sap-ai-dev-toolkit 0.9.9921 → 0.9.9923

package/src/datasphere-auth.mjs

@@ -0,0 +1,279 @@
+// XSUAA OAuth helpers: token requests (SAP Datasphere's x-sap-sac-custom-auth
+// convention by default; other XSUAA products through `profile`), an interactive
+// (authorization code + refresh token) provider, and the localhost
+// authorization-code login used by the sap-ai-dev setup wizards.
+import { execFile } from 'node:child_process';
+import { createServer } from 'node:http';
+import { randomBytes } from 'node:crypto';
+import { EnvHttpProxyAgent, fetch as undiciFetch } from 'undici';
+import { IntegrationError, readCapped } from './integration-http.mjs';
+
+const TOKEN_TIMEOUT_MS = 15_000;
+const TOKEN_MAX_BYTES = 64 * 1024;
+const REFRESH_MARGIN_MS = 15 * 60 * 1000;
+
+/** Product profile: names in messages, the setup command, and whether the SAC custom-auth convention applies. */
+export const DATASPHERE_OAUTH = Object.freeze({ product: 'Datasphere', setupCommand: 'sap-ai-dev --setup-datasphere', sacCustomAuth: true });
+
+function proxyDispatcher(env) {
+  const httpProxy = env?.HTTP_PROXY || env?.http_proxy;
+  const httpsProxy = env?.HTTPS_PROXY || env?.https_proxy;
+  if (!httpProxy && !httpsProxy) return undefined;
+  return new EnvHttpProxyAgent({ httpProxy, httpsProxy, noProxy: env?.NO_PROXY || env?.no_proxy });
+}
+
+/**
+ * POST the tenant token endpoint (Basic auth, form encoded). Custom `sb-` clients
+ * send no client_id in the body and require x-sap-sac-custom-auth; the response
+ * body is never surfaced. Returns { accessToken, refreshToken, expiresAt }.
+ */
+export async function requestDatasphereToken({
+  tokenUrl,
+  clientId,
+  clientSecret,
+  form,
+  fetchImpl = undiciFetch,
+  env = process.env,
+  timeoutMs = TOKEN_TIMEOUT_MS,
+  now = Date.now,
+  profile = DATASPHERE_OAUTH
+}) {
+  const body = profile.sacCustomAuth
+    ? new URLSearchParams({
+      ...form,
+      response_type: 'token',
+      ...(clientId.startsWith('sb-') ? {} : { client_id: clientId })
+    })
+    : new URLSearchParams(form);
+  const controller = new AbortController();
+  const dispatcher = proxyDispatcher(env);
+  let timer;
+  try {
+    const request = async () => {
+      const response = await fetchImpl(tokenUrl, {
+        method: 'POST',
+        headers: {
+          'content-type': 'application/x-www-form-urlencoded',
+          authorization: `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString('base64')}`,
+          ...(profile.sacCustomAuth && clientId.startsWith('sb-') ? { 'x-sap-sac-custom-auth': 'true' } : {})
+        },
+        body: body.toString(),
+        redirect: 'manual',
+        signal: controller.signal,
+        ...(dispatcher ? { dispatcher } : {})
+      });
+      if (response.status < 200 || response.status >= 300) {
+        void response.body?.cancel().catch(() => {});
+        throw new IntegrationError(`${profile.product} token request failed (HTTP ${response.status})`);
+      }
+      const bytes = await readCapped(response, TOKEN_MAX_BYTES, `${profile.product} token`, controller.signal);
+      let payload;
+      try {
+        payload = JSON.parse(new TextDecoder().decode(bytes));
+      } catch {
+        throw new IntegrationError(`${profile.product} token response was not valid JSON`);
+      }
+      if (typeof payload?.access_token !== 'string' || !payload.access_token) throw new IntegrationError(`${profile.product} token response contained no access token`);
+      const expiresInSeconds = Number(payload.expires_in);
+      return {
+        accessToken: payload.access_token,
+        refreshToken: typeof payload.refresh_token === 'string' && payload.refresh_token ? payload.refresh_token : undefined,
+        expiresAt: now() + (Number.isFinite(expiresInSeconds) ? expiresInSeconds : 0) * 1000
+      };
+    };
+    return await Promise.race([
+      request(),
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => {
+          controller.abort();
+          reject(new IntegrationError(`${profile.product} token request failed (timeout)`));
+        }, timeoutMs);
+      })
+    ]);
+  } catch (error) {
+    if (error instanceof IntegrationError) throw error;
+    throw new IntegrationError(`${profile.product} token request failed (${error?.name === 'AbortError' ? 'timeout' : 'network error'})`);
+  } finally {
+    clearTimeout(timer);
+    void dispatcher?.close().catch(() => {});
+  }
+}
+
+/**
+ * Single-flight token provider: technical clients use client_credentials;
+ * interactive clients refresh via grant_type=refresh_token
+ * when no token is cached or it expires within 15 minutes, keeps a rotated
+ * refresh token in memory, and hands it to persistRefreshToken.
+ */
+export function createDatasphereTokenProvider({ config, persistRefreshToken, fetchImpl, env = process.env, now = Date.now, profile = DATASPHERE_OAUTH }) {
+  let current = null;
+  let refreshPromise = null;
+  const interactive = config.auth !== 'technical';
+  const sessionExpired = `${profile.product} interactive session expired or was revoked; rerun ${profile.setupCommand} to sign in again.`;
+
+  const refresh = async () => {
+    const refreshToken = current?.refreshToken || config.refreshToken;
+    if (interactive && !refreshToken) {
+      throw new IntegrationError(sessionExpired);
+    }
+    try {
+      const token = await requestDatasphereToken({
+        tokenUrl: config.tokenUrl,
+        clientId: config.clientId,
+        clientSecret: config.clientSecret,
+        form: interactive
+          ? { grant_type: 'refresh_token', refresh_token: refreshToken }
+          : { grant_type: 'client_credentials' },
+        ...(fetchImpl ? { fetchImpl } : {}),
+        env,
+        now,
+        profile
+      });
+      current = { ...token, refreshToken: token.refreshToken || refreshToken };
+      if (token.refreshToken && token.refreshToken !== refreshToken && persistRefreshToken) {
+        await persistRefreshToken(token.refreshToken);
+      }
+      return current;
+    } catch (error) {
+      if (!interactive) throw error;
+      if (error instanceof IntegrationError && error.message.startsWith(`${profile.product} interactive session`)) throw error;
+      throw new IntegrationError(sessionExpired);
+    }
+  };
+
+  return {
+    async token() {
+      if (current && current.expiresAt - now() >= REFRESH_MARGIN_MS) return current;
+      if (!refreshPromise) {
+        refreshPromise = refresh().finally(() => {
+          refreshPromise = null;
+        });
+      }
+      return refreshPromise;
+    }
+  };
+}
+
+export const createInteractiveTokenProvider = createDatasphereTokenProvider;
+
+/** Best-effort platform browser open; every failure is ignored. */
+export function openInBrowser(url, { execFileImpl = execFile } = {}) {
+  const platform = process.platform;
+  if (platform === 'darwin') execFileImpl('open', [url], () => {});
+  else if (platform === 'win32') execFileImpl('cmd', ['/c', 'start', '', url], () => {});
+  else execFileImpl('xdg-open', [url], () => {});
+}
+
+function extractCode(text, state, product) {
+  const trimmed = String(text || '').trim();
+  if (!trimmed) return '';
+  let url;
+  try { url = new URL(trimmed); } catch { return trimmed; }
+  if (url.searchParams.get('state') !== state) throw new IntegrationError(`${product} sign-in callback state did not match this login.`);
+  if (url.searchParams.has('error')) throw new IntegrationError(`${product} sign-in was denied or failed.`);
+  return url.searchParams.get('code') || '';
+}
+
+/**
+ * Interactive sign-in: build the authorize URL, capture the redirect `code`
+ * (browser mode on localhost:<port>, or a pasted URL/code), and exchange it.
+ */
+export async function authorizationCodeLogin({
+  config,
+  mode,
+  port = 8080,
+  openUrl,
+  promptPaste,
+  timeoutMs = 120_000,
+  fetchImpl,
+  env = process.env,
+  now = Date.now,
+  profile = DATASPHERE_OAUTH
+}) {
+  const product = profile.product;
+  const state = randomBytes(32).toString('hex');
+  const authorize = new URL(config.authorizationUrl);
+  authorize.searchParams.set('response_type', 'code');
+  authorize.searchParams.set('client_id', config.clientId);
+  authorize.searchParams.set('state', state);
+  const authorizeUrl = authorize.href;
+  const openAuthorizationUrl = () => {
+    try {
+      const opened = openUrl?.(authorizeUrl);
+      if (opened && typeof opened.then === 'function') opened.catch(() => {});
+    } catch {
+      // Opening the browser is best-effort; the caller can print the URL.
+    }
+  };
+  let code;
+  if (mode === 'browser') {
+    const server = createServer((request, response) => {
+      const callback = new URL(request.url || '/', `http://localhost:${port}`);
+      response.setHeader('content-type', 'text/html; charset=utf-8');
+      response.setHeader('cache-control', 'no-store');
+      response.setHeader('content-security-policy', "default-src 'none'; frame-ancestors 'none'");
+      if (request.method !== 'GET' || callback.pathname !== '/') {
+        response.writeHead(404);
+        response.end('Not found.');
+        return;
+      }
+      if (callback.searchParams.get('state') !== state) {
+        response.writeHead(400);
+        response.end(`This callback does not belong to the current ${product} login.`);
+        return;
+      }
+      if (callback.searchParams.has('error')) {
+        response.writeHead(400);
+        response.end(`${product} sign-in was denied or failed. Return to your terminal.`);
+        server.emit('datasphere-code', new IntegrationError(`${product} sign-in was denied or failed.`));
+        return;
+      }
+      const query = callback.searchParams.get('code');
+      if (!query) {
+        response.writeHead(400);
+        response.end(`No ${product} authorization code was received.`);
+        return;
+      }
+      response.writeHead(200);
+      response.end(`<!doctype html><html><body><p>Authorization received. Return to your terminal to confirm the ${product} connection.</p></body></html>`);
+      server.emit('datasphere-code', query);
+    });
+    try {
+      code = await new Promise((resolve, reject) => {
+        const finish = (error, value) => {
+          clearTimeout(timer);
+          server.removeListener('datasphere-code', onCode);
+          if (error) reject(error);
+          else resolve(value);
+        };
+        const onCode = value => value instanceof Error ? finish(value) : finish(null, value);
+        const timer = setTimeout(
+          () => finish(new IntegrationError(`No authorization code arrived within ${Math.round(timeoutMs / 1000)} s. Check that the OAuth client redirect URI is http://localhost:${port}.`)),
+          timeoutMs
+        );
+        server.on('datasphere-code', onCode);
+        server.on('error', error => finish(new IntegrationError(`${product} local login server could not listen on localhost:${port}: ${error?.code || 'error'}`)));
+        server.listen(port, 'localhost', openAuthorizationUrl);
+      });
+    } finally {
+      await new Promise(resolve => server.close(resolve)).catch(() => {});
+    }
+  } else if (mode === 'paste') {
+    if (typeof promptPaste !== 'function') throw new IntegrationError(`${product} paste sign-in needs a prompt`);
+    openAuthorizationUrl();
+    code = extractCode(await promptPaste(), state, product);
+  } else {
+    throw new IntegrationError(`${product} sign-in mode must be browser or paste`);
+  }
+  if (!code) throw new IntegrationError('No authorization code was found in the pasted URL or text.');
+  return requestDatasphereToken({
+    tokenUrl: config.tokenUrl,
+    clientId: config.clientId,
+    clientSecret: config.clientSecret,
+    form: { grant_type: 'authorization_code', code },
+    ...(fetchImpl ? { fetchImpl } : {}),
+    env,
+    now,
+    profile
+  });
+}

package/src/datasphere-cli.mjs

@@ -0,0 +1,220 @@
+// Child-process runner for @sap/datasphere-cli. The CLI is spawned (not driven
+// through its in-process getCommands API) because cli-core joins and re-splits
+// argv on spaces, which breaks values containing spaces. Secrets are written to
+// a private state dir before every process; the child environment is an
+// allowlist so CONSTANT_CASE host variables never leak into CLI options.
+import { execFile } from 'node:child_process';
+import { createRequire } from 'node:module';
+import { readFileSync } from 'node:fs';
+import { chmod, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { IntegrationError } from './integration-http.mjs';
+import { capText } from './integration-common.mjs';
+import { diagnosticText } from './redact.mjs';
+
+const require = createRequire(import.meta.url);
+
+const CLI_TIMEOUT_MS = 180_000;
+const MAX_BUFFER = 16 * 1024 * 1024;
+const OUTPUT_CAP = 16 * 1024;
+const ERROR_CAP = 800;
+const CHILD_ENV_KEYS = [
+  'PATH', 'Path', 'SystemRoot', 'SYSTEMROOT', 'TEMP', 'TMP', 'TMPDIR', 'LANG', 'LC_ALL',
+  'HTTP_PROXY', 'HTTPS_PROXY', 'NO_PROXY', 'http_proxy', 'https_proxy', 'no_proxy',
+  'NODE_EXTRA_CA_CERTS', 'SSL_CERT_FILE', 'SSL_CERT_DIR'
+];
+
+/** Isolate the SAP CLI cache and prevent host environment variables becoming CLI options. */
+export function datasphereCliEnvironment(env, home) {
+  return {
+    ...Object.fromEntries(CHILD_ENV_KEYS.filter(key => env[key] !== undefined).map(key => [key, env[key]])),
+    HOME: home,
+    USERPROFILE: home
+  };
+}
+
+function loadCliPackage() {
+  const packageJsonPath = require.resolve('@sap/datasphere-cli/package.json');
+  return { metadata: JSON.parse(readFileSync(packageJsonPath, 'utf8')), entry: join(dirname(packageJsonPath), 'terminal.js') };
+}
+
+function flatten(options) {
+  const argv = [];
+  for (const [name, value] of Object.entries(options || {})) {
+    if (value === undefined || value === false) continue;
+    if (value === true) argv.push(`--${name}`);
+    else argv.push(`--${name}`, String(value));
+  }
+  return argv;
+}
+
+/**
+ * Create the Datasphere CLI runtime for one resolved config.
+ * `secrets()` is an async callback returning the OAuth record to hand to the CLI;
+ * it is rewritten to <stateDir>/secrets.json before every CLI process.
+ */
+export function createDatasphereCli({
+  config,
+  secrets,
+  env = process.env,
+  execFileImpl = execFile,
+  tmpRoot = tmpdir()
+} = {}) {
+  if (!config?.url) throw new Error('Datasphere CLI runner needs a resolved config');
+  if (typeof secrets !== 'function') throw new Error('Datasphere CLI runner needs a secrets provider');
+  let cli;
+  try {
+    cli = loadCliPackage();
+  } catch (error) {
+    throw new IntegrationError(`Datasphere CLI package could not be loaded: ${diagnosticText(error, 200)}`);
+  }
+  const { entry } = cli;
+
+  let stateDirPath = null;
+  let queue = Promise.resolve();
+  let initPromise = null;
+  let closed = false;
+  let lastSecrets = null;
+
+  const stateDir = () => stateDirPath;
+
+  const ensureState = async () => {
+    if (closed) throw new IntegrationError('Datasphere CLI runtime is closed');
+    if (!stateDirPath) stateDirPath = await mkdtemp(join(tmpRoot, 'sap-ai-datasphere-'));
+    return stateDirPath;
+  };
+
+  const childEnv = dir => datasphereCliEnvironment(env, dir);
+
+  const writeSecrets = async dir => {
+    const record = await secrets();
+    lastSecrets = record;
+    const path = join(dir, 'secrets.json');
+    await writeFile(path, `${JSON.stringify(record, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    await chmod(path, 0o600).catch(() => {});
+    return path;
+  };
+
+  const scrubValues = () => [
+    config.clientSecret,
+    config.clientId,
+    config.refreshToken,
+    config.sql?.password,
+    lastSecrets?.client_secret,
+    lastSecrets?.client_id,
+    lastSecrets?.access_token,
+    lastSecrets?.refresh_token
+  ].filter(Boolean);
+
+  const scrub = text => {
+    let out = String(text ?? '');
+    for (const value of new Set(scrubValues())) out = out.split(value).join('[redacted]');
+    return out;
+  };
+
+  const enqueue = operation => {
+    const result = queue.then(operation);
+    queue = result.then(() => undefined, () => undefined);
+    return result;
+  };
+
+  const exec = async (words, options = {}, { input } = {}) => {
+    const dir = await ensureState();
+    const secretsPath = await writeSecrets(dir);
+    let inputPath;
+    const argv = [entry, ...words, ...flatten(options), '--host', config.url, '--secrets-file', secretsPath];
+    if (input !== undefined) {
+      inputPath = join(dir, `input-${randomUUID()}.json`);
+      await writeFile(inputPath, JSON.stringify(input), { encoding: 'utf8', mode: 0o600 });
+      await chmod(inputPath, 0o600).catch(() => {});
+      argv.push('--file-path', inputPath);
+    }
+    try {
+      return await new Promise((resolve, reject) => {
+        const child = execFileImpl(process.execPath, argv, {
+          cwd: dir,
+          env: childEnv(dir),
+          timeout: CLI_TIMEOUT_MS,
+          maxBuffer: MAX_BUFFER,
+          windowsHide: true
+        }, (error, stdout, stderr) => {
+          if (error) {
+            if (error.killed) {
+              reject(new IntegrationError(`Datasphere CLI "${words.join(' ')}" timed out after ${CLI_TIMEOUT_MS / 1000} s`));
+              return;
+            }
+            const detail = String(stderr || stdout || error.message || '');
+            reject(new IntegrationError(`Datasphere CLI "${words.join(' ')}" failed: ${diagnosticText(scrub(detail), ERROR_CAP)}`));
+            return;
+          }
+          resolve(String(stdout ?? ''));
+        });
+        child?.stdin?.end();
+      });
+    } finally {
+      if (inputPath) await rm(inputPath, { force: true }).catch(() => {});
+    }
+  };
+
+  const shape = text => {
+    const trimmed = scrub(text).trim();
+    if (!trimmed) return null;
+    if (trimmed.startsWith('{') || trimmed.startsWith('[')) {
+      try {
+        return JSON.parse(trimmed);
+      } catch {
+        // Not JSON after all: fall through to plain text.
+      }
+    }
+    return { output: capText(trimmed, OUTPUT_CAP) };
+  };
+
+  const run = (words, options, runOptions) => enqueue(() => exec(words, options, runOptions)).then(shape);
+
+  const init = () => {
+    if (!initPromise) {
+      initPromise = enqueue(async () => {
+        try {
+          await exec(['config', 'cache', 'init']);
+        } catch {
+          await exec(['login'], { 'authorization-flow': config.auth === 'interactive' ? 'authorization_code' : 'client_credentials' });
+        }
+      });
+    }
+    return initPromise;
+  };
+
+  const version = () => enqueue(() => new Promise((resolve, reject) => {
+    const child = execFileImpl(process.execPath, [entry, '--version'], {
+      timeout: CLI_TIMEOUT_MS,
+      maxBuffer: MAX_BUFFER,
+      windowsHide: true
+    }, (error, stdout, stderr) => {
+      if (error) {
+        reject(new IntegrationError(`Datasphere CLI "--version" failed: ${diagnosticText(scrub(String(stderr || stdout || error.message || '')), ERROR_CAP)}`));
+        return;
+      }
+      resolve(String(stdout ?? '').split(/\r?\n/).map(line => line.trim()).find(line => /^\d/.test(line)) ?? '');
+    });
+    child?.stdin?.end();
+  }));
+
+  const close = async () => {
+    closed = true;
+    await queue.catch(() => {});
+    if (stateDirPath) await rm(stateDirPath, { recursive: true, force: true }).catch(() => {});
+  };
+
+  return {
+    get packageVersion() {
+      return cli.metadata.version;
+    },
+    init,
+    run,
+    version,
+    stateDir,
+    close
+  };
+}