sap-ai-dev-toolkit 0.2.5

package/src/binary.mjs

@@ -0,0 +1,99 @@
+import { createHash } from 'node:crypto';
+import { chmod, mkdir, rename, stat, writeFile } from 'node:fs/promises';
+import { homedir, tmpdir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const packageRoot = dirname(dirname(fileURLToPath(import.meta.url)));
+export const UPSTREAM_COMMIT = '9886d2727f47506368b0a3c2f1c1766f1200f747';
+
+const platformMap = {
+  'linux:x64': ['linux', 'x64', ''],
+  'linux:arm64': ['linux', 'arm64', ''],
+  'darwin:x64': ['darwin', 'x64', ''],
+  'darwin:arm64': ['darwin', 'arm64', ''],
+  'win32:x64': ['windows', 'x64', '.exe']
+};
+
+export function binaryTarget(platform = process.platform, arch = process.arch) {
+  const target = platformMap[`${platform}:${arch}`];
+  if (!target) throw new Error(`Unsupported platform ${platform}/${arch}. Set BAS_VSP_BINARY or build cmd/vsp with scripts/build-vsp.mjs.`);
+  return { os: target[0], arch: target[1], extension: target[2], asset: `vsp-${target[0]}-${target[1]}${target[2]}` };
+}
+
+export function bundledBinaryPath(platform = process.platform, arch = process.arch) {
+  return join(packageRoot, 'dist', binaryTarget(platform, arch).asset);
+}
+
+export function packageRepositoryUrl(pkg) {
+  const raw = typeof pkg.repository === 'string' ? pkg.repository : pkg.repository?.url;
+  if (!raw) throw new Error('package.json repository.url is required to resolve VSP release assets');
+  return raw.replace(/^git\+/, '').replace(/\.git$/, '').replace(/\/$/, '');
+}
+
+export function releaseBaseUrl(pkg, version = pkg.version) {
+  const override = process.env.BAS_VSP_RELEASE_BASE_URL;
+  if (override) return `${override.replace(/\/$/, '')}/v${version}`;
+  const repo = packageRepositoryUrl(pkg).replace(/^ssh:\/\/git@github.com:/, 'https://github.com/').replace(/^git@github.com:/, 'https://github.com/');
+  if (!repo.startsWith('http')) throw new Error('package repository URL must be an HTTPS URL for release assets');
+  return `${repo}/releases/download/v${version}`;
+}
+
+export function cacheDirectory() {
+  return process.env.BAS_VSP_CACHE_DIR || join(process.env.XDG_CACHE_HOME || join(homedir(), '.cache'), 'sap-ai-dev-toolkit');
+}
+
+export function cachedBinaryPath(pkg, platform = process.platform, arch = process.arch) {
+  const target = binaryTarget(platform, arch);
+  return join(cacheDirectory(), `${pkg.name}-${pkg.version}-${target.asset}`);
+}
+
+export async function findBinary(pkg, options = {}) {
+  const env = options.env || process.env;
+  if (env.BAS_VSP_BINARY) return env.BAS_VSP_BINARY;
+  if (!env.BAS_VSP_BINARY_URL) {
+    const bundled = bundledBinaryPath(options.platform, options.arch);
+    try { await stat(bundled); return bundled; } catch {}
+  }
+  const path = cachedBinaryPath(pkg, options.platform, options.arch);
+  try { await stat(path); return path; } catch { return null; }
+}
+
+export async function installBinary(pkg, options = {}) {
+  const env = options.env || process.env;
+  if (env.BAS_VSP_BINARY) return env.BAS_VSP_BINARY;
+  if (!env.BAS_VSP_BINARY_URL) {
+    const bundled = bundledBinaryPath(options.platform, options.arch);
+    try { await stat(bundled); return bundled; } catch {}
+  }
+  const target = binaryTarget(options.platform, options.arch);
+  const base = releaseBaseUrl(pkg, pkg.version);
+  const assetUrl = env.BAS_VSP_BINARY_URL || `${base}/${target.asset}`;
+  const checksumUrl = `${base}/checksums.txt`;
+  const response = await fetch(assetUrl);
+  if (!response.ok) throw new Error(`VSP binary download failed (${response.status}); set BAS_VSP_BINARY or BAS_VSP_BINARY_URL`);
+  const bytes = Buffer.from(await response.arrayBuffer());
+  const checksumResponse = await fetch(checksumUrl);
+  if (!checksumResponse.ok) throw new Error(`VSP checksum download failed (${checksumResponse.status}); set BAS_VSP_BINARY or BAS_VSP_BINARY_URL`);
+  const checksumText = await checksumResponse.text();
+  const expected = checksumText.split(/\r?\n/).map(line => line.trim().split(/\s+/)).find(parts => parts.length >= 2 && (parts[1] === target.asset || parts[1].endsWith(`/${target.asset}`)))?.[0];
+  if (!expected) throw new Error(`checksums.txt has no entry for ${target.asset}; set BAS_VSP_BINARY or BAS_VSP_BINARY_URL`);
+  const actual = createHash('sha256').update(bytes).digest('hex');
+  if (actual.toLowerCase() !== expected.toLowerCase()) throw new Error(`VSP checksum mismatch for ${target.asset}`);
+  const dir = cacheDirectory();
+  await mkdir(dir, { recursive: true, mode: 0o700 });
+  await chmod(dir, 0o700);
+  const destination = cachedBinaryPath(pkg, options.platform, options.arch);
+  const temporary = join(tmpdir(), `bas-vsp-${process.pid}-${Date.now()}`);
+  await writeFile(temporary, bytes, { mode: 0o700 });
+  await chmod(temporary, 0o700);
+  await rename(temporary, destination);
+  await chmod(destination, 0o700);
+  return destination;
+}
+
+export async function ensureBinary(pkg, options = {}) {
+  const existing = await findBinary(pkg, options);
+  if (existing) return existing;
+  return installBinary(pkg, options);
+}

package/src/cf-connectivity.mjs

@@ -0,0 +1,317 @@
+import http from 'node:http';
+import net from 'node:net';
+import { once } from 'node:events';
+
+const TOKEN_TIMEOUT_MS = 15_000;
+const TOKEN_REFRESH_SKEW_MS = 60_000;
+const MAX_TOKEN_RESPONSE_BYTES = 1024 * 1024;
+
+function safeError(message) {
+  return new Error(message);
+}
+
+function configuredProxy(credentials) {
+  if (!credentials || typeof credentials !== 'object') {
+    throw safeError('Connectivity service credentials are unavailable');
+  }
+  const host = credentials.onpremise_proxy_host;
+  const port = Number(credentials.onpremise_proxy_http_port);
+  const tokenServiceUrl = credentials.token_service_url;
+  const clientId = credentials.clientid;
+  const clientSecret = credentials.clientsecret;
+  if (typeof host !== 'string' || !host || !Number.isInteger(port) || port < 1 || port > 65535 ||
+      typeof tokenServiceUrl !== 'string' || !clientId || !clientSecret) {
+    throw safeError('Connectivity service credentials are incomplete');
+  }
+  let tokenUrl;
+  try {
+    tokenUrl = new URL(tokenServiceUrl);
+  } catch {
+    throw safeError('Connectivity token service URL is invalid');
+  }
+  if ((tokenUrl.protocol !== 'https:' && tokenUrl.protocol !== 'http:') || tokenUrl.username || tokenUrl.password) {
+    throw safeError('Connectivity token service URL is invalid');
+  }
+  const pathname = tokenUrl.pathname.replace(/\/+$/, '');
+  if (!pathname.toLowerCase().endsWith('/oauth/token')) tokenUrl.pathname = `${pathname}/oauth/token`;
+  tokenUrl.hash = '';
+  return { host, port, tokenUrl, clientId, clientSecret };
+}
+
+function targetFromUrl(value) {
+  let target;
+  try {
+    target = new URL(value);
+  } catch {
+    throw safeError('Destination URL is invalid');
+  }
+  if (target.protocol !== 'http:' && target.protocol !== 'https:') {
+    throw safeError('Destination URL must use HTTP or HTTPS');
+  }
+  if (target.username || target.password || !target.hostname) {
+    throw safeError('Destination URL must not contain user information');
+  }
+  return {
+    url: target,
+    host: target.hostname.toLowerCase().replace(/^\[|\]$/g, ''),
+    port: Number(target.port || (target.protocol === 'https:' ? 443 : 80)),
+  };
+}
+
+function hostPort(authority, defaultPort) {
+  if (typeof authority !== 'string' || !authority || /[@/?#\\]/.test(authority)) return null;
+  let parsed;
+  try {
+    parsed = new URL(`http://${authority}`);
+  } catch {
+    return null;
+  }
+  if (!parsed.hostname || parsed.username || parsed.password || parsed.pathname !== '/' || parsed.search || parsed.hash) return null;
+  const explicit = authority.startsWith('[') ? authority.match(/^\[[^\]]+\](?::(\d+))?$/) : authority.match(/^[^:]+(?::(\d+))?$/);
+  if (!explicit) return null;
+  const port = explicit[1] ? Number(explicit[1]) : (defaultPort === 80 || defaultPort === 443 ? defaultPort : null);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return null;
+  return { host: parsed.hostname.toLowerCase().replace(/^\[|\]$/g, ''), port };
+}
+
+function targetMatches(hostPortValue, target) {
+  return hostPortValue?.host === target.host && hostPortValue.port === target.port;
+}
+
+function respond(res, status, text) {
+  if (res.headersSent) return res.destroy();
+  res.writeHead(status, { 'content-type': 'text/plain; charset=utf-8', 'connection': 'close' });
+  res.end(`${text}\n`);
+}
+
+function boundedSocketError(socket) {
+  socket.on('error', () => socket.destroy());
+}
+
+export async function createCfConnectivityProxy({
+  destinationUrl,
+  connectivityCredentials,
+  locationId,
+  authMode,
+  userTokenProvider,
+  fetchImpl = globalThis.fetch,
+}) {
+  const target = targetFromUrl(destinationUrl);
+  const proxy = configuredProxy(connectivityCredentials);
+  if (authMode !== 'application' && authMode !== 'principal-propagation') {
+    throw safeError('Connectivity authentication mode is unsupported');
+  }
+  if (locationId != null && /[\r\n]/.test(String(locationId))) {
+    throw safeError('Connectivity location identifier is invalid');
+  }
+  if (typeof fetchImpl !== 'function') throw safeError('Token request implementation is unavailable');
+  if (authMode === 'principal-propagation' && typeof userTokenProvider !== 'function') {
+    throw safeError('Cloud Foundry user token provider is unavailable');
+  }
+
+  let cachedToken;
+  let tokenExpiry = 0;
+  let refreshing;
+  let closed = false;
+  const sockets = new Set();
+
+  async function acquireToken() {
+    if (cachedToken && Date.now() < tokenExpiry - TOKEN_REFRESH_SKEW_MS) return cachedToken;
+    if (refreshing) return refreshing;
+    refreshing = (async () => {
+      let body;
+      if (authMode === 'principal-propagation') {
+        let assertion;
+        try {
+          assertion = await userTokenProvider();
+        } catch {
+          throw safeError('Unable to obtain the current Cloud Foundry user token');
+        }
+        if (typeof assertion !== 'string' || !assertion) {
+          throw safeError('Unable to obtain the current Cloud Foundry user token');
+        }
+        body = new URLSearchParams({
+          grant_type: 'urn:ietf:params:oauth:grant-type:jwt-bearer',
+          assertion,
+          token_format: 'jwt',
+          response_type: 'token',
+        });
+      } else {
+        body = new URLSearchParams({ grant_type: 'client_credentials' });
+      }
+      let response;
+      try {
+        response = await fetchImpl(proxy.tokenUrl, {
+          method: 'POST',
+          headers: {
+            authorization: `Basic ${Buffer.from(`${proxy.clientId}:${proxy.clientSecret}`).toString('base64')}`,
+            'content-type': 'application/x-www-form-urlencoded',
+            accept: 'application/json',
+          },
+          body,
+          signal: AbortSignal.timeout(TOKEN_TIMEOUT_MS),
+        });
+      } catch {
+        throw safeError('Connectivity token request failed');
+      }
+      let data;
+      try {
+        const raw = await response.text();
+        if (Buffer.byteLength(raw) > MAX_TOKEN_RESPONSE_BYTES) throw new Error('large');
+        data = JSON.parse(raw);
+      } catch {
+        throw safeError('Connectivity token response was invalid');
+      }
+      if (!response.ok || typeof data?.access_token !== 'string' || !data.access_token ||
+          !Number.isFinite(Number(data.expires_in)) || Number(data.expires_in) <= 0) {
+        throw safeError('Connectivity token exchange was rejected');
+      }
+      cachedToken = data.access_token;
+      tokenExpiry = Date.now() + Number(data.expires_in) * 1000;
+      return cachedToken;
+    })();
+    try {
+      return await refreshing;
+    } finally {
+      refreshing = undefined;
+    }
+  }
+
+  async function connectivityHeaders() {
+    const token = await acquireToken();
+    const headers = { 'Proxy-Authorization': `Bearer ${token}` };
+    if (locationId) headers['SAP-Connectivity-SCC-Location_ID'] = String(locationId);
+    return headers;
+  }
+
+  // Fail during route preparation when the CF identity or service credentials
+  // cannot obtain the required Connectivity token.
+  await connectivityHeaders();
+
+  const server = http.createServer((req, res) => {
+    void (async () => {
+      let requested;
+      try {
+        const requestUrl = new URL(req.url, `${target.url.protocol}//${req.headers.host || ''}`);
+        if (requestUrl.username || requestUrl.password) return respond(res, 400, 'Invalid proxy target');
+        const defaultPort = requestUrl.protocol === 'https:' ? 443 : 80;
+        requested = { host: requestUrl.hostname.toLowerCase().replace(/^\[|\]$/g, ''), port: Number(requestUrl.port || defaultPort) };
+        if ((requestUrl.protocol !== 'http:' && requestUrl.protocol !== 'https:') || !targetMatches(requested, target)) {
+          return respond(res, 403, 'Proxy target is not permitted');
+        }
+        // The BTP Connectivity endpoint accepts HTTP forward requests; HTTPS destinations use CONNECT.
+        if (requestUrl.protocol !== 'http:') return respond(res, 400, 'HTTPS destinations must use CONNECT');
+        const headers = await connectivityHeaders();
+        if (closed) return respond(res, 503, 'Proxy is closed');
+        const forwardedHeaders = { ...req.headers };
+        for (const name of ['host', 'proxy-authorization', 'proxy-connection', 'connection', 'sap-connectivity-scc-location_id']) {
+          delete forwardedHeaders[name];
+        }
+        const upstream = http.request({
+          host: proxy.host,
+          port: proxy.port,
+          method: req.method,
+          path: requestUrl.href,
+          headers: { ...forwardedHeaders, host: requestUrl.host, ...headers, connection: 'close' },
+          agent: false,
+        }, (upstreamRes) => {
+          res.writeHead(upstreamRes.statusCode || 502, upstreamRes.statusMessage, upstreamRes.headers);
+          upstreamRes.pipe(res);
+        });
+        sockets.add(upstream);
+        upstream.once('close', () => sockets.delete(upstream));
+        req.once('aborted', () => upstream.destroy());
+        res.once('close', () => {
+          if (!res.writableEnded) upstream.destroy();
+        });
+        upstream.on('error', () => respond(res, 502, 'Connectivity proxy request failed'));
+        req.pipe(upstream);
+      } catch {
+        respond(res, 502, 'Connectivity proxy request failed');
+      }
+    })();
+  });
+
+  server.on('connect', (req, clientSocket, head) => {
+    sockets.add(clientSocket);
+    clientSocket.once('close', () => sockets.delete(clientSocket));
+    boundedSocketError(clientSocket);
+    void (async () => {
+      const requested = hostPort(req.url, target.port);
+      if (!targetMatches(requested, target)) {
+        clientSocket.end('HTTP/1.1 403 Forbidden\r\nConnection: close\r\n\r\n');
+        return;
+      }
+      let upstream;
+      try {
+        const headers = await connectivityHeaders();
+        if (closed) throw safeError('Proxy is closed');
+        upstream = net.connect({ host: proxy.host, port: proxy.port });
+        sockets.add(upstream);
+        upstream.once('close', () => sockets.delete(upstream));
+        boundedSocketError(upstream);
+        await once(upstream, 'connect');
+        const authority = req.url;
+        const headerText = Object.entries(headers).map(([name, value]) => `${name}: ${value}`).join('\r\n');
+        upstream.write(`CONNECT ${authority} HTTP/1.1\r\nHost: ${authority}\r\n${headerText}\r\n\r\n`);
+        let response = Buffer.alloc(0);
+        const onData = (chunk) => {
+          response = Buffer.concat([response, chunk]);
+          if (response.length > 64 * 1024) {
+            upstream.destroy();
+            clientSocket.end('HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n');
+            return;
+          }
+          const boundary = response.indexOf('\r\n\r\n');
+          if (boundary < 0) return;
+          upstream.removeListener('data', onData);
+          const statusLine = response.subarray(0, boundary).toString('latin1').split('\r\n', 1)[0];
+          const match = /^HTTP\/1\.[01] (\d{3})(?:\s|$)/.exec(statusLine);
+          if (!match || Number(match[1]) !== 200) {
+            upstream.destroy();
+            clientSocket.end('HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n');
+            return;
+          }
+          clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+          const remaining = response.subarray(boundary + 4);
+          if (remaining.length) clientSocket.write(remaining);
+          if (head.length) upstream.write(head);
+          clientSocket.pipe(upstream);
+          upstream.pipe(clientSocket);
+        };
+        upstream.on('data', onData);
+      } catch {
+        upstream?.destroy();
+        if (!clientSocket.destroyed) clientSocket.end('HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n');
+      }
+    })();
+  });
+
+  server.on('clientError', (_error, socket) => {
+    if (!socket.destroyed) socket.end('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
+  });
+
+  await new Promise((resolve, reject) => {
+    server.once('error', () => reject(safeError('Unable to start Connectivity proxy')));
+    server.listen(0, '127.0.0.1', resolve);
+  });
+  const close = async () => {
+    if (closed) return;
+    closed = true;
+    cachedToken = undefined;
+    if (server.listening) {
+      const done = once(server, 'close');
+      server.close();
+      server.closeAllConnections();
+      for (const socket of sockets) socket.destroy();
+      await done;
+    }
+  };
+  return {
+    get url() {
+      const address = server.address();
+      return typeof address === 'object' && address ? `http://127.0.0.1:${address.port}` : 'http://127.0.0.1';
+    },
+    close,
+  };
+}