@dynatrace-oss/dynatrace-mcp-server 0.7.0 → 0.9.0

package/README.md

@@ -25,17 +25,15 @@ bringing real-time observability data directly into your development workflow.
 
 If you need help, please contact us via [GitHub Issues](https://github.com/dynatrace-oss/dynatrace-mcp/issues) if you have feature requests, questions, or need help.
 
-## Quickstart
+https://github.com/user-attachments/assets/25c05db1-8e09-4a7f-add2-ed486ffd4b5a
 
-You can add this MCP server to your MCP Client like VSCode, Claude, Cursor, Amazon Q, Windsurf, ChatGPT, or Github Copilot via the npmjs package `@dynatrace-oss/dynatrace-mcp-server`, and type `stdio`.
-You can find more details about the configuration for different AI Assistants, Agents and MCP Clients in the [Configuration section below](#configuration).
+## Quickstart
 
-Furthermore, you need your Dynatrace environment URL, e.g., `https://abc12345.apps.dynatrace.com`, as well as a [Platform Token](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/platform-tokens), e.g., `dt0s16.SAMPLE.abcd1234`, with [required scopes](#scopes-for-authentication).
+You can add this MCP server to your MCP Client like VSCode, Claude, Cursor, Amazon Q, Windsurf, ChatGPT, or Github Copilot via the command is `npx -y @dynatrace-oss/dynatrace-mcp-server` (type: `stdio`). For more details, please refer to the [configuration section below](#configuration).
 
-Depending on your MCP Client, you need to configure these as environment variables or as settings in the UI:
+Furthermore, you need to configure the URL to a Dynatrace environment:
 
 - `DT_ENVIRONMENT` (string, e.g., `https://abc12345.apps.dynatrace.com`) - URL to your Dynatrace Platform (do not use Dynatrace classic URLs like `abc12345.live.dynatrace.com`)
-- `DT_PLATFORM_TOKEN` (string, e.g., `dt0s16.SAMPLE.abcd1234`) - **Recommended**: Dynatrace Platform Token
 
 Once you are done, we recommend looking into [example prompts](#-example-prompts-), like `Get all details of the entity 'my-service'` or `Show me error logs`. Please mind that these prompts lead to executing DQL statements which may incur [costs](#costs) in accordance to your licence.
 
@@ -109,97 +107,6 @@ fetch dt.system.events
 
 > **Note:** While Davis CoPilot AI is generally available (GA), the Davis CoPilot APIs are currently in preview. For more information, visit the [Davis CoPilot Preview Community](https://dt-url.net/copilot-community).
 
-## 🎯 AI-Powered Observability Workshop Rules
-
-Enhance your AI assistant with comprehensive Dynatrace observability analysis capabilities through our streamlined workshop rules. These rules provide hierarchical workflows for security, compliance, incident response, and distributed systems investigation.
-
-### **🚀 Quick Setup for AI Assistants**
-
-Copy the comprehensive rule files from the [`dynatrace-agent-rules/rules/`](./dynatrace-agent-rules/rules/) directory to your AI assistant's rules directory:
-
-**IDE-Specific Locations:**
-
-- **Amazon Q**: `.amazonq/rules/` (project) or `~/.aws/amazonq/rules/` (global)
-- **Cursor**: `.cursor/rules/` (project) or via Settings → Rules (global)
-- **Windsurf**: `.windsurfrules/` (project) or via Customizations → Rules (global)
-- **Cline**: `.clinerules/` (project) or `~/Documents/Cline/Rules/` (global)
-- **GitHub Copilot**: `.github/copilot-instructions.md` (project only)
-
-Then initialize the agent in your AI chat:
-
-```
-load dynatrace mcp
-```
-
-### **🏗️ Enhanced Analysis Capabilities**
-
-The workshop rules unlock advanced observability analysis modes:
-
-#### **🚨 Incident Response & Problem Investigation**
-
-- **4-phase structured investigation** workflow (Detection → Impact → Root Cause → Resolution)
-- **Cross-data source correlation** (problems → logs → spans → metrics)
-- **Kubernetes-aware incident analysis** with namespace and pod context
-- **User impact assessment** with Davis AI integration
-
-#### **📊 Comprehensive Data Investigation**
-
-- **Unified log-service-process analysis** in single workflow
-- **Business logic error detection** patterns
-- **Deployment correlation analysis** with ArgoCD/GitOps integration
-- **Golden signals monitoring** (Rate, Errors, Duration, Saturation)
-
-#### **🔗 Advanced Transaction Analysis**
-
-- **Precise root cause identification** with file/line numbers
-- **Exception stack trace analysis** with business context
-- **Multi-service cascade failure analysis**
-- **Performance impact correlation** across distributed systems
-
-#### **🛡️ Enhanced Security & Compliance**
-
-- **Latest-scan analysis** prevents outdated data aggregation
-- **Multi-cloud compliance** (AWS, Azure, GCP, Kubernetes)
-- **Evidence-based investigation** with detailed remediation paths
-- **Risk-based scoring** with team-specific guidance
-
-#### **⚡ DevOps Automation & SRE**
-
-- **Deployment health gates** with automated promotion/rollback
-- **SLO/SLI automation** with error budget calculations
-- **Infrastructure as Code remediation** with auto-generated templates
-- **Alert optimization workflows** with pattern recognition
-
-### **📁 Hierarchical Rule Architecture**
-
-The rules are organized in a context-window optimized structure:
-
-```
-rules/
-├── DynatraceMcpIntegration.md                    # 🎯 MAIN ORCHESTRATOR
-├── workflows/                                    # 🔧 ANALYSIS WORKFLOWS
-│   ├── incidentResponse.md                       # Core incident investigation
-│   ├── DynatraceSecurityCompliance.md           # Security & compliance analysis
-│   ├── DynatraceDevOpsIntegration.md            # CI/CD automation
-│   └── dataSourceGuides/                        # 📊 DATA ANALYSIS GUIDES
-│       ├── dataInvestigation.md                 # Logs, services, processes
-│       └── DynatraceSpanAnalysis.md             # Transaction tracing
-└── reference/                                   # 📚 TECHNICAL DOCUMENTATION
-    ├── DynatraceQueryLanguage.md                # DQL syntax foundation
-    ├── DynatraceExplore.md                      # Field discovery patterns
-    ├── DynatraceSecurityEvents.md               # Security events schema
-    └── DynatraceProblemsSpec.md                 # Problems schema reference
-```
-
-**Key Architectural Benefits:**
-
-- **All files under 6,500 tokens** - Compatible with most LLM context limits
-- **Hierarchical organization** - Clear entry points and specialized guides
-- **Eliminated circular references** - No more confusing cross-referencing webs
-- **DQL-first approach** - Prefer flexible queries over rigid MCP calls
-
-For detailed information about the workshop rules, see the [Rules README](./dynatrace-agent-rules/rules/README.md).
-
 ## Configuration
 
 You can add this MCP server (using STDIO) to your MCP Client like VS Code, Claude, Cursor, Amazon Q Developer CLI, Windsurf Github Copilot via the package `@dynatrace-oss/dynatrace-mcp-server`.
@@ -231,7 +138,6 @@ This only works if the config is stored in the current workspaces, e.g., `<your-
       "command": "npx",
       "args": ["-y", "@dynatrace-oss/dynatrace-mcp-server@latest"],
       "env": {
-        "DT_PLATFORM_TOKEN": "",
         "DT_ENVIRONMENT": ""
       }
     }
@@ -248,7 +154,6 @@ This only works if the config is stored in the current workspaces, e.g., `<your-
       "command": "npx",
       "args": ["-y", "@dynatrace-oss/dynatrace-mcp-server@latest"],
       "env": {
-        "DT_PLATFORM_TOKEN": "",
         "DT_ENVIRONMENT": ""
       }
     }
@@ -267,7 +172,6 @@ The [Amazon Q Developer CLI](https://docs.aws.amazon.com/amazonq/latest/qdevelop
       "command": "npx",
       "args": ["-y", "@dynatrace-oss/dynatrace-mcp-server@latest"],
       "env": {
-        "DT_PLATFORM_TOKEN": "",
         "DT_ENVIRONMENT": ""
       }
     }
@@ -285,7 +189,7 @@ Using `gemini` CLI directly (recommended):
 
 ```bash
 gemini extensions install https://github.com/dynatrace-oss/dynatrace-mcp
-export DT_PLATFORM_TOKEN=...
+export DT_PLATFORM_TOKEN=... # optional
 export DT_ENVIRONMENT=https://...
 ```
 
@@ -304,7 +208,6 @@ Or manually in your `~/.gemini/settings.json` or `.gemini/settings.json`:
       "command": "npx",
       "args": ["@dynatrace-oss/dynatrace-mcp-server@latest"],
       "env": {
-        "DT_PLATFORM_TOKEN": "",
         "DT_ENVIRONMENT": ""
       },
       "timeout": 30000,
@@ -379,17 +282,15 @@ For fetching just error-logs, add `| filter loglevel == "ERROR"`.
 
 ## Environment Variables
 
-You can set up authentication via **Platform Tokens** (recommended) or **OAuth Client** via the following environment variables:
-
-- `DT_ENVIRONMENT` (string, e.g., `https://abc12345.apps.dynatrace.com`) - URL to your Dynatrace Platform (do not use Dynatrace classic URLs like `abc12345.live.dynatrace.com`)
-- `DT_PLATFORM_TOKEN` (string, e.g., `dt0s16.SAMPLE.abcd1234`) - **Recommended**: Dynatrace Platform Token
-- `OAUTH_CLIENT_ID` (string, e.g., `dt0s02.SAMPLE`) - Alternative: Dynatrace OAuth Client ID (for advanced use cases)
-- `OAUTH_CLIENT_SECRET` (string, e.g., `dt0s02.SAMPLE.abcd1234`) - Alternative: Dynatrace OAuth Client Secret (for advanced use cases)
-- `DT_GRAIL_QUERY_BUDGET_GB` (number, default: `1000`) - Budget limit in GB (base 1000) for Grail query bytes scanned per session. The MCP server tracks your Grail usage and warns when approaching or exceeding this limit.
+- `DT_ENVIRONMENT` (**required**, string, e.g., `https://abc12345.apps.dynatrace.com`) - URL to your Dynatrace Platform (do not use Dynatrace classic URLs like `abc12345.live.dynatrace.com`)
+- `DT_PLATFORM_TOKEN` (optional, string, e.g., `dt0s16.SAMPLE.abcd1234`) - Dynatrace Platform Token
+- `OAUTH_CLIENT_ID` (optional, string, e.g., `dt0s02.SAMPLE`) - Alternative: Dynatrace OAuth Client ID (for advanced use cases)
+- `OAUTH_CLIENT_SECRET` (optional, string, e.g., `dt0s02.SAMPLE.abcd1234`) - Alternative: Dynatrace OAuth Client Secret (for advanced use cases)
+- `DT_GRAIL_QUERY_BUDGET_GB` (optional, number, default: `1000`) - Budget limit in GB (base 1000) for Grail query bytes scanned per session. The MCP server tracks your Grail usage and warns when approaching or exceeding this limit.
 
-**Platform Tokens are recommended** for most use cases as they provide a simpler authentication flow. OAuth Clients should only be used when specific OAuth features are required.
+When just providing `DT_ENVIRONMENT`, the local MCP server will try to open a browser window to authenticate against the Dynatrace SSO.
 
-For more information, please have a look at the documentation about
+For more information about the other authentication methods, please have a look at the documentation about
 [creating a Platform Token in Dynatrace](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/platform-tokens), as well as
 [creating an OAuth Client in Dynatrace](https://docs.dynatrace.com/docs/manage/identity-access-management/access-tokens-and-oauth-clients/oauth-clients) for advanced scenarios.
 

package/dist/authentication/dynatrace-clients.js

@@ -4,37 +4,13 @@ exports.createDtHttpClient = void 0;
 const http_client_1 = require("@dynatrace-sdk/http-client");
 const dt_app_1 = require("dt-app");
 const user_agent_1 = require("../utils/user-agent");
+const dynatrace_oauth_auth_code_flow_1 = require("./dynatrace-oauth-auth-code-flow");
+const token_cache_1 = require("./token-cache");
+const utils_1 = require("./utils");
+const dynatrace_oauth_client_credentials_1 = require("./dynatrace-oauth-client-credentials");
 /**
- * Uses the provided oauth Client ID and Secret and requests a token via client-credentials flow
- * @param clientId - OAuth Client ID for Dynatrace
- * @param clientSecret - Oauth Client Secret for Dynatrace
- * @param ssoAuthUrl - SSO Authentication URL
- * @param scopes - List of requested scopes
- * @returns Response of the OAuth Endpoint (which, in the best case includes a token)
- */
-const requestToken = async (clientId, clientSecret, ssoAuthUrl, scopes) => {
-    const res = await fetch(ssoAuthUrl, {
-        method: 'POST',
-        headers: {
-            'Content-Type': 'application/x-www-form-urlencoded',
-        },
-        body: new URLSearchParams({
-            grant_type: 'client_credentials',
-            client_id: clientId,
-            client_secret: clientSecret,
-            scope: scopes.join(' '),
-        }),
-    });
-    // check if the response was okay (HTTP 2xx) or not (HTTP 4xx or 5xx)
-    if (!res.ok) {
-        // log the error
-        console.error(`Failed to fetch token: ${res.status} ${res.statusText}`);
-    }
-    // and return the JSON result, as it contains additional information
-    return await res.json();
-};
-/**
- * Create a Dynatrace Http Client (from the http-client SDK) based on the provided authentication credentails
+ * Create a Dynatrace Http Client (from the http-client SDK) based on the provided authentication credentials
+ * Supports Platform Token, OAuth Client Credentials Flow, and OAuth Authorization Code Flow (interactive)
  * @param environmentUrl
  * @param scopes
  * @param clientId
@@ -43,50 +19,128 @@ const requestToken = async (clientId, clientSecret, ssoAuthUrl, scopes) => {
  * @returns an authenticated HttpClient
  */
 const createDtHttpClient = async (environmentUrl, scopes, clientId, clientSecret, dtPlatformToken) => {
-    if (clientId && clientSecret) {
-        // create an OAuth client if clientId and clientSecret are provided
-        return createOAuthHttpClient(environmentUrl, scopes, clientId, clientSecret);
-    }
+    /** Logic:
+     * * if a platform token is provided, use it
+     * * If no platform token is provided, but clientId and clientSecret are provided, use client credentials flow
+     * * If no platform token is provided, and no clientSecret is provided, but a clientId is provided, use OAuth authorization code flow (interactive)
+     * * If neither platform token nor OAuth credentials are provided, throw an error
+     */
     if (dtPlatformToken) {
         // create a simple HTTP client if only the platform token is provided
-        return createBearerTokenHttpClient(environmentUrl, dtPlatformToken);
+        return createPlatformTokenHttpClient(environmentUrl, dtPlatformToken);
     }
-    throw new Error('Failed to create Dynatrace HTTP Client: Please provide either clientId and clientSecret or dtPlatformToken');
+    else if (clientId && clientSecret) {
+        // create an Oauth client using client credentials flow (non-interactive)
+        return createOAuthClientCredentialsHttpClient(environmentUrl, scopes, clientId, clientSecret);
+    }
+    else if (clientId) {
+        // create an OAuth client using authorization code flow (interactive)
+        return createOAuthAuthCodeFlowHttpClient(environmentUrl, scopes, clientId);
+    }
+    throw new Error('Failed to create Dynatrace HTTP Client: Please provide either clientId and clientSecret for client credentials flow, clientId only for interactive OAuth flow, or just a platform token.');
 };
 exports.createDtHttpClient = createDtHttpClient;
-/** Creates an HTTP Client based on environmentUrl and a platform token */
-const createBearerTokenHttpClient = async (environmentUrl, dtPlatformToken) => {
+/**
+ * Creates an HTTP Client based on environmentUrl and a bearer token, and also sets the user agent
+ */
+const createBearerTokenHttpClient = async (environmentUrl, bearerToken) => {
     return new http_client_1.PlatformHttpClient({
         baseUrl: environmentUrl,
         defaultHeaders: {
-            'Authorization': `Bearer ${dtPlatformToken}`,
+            'Authorization': `Bearer ${bearerToken}`,
             'User-Agent': (0, user_agent_1.getUserAgent)(),
         },
     });
 };
-/** Create an Oauth Client based on clientId, clientSecret, environmentUrl and scopes
+/**
+ * Creates an HTTP Client based on environmentUrl and a platform token (as bearer token)
+ */
+const createPlatformTokenHttpClient = async (environmentUrl, dtPlatformToken) => {
+    console.error(`🔒 Using Platform Token to authenticate API Calls to ${environmentUrl}`);
+    return createBearerTokenHttpClient(environmentUrl, dtPlatformToken);
+};
+/**
+ * Create an OAuth Client based on clientId, clientSecret, environmentUrl and scopes
  * This uses a client-credentials flow to request a token from the SSO endpoint.
+ * Note: We do not refresh the token here, we always request a new one on each client creation.
  */
-const createOAuthHttpClient = async (environmentUrl, scopes, clientId, clientSecret) => {
-    if (!clientId) {
-        throw new Error('Failed to retrieve OAuth client id from env "DT_APP_OAUTH_CLIENT_ID"');
-    }
-    if (!clientSecret) {
-        throw new Error('Failed to retrieve OAuth client secret from env "DT_APP_OAUTH_CLIENT_SECRET"');
-    }
-    if (!environmentUrl) {
-        throw new Error('Failed to retrieve environment URL from env "DT_ENVIRONMENT"');
-    }
-    console.error(`Trying to authenticate API Calls to ${environmentUrl} via OAuthClientId ${clientId} with the following scopes: ${scopes.join(', ')}`);
-    const ssoBaseUrl = await (0, dt_app_1.getSSOUrl)(environmentUrl);
-    const ssoAuthUrl = new URL('/sso/oauth2/token', ssoBaseUrl).toString();
-    console.error(`Using SSO auth URL: ${ssoAuthUrl}`);
+const createOAuthClientCredentialsHttpClient = async (environmentUrl, scopes, clientId, clientSecret) => {
+    console.error(`🔒 Client-Creds-Flow: Trying to authenticate API Calls to ${environmentUrl} via OAuthClientId ${clientId} with the following scopes: ${scopes.join(', ')}`);
+    // Get SSO Base URL
+    const ssoBaseURL = await (0, dt_app_1.getSSOUrl)(environmentUrl);
     // try to request a token, just to verify that everything is set up correctly
-    const tokenResponse = await requestToken(clientId, clientSecret, ssoAuthUrl, scopes);
+    const tokenResponse = await (0, dynatrace_oauth_client_credentials_1.requestTokenForClientCredentials)(clientId, clientSecret, ssoBaseURL, scopes);
     // in case we didn't get a token, or error / error_description / issueId is set, we throw an error
     if (!tokenResponse.access_token || tokenResponse.error || tokenResponse.error_description || tokenResponse.issueId) {
         throw new Error(`Failed to retrieve OAuth token (IssueId: ${tokenResponse.issueId}): ${tokenResponse.error} - ${tokenResponse.error_description}. Note: Your OAuth client is most likely not configured correctly and/or is missing scopes.`);
     }
-    console.error(`Successfully retrieved token from SSO!`);
+    console.error(`Successfully retrieved token from SSO! Token valid for ${tokenResponse.expires_in}s with scopes: ${tokenResponse.scope}`);
+    // now that we have the access token, we can just use a plain bearer token client
+    return createBearerTokenHttpClient(environmentUrl, tokenResponse.access_token);
+};
+/** Create an OAuth Client using authorization code flow (interactive authentication)
+ * This starts a local HTTP server to handle the OAuth redirect and requires user interaction.
+ * Implements token caching (via .dt-mcp/token.json) to avoid repeated OAuth flows.
+ * Note: Always requests a complete set of scopes for maximum token reusability. Else the user will end up having to approve multiple requests.
+ */
+const createOAuthAuthCodeFlowHttpClient = async (environmentUrl, scopes, clientId) => {
+    // Get SSO Base URL
+    const ssoBaseURL = await (0, dt_app_1.getSSOUrl)(environmentUrl);
+    // Fast Track: Fetch cached token and check if it is still valid
+    const cachedToken = token_cache_1.globalTokenCache.getToken(scopes);
+    const isValid = token_cache_1.globalTokenCache.isTokenValid(scopes);
+    // If we have a valid cached token, we can use it
+    if (isValid && cachedToken) {
+        const expiresIn = cachedToken.expires_at ? Math.round((cachedToken.expires_at - Date.now()) / 1000) : 'never';
+        console.error(`✅ Auth-Code-Flow: Using cached access token (expires in ${expiresIn}s)`);
+        // just use the cached token as a bearer token
+        return createBearerTokenHttpClient(environmentUrl, cachedToken.access_token);
+    }
+    // If we have an expired token that can be refreshed, refresh it
+    if (cachedToken && cachedToken.refresh_token && !isValid) {
+        const expiresIn = cachedToken.expires_at ? Math.round((cachedToken.expires_at - Date.now()) / 1000) : 'never';
+        console.error(`🔍 Auth-Code-Flow: Found expired cached token (expires in ${expiresIn}s), attempting refresh...`);
+        try {
+            console.error(`🔄 Attempting to refresh expired access token...`);
+            const tokenResponse = await (0, dynatrace_oauth_auth_code_flow_1.refreshAccessToken)(ssoBaseURL, clientId, cachedToken.refresh_token, scopes);
+            if (tokenResponse.access_token && !tokenResponse.error) {
+                console.error(`✅ Successfully refreshed access token!`);
+                // Update the cache with the new token
+                token_cache_1.globalTokenCache.setToken(scopes, tokenResponse);
+                // now use the updated token as a bearer token
+                return createBearerTokenHttpClient(environmentUrl, tokenResponse.access_token);
+            }
+            else {
+                console.error(`❌ Token refresh failed: ${tokenResponse.error} - ${tokenResponse.error_description}`);
+                // Clear the invalid token from cache
+                token_cache_1.globalTokenCache.clearToken();
+            }
+        }
+        catch (error) {
+            console.error(`❌ Token refresh failed with error: ${error instanceof Error ? error.message : String(error)}`);
+            // Clear the invalid token from cache
+            token_cache_1.globalTokenCache.clearToken();
+        }
+    }
+    // If we get here, we are currently not authenticated, and need to perform a full OAuth Authorization Code Flow
+    console.error(`🚀 Auth-Code-Flow: No valid cached token found, initiating OAuth Authorization Code Flow...`);
+    console.error(`Using SSO base URL ${ssoBaseURL}`);
+    // Randomly select a port for the OAuth redirect URL (e.g., 5344)
+    const port = (0, utils_1.getRandomPort)();
+    // Perform the OAuth authorization code flow with all scopes
+    const tokenResponse = await (0, dynatrace_oauth_auth_code_flow_1.performOAuthAuthorizationCodeFlow)(ssoBaseURL, {
+        clientId,
+        // redirectUri will be used as a redirect/callback from the authorization code flow
+        redirectUri: `http://localhost:${port}/auth/login`,
+        scopes: scopes, // Request all scopes upfront
+    }, port);
+    // Check if we got a valid token
+    if (!tokenResponse.access_token || tokenResponse.error || tokenResponse.error_description || tokenResponse.issueId) {
+        throw new Error(`Failed to retrieve OAuth token via authorization code flow (IssueId: ${tokenResponse.issueId}): ${tokenResponse.error} - ${tokenResponse.error_description}`);
+    }
+    // Cache the new token with all scopes
+    token_cache_1.globalTokenCache.setToken(scopes, tokenResponse);
+    console.error(`✅ Successfully retrieved token from SSO! Token cached for future use with scopes: ${scopes.join(', ')}`);
+    // now that we have the access token, we can just use a plain bearer token client
     return createBearerTokenHttpClient(environmentUrl, tokenResponse.access_token);
 };

package/dist/authentication/dynatrace-clients.test.js

@@ -3,9 +3,13 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const dynatrace_clients_1 = require("./dynatrace-clients");
 const http_client_1 = require("@dynatrace-sdk/http-client");
 const dt_app_1 = require("dt-app");
+const dynatrace_oauth_auth_code_flow_1 = require("./dynatrace-oauth-auth-code-flow");
+const token_cache_1 = require("./token-cache");
 // Mock external dependencies
 jest.mock('@dynatrace-sdk/http-client');
 jest.mock('dt-app');
+jest.mock('./dynatrace-oauth-auth-code-flow');
+jest.mock('./token-cache');
 jest.mock('../../package.json', () => ({
     version: '1.0.0-test',
 }));
@@ -13,12 +17,21 @@ jest.mock('../../package.json', () => ({
 global.fetch = jest.fn();
 const mockPlatformHttpClient = http_client_1.PlatformHttpClient;
 const mockGetSSOUrl = dt_app_1.getSSOUrl;
+const mockPerformOAuthAuthorizationCodeFlow = dynatrace_oauth_auth_code_flow_1.performOAuthAuthorizationCodeFlow;
+const mockGlobalTokenCache = token_cache_1.globalTokenCache;
 const mockFetch = global.fetch;
 describe('dynatrace-clients', () => {
     beforeEach(() => {
         jest.clearAllMocks();
         // Reset console.error mock
         jest.spyOn(console, 'error').mockImplementation(() => { });
+        // Mock token cache methods
+        mockGlobalTokenCache.getToken.mockReturnValue(null);
+        mockGlobalTokenCache.isTokenValid.mockReturnValue(false);
+        mockGlobalTokenCache.setToken.mockImplementation(() => { });
+        mockGlobalTokenCache.clearToken.mockImplementation(() => { });
+        // Mock getSSOUrl
+        mockGetSSOUrl.mockResolvedValue('https://sso.dynatrace.com');
     });
     afterEach(() => {
         jest.restoreAllMocks();
@@ -67,12 +80,6 @@ describe('dynatrace-clients', () => {
                 });
                 expect(result).toBeInstanceOf(http_client_1.PlatformHttpClient);
             });
-            it('should throw error when clientId, clientSecret and platformToken are missing', async () => {
-                await expect((0, dynatrace_clients_1.createDtHttpClient)(environmentUrl, scopes, undefined, undefined, undefined)).rejects.toThrow('Failed to create Dynatrace HTTP Client: Please provide either clientId and clientSecret or dtPlatformToken');
-            });
-            it('should throw error when environmentUrl is missing', async () => {
-                await expect((0, dynatrace_clients_1.createDtHttpClient)('', scopes, clientId, clientSecret)).rejects.toThrow('Failed to retrieve environment URL from env "DT_ENVIRONMENT"');
-            });
             it('should throw error when token request fails with HTTP error', async () => {
                 mockFetch.mockResolvedValueOnce({
                     ok: false,
@@ -120,7 +127,7 @@ describe('dynatrace-clients', () => {
                     json: async () => mockTokenResponse,
                 });
                 await (0, dynatrace_clients_1.createDtHttpClient)(environmentUrl, scopes, clientId, clientSecret);
-                expect(console.error).toHaveBeenCalledWith(`Trying to authenticate API Calls to ${environmentUrl} via OAuthClientId ${clientId} with the following scopes: ${scopes.join(', ')}`);
+                expect(console.error).toHaveBeenCalledWith(`🔒 Client-Creds-Flow: Trying to authenticate API Calls to ${environmentUrl} via OAuthClientId ${clientId} with the following scopes: ${scopes.join(', ')}`);
             });
         });
         describe('with Bearer token', () => {
@@ -137,11 +144,6 @@ describe('dynatrace-clients', () => {
                 expect(result).toBeInstanceOf(http_client_1.PlatformHttpClient);
             });
         });
-        describe('with no authentication', () => {
-            it('should throw error when no authentication method is provided', async () => {
-                await expect((0, dynatrace_clients_1.createDtHttpClient)(environmentUrl, scopes)).rejects.toThrow('Failed to create Dynatrace HTTP Client: Please provide either clientId and clientSecret or dtPlatformToken');
-            });
-        });
     });
     describe('requestToken function (indirectly tested)', () => {
         it('should handle fetch errors gracefully', async () => {