@abapify/browser-auth 0.4.1 → 0.4.3

package/README.md

@@ -169,7 +169,7 @@ The `requiredCookies` option supports wildcard patterns:
 requiredCookies: ['SAP_SESSIONID_*'];
 
 // Wait for specific cookies
-requiredCookies: ['SAP_SESSIONID_S0D_200', 'sap-usercontext'];
+requiredCookies: ['SAP_SESSIONID_TRL_200', 'sap-usercontext'];
 
 // Multiple patterns
 requiredCookies: ['SAP_SESSIONID_*', 'MYSAPSSO2', 'sap-usercontext'];
@@ -181,10 +181,10 @@ requiredCookies: ['SAP_SESSIONID_*', 'MYSAPSSO2', 'sap-usercontext'];
 import { matchesCookiePattern, cookieMatchesAny } from '@abapify/browser-auth';
 
 // Check single pattern
-matchesCookiePattern('SAP_SESSIONID_S0D_200', 'SAP_SESSIONID_*'); // true
+matchesCookiePattern('SAP_SESSIONID_TRL_200', 'SAP_SESSIONID_*'); // true
 
 // Check multiple patterns
-cookieMatchesAny('SAP_SESSIONID_S0D_200', ['MYSAPSSO2', 'SAP_SESSIONID_*']); // true
+cookieMatchesAny('SAP_SESSIONID_TRL_200', ['MYSAPSSO2', 'SAP_SESSIONID_*']); // true
 ```
 
 ## Types

package/dist/index.d.mts

@@ -171,7 +171,7 @@ declare function toHeaders(credentials: BrowserCredentials): Record<string, stri
 declare function resolveUserDataDir(userDataDir?: string | boolean): string | undefined;
 /**
  * Check if a cookie name matches a pattern (supports * wildcard)
- * @example matchesCookiePattern('SAP_SESSIONID_S0D_200', 'SAP_SESSIONID_*') // true
+ * @example matchesCookiePattern('SAP_SESSIONID_TRL_200', 'SAP_SESSIONID_*') // true
  */
 declare function matchesCookiePattern(cookieName: string, pattern: string): boolean;
 /**

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/auth-core.ts","../src/utils.ts"],"mappings":";;AAUA;;;;;;;;UAAiB,UAAA;EACf,IAAA;EACA,KAAA;EACA,MAAA;EACA,IAAA;EACA,OAAA;EACA,QAAA;EACA,MAAA;EACA,QAAA;AAAA;;;;UAMe,kBAAA;EAME;EAJjB,OAAA;EAMS;EAJT,OAAA,EAAS,UAAA;EAUM;EARf,eAAA,EAAiB,IAAA;;EAEjB,SAAA;AAAA;;;;UAMe,kBAAA;EAoBf;EAlBA,GAAA;EAsBA;;;AAMF;;EAtBE,QAAA;EAuBA;EArBA,QAAA;EA4Be;EA1Bf,OAAA;;EAEA,SAAA;EAsCW;;;;;EAhCX,eAAA;EAyDa;EAvDb,WAAA;EAiE4B;EA/D5B,iBAAA;AAAA;;;;UAMe,aAAA;EACf,GAAA;EACA,MAAA;AAAA;;;;UAMe,cAAA;EAmBe;;;EAf9B,MAAA,CAAO,OAAA;IACL,QAAA;IACA,WAAA;IACA,iBAAA;IACA,SAAA;EAAA,IACE,OAAA;EAyBJ;;;EApBA,OAAA,IAAW,OAAA;EA8BX;;;EAzBA,IAAA,CAAK,GAAA,UAAa,OAAA;IAAY,OAAA;EAAA,IAAqB,OAAA;EAmCnD;;;EA9BA,UAAA,IAAc,OAAA,CAAQ,UAAA;EAoCP;;;EA/Bf,YAAA,CAAa,MAAA,WAAiB,OAAA;EAgC9B;;;EA3BA,YAAA,IAAgB,OAAA;EA6BJ;;;EAxBZ,SAAA,IAAa,OAAA;EC9FE;;;EDmGf,KAAA,IAAS,OAAA;ECnGkC;;;EDwG3C,UAAA,CAAW,OAAA,GAAU,KAAA,EAAO,aAAA;ECtGN;AASxB;;EDkGE,WAAA,CAAY,OAAA;AAAA;;;;UAMG,UAAA;EACf,KAAA;EACA,KAAA;EACA,YAAA;AAAA;;;UCtHe,mBAAA,SAA4B,kBAAA;EDP3C;ECSA,GAAA,IAAO,OAAA;AAAA;;;;;ADCT;;iBCQsB,YAAA,CACpB,OAAA,EAAS,cAAA,EACT,OAAA,EAAS,mBAAA,GACR,OAAA,CAAQ,kBAAA;;;;iBAgJW,eAAA,CACpB,WAAA,EAAa,kBAAA,EACb,OAAA;EAAY,OAAA;AAAA,IACX,OAAA;EAAU,KAAA;EAAgB,KAAA;EAAgB,YAAA;AAAA;;;;iBA+C7B,cAAA,CAAe,WAAA,EAAa,kBAAA;;;;iBAO5B,SAAA,CACd,WAAA,EAAa,kBAAA,GACZ,MAAA;;;;ADpOH;;;;;;;iBEIgB,kBAAA,CACd,WAAA;;;;;iBAec,oBAAA,CACd,UAAA,UACA,OAAA;;AFRF;;iBEoBgB,gBAAA,CACd,UAAA,UACA,QAAA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/auth-core.ts","../src/utils.ts"],"mappings":";;;;;;;;;;UAUiB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;UAMe;;EAEf;;EAEA,SAAS;;EAET,iBAAiB;;EAEjB;;;;;UAMe;;EAEf;;;;;;EAMA;;EAEA;;EAEA;;EAEA;;;;;;EAMA;;EAEA;;EAEA;;;;;UAMe;EACf;EACA;;;;;UAMe;;;;EAIf,OAAO;IACL;IACA;IACA;IACA;MACE;;;;EAKJ,WAAW;;;;EAKX,KAAK,aAAa;IAAY;MAAqB;;;;EAKnD,cAAc,QAAQ;;;;EAKtB,aAAa,iBAAiB;;;;EAK9B,gBAAgB;;;;EAKhB,aAAa;;;;EAKb,SAAS;;;;EAKT,WAAW,UAAU,OAAO;;;;EAK5B,YAAY;;;;;UAMG;EACf;EACA;EACA;;;;UCtHe,4BAA4B;;EAE3C,OAAO;;;;;;;;iBASa,aACpB,SAAS,gBACT,SAAS,sBACR,QAAQ;;;;iBAgJW,gBACpB,aAAa,oBACb;EAAY;IACX;EAAU;EAAgB;EAAgB;;;;;iBA+C7B,eAAe,aAAa;;;;iBAO5B,UACd,aAAa,qBACZ;;;;;;;;;;;iBChOa,mBACd;;;;;iBAec,qBACd,oBACA;;;;iBAYc,iBACd,oBACA"}

package/dist/index.mjs

@@ -1,5 +1,5 @@
-import { homedir } from "os";
-import { join } from "path";
+import { homedir } from "node:os";
+import { join } from "node:path";
 
 //#region src/utils.ts
 /**
@@ -17,7 +17,7 @@ function resolveUserDataDir(userDataDir) {
 }
 /**
 * Check if a cookie name matches a pattern (supports * wildcard)
-* @example matchesCookiePattern('SAP_SESSIONID_S0D_200', 'SAP_SESSIONID_*') // true
+* @example matchesCookiePattern('SAP_SESSIONID_TRL_200', 'SAP_SESSIONID_*') // true
 */
 function matchesCookiePattern(cookieName, pattern) {
 	if (!pattern.includes("*")) return cookieName === pattern;

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/utils.ts","../src/auth-core.ts"],"sourcesContent":["/**\n * Browser Auth Utilities\n *\n * Cookie matching and path resolution utilities.\n */\n\nimport { homedir } from 'os';\nimport { join } from 'path';\n\nconst DEFAULT_USER_DATA_DIR = join(homedir(), '.adt', 'browser-profile');\n\n/**\n * Resolve userDataDir configuration to an absolute path\n */\nexport function resolveUserDataDir(\n  userDataDir?: string | boolean,\n): string | undefined {\n  if (userDataDir === true) {\n    return DEFAULT_USER_DATA_DIR;\n  }\n  if (typeof userDataDir === 'string') {\n    return userDataDir;\n  }\n  return undefined;\n}\n\n/**\n * Check if a cookie name matches a pattern (supports * wildcard)\n * @example matchesCookiePattern('SAP_SESSIONID_S0D_200', 'SAP_SESSIONID_*') // true\n */\nexport function matchesCookiePattern(\n  cookieName: string,\n  pattern: string,\n): boolean {\n  if (!pattern.includes('*')) {\n    return cookieName === pattern;\n  }\n  const regexPattern = pattern.replaceAll(/\\*/g, '.*');\n  return new RegExp(`^${regexPattern}$`).test(cookieName);\n}\n\n/**\n * Check if a cookie matches any of the required patterns\n */\nexport function cookieMatchesAny(\n  cookieName: string,\n  patterns: string[],\n): boolean {\n  return patterns.some((pattern) => matchesCookiePattern(cookieName, pattern));\n}\n","/**\n * Browser Auth Core\n *\n * Event-driven authentication logic shared by Playwright and Puppeteer adapters.\n * This module contains NO browser-specific code.\n */\n\nimport type {\n  BrowserAdapter,\n  BrowserAuthOptions,\n  BrowserCredentials,\n} from './types';\nimport {\n  matchesCookiePattern,\n  cookieMatchesAny,\n  resolveUserDataDir,\n} from './utils';\n\nconst DEFAULT_TIMEOUT = 300_000; // 5 minutes\nconst SYSTEM_INFO_PATH = '/sap/bc/adt/core/http/systeminformation';\n\nexport interface AuthenticateOptions extends BrowserAuthOptions {\n  /** Callback for logging */\n  log?: (message: string) => void;\n}\n\n/**\n * Authenticate using browser-based SSO\n *\n * This is the main entry point - it orchestrates the auth flow using the provided adapter.\n * The adapter handles browser-specific operations, this function handles the logic.\n */\nexport async function authenticate(\n  adapter: BrowserAdapter,\n  options: AuthenticateOptions,\n): Promise<BrowserCredentials> {\n  const {\n    url,\n    loginUrl,\n    headless = false,\n    timeout = DEFAULT_TIMEOUT,\n    userAgent,\n    requiredCookies,\n    userDataDir,\n    ignoreHTTPSErrors = true,\n    log = console.log,\n  } = options;\n\n  // URL to navigate to for SSO login\n  const targetUrl = loginUrl || new URL(SYSTEM_INFO_PATH, url).toString();\n  const sapHost = new URL(url).hostname;\n  const profileDir = resolveUserDataDir(userDataDir);\n\n  if (profileDir) {\n    log(`🔄 Using persistent browser profile: ${profileDir}`);\n  }\n\n  try {\n    // Step 1: Launch browser\n    await adapter.launch({\n      headless,\n      userDataDir: profileDir,\n      ignoreHTTPSErrors,\n      userAgent,\n    });\n\n    log('🔍 Opening browser...');\n    await adapter.newPage();\n\n    // Step 2: Clear old SAP cookies to ensure we capture fresh ones\n    // This is critical for re-authentication - old cookies may be stale\n    log('🧹 Clearing old SAP cookies...');\n    await adapter.clearCookies(sapHost);\n\n    // Step 3: Wait for authentication (required cookies appear after SSO)\n    log('🌐 Complete SSO login if prompted...');\n\n    const cookiesToWait =\n      requiredCookies && requiredCookies.length > 0\n        ? requiredCookies\n        : ['SAP_SESSIONID_*']; // Default: wait for session cookie\n\n    log(`⏳ Waiting for cookies: ${cookiesToWait.join(', ')}`);\n\n    const sapCookies = await new Promise<\n      Awaited<ReturnType<typeof adapter.getCookies>>\n    >((resolve, reject) => {\n      const timeoutId = setTimeout(() => {\n        reject(new Error('Authentication timeout - SSO not completed'));\n      }, timeout);\n\n      adapter.onPageClose(() => {\n        clearTimeout(timeoutId);\n        reject(new Error('Authentication cancelled - browser was closed'));\n      });\n\n      // Check for required cookies on every response from SAP domain\n      adapter.onResponse(async (event) => {\n        // Check responses from SAP domain (not just targetUrl, since SSO may redirect)\n        const eventHost = new URL(event.url).hostname;\n        const isSapDomain =\n          eventHost === sapHost ||\n          eventHost.endsWith('.' + sapHost) ||\n          sapHost.endsWith('.' + eventHost);\n\n        if (isSapDomain && event.status === 200) {\n          // Got 200 from SAP domain - check if required cookies are set\n          const allCookies = await adapter.getCookies();\n          const domainCookies = allCookies.filter(\n            (c) =>\n              c.domain.includes(sapHost) ||\n              sapHost.includes(c.domain.replace(/^\\./, '')),\n          );\n          const matchedCookies = domainCookies.filter((c) =>\n            cookieMatchesAny(c.name, cookiesToWait),\n          );\n          const allFound = cookiesToWait.every((pattern) =>\n            matchedCookies.some((c) => matchesCookiePattern(c.name, pattern)),\n          );\n\n          if (allFound) {\n            clearTimeout(timeoutId);\n            log('✅ Authentication complete!');\n            log(\n              `🍪 Found required cookies: ${matchedCookies.map((c) => c.name).join(', ')}`,\n            );\n            resolve(matchedCookies);\n          }\n          // If cookies not found yet, keep waiting for more responses\n        }\n      });\n\n      // Navigate - events are already set up; navigation errors are expected\n      // (auth flow handles results through response event listeners, not navigation result)\n      // eslint-disable-next-line @typescript-eslint/no-empty-function\n      adapter.goto(targetUrl, { timeout: 30000 }).catch(() => {});\n    });\n\n    await adapter.closePage();\n\n    // Validate cookies\n    if (requiredCookies && requiredCookies.length > 0) {\n      const missingPatterns = requiredCookies.filter(\n        (pattern) =>\n          !sapCookies.some((c) => matchesCookiePattern(c.name, pattern)),\n      );\n      if (missingPatterns.length > 0) {\n        throw new Error(\n          `Missing required cookies: ${missingPatterns.join(', ')}`,\n        );\n      }\n    }\n\n    if (sapCookies.length === 0) {\n      throw new Error(\n        'No SAP cookies captured - authentication may have failed',\n      );\n    }\n\n    const cookieNames = sapCookies.map((c) => c.name).join(', ');\n    log(`🍪 Captured ${sapCookies.length} cookies: ${cookieNames}`);\n\n    // Get user agent\n    const userAgentString = userAgent || (await adapter.getUserAgent());\n\n    return {\n      baseUrl: url,\n      cookies: sapCookies,\n      authenticatedAt: new Date(),\n      userAgent: userAgentString,\n    };\n  } finally {\n    await adapter.close();\n  }\n}\n\n/**\n * Test if credentials are still valid\n */\nexport async function testCredentials(\n  credentials: BrowserCredentials,\n  options?: { timeout?: number },\n): Promise<{ valid: boolean; error?: string; responseTime?: number }> {\n  const startTime = Date.now();\n  const testUrl = new URL(SYSTEM_INFO_PATH, credentials.baseUrl);\n\n  try {\n    const cookieHeader = credentials.cookies\n      .map((c) => `${c.name}=${c.value}`)\n      .join('; ');\n\n    const response = await fetch(testUrl.toString(), {\n      headers: {\n        Cookie: cookieHeader,\n        Accept: 'application/xml',\n      },\n      signal: options?.timeout\n        ? AbortSignal.timeout(options.timeout)\n        : undefined,\n    });\n\n    const text = await response.text();\n\n    // Check for SAML redirect (session expired)\n    if (text.includes('SAMLRequest') || text.includes('SAMLResponse')) {\n      return {\n        valid: false,\n        error: 'Session expired - SAML redirect detected',\n        responseTime: Date.now() - startTime,\n      };\n    }\n\n    return {\n      valid: response.ok,\n      error: response.ok ? undefined : `HTTP ${response.status}`,\n      responseTime: Date.now() - startTime,\n    };\n  } catch (error) {\n    return {\n      valid: false,\n      error: error instanceof Error ? error.message : String(error),\n      responseTime: Date.now() - startTime,\n    };\n  }\n}\n\n/**\n * Convert credentials to HTTP cookie header\n */\nexport function toCookieHeader(credentials: BrowserCredentials): string {\n  return credentials.cookies.map((c) => `${c.name}=${c.value}`).join('; ');\n}\n\n/**\n * Convert credentials to HTTP headers object\n */\nexport function toHeaders(\n  credentials: BrowserCredentials,\n): Record<string, string> {\n  return {\n    Cookie: toCookieHeader(credentials),\n    ...(credentials.userAgent ? { 'User-Agent': credentials.userAgent } : {}),\n  };\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,wBAAwB,KAAK,SAAS,EAAE,QAAQ,kBAAkB;;;;AAKxE,SAAgB,mBACd,aACoB;AACpB,KAAI,gBAAgB,KAClB,QAAO;AAET,KAAI,OAAO,gBAAgB,SACzB,QAAO;;;;;;AASX,SAAgB,qBACd,YACA,SACS;AACT,KAAI,CAAC,QAAQ,SAAS,IAAI,CACxB,QAAO,eAAe;CAExB,MAAM,eAAe,QAAQ,WAAW,OAAO,KAAK;AACpD,QAAO,IAAI,OAAO,IAAI,aAAa,GAAG,CAAC,KAAK,WAAW;;;;;AAMzD,SAAgB,iBACd,YACA,UACS;AACT,QAAO,SAAS,MAAM,YAAY,qBAAqB,YAAY,QAAQ,CAAC;;;;;AC9B9E,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;;;;;;;AAazB,eAAsB,aACpB,SACA,SAC6B;CAC7B,MAAM,EACJ,KACA,UACA,WAAW,OACX,UAAU,iBACV,WACA,iBACA,aACA,oBAAoB,MACpB,MAAM,QAAQ,QACZ;CAGJ,MAAM,YAAY,YAAY,IAAI,IAAI,kBAAkB,IAAI,CAAC,UAAU;CACvE,MAAM,UAAU,IAAI,IAAI,IAAI,CAAC;CAC7B,MAAM,aAAa,mBAAmB,YAAY;AAElD,KAAI,WACF,KAAI,wCAAwC,aAAa;AAG3D,KAAI;AAEF,QAAM,QAAQ,OAAO;GACnB;GACA,aAAa;GACb;GACA;GACD,CAAC;AAEF,MAAI,wBAAwB;AAC5B,QAAM,QAAQ,SAAS;AAIvB,MAAI,iCAAiC;AACrC,QAAM,QAAQ,aAAa,QAAQ;AAGnC,MAAI,uCAAuC;EAE3C,MAAM,gBACJ,mBAAmB,gBAAgB,SAAS,IACxC,kBACA,CAAC,kBAAkB;AAEzB,MAAI,0BAA0B,cAAc,KAAK,KAAK,GAAG;EAEzD,MAAM,aAAa,MAAM,IAAI,SAE1B,SAAS,WAAW;GACrB,MAAM,YAAY,iBAAiB;AACjC,2BAAO,IAAI,MAAM,6CAA6C,CAAC;MAC9D,QAAQ;AAEX,WAAQ,kBAAkB;AACxB,iBAAa,UAAU;AACvB,2BAAO,IAAI,MAAM,gDAAgD,CAAC;KAClE;AAGF,WAAQ,WAAW,OAAO,UAAU;IAElC,MAAM,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC;AAMrC,SAJE,cAAc,WACd,UAAU,SAAS,MAAM,QAAQ,IACjC,QAAQ,SAAS,MAAM,UAAU,KAEhB,MAAM,WAAW,KAAK;KAQvC,MAAM,kBANa,MAAM,QAAQ,YAAY,EACZ,QAC9B,MACC,EAAE,OAAO,SAAS,QAAQ,IAC1B,QAAQ,SAAS,EAAE,OAAO,QAAQ,OAAO,GAAG,CAAC,CAChD,CACoC,QAAQ,MAC3C,iBAAiB,EAAE,MAAM,cAAc,CACxC;AAKD,SAJiB,cAAc,OAAO,YACpC,eAAe,MAAM,MAAM,qBAAqB,EAAE,MAAM,QAAQ,CAAC,CAClE,EAEa;AACZ,mBAAa,UAAU;AACvB,UAAI,6BAA6B;AACjC,UACE,8BAA8B,eAAe,KAAK,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK,GAC3E;AACD,cAAQ,eAAe;;;KAI3B;AAKF,WAAQ,KAAK,WAAW,EAAE,SAAS,KAAO,CAAC,CAAC,YAAY,GAAG;IAC3D;AAEF,QAAM,QAAQ,WAAW;AAGzB,MAAI,mBAAmB,gBAAgB,SAAS,GAAG;GACjD,MAAM,kBAAkB,gBAAgB,QACrC,YACC,CAAC,WAAW,MAAM,MAAM,qBAAqB,EAAE,MAAM,QAAQ,CAAC,CACjE;AACD,OAAI,gBAAgB,SAAS,EAC3B,OAAM,IAAI,MACR,6BAA6B,gBAAgB,KAAK,KAAK,GACxD;;AAIL,MAAI,WAAW,WAAW,EACxB,OAAM,IAAI,MACR,2DACD;EAGH,MAAM,cAAc,WAAW,KAAK,MAAM,EAAE,KAAK,CAAC,KAAK,KAAK;AAC5D,MAAI,eAAe,WAAW,OAAO,YAAY,cAAc;EAG/D,MAAM,kBAAkB,aAAc,MAAM,QAAQ,cAAc;AAElE,SAAO;GACL,SAAS;GACT,SAAS;GACT,iCAAiB,IAAI,MAAM;GAC3B,WAAW;GACZ;WACO;AACR,QAAM,QAAQ,OAAO;;;;;;AAOzB,eAAsB,gBACpB,aACA,SACoE;CACpE,MAAM,YAAY,KAAK,KAAK;CAC5B,MAAM,UAAU,IAAI,IAAI,kBAAkB,YAAY,QAAQ;AAE9D,KAAI;EACF,MAAM,eAAe,YAAY,QAC9B,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,QAAQ,CAClC,KAAK,KAAK;EAEb,MAAM,WAAW,MAAM,MAAM,QAAQ,UAAU,EAAE;GAC/C,SAAS;IACP,QAAQ;IACR,QAAQ;IACT;GACD,QAAQ,SAAS,UACb,YAAY,QAAQ,QAAQ,QAAQ,GACpC;GACL,CAAC;EAEF,MAAM,OAAO,MAAM,SAAS,MAAM;AAGlC,MAAI,KAAK,SAAS,cAAc,IAAI,KAAK,SAAS,eAAe,CAC/D,QAAO;GACL,OAAO;GACP,OAAO;GACP,cAAc,KAAK,KAAK,GAAG;GAC5B;AAGH,SAAO;GACL,OAAO,SAAS;GAChB,OAAO,SAAS,KAAK,SAAY,QAAQ,SAAS;GAClD,cAAc,KAAK,KAAK,GAAG;GAC5B;UACM,OAAO;AACd,SAAO;GACL,OAAO;GACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC7D,cAAc,KAAK,KAAK,GAAG;GAC5B;;;;;;AAOL,SAAgB,eAAe,aAAyC;AACtE,QAAO,YAAY,QAAQ,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,QAAQ,CAAC,KAAK,KAAK;;;;;AAM1E,SAAgB,UACd,aACwB;AACxB,QAAO;EACL,QAAQ,eAAe,YAAY;EACnC,GAAI,YAAY,YAAY,EAAE,cAAc,YAAY,WAAW,GAAG,EAAE;EACzE"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/utils.ts","../src/auth-core.ts"],"sourcesContent":["/**\n * Browser Auth Utilities\n *\n * Cookie matching and path resolution utilities.\n */\n\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\n\nconst DEFAULT_USER_DATA_DIR = join(homedir(), '.adt', 'browser-profile');\n\n/**\n * Resolve userDataDir configuration to an absolute path\n */\nexport function resolveUserDataDir(\n  userDataDir?: string | boolean,\n): string | undefined {\n  if (userDataDir === true) {\n    return DEFAULT_USER_DATA_DIR;\n  }\n  if (typeof userDataDir === 'string') {\n    return userDataDir;\n  }\n  return undefined;\n}\n\n/**\n * Check if a cookie name matches a pattern (supports * wildcard)\n * @example matchesCookiePattern('SAP_SESSIONID_TRL_200', 'SAP_SESSIONID_*') // true\n */\nexport function matchesCookiePattern(\n  cookieName: string,\n  pattern: string,\n): boolean {\n  if (!pattern.includes('*')) {\n    return cookieName === pattern;\n  }\n  const regexPattern = pattern.replaceAll(/\\*/g, '.*');\n  return new RegExp(`^${regexPattern}$`).test(cookieName);\n}\n\n/**\n * Check if a cookie matches any of the required patterns\n */\nexport function cookieMatchesAny(\n  cookieName: string,\n  patterns: string[],\n): boolean {\n  return patterns.some((pattern) => matchesCookiePattern(cookieName, pattern));\n}\n","/**\n * Browser Auth Core\n *\n * Event-driven authentication logic shared by Playwright and Puppeteer adapters.\n * This module contains NO browser-specific code.\n */\n\nimport type {\n  BrowserAdapter,\n  BrowserAuthOptions,\n  BrowserCredentials,\n} from './types';\nimport {\n  matchesCookiePattern,\n  cookieMatchesAny,\n  resolveUserDataDir,\n} from './utils';\n\nconst DEFAULT_TIMEOUT = 300_000; // 5 minutes\nconst SYSTEM_INFO_PATH = '/sap/bc/adt/core/http/systeminformation';\n\nexport interface AuthenticateOptions extends BrowserAuthOptions {\n  /** Callback for logging */\n  log?: (message: string) => void;\n}\n\n/**\n * Authenticate using browser-based SSO\n *\n * This is the main entry point - it orchestrates the auth flow using the provided adapter.\n * The adapter handles browser-specific operations, this function handles the logic.\n */\nexport async function authenticate(\n  adapter: BrowserAdapter,\n  options: AuthenticateOptions,\n): Promise<BrowserCredentials> {\n  const {\n    url,\n    loginUrl,\n    headless = false,\n    timeout = DEFAULT_TIMEOUT,\n    userAgent,\n    requiredCookies,\n    userDataDir,\n    ignoreHTTPSErrors = true,\n    log = console.log,\n  } = options;\n\n  // URL to navigate to for SSO login\n  const targetUrl = loginUrl || new URL(SYSTEM_INFO_PATH, url).toString();\n  const sapHost = new URL(url).hostname;\n  const profileDir = resolveUserDataDir(userDataDir);\n\n  if (profileDir) {\n    log(`🔄 Using persistent browser profile: ${profileDir}`);\n  }\n\n  try {\n    // Step 1: Launch browser\n    await adapter.launch({\n      headless,\n      userDataDir: profileDir,\n      ignoreHTTPSErrors,\n      userAgent,\n    });\n\n    log('🔍 Opening browser...');\n    await adapter.newPage();\n\n    // Step 2: Clear old SAP cookies to ensure we capture fresh ones\n    // This is critical for re-authentication - old cookies may be stale\n    log('🧹 Clearing old SAP cookies...');\n    await adapter.clearCookies(sapHost);\n\n    // Step 3: Wait for authentication (required cookies appear after SSO)\n    log('🌐 Complete SSO login if prompted...');\n\n    const cookiesToWait =\n      requiredCookies && requiredCookies.length > 0\n        ? requiredCookies\n        : ['SAP_SESSIONID_*']; // Default: wait for session cookie\n\n    log(`⏳ Waiting for cookies: ${cookiesToWait.join(', ')}`);\n\n    const sapCookies = await new Promise<\n      Awaited<ReturnType<typeof adapter.getCookies>>\n    >((resolve, reject) => {\n      const timeoutId = setTimeout(() => {\n        reject(new Error('Authentication timeout - SSO not completed'));\n      }, timeout);\n\n      adapter.onPageClose(() => {\n        clearTimeout(timeoutId);\n        reject(new Error('Authentication cancelled - browser was closed'));\n      });\n\n      // Check for required cookies on every response from SAP domain\n      adapter.onResponse(async (event) => {\n        // Check responses from SAP domain (not just targetUrl, since SSO may redirect)\n        const eventHost = new URL(event.url).hostname;\n        const isSapDomain =\n          eventHost === sapHost ||\n          eventHost.endsWith('.' + sapHost) ||\n          sapHost.endsWith('.' + eventHost);\n\n        if (isSapDomain && event.status === 200) {\n          // Got 200 from SAP domain - check if required cookies are set\n          const allCookies = await adapter.getCookies();\n          const domainCookies = allCookies.filter(\n            (c) =>\n              c.domain.includes(sapHost) ||\n              sapHost.includes(c.domain.replace(/^\\./, '')),\n          );\n          const matchedCookies = domainCookies.filter((c) =>\n            cookieMatchesAny(c.name, cookiesToWait),\n          );\n          const allFound = cookiesToWait.every((pattern) =>\n            matchedCookies.some((c) => matchesCookiePattern(c.name, pattern)),\n          );\n\n          if (allFound) {\n            clearTimeout(timeoutId);\n            log('✅ Authentication complete!');\n            log(\n              `🍪 Found required cookies: ${matchedCookies.map((c) => c.name).join(', ')}`,\n            );\n            resolve(matchedCookies);\n          }\n          // If cookies not found yet, keep waiting for more responses\n        }\n      });\n\n      // Navigate - events are already set up; navigation errors are expected\n      // (auth flow handles results through response event listeners, not navigation result)\n      // eslint-disable-next-line @typescript-eslint/no-empty-function\n      adapter.goto(targetUrl, { timeout: 30000 }).catch(() => {});\n    });\n\n    await adapter.closePage();\n\n    // Validate cookies\n    if (requiredCookies && requiredCookies.length > 0) {\n      const missingPatterns = requiredCookies.filter(\n        (pattern) =>\n          !sapCookies.some((c) => matchesCookiePattern(c.name, pattern)),\n      );\n      if (missingPatterns.length > 0) {\n        throw new Error(\n          `Missing required cookies: ${missingPatterns.join(', ')}`,\n        );\n      }\n    }\n\n    if (sapCookies.length === 0) {\n      throw new Error(\n        'No SAP cookies captured - authentication may have failed',\n      );\n    }\n\n    const cookieNames = sapCookies.map((c) => c.name).join(', ');\n    log(`🍪 Captured ${sapCookies.length} cookies: ${cookieNames}`);\n\n    // Get user agent\n    const userAgentString = userAgent || (await adapter.getUserAgent());\n\n    return {\n      baseUrl: url,\n      cookies: sapCookies,\n      authenticatedAt: new Date(),\n      userAgent: userAgentString,\n    };\n  } finally {\n    await adapter.close();\n  }\n}\n\n/**\n * Test if credentials are still valid\n */\nexport async function testCredentials(\n  credentials: BrowserCredentials,\n  options?: { timeout?: number },\n): Promise<{ valid: boolean; error?: string; responseTime?: number }> {\n  const startTime = Date.now();\n  const testUrl = new URL(SYSTEM_INFO_PATH, credentials.baseUrl);\n\n  try {\n    const cookieHeader = credentials.cookies\n      .map((c) => `${c.name}=${c.value}`)\n      .join('; ');\n\n    const response = await fetch(testUrl.toString(), {\n      headers: {\n        Cookie: cookieHeader,\n        Accept: 'application/xml',\n      },\n      signal: options?.timeout\n        ? AbortSignal.timeout(options.timeout)\n        : undefined,\n    });\n\n    const text = await response.text();\n\n    // Check for SAML redirect (session expired)\n    if (text.includes('SAMLRequest') || text.includes('SAMLResponse')) {\n      return {\n        valid: false,\n        error: 'Session expired - SAML redirect detected',\n        responseTime: Date.now() - startTime,\n      };\n    }\n\n    return {\n      valid: response.ok,\n      error: response.ok ? undefined : `HTTP ${response.status}`,\n      responseTime: Date.now() - startTime,\n    };\n  } catch (error) {\n    return {\n      valid: false,\n      error: error instanceof Error ? error.message : String(error),\n      responseTime: Date.now() - startTime,\n    };\n  }\n}\n\n/**\n * Convert credentials to HTTP cookie header\n */\nexport function toCookieHeader(credentials: BrowserCredentials): string {\n  return credentials.cookies.map((c) => `${c.name}=${c.value}`).join('; ');\n}\n\n/**\n * Convert credentials to HTTP headers object\n */\nexport function toHeaders(\n  credentials: BrowserCredentials,\n): Record<string, string> {\n  return {\n    Cookie: toCookieHeader(credentials),\n    ...(credentials.userAgent ? { 'User-Agent': credentials.userAgent } : {}),\n  };\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,wBAAwB,KAAK,QAAQ,GAAG,QAAQ,iBAAiB;;;;AAKvE,SAAgB,mBACd,aACoB;CACpB,IAAI,gBAAgB,MAClB,OAAO;CAET,IAAI,OAAO,gBAAgB,UACzB,OAAO;AAGX;;;;;AAMA,SAAgB,qBACd,YACA,SACS;CACT,IAAI,CAAC,QAAQ,SAAS,GAAG,GACvB,OAAO,eAAe;CAExB,MAAM,eAAe,QAAQ,WAAW,OAAO,IAAI;CACnD,OAAO,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC,CAAC,KAAK,UAAU;AACxD;;;;AAKA,SAAgB,iBACd,YACA,UACS;CACT,OAAO,SAAS,MAAM,YAAY,qBAAqB,YAAY,OAAO,CAAC;AAC7E;;;;AC/BA,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;;;;;;;AAazB,eAAsB,aACpB,SACA,SAC6B;CAC7B,MAAM,EACJ,KACA,UACA,WAAW,OACX,UAAU,iBACV,WACA,iBACA,aACA,oBAAoB,MACpB,MAAM,QAAQ,QACZ;CAGJ,MAAM,YAAY,YAAY,IAAI,IAAI,kBAAkB,GAAG,CAAC,CAAC,SAAS;CACtE,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC;CAC7B,MAAM,aAAa,mBAAmB,WAAW;CAEjD,IAAI,YACF,IAAI,wCAAwC,YAAY;CAG1D,IAAI;EAEF,MAAM,QAAQ,OAAO;GACnB;GACA,aAAa;GACb;GACA;EACF,CAAC;EAED,IAAI,uBAAuB;EAC3B,MAAM,QAAQ,QAAQ;EAItB,IAAI,gCAAgC;EACpC,MAAM,QAAQ,aAAa,OAAO;EAGlC,IAAI,sCAAsC;EAE1C,MAAM,gBACJ,mBAAmB,gBAAgB,SAAS,IACxC,kBACA,CAAC,iBAAiB;EAExB,IAAI,0BAA0B,cAAc,KAAK,IAAI,GAAG;EAExD,MAAM,aAAa,MAAM,IAAI,SAE1B,SAAS,WAAW;GACrB,MAAM,YAAY,iBAAiB;IACjC,uBAAO,IAAI,MAAM,4CAA4C,CAAC;GAChE,GAAG,OAAO;GAEV,QAAQ,kBAAkB;IACxB,aAAa,SAAS;IACtB,uBAAO,IAAI,MAAM,+CAA+C,CAAC;GACnE,CAAC;GAGD,QAAQ,WAAW,OAAO,UAAU;IAElC,MAAM,YAAY,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC;IAMrC,KAJE,cAAc,WACd,UAAU,SAAS,MAAM,OAAO,KAChC,QAAQ,SAAS,MAAM,SAAS,MAEf,MAAM,WAAW,KAAK;KAQvC,MAAM,kBALgB,MADG,QAAQ,WAAW,EACZ,CAAC,QAC9B,MACC,EAAE,OAAO,SAAS,OAAO,KACzB,QAAQ,SAAS,EAAE,OAAO,QAAQ,OAAO,EAAE,CAAC,CAEb,CAAC,CAAC,QAAQ,MAC3C,iBAAiB,EAAE,MAAM,aAAa,CACxC;KAKA,IAJiB,cAAc,OAAO,YACpC,eAAe,MAAM,MAAM,qBAAqB,EAAE,MAAM,OAAO,CAAC,CAGvD,GAAG;MACZ,aAAa,SAAS;MACtB,IAAI,4BAA4B;MAChC,IACE,8BAA8B,eAAe,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAC3E;MACA,QAAQ,cAAc;KACxB;IAEF;GACF,CAAC;GAKD,QAAQ,KAAK,WAAW,EAAE,SAAS,IAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;EAC5D,CAAC;EAED,MAAM,QAAQ,UAAU;EAGxB,IAAI,mBAAmB,gBAAgB,SAAS,GAAG;GACjD,MAAM,kBAAkB,gBAAgB,QACrC,YACC,CAAC,WAAW,MAAM,MAAM,qBAAqB,EAAE,MAAM,OAAO,CAAC,CACjE;GACA,IAAI,gBAAgB,SAAS,GAC3B,MAAM,IAAI,MACR,6BAA6B,gBAAgB,KAAK,IAAI,GACxD;EAEJ;EAEA,IAAI,WAAW,WAAW,GACxB,MAAM,IAAI,MACR,0DACF;EAGF,MAAM,cAAc,WAAW,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;EAC3D,IAAI,eAAe,WAAW,OAAO,YAAY,aAAa;EAG9D,MAAM,kBAAkB,aAAc,MAAM,QAAQ,aAAa;EAEjE,OAAO;GACL,SAAS;GACT,SAAS;GACT,iCAAiB,IAAI,KAAK;GAC1B,WAAW;EACb;CACF,UAAU;EACR,MAAM,QAAQ,MAAM;CACtB;AACF;;;;AAKA,eAAsB,gBACpB,aACA,SACoE;CACpE,MAAM,YAAY,KAAK,IAAI;CAC3B,MAAM,UAAU,IAAI,IAAI,kBAAkB,YAAY,OAAO;CAE7D,IAAI;EACF,MAAM,eAAe,YAAY,QAC9B,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC,CAClC,KAAK,IAAI;EAEZ,MAAM,WAAW,MAAM,MAAM,QAAQ,SAAS,GAAG;GAC/C,SAAS;IACP,QAAQ;IACR,QAAQ;GACV;GACA,QAAQ,SAAS,UACb,YAAY,QAAQ,QAAQ,OAAO,IACnC;EACN,CAAC;EAED,MAAM,OAAO,MAAM,SAAS,KAAK;EAGjC,IAAI,KAAK,SAAS,aAAa,KAAK,KAAK,SAAS,cAAc,GAC9D,OAAO;GACL,OAAO;GACP,OAAO;GACP,cAAc,KAAK,IAAI,IAAI;EAC7B;EAGF,OAAO;GACL,OAAO,SAAS;GAChB,OAAO,SAAS,KAAK,SAAY,QAAQ,SAAS;GAClD,cAAc,KAAK,IAAI,IAAI;EAC7B;CACF,SAAS,OAAO;EACd,OAAO;GACL,OAAO;GACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC5D,cAAc,KAAK,IAAI,IAAI;EAC7B;CACF;AACF;;;;AAKA,SAAgB,eAAe,aAAyC;CACtE,OAAO,YAAY,QAAQ,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI;AACzE;;;;AAKA,SAAgB,UACd,aACwB;CACxB,OAAO;EACL,QAAQ,eAAe,WAAW;EAClC,GAAI,YAAY,YAAY,EAAE,cAAc,YAAY,UAAU,IAAI,CAAC;CACzE;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abapify/browser-auth",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "Browser-based SSO authentication core - shared logic for Playwright/Puppeteer plugins",
   "license": "MIT",
   "publishConfig": {
@@ -17,7 +17,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@abapify/adt-config": "0.4.1"
+    "@abapify/adt-config": "0.4.3"
   },
   "devDependencies": {
     "@types/node": "^22.10.2"