Custom UI based App to download CPI-IS Payloads and logs from SAP DMS

Before we get into the detail of this blog, I would highly recommend to go through the below two wonderful blogs by Bhavesh Kuntilal
https://www.sprintegrate.com/cpi/sap-cpi-archive-mpls-to-sap-btp-dms/
https://www.sprintegrate.com/documentmanagementservice/sap-btp-dms-integration-repository-option-initial-set-up/
Since SAP doesn’t provide an out of the box solution or UI to download the logs- here is why I have decided to go with this application.

Introduction
The DMS Payload Logger is a read only web application in the CPI Custom Utilities multitarget application. It gives authorized support users a controlled way to find archived SAP Cloud Integration message payload and log records stored in SAP Document Management Service and download an individual archived object when required for support or analysis.

This BTP application’s design separates browser facing concerns from the DMS technical integration. SAP Application Router serves the static interface, redirects unauthenticated users to XSUAA, enforces route scopes, and forwards the user token. A dedicated Node.js service validates the request, obtains a service token from the DMS binding, runs CMIS Browser Binding requests, normalizes the response, and streams downloaded content back to the browser.

What the application does

• Searches archived message documents by iFlow name message identifier status and date range.
• Blocks an unfiltered guided search to reduce accidental repository wide scans.
• Allows a privileged user to submit a constrained read only CMIS SELECT query.
• Displays normalized message metadata in a paged result table.
• Streams a selected archived object to the browser without exposing the DMS service credential.
  

  Solution architecture

  

   

  Figure 1  Sanitized logical architecture

  The browser communicates only with the Application Router. XSUAA authenticates the user and the route requires a base application scope. The router forwards the user JWT to the Node.js destination. The service performs its own role decision, gets a DMS OAuth client credentials token from the bound service, and invokes the CMIS Browser Binding.

  Implementation stack

  Layer	Technology	Role
  User interface	HTML CSS and vanilla JavaScript	Search form result table pagination and download action
  Routing	SAP Application Router	Static content authentication scoped routes and JWT forwarding
  Service	Node.js Express Axios and @SAP/xssec	Validation authorization token management CMIS calls and streaming
  Security	XSUAA	Scopes role templates and user authentication
  Content repository	SAP Document Management Service	Archived message documents exposed through CMIS 1.1 Browser Binding
  Packaging	SAP Multitarget Application	Repeatable Cloud Foundry build binding and deployment

   

  Runtime workflow

  

  Figure 2  Search and download workflow

Process workflow

1. The user opens the DMS Payload Logger route through SAP Application Router.
2. XSUAA authenticates the user. The route requires the standard DMS scope and forwards the JWT to the backend destination.
3. The UI calls the identity endpoint and adapts the screen to the standard or advanced role returned by the service.
4. For guided search the user supplies at least one iFlow message status or date filter. Open wide searches are rejected.
5. For custom search an authorized administrator enables the custom query option and enters a single read only CMIS SELECT statement.
6. The service validates the request constructs or validates the CMIS query obtains a cached or new DMS service token and invokes the Browser Binding query selector.
7. The service maps DMS property collections into a stable JSON contract and the UI renders a paged table.
8. When the user chooses Download the service requests the DMS content selector and streams the response as an attachment.

User interface

The interface is implemented as one responsive HTML document with embedded CSS and JavaScript. It does not use React Next.js SAPUI5 or another client framework. All screenshots in this document were captured from a local documentation instance with synthetic records and contain no production payload data.

Figure 3  Standard search with user identity role badges and guided filters

Standard users can search by iFlow name message identifier status and date range. The UI requires at least one filter and shows the exact CMIS query returned by the service for transparency and troubleshooting.

Figure 4  Advanced search shown only to users with the advanced role

Advanced users can enable a custom CMIS query. The UI explains that only SELECT is allowed and pagination is still enforced. Server side validation remains authoritative even if client checks are bypassed.

Figure 5  Synthetic search results with per record download action

Result fields include file name iFlow metadata message GUID status log start size and download action. Dynamic values are HTML escaped before insertion into the result table.

Search parameters

Guided query construction

The service creates a query against mpl:message combines supplied predicates with AND escapes apostrophes in text values and orders the result by mpl:logStart descending. A representative request and generated query are shown below.

GET /dms_payload_logger/api/search?iflow=IF_DEMO_ORDER&status=COMPLETED&maxItems=100&skipCount=0

SELECT * FROM mpl:message
WHERE mpl:iFlowName = ‘IF_DEMO_ORDER’ AND mpl:status = ‘COMPLETED’
ORDER BY mpl:logStart DESC

Advanced query validation

• The request must be nonempty start with SELECT and contain a FROM clause.
• The only accepted source object types are mpl:message and cmis:document.
• DELETE UPDATE INSERT CREATE DROP ALTER and TRUNCATE tokens are blocked.
• Semicolons are blocked so a second statement cannot be appended.
• Before the full search the service submits the query to DMS with maxItems set to one to confirm DMS accepts it.
• This is a constrained read only guard not a complete SQL parser. Advanced access therefore remains privileged.

Security design

Security controls

Scopes role templates and collections

Assign the least privileged collection that supports the user task. Do not grant the administrator collection solely to resolve a standard search problem.

  Read More Technology Blog Posts by Members articles 

#abap