */
-function resolveEntityPath(url, edm) {
-  if (!edm) return resolveEntitySet(url);
-  if (!url) return undefined;
-
-  const pathOnly = url.split('?')[0];
-  const segments = pathOnly
-    .split('/')
-    .filter(Boolean)
-    .map((s) => s.replace(/\(.*$/, ''))
-    .filter((s) => s && !ODATA_SYSTEM_SEGMENTS.has(s) && !s.startsWith('$'));
-
-  return resolveEntityForPath(edm, segments);
-}
-
-function nestedRowsFor(row, navName) {
-  const value = row && typeof row === 'object' ? row[navName] : undefined;
-
-  if (Array.isArray(value)) return value;
-  if (value && Array.isArray(value.results)) return value.results; // OData V2 expand shape
-  if (value && typeof value === 'object' && !('__deferred' in value)) return [value];
-
-  return [];
-}
-
-/**
- * Walks a parsed OData response body and groups every row it contains —
- * the top-level collection/entity plus every `$expand`'ed nested
- * entity/collection reachable through `expandTree` — by the entity name
- * masking rules should be looked up under. Each group's rows are the SAME
- * object references found inside `body` (see extractResultRows), so
- * masking a group's rows mutates the response body in place.
- *
- * Without an `edm`, a nested entity's name is just its nav-property name
- * as it appears in `$expand` — good enough when cap-mcp-guard.yaml happens
- * to key an entity by that same name, but not a real entity-set/type
- * resolution. Pass `edm` (see lib/core/edm.js) to resolve nav properties
- * to their real target entity instead.
- *
- * @param {*} body parsed JSON response body
- * @param {string} rootEntity entity name for the top-level rows
- * @param {object} [expandTree] see lib/core/edm.js parseExpandOption()
- * @param {object} [edm] see lib/core/edm.js parseMetadata()
- * @returns {{ entity: string, rows: object[] }[]}
- */
-function collectMaskableGroups(body, rootEntity, expandTree = {}, edm) {
-  const groups = [];
-
-  function walk(rows, entityName, tree) {
-    if (rows.length) groups.push({ entity: entityName, rows });
-
-    for (const [navName, subTree] of Object.entries(tree)) {
-      const nestedEntity = edm ? resolveExpandTarget(edm, entityName, navName) : navName;
-      const nestedRows = rows.flatMap((row) => nestedRowsFor(row, navName));
-
-      walk(nestedRows, nestedEntity, subTree);
-    }
-  }
-
-  walk(extractResultRows(body), rootEntity, expandTree);
-  return groups;
-}
-
-module.exports = {
-  resolveEntitySet,
-  resolveOperation,
-  isBatchRequest,
-  extractResultRows,
-  resolveEntityPath,
-  collectMaskableGroups
-};