sap-ai-dev-toolkit 0.3.1 → 0.3.4

package/test/bas-destination-relay.test.mjs

@@ -0,0 +1,238 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import http from 'node:http';
+import net from 'node:net';
+import { request as httpRequest } from 'node:http';
+import { createBasDestinationRelay } from '../src/bas-destination-relay.mjs';
+
+const UNSAFE_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'];
+
+// Simulates SAP ADT semantics: a CSRF token is only valid when the unsafe
+// request carries BOTH the token and the session cookies that were set
+// together with it. This reproduces the 403 "CSRF token validation failed"
+// seen on the BAS .dest proxy path before the relay paired sessions.
+function sapLikeBackend({ neverAcceptUnsafe = false, rotateOnFetch = false } = {}) {
+  const state = { sessionCounter: 0, requests: [] };
+  const server = http.createServer((req, res) => {
+    state.requests.push({ method: req.method, path: req.url, headers: { ...req.headers } });
+    if (req.method === 'GET' && req.headers['x-csrf-token'] === 'Fetch') {
+      state.sessionCounter += 1;
+      res.writeHead(200, {
+        'x-csrf-token': `token-${state.sessionCounter}`,
+        'set-cookie': [`sap-session-${state.sessionCounter}=s${state.sessionCounter}; path=/`, 'sap-usercontext=sap-client=100; path=/']
+      });
+      res.end('<ok/>');
+      return;
+    }
+    if (UNSAFE_METHODS.includes(req.method)) {
+      if (neverAcceptUnsafe) {
+        res.writeHead(403, { 'x-csrf-token': 'Required' });
+        res.end('CSRF token validation failed');
+        return;
+      }
+      const token = req.headers['x-csrf-token'];
+      const cookie = String(req.headers.cookie || '');
+      const match = String(token || '').match(/^token-(\d+)$/);
+      // Without rotation any still-live token+cookie pair is accepted; with
+      // rotation only the newest issued session remains valid, matching SAP
+      // server-side session invalidation.
+      const valid = match && cookie.includes(`sap-session-${match[1]}=`) && (!rotateOnFetch || Number(match[1]) === state.sessionCounter);
+      if (!valid) {
+        res.writeHead(403, { 'x-csrf-token': 'Required' });
+        res.end('CSRF token validation failed');
+        return;
+      }
+      res.writeHead(201);
+      res.end('<created/>');
+      return;
+    }
+    res.writeHead(200);
+    res.end('<read/>');
+  });
+  return { state, server };
+}
+
+async function startServer(server) {
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  return server.address().port;
+}
+
+function relayFetch(relayUrl, path, options = {}) {
+  const target = new URL(path, relayUrl);
+  return new Promise((resolve, reject) => {
+    const req = httpRequest(target, { method: options.method || 'GET', headers: options.headers || {} }, response => {
+      let body = '';
+      response.setEncoding('utf8');
+      response.on('data', chunk => { body += chunk; });
+      response.on('end', () => resolve({ status: response.statusCode, headers: response.headers, body }));
+    });
+    req.on('error', reject);
+    if (options.body) req.write(options.body);
+    req.end();
+  });
+}
+
+async function withBackend(options, handler) {
+  const { state, server } = sapLikeBackend(options || {});
+  const backendPort = await startServer(server);
+  const logs = [];
+  const relay = createBasDestinationRelay(
+    { name: 'TEST', url: `http://127.0.0.1:${backendPort}`, authentication: 'BasicAuthentication' },
+    {
+      env: { HTTP_PROXY: '' },
+      fetchImpl: options?.fetchImpl || ((url, init) => globalThis.fetch(url, init)),
+      log: message => logs.push(message)
+    }
+  );
+  const relayUrl = await relay.ready;
+  try {
+    return await handler({ state, relay, relayUrl, logs });
+  } finally {
+    await relay.close();
+    await new Promise(resolve => server.close(resolve));
+  }
+}
+
+test('pairs CSRF token with its session cookies so unsafe requests succeed', async () => {
+  await withBackend(null, async ({ relayUrl, state }) => {
+    const response = await relayFetch(relayUrl, '/sap/bc/adt/oo/classes', { method: 'POST', headers: { accept: 'application/xml' }, body: '<x/>' });
+    assert.equal(response.status, 201, `expected 201, got ${response.status}: ${response.body}`);
+    const post = state.requests.find(request => request.method === 'POST');
+    assert.match(post.headers['x-csrf-token'], /^token-\d+$/);
+    assert.match(String(post.headers.cookie), /sap-session-\d+=/);
+  });
+});
+
+test('reuses the cached CSRF session for subsequent unsafe requests', async () => {
+  await withBackend(null, async ({ relay, relayUrl, state }) => {
+    await relayFetch(relayUrl, '/sap/bc/adt/oo/classes', { method: 'POST', body: '<x/>' });
+    await relayFetch(relayUrl, '/sap/bc/adt/oo/classes', { method: 'POST', body: '<y/>' });
+    const fetches = state.requests.filter(request => request.headers['x-csrf-token'] === 'Fetch');
+    assert.equal(fetches.length, 1, 'second POST must reuse the cached session');
+    assert.equal(state.requests.filter(request => request.method === 'POST').length, 2);
+    assert.equal(relay.stats.csrfFetches, 1);
+    assert.equal(relay.stats.csrfRetries, 0);
+  });
+});
+
+test('self-heals when SAP rotates the session: refetches token and cookies', async () => {
+  await withBackend({ rotateOnFetch: true }, async ({ relay, relayUrl, state }) => {
+    // A first POST establishes session token-1. SAP then invalidates it
+    // server-side (simulated by the rotation rule below).
+    await relayFetch(relayUrl, '/sap/bc/adt/oo/classes', { method: 'POST', body: '<x/>' });
+    state.sessionCounter += 1;
+    const response = await relayFetch(relayUrl, '/sap/bc/adt/oo/classes', { method: 'POST', body: '<y/>' });
+    assert.equal(response.status, 201, `rotated session must heal via refetch, got ${response.status}`);
+    assert.ok(relay.stats.csrfRetries >= 1, 'a retry must have been counted');
+    const fetches = state.requests.filter(request => request.headers['x-csrf-token'] === 'Fetch');
+    assert.ok(fetches.length >= 2, 'a fresh token fetch must have occurred');
+  });
+});
+
+test('stops retrying after bounded attempts and surfaces the failure', async () => {
+  await withBackend({ neverAcceptUnsafe: true }, async ({ relay, relayUrl, state }) => {
+    const response = await relayFetch(relayUrl, '/sap/bc/adt/oo/classes', { method: 'POST', body: '<x/>' });
+    assert.equal(response.status, 403);
+    const attempts = state.requests.filter(request => UNSAFE_METHODS.includes(request.method));
+    assert.equal(attempts.length, 1 + 3, 'one initial try plus three bounded retries');
+    assert.equal(relay.stats.csrfRetries, 3);
+  });
+});
+
+test('GET requests pass through without CSRF handling', async () => {
+  await withBackend(null, async ({ relayUrl, state, relay }) => {
+    const response = await relayFetch(relayUrl, '/sap/bc/adt/discovery', { headers: { accept: 'application/xml' } });
+    assert.equal(response.status, 200);
+    assert.equal(state.requests.filter(request => request.headers['x-csrf-token']).length, 0);
+    assert.equal(relay.stats.csrfFetches, 0);
+  });
+});
+
+test('drops POST body headers from the token-fetch GET', async () => {
+  await withBackend(null, async ({ relayUrl, state }) => {
+    await relayFetch(relayUrl, '/sap/bc/adt/oo/classes', {
+      method: 'POST',
+      headers: { accept: 'application/xml', 'content-type': 'application/xml', 'content-length': '5' },
+      body: '<xy/>'
+    });
+    const fetchRequest = state.requests.find(request => request.headers['x-csrf-token'] === 'Fetch');
+    assert.equal(fetchRequest.headers['content-type'], undefined, 'content-type must not leak into token GET');
+    assert.equal(fetchRequest.headers['content-length'], undefined, 'content-length must not leak into token GET');
+  });
+});
+
+test('falls back to a proxy tunnel when the absolute-form request is refused', async () => {
+  const fetchCalls = [];
+  const fetchImpl = (url, options = {}) => {
+    fetchCalls.push({ url: String(url), tunneled: Boolean(options.dispatcher && options.dispatcher.proxyTunnel !== false && options.dispatcher.constructor?.name === 'ProxyAgent' && options.dispatcher.__tunnelMarker !== false) });
+    // First call (absolute-form through proxy) is refused by the proxy itself.
+    if (fetchCalls.length === 1) return Promise.resolve(new Response('<gateway/>', { status: 502 }));
+    return Promise.resolve(new Response('<ok/>', { status: 200, headers: { 'x-csrf-token': 'tok' } }));
+  };
+  const { state, server } = sapLikeBackend();
+  void state;
+  const backendPort = await startServer(server);
+  const relay = createBasDestinationRelay(
+    { name: 'TEST', url: `http://127.0.0.1:${backendPort}`, authentication: 'BasicAuthentication' },
+    { env: { HTTP_PROXY: 'http://127.0.0.1:1' }, fetchImpl, log: () => {} }
+  );
+  const relayUrl = await relay.ready;
+  try {
+    const response = await relayFetch(relayUrl, '/sap/bc/adt/discovery');
+    assert.equal(response.status, 200);
+    assert.equal(relay.stats.tunnelFallbacks, 1, 'exactly one tunnel fallback must occur');
+    assert.equal(fetchCalls.length, 2, 'absolute-form attempt then one tunnel retry');
+  } finally {
+    await relay.close();
+    await new Promise(resolve => server.close(resolve));
+  }
+});
+
+test('keeps OnPremise Basic auth on a BAS proxy tunnel and verifies the CSRF session', async t => {
+  const { state, server } = sapLikeBackend();
+  const backendPort = await startServer(server);
+  const connectTargets = [];
+  const proxy = http.createServer();
+  proxy.on('connect', (request, clientSocket, head) => {
+    connectTargets.push(request.url);
+    const upstream = net.connect(backendPort, '127.0.0.1', () => {
+      clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+      if (head.length) upstream.write(head);
+      clientSocket.pipe(upstream);
+      upstream.pipe(clientSocket);
+    });
+    clientSocket.on('error', () => upstream.destroy());
+    upstream.on('error', () => clientSocket.destroy());
+  });
+  const proxyPort = await startServer(proxy);
+  const logs = [];
+  const relay = createBasDestinationRelay({
+    name: 'CC-SYSTEM',
+    url: 'http://cc-system.dest',
+    authentication: 'BasicAuthentication',
+    credentials: { user: 'DEVELOPER', password: 'secret123', mode: 'bas-tunnel' }
+  }, {
+    env: { HTTP_PROXY: `http://127.0.0.1:${proxyPort}` },
+    log: message => logs.push(message)
+  });
+  const relayUrl = await relay.ready;
+  t.after(async () => {
+    await relay.close();
+    proxy.closeAllConnections?.();
+    await new Promise(resolve => proxy.close(resolve));
+    await new Promise(resolve => server.close(resolve));
+  });
+
+  const probe = await relay.probeCsrfSession();
+  assert.deepEqual(probe, { httpStatus: 200, tokenReceived: true, cookieCount: 2 });
+  const response = await relayFetch(relayUrl, '/sap/bc/adt/oo/classes', { method: 'POST', body: '<x/>' });
+  assert.equal(response.status, 201, `expected a paired CSRF session, got ${response.status}: ${response.body}`);
+  const post = state.requests.find(request => request.method === 'POST');
+  assert.match(post.headers.authorization, /^Basic /);
+  assert.match(String(post.headers.cookie), /sap-session-\d+=/);
+  assert.ok(connectTargets.length >= 2);
+  assert.ok(connectTargets.every(target => target === 'cc-system.dest:80'));
+  assert.equal(relay.stats.direct, false);
+  assert.equal(relay.stats.proxyTunnel, true);
+  assert.ok(logs.some(message => message.includes('BAS proxy tunnel')));
+});

package/test/cf-runtime.test.mjs

@@ -6,6 +6,7 @@ import { spawn } from 'node:child_process';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { storeDestinationCredentials } from '../src/credentials-store.mjs';
 
 const launcher = fileURLToPath(new URL('../src/launcher.mjs', import.meta.url));
 const fakeVsp = fileURLToPath(new URL('./fixtures/fake-vsp.mjs', import.meta.url));
@@ -257,6 +258,12 @@ test('routes a PrincipalPropagation MCP call through CF Connectivity to the SAP
     connectivityProxyPort,
     connectivityTokenUrl: `${serviceOrigin}/connectivity/oauth/token`
   });
+  const credentialsPath = join(directory, 'sap-ai-dev-toolkit-credentials.json');
+  await storeDestinationCredentials(credentialsPath, `cloud-foundry:cf:${SPACE_GUID}:${INSTANCE_GUID}:pp-target`, {
+    user: 'must-not-override',
+    password: 'must-not-override-secret',
+    mode: 'cf-connectivity'
+  });
   const childLog = join(directory, 'vsp-children.jsonl');
   t.after(async () => {
     await new Promise(resolve => service.close(resolve));
@@ -271,6 +278,7 @@ test('routes a PrincipalPropagation MCP call through CF Connectivity to the SAP
     SAP_AI_DEV_TOOLKIT_BINARY: fakeVsp,
     SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE: 'cloud-foundry',
     SAP_AI_DEV_TOOLKIT_DESTINATION: 'pp-target',
+    SAP_AI_DEV_TOOLKIT_CREDENTIALS_FILE: credentialsPath,
     BAS_CF_SPACE_GUID: SPACE_GUID,
     BAS_CF_DESTINATION_INSTANCE_GUID: INSTANCE_GUID,
     BAS_CF_DESTINATION_INSTANCE: INSTANCE_NAME,
@@ -313,17 +321,17 @@ test('routes a PrincipalPropagation MCP call through CF Connectivity to the SAP
   assert.equal(initialized.argv.includes('--proxy-auth'), true);
   assert.equal(initialized.env.user, undefined);
   assert.equal(initialized.env.password, undefined);
-  for (const secret of ['destination-key-secret', 'destination-api-token', 'connectivity-key-secret', 'user-exchange-token', 'current-cf-user-jwt', 'parent-user-secret', 'parent-password-secret']) {
+  for (const secret of ['must-not-override', 'must-not-override-secret', 'destination-key-secret', 'destination-api-token', 'connectivity-key-secret', 'user-exchange-token', 'current-cf-user-jwt', 'parent-user-secret', 'parent-password-secret']) {
     assert.equal(`${result.stdout}\\n${result.stderr}\\n${JSON.stringify(initialized.argv)}`.includes(secret), false);
   }
 });
 
-test('routes a CF Basic OnPremise MCP call through the HTTP Connectivity proxy', async t => {
+test('overrides CF Basic OnPremise backend auth while retaining the HTTP Connectivity proxy', async t => {
   const directory = await mkdtemp(join(tmpdir(), 'bas-cf-basic-onprem-'));
   const observed = { destinationToken: [], destinationList: [], connectivityToken: [], proxy: [], connect: [], target: [] };
   const target = createServer((request, response) => {
     observed.target.push({ path: request.url, authorization: request.headers.authorization });
-    response.writeHead(request.headers.authorization === `Basic ${Buffer.from('sap-user:sap-password').toString('base64')}` ? 200 : 401, {
+    response.writeHead(request.headers.authorization === `Basic ${Buffer.from('override-user:override-password').toString('base64')}` ? 200 : 401, {
       'content-type': 'text/plain'
     });
     response.end('SAP system information: client=100');
@@ -409,6 +417,12 @@ test('routes a CF Basic OnPremise MCP call through the HTTP Connectivity proxy',
     connectivityProxyPort,
     connectivityTokenUrl: `${serviceOrigin}/connectivity/oauth/token`
   });
+  const credentialsPath = join(directory, 'sap-ai-dev-toolkit-credentials.json');
+  await storeDestinationCredentials(credentialsPath, `cloud-foundry:cf:${SPACE_GUID}:${INSTANCE_GUID}:basic-onprem`, {
+    user: 'override-user',
+    password: 'override-password',
+    mode: 'cf-connectivity'
+  });
   const childLog = join(directory, 'vsp-children.jsonl');
   const servers = [service, target, connectivityProxy];
   t.after(async () => {
@@ -423,6 +437,7 @@ test('routes a CF Basic OnPremise MCP call through the HTTP Connectivity proxy',
     SAP_AI_DEV_TOOLKIT_BINARY: fakeVsp,
     SAP_AI_DEV_TOOLKIT_DESTINATION_SOURCE: 'cloud-foundry',
     SAP_AI_DEV_TOOLKIT_DESTINATION: 'basic-onprem',
+    SAP_AI_DEV_TOOLKIT_CREDENTIALS_FILE: credentialsPath,
     BAS_CF_SPACE_GUID: SPACE_GUID,
     BAS_CF_DESTINATION_INSTANCE_GUID: INSTANCE_GUID,
     BAS_CF_DESTINATION_INSTANCE: INSTANCE_NAME,
@@ -461,13 +476,20 @@ test('routes a CF Basic OnPremise MCP call through the HTTP Connectivity proxy',
     'GET',
     `${targetOrigin}/sap/bc/adt/discovery`,
     'Bearer application-proxy-token',
-    `Basic ${Buffer.from('sap-user:sap-password').toString('base64')}`
+    `Basic ${Buffer.from('override-user:override-password').toString('base64')}`
   ]]);
   assert.deepEqual(observed.connect, []);
   assert.deepEqual(observed.target, [{
     path: '/sap/bc/adt/discovery',
-    authorization: `Basic ${Buffer.from('sap-user:sap-password').toString('base64')}`
+    authorization: `Basic ${Buffer.from('override-user:override-password').toString('base64')}`
   }]);
+  const events = (await readFile(childLog, 'utf8')).trim().split('\n').map(line => JSON.parse(line));
+  const initialized = events.find(event => event.event === 'initialize');
+  assert.deepEqual([initialized.env.user, initialized.env.password], ['override-user', 'override-password']);
+  assert.equal(initialized.argv.includes('--proxy-auth'), false);
+  for (const secret of ['override-user', 'override-password', 'sap-password', 'connectivity-key-secret', 'application-proxy-token']) {
+    assert.equal(`${result.stdout}\n${result.stderr}\n${JSON.stringify(initialized.argv)}`.includes(secret), false, `${secret} must not appear in output or argv`);
+  }
 });
 
 test('CF list-destinations clears the CF name filter and remains BAS-only', async t => {

package/test/copilot-content.test.mjs

@@ -49,6 +49,12 @@ function assertMentionsLiveToolDiscovery(markdown, path) {
   assert.match(markdown, /schema/i, `${path} must tell agents to follow live tool schemas`);
 }
 
+function assertDirectMcpUsage(markdown, path) {
+  assert.match(markdown, /Direct MCP invocation is mandatory/i, `${path} must require direct MCP calls`);
+  assert.match(markdown, /Do not launch `sap-ai-dev`.*MCP operations/i, `${path} must forbid terminal-driven MCP discovery/calls`);
+  assert.match(markdown, /host\/session binding issue/i, `${path} must report host tool-binding failures instead of using a CLI fallback`);
+}
+
 function assertValidationPolicy(markdown, path) {
   assert.match(markdown, /ABAP Unit|RunUnitTests/i, `${path} must include ABAP Unit or test execution guidance`);
   assert.match(markdown, /runtime validation|Self-validate|executable validation|reproduce/i, `${path} must require executable/runtime validation evidence`);
@@ -56,6 +62,18 @@ function assertValidationPolicy(markdown, path) {
   assert.match(markdown, /report|Record|document/i, `${path} must require observed outcome reporting`);
 }
 
+function assertPlanFirstPolicy(markdown, path) {
+  assert.match(markdown, /[Pp]lan before implementing|[Pp]lanning phase before implementation/, `${path} must require a plan to be presented before implementation starts`);
+  assert.match(markdown, /wait for explicit (?:user )?approval|no SAP state-changing package proceeds before the user approves/i, `${path} must gate SAP state-changing implementation on explicit approval`);
+}
+
+function assertLocalFirstPolicy(markdown, path) {
+  assert.match(markdown, /abapGit[- ]serialized|abapGit-style/, `${path} must require local abapGit-style source files`);
+  assert.match(markdown, /object\.type\.extension/, `${path} must document the object.type.extension file naming`);
+  assert.match(markdown, /LintABAP/, `${path} must require local linting with LintABAP`);
+  assert.match(markdown, /before (?:they are )?sent to the SAP system|before sending to SAP|check and lint before sending/i, `${path} must require local checks before the SAP transfer`);
+}
+
 function assertNoUnsafeTransportClaims(markdown, path) {
   const releaseMentions = markdown.match(/ReleaseTransport|release\/deletion|release and deletion|release is unavailable|release action/gi) || [];
   assert.ok(releaseMentions.length > 0 || !/transport/i.test(markdown), `${path} transport guidance should explicitly handle release limitations when transport is discussed`);
@@ -73,6 +91,15 @@ test('packaged Copilot agent and skill inventory is complete and canonical', asy
   }
 });
 
+test('all bundled agents invoke chat-attached MCP tools without terminal JSON-RPC fallbacks', async () => {
+  for (const name of expectedAgents) {
+    const path = join(agentsRoot, name);
+    const markdown = await readMarkdown(path);
+    assertDirectMcpUsage(markdown, path);
+    assertMentionsLiveToolDiscovery(markdown, path);
+  }
+});
+
 test('ABAP Developer agent has valid metadata and invokes the packaged skills', async () => {
   const markdown = await readMarkdown(agentPath);
   const metadata = parseFrontmatter(markdown, agentPath);
@@ -88,6 +115,8 @@ test('ABAP Developer agent has valid metadata and invokes the packaged skills',
   }
   assertMentionsLiveToolDiscovery(markdown, agentPath);
   assertValidationPolicy(markdown, agentPath);
+  assertPlanFirstPolicy(markdown, agentPath);
+  assertLocalFirstPolicy(markdown, agentPath);
   assertNoUnsafeTransportClaims(markdown, agentPath);
 });
 
@@ -108,6 +137,24 @@ test('SAP Solution Architect agent has valid metadata and planning/handoff polic
   assert.match(markdown, /RAP Service Developer/i);
   assert.match(markdown, /ABAP Runtime Debugger/i);
   assert.match(markdown, /SDLC|lifecycle/i);
+  assertPlanFirstPolicy(markdown, path);
+  assertLocalFirstPolicy(markdown, path);
+  assertNoUnsafeTransportClaims(markdown, path);
+});
+
+test('RAP Service Developer agent has valid metadata and plan-first local-first policy', async () => {
+  const path = join(agentsRoot, 'rap-service-developer.agent.md');
+  const markdown = await readMarkdown(path);
+  const metadata = parseFrontmatter(markdown, path);
+  assert.deepEqual(Object.keys(metadata).sort(), ['description', 'name', 'target', 'user-invocable']);
+  assert.equal(metadata.name, 'RAP Service Developer');
+  assert.equal(metadata.target, 'vscode');
+  assert.equal(metadata['user-invocable'], 'true');
+  assert.match(metadata.description, /RAP/i);
+  assertMentionsLiveToolDiscovery(markdown, path);
+  assertValidationPolicy(markdown, path);
+  assertPlanFirstPolicy(markdown, path);
+  assertLocalFirstPolicy(markdown, path);
   assertNoUnsafeTransportClaims(markdown, path);
 });
 
@@ -134,6 +181,15 @@ test('implementation-oriented skills require tests, runtime evidence, activation
   }
 });
 
+test('implementation and delivery skills require planning first and local-first authoring', async () => {
+  for (const skill of ['abap-development', 'rap-development', 'rap-service-delivery', 'sap-sdlc-orchestration']) {
+    const path = join(skillsRoot, skill, 'SKILL.md');
+    const markdown = await readMarkdown(path);
+    assertPlanFirstPolicy(markdown, path);
+    assertLocalFirstPolicy(markdown, path);
+  }
+});
+
 test('debugging skill requires evidence before fixes and bounded debugger use', async () => {
   const path = join(skillsRoot, 'abap-debugging', 'SKILL.md');
   const markdown = await readMarkdown(path);

package/test/credentials-store.test.mjs

@@ -0,0 +1,187 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtemp, readFile, rm, stat, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import http from 'node:http';
+import { request as httpRequest } from 'node:http';
+import { createBasDestinationRelay } from '../src/bas-destination-relay.mjs';
+import { readCredentials, removeDestinationCredentials, resolveCredentialsPath, storeDestinationCredentials } from '../src/credentials-store.mjs';
+import { canPromptForCredentials, credentialKeyForDestination, credentialModeForDestination } from '../src/credential-overrides.mjs';
+
+const UNSAFE_METHODS = ['POST', 'PUT', 'PATCH', 'DELETE'];
+
+// SAP-like backend that requires Basic auth AND token+cookie pairing —
+// the semantics that only work when the relay connects directly.
+function authedBackend({ expectedUser = 'DEVELOPER', expectedPassword = 'secret123' } = {}) {
+  const state = { sessionCounter: 0, requests: [] };
+  const server = http.createServer((req, res) => {
+    state.requests.push({ method: req.method, headers: { ...req.headers } });
+    const authorization = String(req.headers.authorization || '');
+    const basic = authorization.replace(/^Basic /i, '');
+    const [user, password] = Buffer.from(basic, 'base64').toString().split(':');
+    if (user !== expectedUser || password !== expectedPassword) {
+      res.writeHead(401, { 'www-authenticate': 'Basic' });
+      res.end('credentials required');
+      return;
+    }
+    if (req.method === 'GET' && req.headers['x-csrf-token'] === 'Fetch') {
+      state.sessionCounter += 1;
+      res.writeHead(200, {
+        'x-csrf-token': `token-${state.sessionCounter}`,
+        'set-cookie': [`sap-session-${state.sessionCounter}=s${state.sessionCounter}; path=/`]
+      });
+      res.end('<ok/>');
+      return;
+    }
+    if (UNSAFE_METHODS.includes(req.method)) {
+      const match = String(req.headers['x-csrf-token'] || '').match(/^token-(\d+)$/);
+      const valid = match && String(req.headers.cookie || '').includes(`sap-session-${match[1]}=`);
+      if (!valid) {
+        res.writeHead(403, { 'x-csrf-token': 'Required' });
+        res.end('CSRF token validation failed');
+        return;
+      }
+      res.writeHead(201);
+      res.end('<created/>');
+      return;
+    }
+    res.writeHead(200);
+    res.end('<read/>');
+  });
+  return { state, server };
+}
+
+function relayFetch(relayUrl, path, options = {}) {
+  const target = new URL(path, relayUrl);
+  return new Promise((resolve, reject) => {
+    const req = httpRequest(target, { method: options.method || 'GET', headers: options.headers || {} }, response => {
+      let body = '';
+      response.setEncoding('utf8');
+      response.on('data', chunk => { body += chunk; });
+      response.on('end', () => resolve({ status: response.statusCode, body }));
+    });
+    req.on('error', reject);
+    if (options.body) req.write(options.body);
+    req.end();
+  });
+}
+
+test('credentials file resolves next to the MCP config and stores entries with 0600', async t => {
+  const directory = await mkdtemp(join(tmpdir(), 'bas-creds-'));
+  t.after(async () => { await rm(directory, { recursive: true, force: true }); });
+  const mcpConfig = join(directory, 'mcp.json');
+  const path = await resolveCredentialsPath({ HOME: '/nonexistent' }, mcpConfig);
+  assert.equal(path, join(directory, 'sap-ai-dev-toolkit-credentials.json'));
+
+  await storeDestinationCredentials(path, 'S4H', { host: 'https://backend.example:44300', user: 'DEVELOPER', password: 'secret123' });
+  const stored = await readCredentials(path);
+  assert.equal(stored.destinations.S4H.user, 'DEVELOPER');
+  assert.equal(stored.destinations.S4H.host, 'https://backend.example:44300');
+  const permissions = (await stat(path)).mode & 0o777;
+  assert.equal(permissions, 0o600, 'credentials file must be owner-only');
+
+  const raw = JSON.parse(await readFile(path, 'utf8'));
+  assert.equal(raw.version, 1);
+  assert.ok(Object.hasOwn(raw.destinations, 'S4H'));
+
+  const { removed } = await removeDestinationCredentials(path, ['S4H']);
+  assert.deepEqual(removed, ['S4H']);
+  assert.equal((await readCredentials(path)).destinations.S4H, undefined);
+});
+
+test('credentials file with malformed entries keeps only complete records', async t => {
+  const directory = await mkdtemp(join(tmpdir(), 'bas-creds-bad-'));
+  t.after(async () => { await rm(directory, { recursive: true, force: true }); });
+  const path = join(directory, 'sap-ai-dev-toolkit-credentials.json');
+  await writeFile(path, JSON.stringify({
+    version: 1,
+    destinations: {
+      GOOD: { host: 'https://good.example', user: 'u', password: 'p', updatedAt: '2026-01-01T00:00:00.000Z' },
+      NO_PASSWORD: { host: 'https://bad.example', user: 'u' },
+      NOT_OBJECT: 'nope'
+    }
+  }));
+  const stored = await readCredentials(path);
+  assert.deepEqual(Object.keys(stored.destinations), ['GOOD']);
+});
+
+test('credential overrides use route-aware modes and distinct CF destination keys', async t => {
+  const directory = await mkdtemp(join(tmpdir(), 'bas-creds-modes-'));
+  const path = join(directory, 'sap-ai-dev-toolkit-credentials.json');
+  t.after(async () => { await rm(directory, { recursive: true, force: true }); });
+
+  const basDestination = { name: 'shared-name', source: 'bas', proxyType: 'Internet', authentication: 'BasicAuthentication', backendUrl: 'https://internet.example' };
+  const basOnPremise = { name: 'shared-name', source: 'bas', proxyType: 'OnPremise', authentication: 'BasicAuthentication' };
+  const cfOnPremise = { name: 'shared-name', serverName: 'cf:space-one:instance-one:shared-name', source: 'cloud-foundry', proxyType: 'OnPremise', authentication: 'BasicAuthentication' };
+  const principalPropagation = { ...cfOnPremise, authentication: 'PrincipalPropagation' };
+
+  assert.equal(canPromptForCredentials(basDestination), true);
+  assert.equal(credentialModeForDestination(basDestination), 'direct');
+  assert.equal(credentialModeForDestination(basOnPremise), 'bas-tunnel');
+  assert.equal(credentialModeForDestination(cfOnPremise), 'cf-connectivity');
+  assert.equal(canPromptForCredentials(principalPropagation), false);
+  assert.equal(credentialModeForDestination({ ...cfOnPremise, proxyType: 'Internet' }), null);
+  assert.equal(canPromptForCredentials({ ...basDestination, backendUrl: null }), false);
+  assert.notEqual(credentialKeyForDestination(basOnPremise), credentialKeyForDestination(cfOnPremise));
+
+  const cfKey = credentialKeyForDestination(cfOnPremise);
+  await storeDestinationCredentials(path, cfKey, { user: 'OVERRIDE', password: 'secret', mode: 'cf-connectivity' });
+  const stored = await readCredentials(path);
+  assert.equal(stored.destinations[cfKey].mode, 'cf-connectivity');
+  assert.equal(stored.destinations[cfKey].host, undefined);
+  await assert.rejects(
+    () => storeDestinationCredentials(path, 'INVALID', { user: 'U', password: 'P', mode: 'bypass-cloud-connector' }),
+    /route mode is unsupported/
+  );
+});
+
+test('relay direct connect sends Basic auth and CSRF pairing succeeds', async t => {
+  const { state, server } = authedBackend();
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  const backendUrl = `http://127.0.0.1:${server.address().port}`;
+  const relay = createBasDestinationRelay(
+    {
+      name: 'S4H',
+      url: 'http://S4H.dest',
+      authentication: 'BasicAuthentication',
+      credentials: { host: backendUrl, user: 'DEVELOPER', password: 'secret123' }
+    },
+    { env: { HTTP_PROXY: '' }, log: () => {} }
+  );
+  const relayUrl = await relay.ready;
+  t.after(async () => { await relay.close(); await new Promise(resolve => server.close(resolve)); });
+  try {
+    const read = await relayFetch(relayUrl, '/sap/bc/adt/discovery');
+    assert.equal(read.status, 200, 'authenticated read must succeed');
+    const write = await relayFetch(relayUrl, '/sap/bc/adt/datapreview/freestyle', { method: 'POST', body: '<q/>' });
+    assert.equal(write.status, 201, `CSRF-protected write must succeed, got ${write.status}: ${write.body}`);
+    const post = state.requests.find(request => request.method === 'POST');
+    assert.match(post.headers.authorization, /^Basic /);
+    assert.match(String(post.headers.cookie), /sap-session-\d+=/);
+    assert.equal(relay.stats.direct, true);
+  } finally {
+    void relayUrl;
+  }
+});
+
+test('relay direct connect with wrong credentials surfaces 401 without retries', async t => {
+  const { state, server } = authedBackend();
+  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+  const backendUrl = `http://127.0.0.1:${server.address().port}`;
+  const relay = createBasDestinationRelay(
+    {
+      name: 'S4H',
+      url: 'http://S4H.dest',
+      authentication: 'BasicAuthentication',
+      credentials: { host: backendUrl, user: 'DEVELOPER', password: 'wrong' }
+    },
+    { env: { HTTP_PROXY: '' }, log: () => {} }
+  );
+  const relayUrl = await relay.ready;
+  t.after(async () => { await relay.close(); await new Promise(resolve => server.close(resolve)); });
+  const write = await relayFetch(relayUrl, '/sap/bc/adt/datapreview/freestyle', { method: 'POST', body: '<q/>' });
+  assert.equal(write.status, 401);
+  assert.equal(relay.stats.csrfRetries, 0, '401 without a session must not trigger CSRF retries');
+  void state;
+});

package/test/discovery.test.mjs

@@ -10,7 +10,7 @@ test('normalizes destination metadata case-insensitively', () => {
   });
   assert.deepEqual(destination, {
     name: 'DEV-ABAP', authentication: 'PrincipalPropagation', client: '200',
-    url: 'http://DEV-ABAP.dest', rawKeys: ['Name', 'Properties']
+    url: 'http://DEV-ABAP.dest', backendUrl: 'https://backend.example', proxyType: null, rawKeys: ['Name', 'Properties']
   });
 });