sap-ai-dev-toolkit 0.3.1 → 0.3.4

package/test/launcher.test.mjs

@@ -7,6 +7,8 @@ import { chmod, mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { spawnWithPty } from './pty.mjs';
+import { storeDestinationCredentials } from '../src/credentials-store.mjs';
+import { credentialKeyForDestination, enrichWithStoredCredentials } from '../src/credential-overrides.mjs';
 
 const launcher = fileURLToPath(new URL('../src/launcher.mjs', import.meta.url));
 const fakeVsp = fileURLToPath(new URL('./fixtures/fake-vsp.mjs', import.meta.url));
@@ -43,6 +45,56 @@ function runLauncherTty(env, input, args = ['--setup']) {
   });
 }
 
+test('enriches stored credentials without switching BAS OnPremise or CF Connectivity routes', async t => {
+  const directory = await mkdtemp(join(tmpdir(), 'bas-launcher-credentials-'));
+  const credentialsPath = join(directory, 'credentials.json');
+  t.after(async () => { await rm(directory, { recursive: true, force: true }); });
+
+  const internet = {
+    name: 'internet-system', url: 'http://internet-system.dest', backendUrl: 'https://internet.example:44300',
+    authentication: 'BasicAuthentication', proxyType: 'Internet'
+  };
+  const basOnPremise = {
+    name: 'shared-system', url: 'http://shared-system.dest', backendUrl: 'https://internal.example:44300',
+    authentication: 'BasicAuthentication', proxyType: 'OnPremise'
+  };
+  const cfOnPremise = {
+    source: 'cloud-foundry', name: 'shared-system', serverName: 'cf:space-one:instance-one:shared-system',
+    url: 'https://sap.internal:44300', authentication: 'BasicAuthentication', proxyType: 'OnPremise',
+    childEnv: { HTTP_PROXY: 'http://127.0.0.1:3333', SAP_USER: 'configured-user', SAP_PASSWORD: 'configured-password' }
+  };
+  const principalPropagation = { ...cfOnPremise, name: 'principal-system', serverName: 'cf:space-one:instance-one:principal-system', authentication: 'PrincipalPropagation' };
+
+  await storeDestinationCredentials(credentialsPath, 'internet-system', {
+    host: internet.backendUrl, user: 'INTERNET_USER', password: 'internet-secret'
+  });
+  await storeDestinationCredentials(credentialsPath, 'shared-system', {
+    user: 'BAS_USER', password: 'bas-secret', mode: 'bas-tunnel'
+  });
+  await storeDestinationCredentials(credentialsPath, credentialKeyForDestination(cfOnPremise), {
+    user: 'CF_USER', password: 'cf-secret', mode: 'cf-connectivity'
+  });
+  await storeDestinationCredentials(credentialsPath, credentialKeyForDestination(principalPropagation), {
+    user: 'SHOULD_NOT_APPLY', password: 'pp-secret', mode: 'cf-connectivity'
+  });
+
+  const result = await enrichWithStoredCredentials(
+    [internet, basOnPremise, cfOnPremise, principalPropagation],
+    { SAP_AI_DEV_TOOLKIT_CREDENTIALS_FILE: credentialsPath },
+    () => {}
+  );
+  assert.deepEqual(result[0].credentials, {
+    host: internet.backendUrl, user: 'INTERNET_USER', password: 'internet-secret', mode: 'direct'
+  });
+  assert.deepEqual(result[1].credentials, { user: 'BAS_USER', password: 'bas-secret', mode: 'bas-tunnel' });
+  assert.equal(result[1].credentials.host, undefined, 'OnPremise must not bypass the BAS destination route');
+  assert.deepEqual(result[2].childEnv, {
+    HTTP_PROXY: 'http://127.0.0.1:3333', SAP_USER: 'CF_USER', SAP_PASSWORD: 'cf-secret', SAP_VERBOSE: 'false'
+  });
+  assert.equal(result[3].childEnv.SAP_USER, 'configured-user', 'PrincipalPropagation must not receive a Basic override');
+  assert.equal(result[3].childEnv.SAP_PASSWORD, 'configured-password');
+});
+
 test('help exits before BAS destination discovery', async t => {
   let requests = 0;
   const server = createServer((_request, response) => {

package/test/mcp-proxy.test.mjs

@@ -47,6 +47,57 @@ test('uses authentication-specific arguments for Cloud Foundry children', () =>
   assert.equal(childArguments(principal, {}).includes('--proxy-auth'), true);
 });
 
+test('self-heals BAS destinations through a local destination relay without credentials', async t => {
+  const destination = { name: 'S4H', url: 'http://S4H.dest', client: '100', authentication: 'BasicAuthentication', proxyType: 'Internet' };
+  const directory = await mkdtemp(join(tmpdir(), 'bas-relay-'));
+  const log = join(directory, 'children.log');
+  const logs = [];
+  const proxy = new MCPProxy({ binary: fixture, destinations: [destination], env: { ...process.env, FAKE_LOG: log }, log: message => logs.push(message) });
+  t.after(async () => { await proxy.close(); await rm(directory, { recursive: true, force: true }); });
+  proxy.start();
+  await proxy.handle({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
+  const event = (await readFile(log, 'utf8')).trim().split('\n').map(line => JSON.parse(line)).find(row => row.event === 'initialize');
+  assert.equal(event.argv.includes('--proxy-auth'), true);
+  assert.match(event.argv[event.argv.indexOf('--url') + 1], /^http:\/\/127\.0\.0\.1:\d+$/);
+  assert.equal(event.env.user, undefined);
+  assert.equal(event.env.password, undefined);
+  assert.ok(logs.some(message => message.includes('BAS destination relay enabled')));
+});
+
+test('self-heals BAS relay children with loopback NO_PROXY and keeps --proxy-auth', async t => {
+  const destination = { name: 'S4H', url: 'http://S4H.dest', client: '100', authentication: 'BasicAuthentication', proxyType: 'Internet' };
+  const directory = await mkdtemp(join(tmpdir(), 'bas-relay-env-'));
+  const log = join(directory, 'children.log');
+  const proxy = new MCPProxy({ binary: fixture, destinations: [destination], env: { ...process.env, FAKE_LOG: log }, log: () => {} });
+  t.after(async () => { await proxy.close(); await rm(directory, { recursive: true, force: true }); });
+  proxy.start();
+  await proxy.handle({ jsonrpc: '2.0', id: 1, method: 'initialize', params: {} });
+  const event = (await readFile(log, 'utf8')).trim().split('\n').map(line => JSON.parse(line)).find(row => row.event === 'initialize');
+  assert.equal(event.argv.includes('--proxy-auth'), true);
+  const noProxy = String(event.env.noProxy || '').split(',').map(value => value.trim().toLowerCase());
+  assert.ok(noProxy.includes('127.0.0.1'), `NO_PROXY must exempt the relay loopback: ${event.env.noProxy}`);
+  assert.ok(noProxy.includes('localhost'), `NO_PROXY must exempt relay localhost: ${event.env.noProxy}`);
+});
+
+test('restarts a crashed VSP child and retries the tool call once', async t => {
+  const { directory, log, proxy } = await fixtureProxy();
+  t.after(async () => { await proxy.close(); await rm(directory, { recursive: true, force: true }); });
+  await proxy.handle({ jsonrpc: '2.0', id: 1, method: 'initialize', params: { protocolVersion: '2024-11-05' } });
+  await proxy.handle({ jsonrpc: '2.0', id: 2, method: 'tools/list', params: {} });
+  const entry = proxy.children[0];
+  const originalChild = entry.child;
+  // Kill the child behind the proxy's back to simulate a crash.
+  const exit = once(originalChild.process, 'exit');
+  originalChild.process.kill('SIGKILL');
+  await exit;
+  const response = await proxy.handle({ jsonrpc: '2.0', id: 3, method: 'tools/call', params: { name: 'alpha__GetSystemInfo', arguments: {} } });
+  assert.equal(response?.error, undefined, `self-healing must recover the call: ${JSON.stringify(response?.error)}`);
+  assert.notEqual(proxy.children[0].child, originalChild, 'a replacement child must have been spawned');
+  const events = (await readFile(log, 'utf8')).trim().split('\n').map(line => JSON.parse(line));
+  assert.ok(events.some(row => row.event === 'initialize' && row.destination === 'alpha'), 'replacement child must re-initialize');
+  assert.ok(events.some(row => row.event === 'call' && row.name === 'GetSystemInfo'), 'the retried call must reach the child');
+});
+
 test('closes each Cloud Foundry route after child exit and on startup failure', async t => {
   const directory = await mkdtemp(join(tmpdir(), 'bas-cf-child-lifecycle-'));
   const log = join(directory, 'children.log');
@@ -89,7 +140,8 @@ test('closes each Cloud Foundry route after child exit and on startup failure',
     spawn: () => { throw new Error('spawn denied'); },
     log: () => {}
   });
-  assert.throws(() => failedProxy.start(), /No destination child could be started/);
+  failedProxy.start();
+  await assert.rejects(() => failedProxy.starting, /No destination child could be started/);
   await new Promise(resolve => setImmediate(resolve));
   assert.equal(failedStartCloseCount, 1);
 });
@@ -302,9 +354,13 @@ test('returns JSON-RPC errors for unknown namespaces and logs child failures', a
   const child = proxy.children.find(entry => entry.destination.name === 'alpha').child;
   child.process.kill('SIGKILL');
   await new Promise(resolve => setTimeout(resolve, 25));
-  const failed = await proxy.handle({ jsonrpc: '2.0', id: 7, method: 'tools/call', params: { name: 'alpha__GetSource' } });
-  assert.equal(failed.error.code, -32001);
+  // A crashed child no longer fails the call: self-healing restarts it and
+  // retries once, so the request goes through to a fresh child.
+  const healed = await proxy.handle({ jsonrpc: '2.0', id: 7, method: 'tools/call', params: { name: 'alpha__GetSource' } });
+  assert.equal(healed?.error, undefined, `call must heal after child crash: ${JSON.stringify(healed?.error)}`);
+  assert.equal(healed.result.content[0].text, 'alpha:GetSource');
   assert.ok(logs.some(message => message.includes('alpha') && message.includes('tools/call GetSource failed')));
+  assert.ok(logs.some(message => message.includes('self-healing restart complete')), 'restart must be logged');
 });
 test('stdin EOF shuts down every child process and forwards child logs', async t => {
   const { directory, log, proxy } = await fixtureProxy();

package/test/setup-cf.test.mjs

@@ -6,6 +6,8 @@ import { join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { installMcpConfig } from '../src/mcp-config.mjs';
 import { destinationTable } from '../scripts/postinstall.mjs';
+import { readCredentials, resolveCredentialsPath, storeDestinationCredentials } from '../src/credentials-store.mjs';
+import { credentialKeyForDestination } from '../src/credential-overrides.mjs';
 import { spawnWithPty } from './pty.mjs';
 
 const setupModule = fileURLToPath(new URL('../src/setup.mjs', import.meta.url));
@@ -28,6 +30,22 @@ function cloudFoundryDestination({ name, serverName, instanceGuid, instanceName,
   };
 }
 
+function cloudFoundryOnPremiseDestination() {
+  const destination = cloudFoundryDestination({
+    name: 'shared-name',
+    serverName: 'cf:space-one:cf-destination:shared-name',
+    instanceGuid: 'cf-destination',
+    instanceName: 'destination-service',
+    keyName: 'destination-key'
+  });
+  destination.authentication = 'BasicAuthentication';
+  destination.proxyType = 'OnPremise';
+  destination.cf.connectivityInstanceGuid = 'cf-connectivity';
+  destination.cf.connectivityInstanceName = 'connectivity-service';
+  destination.cf.connectivityKeyName = 'connectivity-key';
+  return destination;
+}
+
 async function makeFixture(t, { version = 'cf version 8.18.0', space = 'space-one', deleteMode = 'success' } = {}) {
   const directory = await mkdtemp(join(tmpdir(), 'bas-cf-setup-'));
   const bin = join(directory, 'bin');
@@ -63,6 +81,7 @@ await runSetup({
     await writeFile(process.env.CF_DISCOVERY_LOG, JSON.stringify({ spaceGuid, managedKeys }));
     return JSON.parse(process.env.TEST_CF_RESULT);
   },
+  verifyOnPremCredentialRoute: async () => JSON.parse(process.env.TEST_ONPREM_CSRF_RESULT),
   ...(process.env.TEST_INSTALL_FAIL === 'true' ? {
     install: async () => { throw new Error('simulated config write failure'); }
   } : {})
@@ -81,13 +100,14 @@ await runSetup({
     TEST_CF_DELETE_MODE: deleteMode,
     TEST_INSTALL_FAIL: 'false',
     TEST_BAS_DESTINATIONS: JSON.stringify([]),
-    TEST_CF_RESULT: JSON.stringify({ destinations: [], createdKeys: [], warnings: [] })
+    TEST_CF_RESULT: JSON.stringify({ destinations: [], createdKeys: [], warnings: [] }),
+    TEST_ONPREM_CSRF_RESULT: JSON.stringify({ httpStatus: 200, tokenReceived: true, cookieCount: 1 })
   };
   t.after(() => rm(directory, { recursive: true, force: true }));
   return { directory, configPath, callLog, discoveryLog, harness, env };
 }
 
-function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}) {
+function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r', promptAnswers = [] } = {}) {
   return new Promise((resolve, reject) => {
     const command = `${JSON.stringify(process.execPath)} ${JSON.stringify(fixture.harness)}`;
     const child = spawnWithPty(command, { env: fixture.env, stdio: ['pipe', 'pipe', 'pipe'] });
@@ -95,6 +115,7 @@ function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}
     let stderr = '';
     let importSent = false;
     let selectionSent = false;
+    let promptAnswerIndex = 0;
     const timeout = setTimeout(() => child.kill('SIGKILL'), 15000);
     child.stdout.on('data', chunk => {
       stdout += chunk.toString();
@@ -104,7 +125,16 @@ function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}
       }
       if (!selectionSent && stdout.includes('Select destinations')) {
         selectionSent = true;
-        child.stdin.end(selection);
+        if (promptAnswers.length) child.stdin.write(selection);
+        else child.stdin.end(selection);
+      }
+      if (selectionSent && promptAnswerIndex < promptAnswers.length) {
+        const answer = promptAnswers[promptAnswerIndex];
+        if (stdout.includes(answer.when)) {
+          promptAnswerIndex++;
+          child.stdin.write(answer.value);
+          if (promptAnswerIndex === promptAnswers.length) child.stdin.end();
+        }
       }
     });
     child.stderr.on('data', chunk => { stderr += chunk.toString(); });
@@ -114,7 +144,7 @@ function runSetupInPty(fixture, { importAnswer = 'y\r', selection = ' \r' } = {}
     });
     child.on('exit', (code, signal) => {
       clearTimeout(timeout);
-      resolve({ code, signal, stdout, stderr, importSent, selectionSent });
+      resolve({ code, signal, stdout, stderr, importSent, selectionSent, promptAnswersSent: promptAnswerIndex });
     });
   });
 }
@@ -145,6 +175,7 @@ test('imports selected CF destinations, passes managed key references, and remov
   assert.equal(result.selectionSent, true, result.stdout);
   assert.match(result.stdout, /CF new-destination-service/);
   assert.match(result.stdout, /Configured 1 MCP server/);
+  assert.match(result.stdout, /GitHub Copilot Chat.*Chat tools picker.*enable each selected destination server/s);
   assert.doesNotMatch(`${result.stdout}\n${result.stderr}`, /SECRET|clientSecret|Password/);
 
   const snapshot = JSON.parse(await readFile(fixture.discoveryLog, 'utf8'));
@@ -163,6 +194,102 @@ test('imports selected CF destinations, passes managed key references, and remov
   assert.equal(calls.some(args => args.at(-1) === 'new-key'), false);
 });
 
+test('prompts for BAS and CF OnPremise overrides separately and keeps their routes distinct', async t => {
+  const fixture = await makeFixture(t);
+  const cfDestination = cloudFoundryOnPremiseDestination();
+  fixture.env.TEST_BAS_DESTINATIONS = JSON.stringify([
+    {
+      name: 'internet-system', url: 'http://internet-system.dest', backendUrl: 'https://internet.example:44300',
+      client: '100', authentication: 'BasicAuthentication', proxyType: 'Internet',
+      probe: { status: 'available', available: true }
+    },
+    {
+      name: 'shared-name', url: 'http://shared-name.dest', backendUrl: 'https://internal.example:44300',
+      client: '101', authentication: 'BasicAuthentication', proxyType: 'OnPremise',
+      probe: { status: 'available', available: true }
+    },
+    {
+      name: 'principal-system', url: 'http://principal-system.dest',
+      client: '102', authentication: 'PrincipalPropagation', proxyType: 'OnPremise',
+      probe: { status: 'available', available: true }
+    }
+  ]);
+  fixture.env.TEST_CF_RESULT = JSON.stringify({ destinations: [cfDestination], createdKeys: [], warnings: [] });
+
+  const result = await runSetupInPty(fixture, {
+    selection: 'a\r',
+    promptAnswers: [
+      { when: 'BAS Internet — internet-system — override SAP credentials?', value: 'y\r' },
+      { when: 'BAS Internet — internet-system — SAP user', value: 'INTERNET_USER\r' },
+      { when: 'BAS Internet — internet-system — SAP password', value: 'internet-password-secret\r' },
+      { when: 'BAS OnPremise — shared-name — override SAP credentials?', value: 'y\r' },
+      { when: 'BAS OnPremise — shared-name — SAP user', value: 'BAS_CC_USER\r' },
+      { when: 'BAS OnPremise — shared-name — SAP password', value: 'bas-cc-password-secret\r' },
+      { when: 'Cloud Foundry OnPremise — shared-name — override SAP credentials?', value: 'y\r' },
+      { when: 'Cloud Foundry OnPremise — shared-name — SAP user', value: 'CF_CC_USER\r' },
+      { when: 'Cloud Foundry OnPremise — shared-name — SAP password', value: 'cf-cc-password-secret\r' }
+    ]
+  });
+  assert.equal(result.code, 0, `${result.stdout}\n${result.stderr}`);
+  assert.equal(result.promptAnswersSent, 9, result.stdout);
+  assert.doesNotMatch(result.stdout, /PrincipalPropagation — principal-system — override SAP credentials/);
+  assert.doesNotMatch(`${result.stdout}\n${result.stderr}`, /internet-password-secret|bas-cc-password-secret|cf-cc-password-secret/);
+
+  const credentialsPath = await resolveCredentialsPath(fixture.env, fixture.configPath);
+  const stored = (await readCredentials(credentialsPath)).destinations;
+  assert.equal(stored['internet-system'].mode, 'direct');
+  assert.equal(stored['internet-system'].host, 'https://internet.example:44300');
+  assert.equal(stored['shared-name'].mode, 'bas-tunnel');
+  assert.equal(stored['shared-name'].host, undefined, 'BAS OnPremise must not store or use the backend URL');
+  const cfKey = credentialKeyForDestination(cfDestination);
+  assert.equal(stored[cfKey].mode, 'cf-connectivity');
+  assert.equal(stored[cfKey].host, undefined);
+  assert.deepEqual(
+    [stored['shared-name'].user, stored[cfKey].user],
+    ['BAS_CC_USER', 'CF_CC_USER'],
+    'same destination names from BAS and CF must remain distinct'
+  );
+
+  const mcpConfig = JSON.parse(await readFile(fixture.configPath, 'utf8'));
+  assert.equal(JSON.stringify(mcpConfig).includes('bas-cc-password-secret'), false);
+  assert.equal(JSON.stringify(mcpConfig).includes('cf-cc-password-secret'), false);
+});
+
+test('No removes a stored BAS OnPremise override and failed CSRF preflight refuses a new one', async t => {
+  const fixture = await makeFixture(t);
+  fixture.env.TEST_BAS_DESTINATIONS = JSON.stringify([{
+    name: 'shared-name', url: 'http://shared-name.dest', backendUrl: 'https://internal.example:44300',
+    client: '100', authentication: 'BasicAuthentication', proxyType: 'OnPremise',
+    probe: { status: 'available', available: true }
+  }]);
+  fixture.env.TEST_CF_RESULT = JSON.stringify({ destinations: [], createdKeys: [], warnings: [] });
+  const credentialsPath = await resolveCredentialsPath(fixture.env, fixture.configPath);
+  await storeDestinationCredentials(credentialsPath, 'shared-name', {
+    user: 'OLD_USER', password: 'old-password-secret', mode: 'bas-tunnel'
+  });
+
+  const declined = await runSetupInPty(fixture, {
+    selection: ' \r',
+    promptAnswers: [{ when: 'BAS OnPremise — shared-name — override SAP credentials?', value: 'n\r' }]
+  });
+  assert.equal(declined.code, 0, `${declined.stdout}\n${declined.stderr}`);
+  assert.equal((await readCredentials(credentialsPath)).destinations['shared-name'], undefined);
+
+  fixture.env.TEST_ONPREM_CSRF_RESULT = JSON.stringify({ httpStatus: 200, tokenReceived: true, cookieCount: 0 });
+  const rejected = await runSetupInPty(fixture, {
+    selection: ' \r',
+    promptAnswers: [
+      { when: 'BAS OnPremise — shared-name — override SAP credentials?', value: 'y\r' },
+      { when: 'BAS OnPremise — shared-name — SAP user', value: 'NEW_USER\r' },
+      { when: 'BAS OnPremise — shared-name — SAP password', value: 'new-password-secret\r' }
+    ]
+  });
+  assert.equal(rejected.code, 0, `${rejected.stdout}\n${rejected.stderr}`);
+  assert.match(rejected.stdout, /did not return both a CSRF token and session cookie/);
+  assert.equal((await readCredentials(credentialsPath)).destinations['shared-name'], undefined);
+  assert.doesNotMatch(`${rejected.stdout}\n${rejected.stderr}`, /new-password-secret/);
+});
+
 test('declining CF import keeps BAS setup and does not create CF keys', async t => {
   const fixture = await makeFixture(t);
   fixture.env.TEST_BAS_DESTINATIONS = JSON.stringify([{