@abapify/browser-auth 0.4.16 → 0.4.19

package/dist/index.d.mts

@@ -1,4 +1,3 @@
-//#region src/types.d.ts
 /**
  * Browser Auth Core Types
  *
@@ -127,8 +126,6 @@ interface TestResult {
   error?: string;
   responseTime?: number;
 }
-//#endregion
-//#region src/auth-core.d.ts
 interface AuthenticateOptions extends BrowserAuthOptions {
   /** Callback for logging */
   log?: (message: string) => void;
@@ -158,8 +155,6 @@ declare function toCookieHeader(credentials: BrowserCredentials): string;
  * Convert credentials to HTTP headers object
  */
 declare function toHeaders(credentials: BrowserCredentials): Record<string, string>;
-//#endregion
-//#region src/utils.d.ts
 /**
  * Browser Auth Utilities
  *
@@ -178,6 +173,5 @@ declare function matchesCookiePattern(cookieName: string, pattern: string): bool
  * Check if a cookie matches any of the required patterns
  */
 declare function cookieMatchesAny(cookieName: string, patterns: string[]): boolean;
-//#endregion
 export { type AuthenticateOptions, type BrowserAdapter, type BrowserAuthOptions, type BrowserCredentials, type CookieData, type ResponseEvent, type TestResult, authenticate, cookieMatchesAny, matchesCookiePattern, resolveUserDataDir, testCredentials, toCookieHeader, toHeaders };
 //# sourceMappingURL=index.d.mts.map

package/dist/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/auth-core.ts","../src/utils.ts"],"mappings":";;;;;;;;;;UAUiB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;UAMe;;EAEf;;EAEA,SAAS;;EAET,iBAAiB;;EAEjB;;;;;UAMe;;EAEf;;;;;;EAMA;;EAEA;;EAEA;;EAEA;;;;;;EAMA;;EAEA;;EAEA;;;;;UAMe;EACf;EACA;;;;;UAMe;;;;EAIf,OAAO;IACL;IACA;IACA;IACA;MACE;;;;EAKJ,WAAW;;;;EAKX,KAAK,aAAa;IAAY;MAAqB;;;;EAKnD,cAAc,QAAQ;;;;EAKtB,aAAa,iBAAiB;;;;EAK9B,gBAAgB;;;;EAKhB,aAAa;;;;EAKb,SAAS;;;;EAKT,WAAW,UAAU,OAAO;;;;EAK5B,YAAY;;;;;UAMG;EACf;EACA;EACA;;;;UCtHe,4BAA4B;;EAE3C,OAAO;;;;;;;;iBASa,aACpB,SAAS,gBACT,SAAS,sBACR,QAAQ;;;;iBAgJW,gBACpB,aAAa,oBACb;EAAY;IACX;EAAU;EAAgB;EAAgB;;;;;iBA+C7B,eAAe,aAAa;;;;iBAO5B,UACd,aAAa,qBACZ;;;;;;;;;;;iBChOa,mBACd;;;;;iBAec,qBACd,oBACA;;;;iBAYc,iBACd,oBACA"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../src/types.ts","../src/auth-core.ts","../src/utils.ts"],"mappings":";;;;;;;;;UAUiB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;;;;;UAMe;;EAEf;;EAEA,SAAS;;EAET,iBAAiB;;EAEjB;;;;;UAMe;;EAEf;;;;;;EAMA;;EAEA;;EAEA;;EAEA;;;;;;EAMA;;EAEA;;EAEA;;;;;UAMe;EACf;EACA;;;;;UAMe;;;;EAIf,OAAO;IACL;IACA;IACA;IACA;MACE;;;;EAKJ,WAAW;;;;EAKX,KAAK,aAAa;IAAY;MAAqB;;;;EAKnD,cAAc,QAAQ;;;;EAKtB,aAAa,iBAAiB;;;;EAK9B,gBAAgB;;;;EAKhB,aAAa;;;;EAKb,SAAS;;;;EAKT,WAAW,UAAU,OAAO;;;;EAK5B,YAAY;;;;;UAMG;EACf;EACA;EACA;;UCtHe,4BAA4B;;EAE3C,OAAO;;;;;;;;iBASa,aACpB,SAAS,gBACT,SAAS,sBACR,QAAQ;;;;iBAgJW,gBACpB,aAAa,oBACb;EAAY;IACX;EAAU;EAAgB;EAAgB;;;;;iBA+C7B,eAAe,aAAa;;;;iBAO5B,UACd,aAAa,qBACZ;;;;;;;;;iBChOa,mBACd;;;;;iBAec,qBACd,oBACA;;;;iBAYc,iBACd,oBACA"}

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import { homedir } from "node:os";
 import { join } from "node:path";
 
-//#region src/utils.ts
+// src/utils.ts
 /**
 * Browser Auth Utilities
 *
@@ -31,8 +31,7 @@ function cookieMatchesAny(cookieName, patterns) {
 	return patterns.some((pattern) => matchesCookiePattern(cookieName, pattern));
 }
 
-//#endregion
-//#region src/auth-core.ts
+// src/auth-core.ts
 const DEFAULT_TIMEOUT = 3e5;
 const SYSTEM_INFO_PATH = "/sap/bc/adt/core/http/systeminformation";
 /**
@@ -152,6 +151,5 @@ function toHeaders(credentials) {
 	};
 }
 
-//#endregion
 export { authenticate, cookieMatchesAny, matchesCookiePattern, resolveUserDataDir, testCredentials, toCookieHeader, toHeaders };
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../src/utils.ts","../src/auth-core.ts"],"sourcesContent":["/**\n * Browser Auth Utilities\n *\n * Cookie matching and path resolution utilities.\n */\n\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\n\nconst DEFAULT_USER_DATA_DIR = join(homedir(), '.adt', 'browser-profile');\n\n/**\n * Resolve userDataDir configuration to an absolute path\n */\nexport function resolveUserDataDir(\n  userDataDir?: string | boolean,\n): string | undefined {\n  if (userDataDir === true) {\n    return DEFAULT_USER_DATA_DIR;\n  }\n  if (typeof userDataDir === 'string') {\n    return userDataDir;\n  }\n  return undefined;\n}\n\n/**\n * Check if a cookie name matches a pattern (supports * wildcard)\n * @example matchesCookiePattern('SAP_SESSIONID_TRL_200', 'SAP_SESSIONID_*') // true\n */\nexport function matchesCookiePattern(\n  cookieName: string,\n  pattern: string,\n): boolean {\n  if (!pattern.includes('*')) {\n    return cookieName === pattern;\n  }\n  const regexPattern = pattern.replaceAll(/\\*/g, '.*');\n  return new RegExp(`^${regexPattern}$`).test(cookieName);\n}\n\n/**\n * Check if a cookie matches any of the required patterns\n */\nexport function cookieMatchesAny(\n  cookieName: string,\n  patterns: string[],\n): boolean {\n  return patterns.some((pattern) => matchesCookiePattern(cookieName, pattern));\n}\n","/**\n * Browser Auth Core\n *\n * Event-driven authentication logic shared by Playwright and Puppeteer adapters.\n * This module contains NO browser-specific code.\n */\n\nimport type {\n  BrowserAdapter,\n  BrowserAuthOptions,\n  BrowserCredentials,\n} from './types';\nimport {\n  matchesCookiePattern,\n  cookieMatchesAny,\n  resolveUserDataDir,\n} from './utils';\n\nconst DEFAULT_TIMEOUT = 300_000; // 5 minutes\nconst SYSTEM_INFO_PATH = '/sap/bc/adt/core/http/systeminformation';\n\nexport interface AuthenticateOptions extends BrowserAuthOptions {\n  /** Callback for logging */\n  log?: (message: string) => void;\n}\n\n/**\n * Authenticate using browser-based SSO\n *\n * This is the main entry point - it orchestrates the auth flow using the provided adapter.\n * The adapter handles browser-specific operations, this function handles the logic.\n */\nexport async function authenticate(\n  adapter: BrowserAdapter,\n  options: AuthenticateOptions,\n): Promise<BrowserCredentials> {\n  const {\n    url,\n    loginUrl,\n    headless = false,\n    timeout = DEFAULT_TIMEOUT,\n    userAgent,\n    requiredCookies,\n    userDataDir,\n    ignoreHTTPSErrors = true,\n    log = console.log,\n  } = options;\n\n  // URL to navigate to for SSO login\n  const targetUrl = loginUrl || new URL(SYSTEM_INFO_PATH, url).toString();\n  const sapHost = new URL(url).hostname;\n  const profileDir = resolveUserDataDir(userDataDir);\n\n  if (profileDir) {\n    log(`🔄 Using persistent browser profile: ${profileDir}`);\n  }\n\n  try {\n    // Step 1: Launch browser\n    await adapter.launch({\n      headless,\n      userDataDir: profileDir,\n      ignoreHTTPSErrors,\n      userAgent,\n    });\n\n    log('🔍 Opening browser...');\n    await adapter.newPage();\n\n    // Step 2: Clear old SAP cookies to ensure we capture fresh ones\n    // This is critical for re-authentication - old cookies may be stale\n    log('🧹 Clearing old SAP cookies...');\n    await adapter.clearCookies(sapHost);\n\n    // Step 3: Wait for authentication (required cookies appear after SSO)\n    log('🌐 Complete SSO login if prompted...');\n\n    const cookiesToWait =\n      requiredCookies && requiredCookies.length > 0\n        ? requiredCookies\n        : ['SAP_SESSIONID_*']; // Default: wait for session cookie\n\n    log(`⏳ Waiting for cookies: ${cookiesToWait.join(', ')}`);\n\n    const sapCookies = await new Promise<\n      Awaited<ReturnType<typeof adapter.getCookies>>\n    >((resolve, reject) => {\n      const timeoutId = setTimeout(() => {\n        reject(new Error('Authentication timeout - SSO not completed'));\n      }, timeout);\n\n      adapter.onPageClose(() => {\n        clearTimeout(timeoutId);\n        reject(new Error('Authentication cancelled - browser was closed'));\n      });\n\n      // Check for required cookies on every response from SAP domain\n      adapter.onResponse(async (event) => {\n        // Check responses from SAP domain (not just targetUrl, since SSO may redirect)\n        const eventHost = new URL(event.url).hostname;\n        const isSapDomain =\n          eventHost === sapHost ||\n          eventHost.endsWith('.' + sapHost) ||\n          sapHost.endsWith('.' + eventHost);\n\n        if (isSapDomain && event.status === 200) {\n          // Got 200 from SAP domain - check if required cookies are set\n          const allCookies = await adapter.getCookies();\n          const domainCookies = allCookies.filter(\n            (c) =>\n              c.domain.includes(sapHost) ||\n              sapHost.includes(c.domain.replace(/^\\./, '')),\n          );\n          const matchedCookies = domainCookies.filter((c) =>\n            cookieMatchesAny(c.name, cookiesToWait),\n          );\n          const allFound = cookiesToWait.every((pattern) =>\n            matchedCookies.some((c) => matchesCookiePattern(c.name, pattern)),\n          );\n\n          if (allFound) {\n            clearTimeout(timeoutId);\n            log('✅ Authentication complete!');\n            log(\n              `🍪 Found required cookies: ${matchedCookies.map((c) => c.name).join(', ')}`,\n            );\n            resolve(matchedCookies);\n          }\n          // If cookies not found yet, keep waiting for more responses\n        }\n      });\n\n      // Navigate - events are already set up; navigation errors are expected\n      // (auth flow handles results through response event listeners, not navigation result)\n      // eslint-disable-next-line @typescript-eslint/no-empty-function\n      adapter.goto(targetUrl, { timeout: 30000 }).catch(() => {});\n    });\n\n    await adapter.closePage();\n\n    // Validate cookies\n    if (requiredCookies && requiredCookies.length > 0) {\n      const missingPatterns = requiredCookies.filter(\n        (pattern) =>\n          !sapCookies.some((c) => matchesCookiePattern(c.name, pattern)),\n      );\n      if (missingPatterns.length > 0) {\n        throw new Error(\n          `Missing required cookies: ${missingPatterns.join(', ')}`,\n        );\n      }\n    }\n\n    if (sapCookies.length === 0) {\n      throw new Error(\n        'No SAP cookies captured - authentication may have failed',\n      );\n    }\n\n    const cookieNames = sapCookies.map((c) => c.name).join(', ');\n    log(`🍪 Captured ${sapCookies.length} cookies: ${cookieNames}`);\n\n    // Get user agent\n    const userAgentString = userAgent || (await adapter.getUserAgent());\n\n    return {\n      baseUrl: url,\n      cookies: sapCookies,\n      authenticatedAt: new Date(),\n      userAgent: userAgentString,\n    };\n  } finally {\n    await adapter.close();\n  }\n}\n\n/**\n * Test if credentials are still valid\n */\nexport async function testCredentials(\n  credentials: BrowserCredentials,\n  options?: { timeout?: number },\n): Promise<{ valid: boolean; error?: string; responseTime?: number }> {\n  const startTime = Date.now();\n  const testUrl = new URL(SYSTEM_INFO_PATH, credentials.baseUrl);\n\n  try {\n    const cookieHeader = credentials.cookies\n      .map((c) => `${c.name}=${c.value}`)\n      .join('; ');\n\n    const response = await fetch(testUrl.toString(), {\n      headers: {\n        Cookie: cookieHeader,\n        Accept: 'application/xml',\n      },\n      signal: options?.timeout\n        ? AbortSignal.timeout(options.timeout)\n        : undefined,\n    });\n\n    const text = await response.text();\n\n    // Check for SAML redirect (session expired)\n    if (text.includes('SAMLRequest') || text.includes('SAMLResponse')) {\n      return {\n        valid: false,\n        error: 'Session expired - SAML redirect detected',\n        responseTime: Date.now() - startTime,\n      };\n    }\n\n    return {\n      valid: response.ok,\n      error: response.ok ? undefined : `HTTP ${response.status}`,\n      responseTime: Date.now() - startTime,\n    };\n  } catch (error) {\n    return {\n      valid: false,\n      error: error instanceof Error ? error.message : String(error),\n      responseTime: Date.now() - startTime,\n    };\n  }\n}\n\n/**\n * Convert credentials to HTTP cookie header\n */\nexport function toCookieHeader(credentials: BrowserCredentials): string {\n  return credentials.cookies.map((c) => `${c.name}=${c.value}`).join('; ');\n}\n\n/**\n * Convert credentials to HTTP headers object\n */\nexport function toHeaders(\n  credentials: BrowserCredentials,\n): Record<string, string> {\n  return {\n    Cookie: toCookieHeader(credentials),\n    ...(credentials.userAgent ? { 'User-Agent': credentials.userAgent } : {}),\n  };\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,wBAAwB,KAAK,QAAQ,GAAG,QAAQ,iBAAiB;;;;AAKvE,SAAgB,mBACd,aACoB;CACpB,IAAI,gBAAgB,MAClB,OAAO;CAET,IAAI,OAAO,gBAAgB,UACzB,OAAO;AAGX;;;;;AAMA,SAAgB,qBACd,YACA,SACS;CACT,IAAI,CAAC,QAAQ,SAAS,GAAG,GACvB,OAAO,eAAe;CAExB,MAAM,eAAe,QAAQ,WAAW,OAAO,IAAI;CACnD,OAAO,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC,CAAC,KAAK,UAAU;AACxD;;;;AAKA,SAAgB,iBACd,YACA,UACS;CACT,OAAO,SAAS,MAAM,YAAY,qBAAqB,YAAY,OAAO,CAAC;AAC7E;;;;AC/BA,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;;;;;;;AAazB,eAAsB,aACpB,SACA,SAC6B;CAC7B,MAAM,EACJ,KACA,UACA,WAAW,OACX,UAAU,iBACV,WACA,iBACA,aACA,oBAAoB,MACpB,MAAM,QAAQ,QACZ;CAGJ,MAAM,YAAY,YAAY,IAAI,IAAI,kBAAkB,GAAG,CAAC,CAAC,SAAS;CACtE,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC;CAC7B,MAAM,aAAa,mBAAmB,WAAW;CAEjD,IAAI,YACF,IAAI,wCAAwC,YAAY;CAG1D,IAAI;EAEF,MAAM,QAAQ,OAAO;GACnB;GACA,aAAa;GACb;GACA;EACF,CAAC;EAED,IAAI,uBAAuB;EAC3B,MAAM,QAAQ,QAAQ;EAItB,IAAI,gCAAgC;EACpC,MAAM,QAAQ,aAAa,OAAO;EAGlC,IAAI,sCAAsC;EAE1C,MAAM,gBACJ,mBAAmB,gBAAgB,SAAS,IACxC,kBACA,CAAC,iBAAiB;EAExB,IAAI,0BAA0B,cAAc,KAAK,IAAI,GAAG;EAExD,MAAM,aAAa,MAAM,IAAI,SAE1B,SAAS,WAAW;GACrB,MAAM,YAAY,iBAAiB;IACjC,uBAAO,IAAI,MAAM,4CAA4C,CAAC;GAChE,GAAG,OAAO;GAEV,QAAQ,kBAAkB;IACxB,aAAa,SAAS;IACtB,uBAAO,IAAI,MAAM,+CAA+C,CAAC;GACnE,CAAC;GAGD,QAAQ,WAAW,OAAO,UAAU;IAElC,MAAM,YAAY,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC;IAMrC,KAJE,cAAc,WACd,UAAU,SAAS,MAAM,OAAO,KAChC,QAAQ,SAAS,MAAM,SAAS,MAEf,MAAM,WAAW,KAAK;KAQvC,MAAM,kBALgB,MADG,QAAQ,WAAW,EACZ,CAAC,QAC9B,MACC,EAAE,OAAO,SAAS,OAAO,KACzB,QAAQ,SAAS,EAAE,OAAO,QAAQ,OAAO,EAAE,CAAC,CAEb,CAAC,CAAC,QAAQ,MAC3C,iBAAiB,EAAE,MAAM,aAAa,CACxC;KAKA,IAJiB,cAAc,OAAO,YACpC,eAAe,MAAM,MAAM,qBAAqB,EAAE,MAAM,OAAO,CAAC,CAGvD,GAAG;MACZ,aAAa,SAAS;MACtB,IAAI,4BAA4B;MAChC,IACE,8BAA8B,eAAe,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAC3E;MACA,QAAQ,cAAc;KACxB;IAEF;GACF,CAAC;GAKD,QAAQ,KAAK,WAAW,EAAE,SAAS,IAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;EAC5D,CAAC;EAED,MAAM,QAAQ,UAAU;EAGxB,IAAI,mBAAmB,gBAAgB,SAAS,GAAG;GACjD,MAAM,kBAAkB,gBAAgB,QACrC,YACC,CAAC,WAAW,MAAM,MAAM,qBAAqB,EAAE,MAAM,OAAO,CAAC,CACjE;GACA,IAAI,gBAAgB,SAAS,GAC3B,MAAM,IAAI,MACR,6BAA6B,gBAAgB,KAAK,IAAI,GACxD;EAEJ;EAEA,IAAI,WAAW,WAAW,GACxB,MAAM,IAAI,MACR,0DACF;EAGF,MAAM,cAAc,WAAW,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;EAC3D,IAAI,eAAe,WAAW,OAAO,YAAY,aAAa;EAG9D,MAAM,kBAAkB,aAAc,MAAM,QAAQ,aAAa;EAEjE,OAAO;GACL,SAAS;GACT,SAAS;GACT,iCAAiB,IAAI,KAAK;GAC1B,WAAW;EACb;CACF,UAAU;EACR,MAAM,QAAQ,MAAM;CACtB;AACF;;;;AAKA,eAAsB,gBACpB,aACA,SACoE;CACpE,MAAM,YAAY,KAAK,IAAI;CAC3B,MAAM,UAAU,IAAI,IAAI,kBAAkB,YAAY,OAAO;CAE7D,IAAI;EACF,MAAM,eAAe,YAAY,QAC9B,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC,CAClC,KAAK,IAAI;EAEZ,MAAM,WAAW,MAAM,MAAM,QAAQ,SAAS,GAAG;GAC/C,SAAS;IACP,QAAQ;IACR,QAAQ;GACV;GACA,QAAQ,SAAS,UACb,YAAY,QAAQ,QAAQ,OAAO,IACnC;EACN,CAAC;EAED,MAAM,OAAO,MAAM,SAAS,KAAK;EAGjC,IAAI,KAAK,SAAS,aAAa,KAAK,KAAK,SAAS,cAAc,GAC9D,OAAO;GACL,OAAO;GACP,OAAO;GACP,cAAc,KAAK,IAAI,IAAI;EAC7B;EAGF,OAAO;GACL,OAAO,SAAS;GAChB,OAAO,SAAS,KAAK,SAAY,QAAQ,SAAS;GAClD,cAAc,KAAK,IAAI,IAAI;EAC7B;CACF,SAAS,OAAO;EACd,OAAO;GACL,OAAO;GACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC5D,cAAc,KAAK,IAAI,IAAI;EAC7B;CACF;AACF;;;;AAKA,SAAgB,eAAe,aAAyC;CACtE,OAAO,YAAY,QAAQ,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI;AACzE;;;;AAKA,SAAgB,UACd,aACwB;CACxB,OAAO;EACL,QAAQ,eAAe,WAAW;EAClC,GAAI,YAAY,YAAY,EAAE,cAAc,YAAY,UAAU,IAAI,CAAC;CACzE;AACF"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../src/utils.ts","../src/auth-core.ts"],"sourcesContent":["/**\n * Browser Auth Utilities\n *\n * Cookie matching and path resolution utilities.\n */\n\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\n\nconst DEFAULT_USER_DATA_DIR = join(homedir(), '.adt', 'browser-profile');\n\n/**\n * Resolve userDataDir configuration to an absolute path\n */\nexport function resolveUserDataDir(\n  userDataDir?: string | boolean,\n): string | undefined {\n  if (userDataDir === true) {\n    return DEFAULT_USER_DATA_DIR;\n  }\n  if (typeof userDataDir === 'string') {\n    return userDataDir;\n  }\n  return undefined;\n}\n\n/**\n * Check if a cookie name matches a pattern (supports * wildcard)\n * @example matchesCookiePattern('SAP_SESSIONID_TRL_200', 'SAP_SESSIONID_*') // true\n */\nexport function matchesCookiePattern(\n  cookieName: string,\n  pattern: string,\n): boolean {\n  if (!pattern.includes('*')) {\n    return cookieName === pattern;\n  }\n  const regexPattern = pattern.replaceAll(/\\*/g, '.*');\n  return new RegExp(`^${regexPattern}$`).test(cookieName);\n}\n\n/**\n * Check if a cookie matches any of the required patterns\n */\nexport function cookieMatchesAny(\n  cookieName: string,\n  patterns: string[],\n): boolean {\n  return patterns.some((pattern) => matchesCookiePattern(cookieName, pattern));\n}\n","/**\n * Browser Auth Core\n *\n * Event-driven authentication logic shared by Playwright and Puppeteer adapters.\n * This module contains NO browser-specific code.\n */\n\nimport type {\n  BrowserAdapter,\n  BrowserAuthOptions,\n  BrowserCredentials,\n} from './types';\nimport {\n  matchesCookiePattern,\n  cookieMatchesAny,\n  resolveUserDataDir,\n} from './utils';\n\nconst DEFAULT_TIMEOUT = 300_000; // 5 minutes\nconst SYSTEM_INFO_PATH = '/sap/bc/adt/core/http/systeminformation';\n\nexport interface AuthenticateOptions extends BrowserAuthOptions {\n  /** Callback for logging */\n  log?: (message: string) => void;\n}\n\n/**\n * Authenticate using browser-based SSO\n *\n * This is the main entry point - it orchestrates the auth flow using the provided adapter.\n * The adapter handles browser-specific operations, this function handles the logic.\n */\nexport async function authenticate(\n  adapter: BrowserAdapter,\n  options: AuthenticateOptions,\n): Promise<BrowserCredentials> {\n  const {\n    url,\n    loginUrl,\n    headless = false,\n    timeout = DEFAULT_TIMEOUT,\n    userAgent,\n    requiredCookies,\n    userDataDir,\n    ignoreHTTPSErrors = true,\n    log = console.log,\n  } = options;\n\n  // URL to navigate to for SSO login\n  const targetUrl = loginUrl || new URL(SYSTEM_INFO_PATH, url).toString();\n  const sapHost = new URL(url).hostname;\n  const profileDir = resolveUserDataDir(userDataDir);\n\n  if (profileDir) {\n    log(`🔄 Using persistent browser profile: ${profileDir}`);\n  }\n\n  try {\n    // Step 1: Launch browser\n    await adapter.launch({\n      headless,\n      userDataDir: profileDir,\n      ignoreHTTPSErrors,\n      userAgent,\n    });\n\n    log('🔍 Opening browser...');\n    await adapter.newPage();\n\n    // Step 2: Clear old SAP cookies to ensure we capture fresh ones\n    // This is critical for re-authentication - old cookies may be stale\n    log('🧹 Clearing old SAP cookies...');\n    await adapter.clearCookies(sapHost);\n\n    // Step 3: Wait for authentication (required cookies appear after SSO)\n    log('🌐 Complete SSO login if prompted...');\n\n    const cookiesToWait =\n      requiredCookies && requiredCookies.length > 0\n        ? requiredCookies\n        : ['SAP_SESSIONID_*']; // Default: wait for session cookie\n\n    log(`⏳ Waiting for cookies: ${cookiesToWait.join(', ')}`);\n\n    const sapCookies = await new Promise<\n      Awaited<ReturnType<typeof adapter.getCookies>>\n    >((resolve, reject) => {\n      const timeoutId = setTimeout(() => {\n        reject(new Error('Authentication timeout - SSO not completed'));\n      }, timeout);\n\n      adapter.onPageClose(() => {\n        clearTimeout(timeoutId);\n        reject(new Error('Authentication cancelled - browser was closed'));\n      });\n\n      // Check for required cookies on every response from SAP domain\n      adapter.onResponse(async (event) => {\n        // Check responses from SAP domain (not just targetUrl, since SSO may redirect)\n        const eventHost = new URL(event.url).hostname;\n        const isSapDomain =\n          eventHost === sapHost ||\n          eventHost.endsWith('.' + sapHost) ||\n          sapHost.endsWith('.' + eventHost);\n\n        if (isSapDomain && event.status === 200) {\n          // Got 200 from SAP domain - check if required cookies are set\n          const allCookies = await adapter.getCookies();\n          const domainCookies = allCookies.filter(\n            (c) =>\n              c.domain.includes(sapHost) ||\n              sapHost.includes(c.domain.replace(/^\\./, '')),\n          );\n          const matchedCookies = domainCookies.filter((c) =>\n            cookieMatchesAny(c.name, cookiesToWait),\n          );\n          const allFound = cookiesToWait.every((pattern) =>\n            matchedCookies.some((c) => matchesCookiePattern(c.name, pattern)),\n          );\n\n          if (allFound) {\n            clearTimeout(timeoutId);\n            log('✅ Authentication complete!');\n            log(\n              `🍪 Found required cookies: ${matchedCookies.map((c) => c.name).join(', ')}`,\n            );\n            resolve(matchedCookies);\n          }\n          // If cookies not found yet, keep waiting for more responses\n        }\n      });\n\n      // Navigate - events are already set up; navigation errors are expected\n      // (auth flow handles results through response event listeners, not navigation result)\n      // eslint-disable-next-line @typescript-eslint/no-empty-function\n      adapter.goto(targetUrl, { timeout: 30000 }).catch(() => {});\n    });\n\n    await adapter.closePage();\n\n    // Validate cookies\n    if (requiredCookies && requiredCookies.length > 0) {\n      const missingPatterns = requiredCookies.filter(\n        (pattern) =>\n          !sapCookies.some((c) => matchesCookiePattern(c.name, pattern)),\n      );\n      if (missingPatterns.length > 0) {\n        throw new Error(\n          `Missing required cookies: ${missingPatterns.join(', ')}`,\n        );\n      }\n    }\n\n    if (sapCookies.length === 0) {\n      throw new Error(\n        'No SAP cookies captured - authentication may have failed',\n      );\n    }\n\n    const cookieNames = sapCookies.map((c) => c.name).join(', ');\n    log(`🍪 Captured ${sapCookies.length} cookies: ${cookieNames}`);\n\n    // Get user agent\n    const userAgentString = userAgent || (await adapter.getUserAgent());\n\n    return {\n      baseUrl: url,\n      cookies: sapCookies,\n      authenticatedAt: new Date(),\n      userAgent: userAgentString,\n    };\n  } finally {\n    await adapter.close();\n  }\n}\n\n/**\n * Test if credentials are still valid\n */\nexport async function testCredentials(\n  credentials: BrowserCredentials,\n  options?: { timeout?: number },\n): Promise<{ valid: boolean; error?: string; responseTime?: number }> {\n  const startTime = Date.now();\n  const testUrl = new URL(SYSTEM_INFO_PATH, credentials.baseUrl);\n\n  try {\n    const cookieHeader = credentials.cookies\n      .map((c) => `${c.name}=${c.value}`)\n      .join('; ');\n\n    const response = await fetch(testUrl.toString(), {\n      headers: {\n        Cookie: cookieHeader,\n        Accept: 'application/xml',\n      },\n      signal: options?.timeout\n        ? AbortSignal.timeout(options.timeout)\n        : undefined,\n    });\n\n    const text = await response.text();\n\n    // Check for SAML redirect (session expired)\n    if (text.includes('SAMLRequest') || text.includes('SAMLResponse')) {\n      return {\n        valid: false,\n        error: 'Session expired - SAML redirect detected',\n        responseTime: Date.now() - startTime,\n      };\n    }\n\n    return {\n      valid: response.ok,\n      error: response.ok ? undefined : `HTTP ${response.status}`,\n      responseTime: Date.now() - startTime,\n    };\n  } catch (error) {\n    return {\n      valid: false,\n      error: error instanceof Error ? error.message : String(error),\n      responseTime: Date.now() - startTime,\n    };\n  }\n}\n\n/**\n * Convert credentials to HTTP cookie header\n */\nexport function toCookieHeader(credentials: BrowserCredentials): string {\n  return credentials.cookies.map((c) => `${c.name}=${c.value}`).join('; ');\n}\n\n/**\n * Convert credentials to HTTP headers object\n */\nexport function toHeaders(\n  credentials: BrowserCredentials,\n): Record<string, string> {\n  return {\n    Cookie: toCookieHeader(credentials),\n    ...(credentials.userAgent ? { 'User-Agent': credentials.userAgent } : {}),\n  };\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,wBAAwB,KAAK,QAAQ,GAAG,QAAQ,iBAAiB;;;;AAKvE,SAAgB,mBACd,aACoB;CACpB,IAAI,gBAAgB,MAClB,OAAO;CAET,IAAI,OAAO,gBAAgB,UACzB,OAAO;AAGX;;;;;AAMA,SAAgB,qBACd,YACA,SACS;CACT,IAAI,CAAC,QAAQ,SAAS,GAAG,GACvB,OAAO,eAAe;CAExB,MAAM,eAAe,QAAQ,WAAW,OAAO,IAAI;CACnD,OAAO,IAAI,OAAO,IAAI,aAAa,EAAE,CAAC,CAAC,KAAK,UAAU;AACxD;;;;AAKA,SAAgB,iBACd,YACA,UACS;CACT,OAAO,SAAS,MAAM,YAAY,qBAAqB,YAAY,OAAO,CAAC;AAC7E;;;AC/BA,MAAM,kBAAkB;AACxB,MAAM,mBAAmB;;;;;;;AAazB,eAAsB,aACpB,SACA,SAC6B;CAC7B,MAAM,EACJ,KACA,UACA,WAAW,OACX,UAAU,iBACV,WACA,iBACA,aACA,oBAAoB,MACpB,MAAM,QAAQ,QACZ;CAGJ,MAAM,YAAY,YAAY,IAAI,IAAI,kBAAkB,GAAG,CAAC,CAAC,SAAS;CACtE,MAAM,UAAU,IAAI,IAAI,GAAG,CAAC,CAAC;CAC7B,MAAM,aAAa,mBAAmB,WAAW;CAEjD,IAAI,YACF,IAAI,wCAAwC,YAAY;CAG1D,IAAI;EAEF,MAAM,QAAQ,OAAO;GACnB;GACA,aAAa;GACb;GACA;EACF,CAAC;EAED,IAAI,uBAAuB;EAC3B,MAAM,QAAQ,QAAQ;EAItB,IAAI,gCAAgC;EACpC,MAAM,QAAQ,aAAa,OAAO;EAGlC,IAAI,sCAAsC;EAE1C,MAAM,gBACJ,mBAAmB,gBAAgB,SAAS,IACxC,kBACA,CAAC,iBAAiB;EAExB,IAAI,0BAA0B,cAAc,KAAK,IAAI,GAAG;EAExD,MAAM,aAAa,MAAM,IAAI,SAE1B,SAAS,WAAW;GACrB,MAAM,YAAY,iBAAiB;IACjC,uBAAO,IAAI,MAAM,4CAA4C,CAAC;GAChE,GAAG,OAAO;GAEV,QAAQ,kBAAkB;IACxB,aAAa,SAAS;IACtB,uBAAO,IAAI,MAAM,+CAA+C,CAAC;GACnE,CAAC;GAGD,QAAQ,WAAW,OAAO,UAAU;IAElC,MAAM,YAAY,IAAI,IAAI,MAAM,GAAG,CAAC,CAAC;IAMrC,KAJE,cAAc,WACd,UAAU,SAAS,MAAM,OAAO,KAChC,QAAQ,SAAS,MAAM,SAAS,MAEf,MAAM,WAAW,KAAK;KAQvC,MAAM,kBALgB,MADG,QAAQ,WAAW,EACZ,CAAC,QAC9B,MACC,EAAE,OAAO,SAAS,OAAO,KACzB,QAAQ,SAAS,EAAE,OAAO,QAAQ,OAAO,EAAE,CAAC,CAEb,CAAC,CAAC,QAAQ,MAC3C,iBAAiB,EAAE,MAAM,aAAa,CACxC;KAKA,IAJiB,cAAc,OAAO,YACpC,eAAe,MAAM,MAAM,qBAAqB,EAAE,MAAM,OAAO,CAAC,CAGvD,GAAG;MACZ,aAAa,SAAS;MACtB,IAAI,4BAA4B;MAChC,IACE,8BAA8B,eAAe,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,GAC3E;MACA,QAAQ,cAAc;KACxB;IAEF;GACF,CAAC;GAKD,QAAQ,KAAK,WAAW,EAAE,SAAS,IAAM,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;EAC5D,CAAC;EAED,MAAM,QAAQ,UAAU;EAGxB,IAAI,mBAAmB,gBAAgB,SAAS,GAAG;GACjD,MAAM,kBAAkB,gBAAgB,QACrC,YACC,CAAC,WAAW,MAAM,MAAM,qBAAqB,EAAE,MAAM,OAAO,CAAC,CACjE;GACA,IAAI,gBAAgB,SAAS,GAC3B,MAAM,IAAI,MACR,6BAA6B,gBAAgB,KAAK,IAAI,GACxD;EAEJ;EAEA,IAAI,WAAW,WAAW,GACxB,MAAM,IAAI,MACR,0DACF;EAGF,MAAM,cAAc,WAAW,KAAK,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI;EAC3D,IAAI,eAAe,WAAW,OAAO,YAAY,aAAa;EAG9D,MAAM,kBAAkB,aAAc,MAAM,QAAQ,aAAa;EAEjE,OAAO;GACL,SAAS;GACT,SAAS;GACT,iCAAiB,IAAI,KAAK;GAC1B,WAAW;EACb;CACF,UAAU;EACR,MAAM,QAAQ,MAAM;CACtB;AACF;;;;AAKA,eAAsB,gBACpB,aACA,SACoE;CACpE,MAAM,YAAY,KAAK,IAAI;CAC3B,MAAM,UAAU,IAAI,IAAI,kBAAkB,YAAY,OAAO;CAE7D,IAAI;EACF,MAAM,eAAe,YAAY,QAC9B,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC,CAClC,KAAK,IAAI;EAEZ,MAAM,WAAW,MAAM,MAAM,QAAQ,SAAS,GAAG;GAC/C,SAAS;IACP,QAAQ;IACR,QAAQ;GACV;GACA,QAAQ,SAAS,UACb,YAAY,QAAQ,QAAQ,OAAO,IACnC;EACN,CAAC;EAED,MAAM,OAAO,MAAM,SAAS,KAAK;EAGjC,IAAI,KAAK,SAAS,aAAa,KAAK,KAAK,SAAS,cAAc,GAC9D,OAAO;GACL,OAAO;GACP,OAAO;GACP,cAAc,KAAK,IAAI,IAAI;EAC7B;EAGF,OAAO;GACL,OAAO,SAAS;GAChB,OAAO,SAAS,KAAK,SAAY,QAAQ,SAAS;GAClD,cAAc,KAAK,IAAI,IAAI;EAC7B;CACF,SAAS,OAAO;EACd,OAAO;GACL,OAAO;GACP,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAC5D,cAAc,KAAK,IAAI,IAAI;EAC7B;CACF;AACF;;;;AAKA,SAAgB,eAAe,aAAyC;CACtE,OAAO,YAAY,QAAQ,KAAK,MAAM,GAAG,EAAE,KAAK,GAAG,EAAE,OAAO,CAAC,CAAC,KAAK,IAAI;AACzE;;;;AAKA,SAAgB,UACd,aACwB;CACxB,OAAO;EACL,QAAQ,eAAe,WAAW;EAClC,GAAI,YAAY,YAAY,EAAE,cAAc,YAAY,UAAU,IAAI,CAAC;CACzE;AACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abapify/browser-auth",
-  "version": "0.4.16",
+  "version": "0.4.19",
   "description": "Browser-based SSO authentication core - shared logic for Playwright/Puppeteer plugins",
   "license": "MIT",
   "publishConfig": {
@@ -17,7 +17,7 @@
     "README.md"
   ],
   "dependencies": {
-    "@abapify/adt-config": "0.4.16"
+    "@abapify/adt-config": "0.4.19"
   },
   "devDependencies": {
     "@types/node": "^22.10.2"