Function callOdata

apps/sim/app/api/tools/sap_s4hana/proxy/route.ts:208–252

(
  req: ProxyRequest,
  accessToken: string | null,
  csrf: CsrfBundle | null
)

}

async function callOdata(
  req: ProxyRequest,
  accessToken: string | null,
  csrf: CsrfBundle | null
): Promise<OdataInvocation> {
  const url = buildOdataUrl(req)
  const headers: Record<string, string> = {
    Authorization: buildAuthHeader(req, accessToken),
    Accept: 'application/json',
  }

  const isWrite = WRITE_METHODS.has(req.method)
  const hasBody = req.body !== undefined && req.body !== null
  if (hasBody) headers['Content-Type'] = 'application/json'
  if (req.ifMatch) headers['If-Match'] = req.ifMatch

  if (isWrite && csrf) {
    headers['X-CSRF-Token'] = csrf.token
    if (csrf.cookie) headers.Cookie = csrf.cookie
  }

  const response = await secureFetchWithValidation(
    url,
    {
      method: req.method,
      headers,
      body: hasBody ? JSON.stringify(req.body) : undefined,
      timeout: OUTBOUND_FETCH_TIMEOUT_MS,
    },
    'baseUrl'
  )

  const raw = await response.text()
  let parsed: unknown = null
  if (raw.length > 0) {
    try {
      parsed = JSON.parse(raw)
    } catch {
      parsed = raw
    }
  }

  const csrfHeader = response.headers.get('x-csrf-token')?.toLowerCase() ?? ''
  return { status: response.status, body: parsed, raw, csrfHeader }
}

function isCsrfRequired(invocation: OdataInvocation): boolean {
  if (invocation.status !== 403) return false