sap-ai-dev-toolkit 0.9.3 → 0.9.5

package/scripts/windows-negotiate-helper.ps1

@@ -1,182 +0,0 @@
-# Windows Integrated Authentication helper for sap-ai-dev-toolkit.
-# Reads one JSON object from stdin with: url, challenge, mechanism.
-# Writes only the base64 Negotiate token to stdout.
-# Errors are written to stderr and exit non-zero.
-
-$ErrorActionPreference = 'Stop'
-
-$sspiSource = @'
-using System;
-using System.ComponentModel;
-using System.Runtime.InteropServices;
-
-public static class SapAiDevSspiNegotiate
-{
-    const int SECPKG_CRED_OUTBOUND = 2;
-    const int SECBUFFER_VERSION = 0;
-    const int SECBUFFER_TOKEN = 2;
-    const int SECURITY_NATIVE_DREP = 0x10;
-    const int SEC_E_OK = 0;
-    const int SEC_I_CONTINUE_NEEDED = 0x00090312;
-
-    [StructLayout(LayoutKind.Sequential)]
-    struct SecHandle
-    {
-        public IntPtr dwLower;
-        public IntPtr dwUpper;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    struct SecBuffer
-    {
-        public int cbBuffer;
-        public int BufferType;
-        public IntPtr pvBuffer;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    struct SecBufferDesc
-    {
-        public int ulVersion;
-        public int cBuffers;
-        public IntPtr pBuffers;
-    }
-
-    [StructLayout(LayoutKind.Sequential)]
-    struct SECURITY_INTEGER
-    {
-        public uint LowPart;
-        public int HighPart;
-    }
-
-    [DllImport("secur32.dll", CharSet = CharSet.Unicode, SetLastError = false)]
-    static extern int AcquireCredentialsHandle(
-        string pszPrincipal,
-        string pszPackage,
-        int fCredentialUse,
-        IntPtr pvLogonID,
-        IntPtr pAuthData,
-        IntPtr pGetKeyFn,
-        IntPtr pvGetKeyArgument,
-        out SecHandle phCredential,
-        out SECURITY_INTEGER ptsExpiry);
-
-    [DllImport("secur32.dll", CharSet = CharSet.Unicode, SetLastError = false)]
-    static extern int InitializeSecurityContext(
-        ref SecHandle phCredential,
-        IntPtr phContext,
-        string pszTargetName,
-        int fContextReq,
-        int Reserved1,
-        int TargetDataRep,
-        IntPtr pInput,
-        int Reserved2,
-        out SecHandle phNewContext,
-        IntPtr pOutput,
-        out int pfContextAttr,
-        out SECURITY_INTEGER ptsExpiry);
-
-    [DllImport("secur32.dll", SetLastError = false)]
-    static extern int FreeCredentialsHandle(ref SecHandle phCredential);
-
-    [DllImport("secur32.dll", SetLastError = false)]
-    static extern int DeleteSecurityContext(ref SecHandle phContext);
-
-    static void Check(int status, string operation)
-    {
-        if (status == SEC_E_OK || status == SEC_I_CONTINUE_NEEDED) return;
-        throw new Win32Exception(status, operation + " failed with SSPI status 0x" + status.ToString("X8"));
-    }
-
-    static IntPtr BufferDesc(byte[] token, out IntPtr tokenMemory, out IntPtr bufferMemory)
-    {
-        tokenMemory = IntPtr.Zero;
-        SecBuffer buffer = new SecBuffer();
-        buffer.BufferType = SECBUFFER_TOKEN;
-        if (token != null && token.Length > 0)
-        {
-            tokenMemory = Marshal.AllocHGlobal(token.Length);
-            Marshal.Copy(token, 0, tokenMemory, token.Length);
-            buffer.cbBuffer = token.Length;
-            buffer.pvBuffer = tokenMemory;
-        }
-        bufferMemory = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(SecBuffer)));
-        Marshal.StructureToPtr(buffer, bufferMemory, false);
-        SecBufferDesc desc = new SecBufferDesc();
-        desc.ulVersion = SECBUFFER_VERSION;
-        desc.cBuffers = 1;
-        desc.pBuffers = bufferMemory;
-        IntPtr descMemory = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(SecBufferDesc)));
-        Marshal.StructureToPtr(desc, descMemory, false);
-        return descMemory;
-    }
-
-    static void FreeDesc(IntPtr descMemory, IntPtr tokenMemory, IntPtr bufferMemory)
-    {
-        if (descMemory != IntPtr.Zero) Marshal.FreeHGlobal(descMemory);
-        if (bufferMemory != IntPtr.Zero) Marshal.FreeHGlobal(bufferMemory);
-        if (tokenMemory != IntPtr.Zero) Marshal.FreeHGlobal(tokenMemory);
-    }
-
-    public static string CreateToken(string targetName, string incomingBase64)
-    {
-        SecHandle credential;
-        SECURITY_INTEGER expiry;
-        int status = AcquireCredentialsHandle(null, "Negotiate", SECPKG_CRED_OUTBOUND, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, out credential, out expiry);
-        Check(status, "AcquireCredentialsHandle");
-
-        SecHandle context = new SecHandle();
-        IntPtr inputDesc = IntPtr.Zero, inputToken = IntPtr.Zero, inputBuffer = IntPtr.Zero;
-        IntPtr outputDesc = IntPtr.Zero, outputToken = IntPtr.Zero, outputBuffer = IntPtr.Zero;
-        try
-        {
-            byte[] incoming = null;
-            if (!String.IsNullOrWhiteSpace(incomingBase64)) incoming = Convert.FromBase64String(incomingBase64);
-            if (incoming != null && incoming.Length > 0) inputDesc = BufferDesc(incoming, out inputToken, out inputBuffer);
-
-            outputDesc = BufferDesc(new byte[12288], out outputToken, out outputBuffer);
-            int attrs;
-            status = InitializeSecurityContext(ref credential, IntPtr.Zero, targetName, 0, 0, SECURITY_NATIVE_DREP, inputDesc, 0, out context, outputDesc, out attrs, out expiry);
-            Check(status, "InitializeSecurityContext");
-
-            SecBuffer outBuffer = (SecBuffer) Marshal.PtrToStructure(outputBuffer, typeof(SecBuffer));
-            if (outBuffer.cbBuffer <= 0 || outBuffer.pvBuffer == IntPtr.Zero) throw new Exception("SSPI returned an empty Negotiate token.");
-            byte[] bytes = new byte[outBuffer.cbBuffer];
-            Marshal.Copy(outBuffer.pvBuffer, bytes, 0, bytes.Length);
-            return Convert.ToBase64String(bytes);
-        }
-        finally
-        {
-            FreeDesc(inputDesc, inputToken, inputBuffer);
-            FreeDesc(outputDesc, outputToken, outputBuffer);
-            DeleteSecurityContext(ref context);
-            FreeCredentialsHandle(ref credential);
-        }
-    }
-}
-'@
-
-try {
-  $raw = [Console]::In.ReadToEnd()
-  if ([string]::IsNullOrWhiteSpace($raw)) { throw 'Missing helper request on stdin.' }
-  $request = $raw | ConvertFrom-Json
-  if (-not $request.url) { throw 'Missing target URL.' }
-
-  $uri = [Uri] [string] $request.url
-  if ($uri.Scheme -ne 'http' -and $uri.Scheme -ne 'https') { throw 'Target URL must use HTTP or HTTPS.' }
-  if ($uri.UserInfo) { throw 'Target URL must not contain user information.' }
-
-  Add-Type -TypeDefinition $sspiSource -Language CSharp
-
-  $incoming = $null
-  $challenge = [string] $request.challenge
-  if ($challenge -match '(?i)Negotiate\s+([^,\s]+)') { $incoming = $Matches[1] }
-  $targetName = 'HTTP/' + $uri.DnsSafeHost
-  $token = [SapAiDevSspiNegotiate]::CreateToken($targetName, $incoming)
-  if ([string]::IsNullOrWhiteSpace($token)) { throw 'Negotiate token generation returned an empty token.' }
-  [Console]::Out.WriteLine($token.Trim())
-  exit 0
-} catch {
-  [Console]::Error.WriteLine($_.Exception.Message)
-  exit 1
-}

package/src/windows-sso-adt-proxy.mjs

@@ -1,257 +0,0 @@
-import http from 'node:http';
-import { once } from 'node:events';
-import { execFile as nodeExecFile } from 'node:child_process';
-import { dirname, join } from 'node:path';
-import { fileURLToPath } from 'node:url';
-
-const MAX_HELPER_OUTPUT = 1024 * 1024;
-const HOP_BY_HOP = new Set(['connection', 'keep-alive', 'proxy-authenticate', 'proxy-authorization', 'te', 'trailer', 'transfer-encoding', 'upgrade']);
-const root = dirname(dirname(fileURLToPath(import.meta.url)));
-
-function safeError(message) { return new Error(message); }
-
-function validateTarget(value) {
-  let url;
-  try { url = new URL(value); }
-  catch { throw safeError('Windows SSO target ADT URL is invalid'); }
-  if (!['http:', 'https:'].includes(url.protocol) || !url.hostname || url.username || url.password) {
-    throw safeError('Windows SSO target ADT URL must be an HTTP(S) URL without embedded user information');
-  }
-  url.hash = '';
-  return url;
-}
-
-function hasNegotiateChallenge(headers) {
-  const value = headers.get?.('www-authenticate') || '';
-  return /(?:^|,)\s*Negotiate\b/i.test(value);
-}
-
-function headerObject(headers) {
-  const result = {};
-  for (const [name, value] of Object.entries(headers || {})) {
-    const lower = name.toLowerCase();
-    if (HOP_BY_HOP.has(lower) || lower === 'host') continue;
-    if (lower === 'authorization') continue;
-    if (value == null) continue;
-    result[name] = Array.isArray(value) ? value.join(', ') : String(value);
-  }
-  return result;
-}
-
-function copyResponseHeaders(response, { proxyOrigin, targetOrigin } = {}) {
-  const headers = {};
-  for (const [name, value] of response.headers) {
-    const lower = name.toLowerCase();
-    if (HOP_BY_HOP.has(lower) || ['content-encoding', 'content-length', 'set-cookie'].includes(lower)) continue;
-    // fetch exposes decompressed bytes, so upstream framing is no longer valid.
-    if (lower === 'location' && proxyOrigin && targetOrigin) {
-      try {
-        const location = new URL(value, targetOrigin);
-        if (location.origin === targetOrigin) {
-          headers[name] = `${proxyOrigin}${location.pathname}${location.search}${location.hash}`;
-          continue;
-        }
-      } catch {
-        // Keep unparsable Location values unchanged; the client/backend can decide.
-      }
-    }
-    headers[name] = value;
-  }
-  const cookies = setCookies(response.headers);
-  if (cookies.length) headers['set-cookie'] = cookies;
-  return headers;
-}
-
-function setCookies(headers) {
-  if (typeof headers?.getSetCookie === 'function') return headers.getSetCookie();
-  const value = headers?.get?.('set-cookie');
-  return value ? [value] : [];
-}
-
-function mergeCookieHeader(existing, cookies) {
-  const pairs = new Map();
-  for (const part of String(existing || '').split(';')) {
-    const trimmed = part.trim();
-    const index = trimmed.indexOf('=');
-    if (index > 0) pairs.set(trimmed.slice(0, index), trimmed.slice(index + 1));
-  }
-  for (const cookie of cookies || []) {
-    const first = String(cookie || '').split(';', 1)[0]?.trim();
-    const index = first.indexOf('=');
-    if (index > 0) pairs.set(first.slice(0, index), first.slice(index + 1));
-  }
-  return [...pairs].map(([name, value]) => `${name}=${value}`).join('; ');
-}
-
-async function readRequestBody(req, limit = 50 * 1024 * 1024) {
-  if (['GET', 'HEAD'].includes(req.method || 'GET')) return undefined;
-  const chunks = [];
-  let size = 0;
-  for await (const chunk of req) {
-    size += chunk.length;
-    if (size > limit) throw safeError('Windows SSO proxy request body is too large');
-    chunks.push(chunk);
-  }
-  return Buffer.concat(chunks);
-}
-
-function helperCommand(env) {
-  const command = env.SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER || env.SAP_AI_DEV_TOOLKIT_SSPI_HELPER;
-  if (command) return { command, args: [] };
-  if (process.platform !== 'win32') return null;
-  const interactiveCredentialUi = env.SAP_AI_DEV_TOOLKIT_WINDOWS_CREDENTIAL_UI === 'true' || env.SAP_WINDOWS_CREDENTIAL_UI === 'true';
-  return {
-    command: env.SystemRoot ? join(env.SystemRoot, 'System32', 'WindowsPowerShell', 'v1.0', 'powershell.exe') : 'powershell.exe',
-    args: ['-NoLogo', '-NoProfile', ...(interactiveCredentialUi ? [] : ['-NonInteractive']), '-ExecutionPolicy', 'Bypass', '-File', join(root, 'scripts', 'windows-negotiate-helper.ps1')]
-  };
-}
-
-function tokenLooksLikeNtlm(token) {
-  try {
-    return Buffer.from(token, 'base64').subarray(0, 8).toString('ascii') === 'NTLMSSP\0';
-  } catch {
-    return false;
-  }
-}
-
-function execHelper(helper, payload, execFileImpl = nodeExecFile, env = process.env) {
-  return new Promise((resolve, reject) => {
-    const child = execFileImpl(helper.command, helper.args, {
-      windowsHide: true,
-      timeout: 30_000,
-      maxBuffer: MAX_HELPER_OUTPUT,
-      env: { ...process.env, ...env }
-    }, (error, stdout) => {
-      // execFile errors can contain helper stdout/stderr, including tokens.
-      if (error) return reject(safeError('Windows SSO helper failed; verify the ADT endpoint supports HTTP Negotiate/SPNEGO for the signed-in Windows identity (including smart-card-backed Windows logon) and that Kerberos/SPN configuration is correct. The toolkit cannot prompt for or accept manually pasted bearer/SAML tokens.'));
-      const token = String(stdout || '').trim();
-      if (!/^[A-Za-z0-9+/=_-]+$/.test(token)) return reject(safeError('Windows SSO helper returned an invalid Negotiate token'));
-      if (tokenLooksLikeNtlm(token)) return reject(safeError('Windows SSO helper returned an NTLM token. ADT SSO requires Kerberos/SPNEGO; verify the backend SPN and Kerberos configuration, or rerun sap-ai-dev --setup and choose username/password.'));
-      resolve(token);
-    });
-    child.stdin?.end(`${JSON.stringify(payload)}\n`);
-  });
-}
-
-async function acquireNegotiateToken({ targetUrl, challenge, env, execFileImpl }) {
-  const helper = helperCommand(env);
-  if (!helper) {
-    throw safeError('Windows SSO requires an SSPI/Negotiate helper that uses the current Windows logon session (including smart-card-backed logon). Set SAP_AI_DEV_TOOLKIT_NEGOTIATE_HELPER to a trusted helper executable, or rerun sap-ai-dev --setup and choose username/password. Manual token entry is not supported.');
-  }
-  return execHelper(helper, { url: targetUrl, challenge, mechanism: 'Negotiate' }, execFileImpl, env);
-}
-
-function basicFallbackCredentials(env) {
-  const mode = String(env.SAP_AUTH_FALLBACK_MODE || env.SAP_AI_DEV_TOOLKIT_AUTH_FALLBACK_MODE || '').toLowerCase();
-  const enabled = mode === 'basic' || env.SAP_AI_DEV_TOOLKIT_SSO_BASIC_FALLBACK === 'true';
-  const user = String(env.SAP_USER || env.SAP_USERNAME || '').trim();
-  const password = String(env.SAP_PASSWORD || env.SAP_PASS || '');
-  if (!enabled || !user || !password) return null;
-  return { user, password };
-}
-
-function hasBasicChallenge(headers) {
-  const value = headers.get?.('www-authenticate') || '';
-  return /(?:^|,)\s*Basic\b/i.test(value);
-}
-
-async function retryWithBasicFallback({ req, target, headers, body, fetchImpl, env }) {
-  const credentials = basicFallbackCredentials(env);
-  if (!credentials) return null;
-  return forward(req, target, {
-    ...headers,
-    Authorization: `Basic ${Buffer.from(`${credentials.user}:${credentials.password}`).toString('base64')}`
-  }, body, fetchImpl);
-}
-
-async function forward(req, targetUrl, headers, body, fetchImpl) {
-  return fetchImpl(targetUrl, {
-    method: req.method,
-    headers,
-    body,
-    duplex: body ? 'half' : undefined,
-    redirect: 'manual'
-  });
-}
-
-function writeFetchResponse(res, response, base, proxyOrigin) {
-  res.writeHead(response.status, response.statusText, copyResponseHeaders(response, { proxyOrigin, targetOrigin: base.origin }));
-  if (!response.body) return res.end();
-  response.body.pipeTo(new WritableStream({
-    write(chunk) { res.write(chunk); },
-    close() { res.end(); },
-    abort() { res.destroy(); }
-  })).catch(() => res.destroy());
-}
-
-export async function createWindowsSsoAdtProxy({ destinationUrl, env = process.env, fetchImpl = globalThis.fetch, execFileImpl = nodeExecFile } = {}) {
-  if (process.platform !== 'win32' && env.SAP_AI_DEV_TOOLKIT_ALLOW_SSO_PROXY_ON_NON_WINDOWS !== 'true') {
-    throw safeError('Windows SSO for local ADT destinations is only supported on Windows');
-  }
-  if (typeof fetchImpl !== 'function') throw safeError('HTTP fetch implementation is unavailable');
-  const base = validateTarget(destinationUrl);
-  const sockets = new Set();
-  let closed = false;
-  let proxyOrigin = '';
-
-  const server = http.createServer(async (req, res) => {
-    if (closed) return res.destroy();
-    let target;
-    try {
-      target = new URL(req.url || '/', base);
-      if (target.origin !== base.origin) throw safeError('Cross-origin Windows SSO proxy request rejected');
-      const headers = headerObject(req.headers);
-      const body = await readRequestBody(req);
-      let response = await forward(req, target, headers, body, fetchImpl);
-      if (response.status === 401 && hasNegotiateChallenge(response.headers)) {
-        const challenge = response.headers.get('www-authenticate') || '';
-        const cookies = mergeCookieHeader(headers.cookie || headers.Cookie, setCookies(response.headers));
-        const cancel = response.body?.cancel?.();
-        await cancel?.catch?.(() => {});
-        try {
-          const token = await acquireNegotiateToken({ targetUrl: target.href, challenge, env, execFileImpl });
-          const retryHeaders = { ...headers, Authorization: `Negotiate ${token}` };
-          delete retryHeaders.cookie;
-          delete retryHeaders.Cookie;
-          if (cookies) retryHeaders.Cookie = cookies;
-          response = await forward(req, target, retryHeaders, body, fetchImpl);
-        } catch (error) {
-          response = await retryWithBasicFallback({ req, target, headers: { ...headers, ...(cookies ? { Cookie: cookies } : {}) }, body, fetchImpl, env });
-          if (!response) throw error;
-        }
-      } else if (response.status === 401 && hasBasicChallenge(response.headers) && basicFallbackCredentials(env)) {
-        const cancel = response.body?.cancel?.();
-        await cancel?.catch?.(() => {});
-        response = await retryWithBasicFallback({ req, target, headers, body, fetchImpl, env }) || response;
-      }
-      writeFetchResponse(res, response, base, proxyOrigin);
-    } catch (error) {
-      if (!res.headersSent) {
-        res.writeHead(502, { 'content-type': 'text/plain; charset=utf-8', connection: 'close' });
-        res.end(`${error.message || 'Windows SSO proxy request failed'}\n`);
-      } else {
-        res.destroy();
-      }
-    }
-  });
-
-  server.on('connection', socket => {
-    sockets.add(socket);
-    socket.on('close', () => sockets.delete(socket));
-  });
-
-  server.listen(0, '127.0.0.1');
-  await once(server, 'listening');
-  const address = server.address();
-  proxyOrigin = `http://127.0.0.1:${address.port}`;
-  return {
-    url: proxyOrigin,
-    close: async () => {
-      if (closed) return;
-      closed = true;
-      for (const socket of sockets) socket.destroy();
-      server.close();
-      await once(server, 'close').catch(() => {});
-    }
-  };
-}