feat(integrations): SAP S/4HANA

[waleedlatif1]

Summary

• New SAP S/4HANA integration: 37 tools across Business Partner, Customer, Supplier, Sales Order, Product, Purchase Order/Requisition, Supplier Invoice, Outbound/Inbound Delivery, Material Stock/Documents, Billing Document + a generic OData v2 query escape hatch
• Single internal proxy route handles BTP UAA token caching, CSRF fetch+retry on writes, and OData error/payload normalization
• Supports Cloud Public Edition, Cloud Private Edition (RISE), and on-premise — with OAuth 2.0 client credentials or HTTP Basic auth selectable per deployment
• Block, registry entries, icon, integrations landing entry, and generated docs

Type of Change

• New feature

Testing

Tested manually

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
docs	Ready	Preview, Comment	Apr 27, 2026 9:56pm

[cursor]

PR Summary

Medium Risk
Introduces a new server-side proxy that fetches OAuth tokens, forwards authenticated requests to customer-provided SAP endpoints, and performs CSRF retries, so regressions or validation gaps could impact outbound request security and write behavior.

Overview
Adds a full SAP S/4HANA integration: new docs page (sap_s4hana.mdx), tool metadata entries, and a new sap_s4hana integration entry for the integrations landing pages.

Implements a new /api/tools/sap_s4hana/proxy route that validates inputs, blocks unsafe URLs, caches OAuth client-credentials tokens, fetches CSRF tokens for write calls, retries on CSRF failures, and normalizes OData v2 responses/errors.

Registers ~37 new sap_s4hana_* tools and a new SapS4HanaBlock in the Sim block/tool registries, and updates icon mapping to include SapS4HanaIcon plus fixes several SVGs to use useId()-scoped IDs to avoid gradient/path collisions.

^{Reviewed by Cursor Bugbot for commit 6403b56. Configure here.}

[greptile-apps]

Greptile Summary

This PR introduces a complete SAP S/4HANA integration with 37 tools, a single internal proxy route (/api/tools/sap_s4hana/proxy) that handles BTP UAA OAuth token caching, CSRF fetch-and-retry, OData error normalization, and SSRF protection, plus a block, registry entries, icon, and docs. Previous security findings (SSRF via unvalidated URLs, token cache unboundedness, no fetch timeouts, CSRF cache key collision, private IP ranges, query-string injection) have all been addressed in follow-up commits.

Confidence Score: 5/5

Safe to merge — all prior P0/P1 security issues are fixed; only two minor P2 findings remain.

All critical security issues from previous review rounds have been resolved (SSRF, token cache, CSRF key, private IPs, timeouts, path injection). Remaining findings are P2: response body has no size cap, and the joinSetCookies fallback regex can misbehave on cookie values with commas. Neither blocks correctness in standard SAP environments.

apps/sim/app/api/tools/sap_s4hana/proxy/route.ts — lines 359-368 (cookie splitting fallback) and 479-481 (unbounded response buffering).

Important Files Changed

Filename	Overview
apps/sim/app/api/tools/sap_s4hana/proxy/route.ts	Core proxy route handling BTP UAA token caching, CSRF fetch+retry, SSRF validation, and OData normalization — well-implemented with prior security issues resolved; minor concerns around response body size limit and cookie fallback parsing.
apps/sim/tools/sap_s4hana/utils.ts	Shared utilities (proxy body builder, OData query builder, JSON input parser, OData key quoter, response transformer) — return type of parseJsonInput correctly updated to T
apps/sim/tools/sap_s4hana/types.ts	Type definitions for all 37 tool parameter interfaces — thorough, consistent, no issues.
apps/sim/blocks/blocks/sap_s4hana.ts	Block config wiring all 37 operations with conditional sub-blocks and auth fields — credential params correctly use user-only visibility per convention.
apps/sim/tools/sap_s4hana/odata_query.ts	Generic OData escape-hatch tool with normalizeQuery handling both JSON-object and query-string forms; $format=json injected automatically when absent.
apps/sim/tools/sap_s4hana/create_sales_order.ts	Creates a sales order with deep insert of to_Item; validates items is a non-empty array before sending.
apps/sim/tools/sap_s4hana/update_sales_order.ts	PATCH update tool using quoteOdataKey for key escaping; defaults If-Match to * (unconditional) with clear documentation.

Sequence Diagram

sequenceDiagram
participant Tool as Tool (client)
participant Proxy as /api/tools/sap_s4hana/proxy
participant BTP as SAP BTP UAA
participant SAP as SAP S/4HANA OData
Tool->>Proxy: POST {deploymentType, authType, service, path, method, query, body}
Proxy->>Proxy: checkInternalAuth + Zod validation + SSRF checks
alt OAuth client credentials
Proxy->>Proxy: tokenCacheKey lookup
opt cache miss / expired
Proxy->>BTP: POST /oauth/token (grant_type=client_credentials)
BTP-->>Proxy: {access_token, expires_in}
Proxy->>Proxy: rememberToken (LRU, max 500)
end
end
alt Write method (POST/PATCH/PUT/DELETE/MERGE)
Proxy->>SAP: GET /$metadata (X-CSRF-Token: Fetch)
SAP-->>Proxy: x-csrf-token + Set-Cookie
end
Proxy->>SAP: {method} /sap/opu/odata/sap/{service}{path}?{query}
SAP-->>Proxy: OData JSON response
alt 403 + CSRF required
Proxy->>SAP: GET /$metadata (re-fetch CSRF)
SAP-->>Proxy: refreshed csrf token
Proxy->>SAP: retry {method} with new CSRF token
SAP-->>Proxy: OData JSON response
end
Proxy->>Proxy: unwrapOdata (strip .d / .d.results wrapper)
Proxy-->>Tool: {success, output: {status, data}}

Loading

_{Reviews (13): Last reviewed commit: "fix(icons): remove unused mask in Pipedr..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 6403b56. Configure here.}