@dynatrace-oss/dynatrace-mcp-server 0.7.0 → 0.9.0

package/dist/authentication/dynatrace-oauth-auth-code-flow.js

@@ -0,0 +1,220 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAuthorizationUrl = createAuthorizationUrl;
+exports.exchangeCodeForToken = exchangeCodeForToken;
+exports.refreshAccessToken = refreshAccessToken;
+exports.startOAuthRedirectServer = startOAuthRedirectServer;
+exports.performOAuthAuthorizationCodeFlow = performOAuthAuthorizationCodeFlow;
+const node_crypto_1 = require("node:crypto");
+const node_http_1 = require("node:http");
+const node_url_1 = require("node:url");
+const dynatrace_oauth_base_1 = require("./dynatrace-oauth-base");
+const utils_1 = require("./utils");
+const open_1 = __importDefault(require("open"));
+/**
+ * Generates PKCE code verifier and challenge according to RFC 7636
+ * Uses 46 bytes for code verifier as recommended by Auth0/OAuth best practices
+ */
+function generatePKCEChallenge() {
+    const codeVerifier = (0, utils_1.base64URLEncode)((0, node_crypto_1.randomBytes)(46));
+    const codeChallenge = (0, utils_1.base64URLEncode)((0, node_crypto_1.createHash)('sha256').update(codeVerifier).digest());
+    return { codeVerifier, codeChallenge };
+}
+/**
+ * Constructs the OAuth authorization URL with PKCE
+ */
+function createAuthorizationUrl(ssoBaseURL, config) {
+    const state = (0, utils_1.generateRandomState)();
+    const { codeVerifier, codeChallenge } = generatePKCEChallenge();
+    const authUrl = new node_url_1.URL('/oauth2/authorize', ssoBaseURL);
+    // Build query parameters manually to control encoding and exact order
+    // Order parameters to match working OAuth implementation:
+    // client_id → redirect_uri → state → response_type → code_challenge_method → code_challenge → scope
+    const queryParts = [
+        `client_id=${encodeURIComponent(config.clientId)}`,
+        `redirect_uri=${encodeURIComponent(config.redirectUri)}`,
+        `state=${encodeURIComponent(state)}`,
+        `response_type=code`,
+        `code_challenge_method=S256`,
+        `code_challenge=${encodeURIComponent(codeChallenge)}`,
+        `scope=${encodeURIComponent(config.scopes.join(' ')).replace(/%20/g, '%20')}`, // Ensure %20 for spaces
+    ];
+    const queryString = queryParts.join('&');
+    // Manually construct the final URL to ensure exact parameter order and encoding required by some OAuth implementations.
+    const finalUrl = `${authUrl.origin}${authUrl.pathname}?${queryString}`;
+    return {
+        authorizationUrl: finalUrl,
+        codeVerifier,
+        state,
+    };
+}
+/**
+ * Exchanges authorization code for access token using PKCE
+ */
+async function exchangeCodeForToken(ssoBaseURL, config, code, codeVerifier) {
+    return (0, dynatrace_oauth_base_1.requestOAuthToken)(ssoBaseURL, {
+        grant_type: 'authorization_code',
+        client_id: config.clientId,
+        code,
+        redirect_uri: config.redirectUri,
+        code_verifier: codeVerifier,
+    });
+}
+/**
+ * Refreshes an access token using a refresh token
+ */
+async function refreshAccessToken(ssoBaseURL, clientId, refreshToken, scopes) {
+    const tokenResponse = await (0, dynatrace_oauth_base_1.requestOAuthToken)(ssoBaseURL, {
+        grant_type: 'refresh_token',
+        client_id: clientId,
+        refresh_token: refreshToken,
+        scope: scopes.join(' '),
+    });
+    // For refresh token, we want to throw an error if the request failed
+    // since this is different from other flows where we just return the error response
+    if (!tokenResponse.access_token || tokenResponse.error) {
+        throw new Error(`Failed to refresh access token: ${tokenResponse.error} - ${tokenResponse.error_description}`);
+    }
+    return tokenResponse;
+}
+/**
+ * Starts a temporary HTTP server to handle the OAuth redirect
+ */
+async function startOAuthRedirectServer(port = 5344) {
+    const redirectUri = `http://localhost:${port}/auth/login`;
+    let resolveAuthCode;
+    let rejectAuthCode;
+    const authCodePromise = new Promise((resolve, reject) => {
+        resolveAuthCode = resolve;
+        rejectAuthCode = reject;
+    });
+    const server = (0, node_http_1.createServer)((req, res) => {
+        const url = new node_url_1.URL(req.url || '', `http://localhost:${port}`);
+        if (url.pathname === '/auth/login') {
+            const code = url.searchParams.get('code');
+            const state = url.searchParams.get('state');
+            const error = url.searchParams.get('error');
+            const errorDescription = url.searchParams.get('error_description');
+            if (error) {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(`
+          <!DOCTYPE html>
+          <html>
+            <head><title>OAuth Error</title></head>
+            <body>
+              <h1>OAuth Authorization Error</h1>
+              <p><strong>Error:</strong> ${error}</p>
+              <p><strong>Description:</strong> ${errorDescription || 'Unknown error'}</p>
+              <p>You can close this tab and check the console for more information.</p>
+            </body>
+          </html>
+        `);
+                rejectAuthCode(new Error(`OAuth error: ${error} - ${errorDescription}`));
+                return;
+            }
+            if (code && state) {
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end(`
+          <!DOCTYPE html>
+          <html>
+            <head><title>OAuth Success</title></head>
+            <body>
+              <h1>Authorization Successful!</h1>
+              <p>You have successfully authorized the Dynatrace MCP Server.</p>
+              <p>You can close this tab and return to your terminal.</p>
+              <script>
+                // Auto-close after 3 seconds
+                setTimeout(() => window.close(), 3000);
+              </script>
+            </body>
+          </html>
+        `);
+                resolveAuthCode({ code, state });
+            }
+            else {
+                res.writeHead(400, { 'Content-Type': 'text/html' });
+                res.end(`
+          <!DOCTYPE html>
+          <html>
+            <head><title>Invalid Request</title></head>
+            <body>
+              <h1>Invalid OAuth Callback</h1>
+              <p>The authorization code or state parameter is missing.</p>
+              <p>You can close this tab and try again.</p>
+            </body>
+          </html>
+        `);
+                rejectAuthCode(new Error('Missing authorization code or state parameter'));
+            }
+        }
+        else {
+            res.writeHead(404, { 'Content-Type': 'text/plain' });
+            res.end('Not Found');
+        }
+    });
+    return new Promise((resolve, reject) => {
+        server.listen(port, 'localhost', () => {
+            console.error(`🌐 OAuth redirect server listening on ${redirectUri}`);
+            resolve({
+                server,
+                redirectUri,
+                waitForAuthorizationCode: () => authCodePromise,
+            });
+        });
+        server.on('error', reject);
+    });
+}
+/**
+ * Performs the complete OAuth authorization code flow
+ */
+async function performOAuthAuthorizationCodeFlow(ssoBaseURL, config, serverPort = 5344) {
+    console.error('🚀 Starting OAuth Authorization Code Flow with local redirect/callback...');
+    // Start the redirect server
+    const { server, redirectUri, waitForAuthorizationCode } = await startOAuthRedirectServer(serverPort);
+    try {
+        // Update config with the actual redirect URI
+        const updatedConfig = { ...config, redirectUri };
+        // Create authorization URL
+        const { authorizationUrl, codeVerifier, state } = createAuthorizationUrl(ssoBaseURL, updatedConfig);
+        // Print a pretty message telling the user to open the URL
+        console.error('\n' + '='.repeat(60));
+        console.error('🔐 OAuth Authorization Required');
+        console.error('='.repeat(60));
+        console.error('');
+        // Open the authorization URL in the default browser
+        console.error('Trying to open the authorization URL in your default browser...');
+        try {
+            (0, open_1.default)(authorizationUrl);
+        }
+        catch (error) {
+            console.error('Failed to open browser automatically. Please click on the following URL to authorize the application:', error.message);
+        }
+        console.error('');
+        console.error('👉 ' + authorizationUrl);
+        console.error('');
+        console.error('After authorization, you will be redirected back and the server will continue automatically.');
+        console.error('');
+        console.error('='.repeat(60) + '\n');
+        // Wait for the authorization code
+        const { code, state: receivedState } = await waitForAuthorizationCode();
+        // Validate state parameter
+        if (receivedState !== state) {
+            throw new Error('OAuth state parameter mismatch - possible CSRF attack');
+        }
+        console.error('✅ Authorization code received! Exchanging for access token...');
+        // Exchange code for token
+        const tokenResponse = await exchangeCodeForToken(ssoBaseURL, updatedConfig, code, codeVerifier);
+        if (!tokenResponse.access_token || tokenResponse.error) {
+            throw new Error(`Failed to exchange code for token: ${tokenResponse.error} - ${tokenResponse.error_description}`);
+        }
+        console.error('🎉 Successfully obtained access token via OAuth Authorization Code Flow!');
+        return tokenResponse;
+    }
+    finally {
+        // Clean up the server
+        server.close();
+    }
+}

package/dist/authentication/dynatrace-oauth-auth-code-flow.test.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const crypto_1 = require("crypto");
+const dynatrace_oauth_auth_code_flow_1 = require("./dynatrace-oauth-auth-code-flow");
+describe('OAuth Authorization Code Flow', () => {
+    const mockConfig = {
+        clientId: 'dt0s08.mocked-client',
+        redirectUri: 'http://localhost:5343/auth/login',
+        scopes: ['app-engine:apps:run', 'app-engine:functions:run', 'storage:logs:read'], // Basic Example scopes
+    };
+    test('createAuthorizationUrl generates valid URL with PKCE', () => {
+        const result = (0, dynatrace_oauth_auth_code_flow_1.createAuthorizationUrl)('https://sso.dynatrace.com', mockConfig);
+        // URL needs to match sso.dynatrace.com/oauth2/authorize
+        expect(result.authorizationUrl).toMatch(/^https:\/\/sso\.dynatrace\.com\/oauth2\/authorize\?/);
+        expect(result.codeVerifier).toMatch(/^[A-Za-z0-9_-]{62}$/); // Base64URL without padding (46 bytes = ~62 chars)
+        expect(result.state).toMatch(/^[a-f0-9]{40}$/); // Hex string (20 bytes = 40 hex chars)
+        // Parse the URL and verify query parameters
+        const url = new URL(result.authorizationUrl);
+        expect(url.searchParams.get('response_type')).toBe('code');
+        expect(url.searchParams.get('client_id')).toBe('dt0s08.mocked-client');
+        expect(url.searchParams.get('redirect_uri')).toBe('http://localhost:5343/auth/login');
+        expect(url.searchParams.get('scope')).toBe('app-engine:apps:run app-engine:functions:run storage:logs:read');
+        expect(url.searchParams.get('code_challenge_method')).toBe('S256');
+        expect(url.searchParams.get('code_challenge')).toMatch(/^[A-Za-z0-9_-]{43}$/); // SHA256 base64url = 43 chars
+        expect(url.searchParams.get('state')).toBe(result.state);
+    });
+    test('createAuthorizationUrl encodes scopes with %20 for spaces instead of +', () => {
+        const result = (0, dynatrace_oauth_auth_code_flow_1.createAuthorizationUrl)('https://sso.dynatrace.com', mockConfig);
+        // Check that the raw URL string contains %20 for spaces, not +
+        expect(result.authorizationUrl).toMatch(/scope=app-engine%3Aapps%3Arun%20app-engine%3Afunctions%3Arun%20storage%3Alogs%3Aread/);
+        // Verify that + is not used for space encoding in scopes
+        expect(result.authorizationUrl).not.toMatch(/scope=.*\+.*(?=&|$)/);
+        // Verify that colons are properly encoded as %3A
+        expect(result.authorizationUrl).toMatch(/app-engine%3Aapps%3Arun/);
+        expect(result.authorizationUrl).toMatch(/app-engine%3Afunctions%3Arun/);
+        expect(result.authorizationUrl).toMatch(/storage%3Alogs%3Aread/);
+        // Double-check by parsing the URL and verifying the decoded scope
+        const url = new URL(result.authorizationUrl);
+        expect(url.searchParams.get('scope')).toBe('app-engine:apps:run app-engine:functions:run storage:logs:read');
+    });
+    test('startOAuthRedirectServer returns server configuration', async () => {
+        const port = ((0, crypto_1.randomBytes)(2).readUInt16BE(0) % 10000) + 5000; // Random port between 5000-5999
+        const result = await (0, dynatrace_oauth_auth_code_flow_1.startOAuthRedirectServer)(port);
+        expect(result.redirectUri).toBe(`http://localhost:${port}/auth/login`);
+        expect(result.server).toBeDefined();
+        expect(result.waitForAuthorizationCode).toBeDefined();
+        // Clean up
+        result.server.close();
+    });
+});

package/dist/authentication/dynatrace-oauth-base.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestOAuthToken = void 0;
+/**
+ * Generic OAuth token request function that can handle different grant types
+ * @param ssoBaseURL - SSO Base URL (e.g., sso.dynatrace.com)
+ * @param params - OAuth parameters for the specific grant type (client_credentials, authorization_code, or refresh_token)
+ * @returns Response of the OAuth Endpoint
+ */
+const requestOAuthToken = async (ssoBaseURL, params) => {
+    const tokenUrl = new URL('/sso/oauth2/token', ssoBaseURL).toString();
+    const res = await fetch(tokenUrl, {
+        method: 'POST',
+        headers: {
+            'Content-Type': 'application/x-www-form-urlencoded',
+        },
+        body: new URLSearchParams(params),
+    });
+    // check if the response was okay (HTTP 2xx) or not (HTTP 4xx or 5xx)
+    if (!res.ok) {
+        // log the error
+        console.error(`Failed to fetch token: ${res.status} ${res.statusText}`);
+        // Note: Do not throw here, as we want to return the error response from the OAuth endpoint
+    }
+    // and return the JSON result, as it contains additional information
+    return await res.json();
+};
+exports.requestOAuthToken = requestOAuthToken;

package/dist/authentication/dynatrace-oauth-client-credentials.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.requestTokenForClientCredentials = void 0;
+const dynatrace_oauth_base_1 = require("./dynatrace-oauth-base");
+/**
+ * Uses the provided oauth Client ID and Secret and requests a token via client-credentials flow
+ * @param clientId - OAuth Client ID for Dynatrace
+ * @param clientSecret - OAuth Client Secret for Dynatrace
+ * @param ssoBaseURL - SSO Base URL (e.g., sso.dynatrace.com)
+ * @param scopes - List of requested scopes
+ * @returns Response of the OAuth Endpoint (which, in the best case includes a token)
+ */
+const requestTokenForClientCredentials = async (clientId, clientSecret, ssoBaseURL, scopes) => {
+    return (0, dynatrace_oauth_base_1.requestOAuthToken)(ssoBaseURL, {
+        grant_type: 'client_credentials',
+        client_id: clientId,
+        client_secret: clientSecret,
+        scope: scopes.join(' '),
+    });
+};
+exports.requestTokenForClientCredentials = requestTokenForClientCredentials;

package/dist/authentication/token-cache.js

@@ -0,0 +1,149 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.globalTokenCache = exports.FileTokenCache = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * File-based token cache implementation that persists tokens to disk
+ * Stores tokens in .dt-mcp/token.json for persistence across dynatrace-mcp-server restarts
+ */
+class FileTokenCache {
+    tokenFilePath;
+    token = null;
+    constructor() {
+        // Create .dt-mcp directory in the current working directory
+        const tokenDir = path.join(process.cwd(), '.dt-mcp');
+        this.tokenFilePath = path.join(tokenDir, 'token.json');
+        // Ensure the directory exists
+        if (!fs.existsSync(tokenDir)) {
+            fs.mkdirSync(tokenDir, { recursive: true });
+        }
+        this.loadToken();
+    }
+    /**
+     * Loads the token from the file system
+     */
+    loadToken() {
+        try {
+            if (fs.existsSync(this.tokenFilePath)) {
+                const tokenData = fs.readFileSync(this.tokenFilePath, 'utf8');
+                this.token = JSON.parse(tokenData);
+                console.error(`🔍 Loaded token from file: ${this.tokenFilePath}`);
+            }
+            else {
+                console.error(`🔍 No token file found at: ${this.tokenFilePath}`);
+                this.token = null;
+            }
+        }
+        catch (error) {
+            console.error(`❌ Failed to load token from file: ${error}`);
+            this.token = null;
+        }
+    }
+    /**
+     * Saves the token to the file system
+     */
+    saveToken() {
+        try {
+            if (this.token) {
+                fs.writeFileSync(this.tokenFilePath, JSON.stringify(this.token, null, 2), 'utf8');
+                console.error(`✅ Saved token to file: ${this.tokenFilePath}`);
+            }
+            else {
+                // Remove the file if no token exists
+                if (fs.existsSync(this.tokenFilePath)) {
+                    fs.unlinkSync(this.tokenFilePath);
+                    console.error(`🗑️ Removed token file: ${this.tokenFilePath}`);
+                }
+            }
+        }
+        catch (error) {
+            console.error(`❌ Failed to save token to file: ${error}`);
+        }
+    }
+    /**
+     * Retrieves the cached token (ignores scopes since we use a global token)
+     */
+    getToken(scopes) {
+        // We ignore the scopes parameter since we use a single token with all scopes
+        return this.token;
+    }
+    /**
+     * Stores the global token in the cache and persists it to file
+     */
+    setToken(scopes, token) {
+        // We ignore the scopes parameter since we use a single token with all scopes
+        this.token = {
+            access_token: token.access_token,
+            refresh_token: token.refresh_token,
+            expires_at: token.expires_in ? Date.now() + token.expires_in * 1000 : undefined,
+            scopes: [...scopes], // Store the actual scopes that were granted
+        };
+        this.saveToken();
+    }
+    /**
+     * Removes the cached token and deletes the file
+     */
+    clearToken(scopes) {
+        // We ignore the scopes parameter since we use a single global token
+        this.token = null;
+        this.saveToken();
+    }
+    /**
+     * Checks if the token exists and is still valid (not expired)
+     */
+    isTokenValid(scopes) {
+        // We ignore the scopes parameter since we use a single token with all scopes
+        if (!this.token) {
+            console.error(`🔍 Token validation: No token in cache`);
+            return false;
+        }
+        // If no expiration time is set, assume token is valid
+        if (!this.token.expires_at) {
+            console.error(`🔍 Token validation: Token has no expiration, assuming valid`);
+            return true;
+        }
+        // Add a 30-second buffer to avoid using tokens that are about to expire
+        const bufferMs = 30 * 1000; // 30 seconds
+        const now = Date.now();
+        const expiresAt = this.token.expires_at;
+        const isValid = now + bufferMs < expiresAt;
+        return isValid;
+    }
+}
+exports.FileTokenCache = FileTokenCache;
+// Global token cache instance - uses file-based persistence
+exports.globalTokenCache = new FileTokenCache();

package/dist/authentication/utils.js

@@ -0,0 +1,26 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getRandomPort = exports.generateRandomState = exports.base64URLEncode = void 0;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Base64URL encoding according to RFC 7636
+ */
+const base64URLEncode = (buffer) => {
+    return buffer.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+};
+exports.base64URLEncode = base64URLEncode;
+/**
+ * Generates a cryptographically secure random string for OAuth state parameter
+ * Uses hex encoding for better compatibility
+ */
+const generateRandomState = () => {
+    return (0, node_crypto_1.randomBytes)(20).toString('hex');
+};
+exports.generateRandomState = generateRandomState;
+/**
+ * Generates a random port number between min and max (inclusive)
+ */
+const getRandomPort = (min = 5344, max = 5349) => {
+    return Math.floor(Math.random() * (max - min + 1)) + min;
+};
+exports.getRandomPort = getRandomPort;

package/dist/capabilities/get-events-for-cluster.js

@@ -2,12 +2,22 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getEventsForCluster = void 0;
 const execute_dql_1 = require("./execute-dql");
-const getEventsForCluster = async (dtClient, clusterId) => {
-    let dql = `fetch events | filter k8s.cluster.uid == "${clusterId}"`;
-    if (!clusterId) {
-        // if no clusterId is provided, we need to fetch all events
-        dql = `fetch events | filter isNotNull(k8s.cluster.uid)`;
+const getEventsForCluster = async (dtClient, clusterId, kubernetesEntityId, eventType) => {
+    let dql = 'fetch events';
+    if (!clusterId && !kubernetesEntityId) {
+        // If no clusterId or kubernetesEntityId is provided, return all kubernetes related events
+        dql += ` | filter isNotNull(k8s.cluster.uid)`;
     }
+    else if (clusterId || kubernetesEntityId) {
+        // filter by clusterId or kubernetesEntityId if provided
+        dql += `| filter k8s.cluster.uid == "${clusterId}" or dt.entity.kubernetes_cluster == "${kubernetesEntityId}"`;
+    }
+    // filter by eventType if provided
+    if (eventType) {
+        dql += ` | filter eventType == "${eventType}"`;
+    }
+    // sort by timestamp
+    dql += ' | sort timestamp desc';
     return (0, execute_dql_1.executeDql)(dtClient, { query: dql });
 };
 exports.getEventsForCluster = getEventsForCluster;

package/dist/capabilities/update-workflow.js

@@ -3,8 +3,8 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.updateWorkflow = void 0;
 const client_automation_1 = require("@dynatrace-sdk/client-automation");
 const updateWorkflow = async (dtClient, workflowId, body) => {
-    const workflowsclient = new client_automation_1.WorkflowsClient(dtClient);
-    return await workflowsclient.updateWorkflow({
+    const workflowsClient = new client_automation_1.WorkflowsClient(dtClient);
+    return await workflowsClient.updateWorkflow({
         id: workflowId,
         body: body,
     });

package/dist/getDynatraceEnv.js

@@ -15,9 +15,8 @@ function getDynatraceEnv(env = process.env) {
     if (!dtEnvironment) {
         throw new Error('Please set DT_ENVIRONMENT environment variable to your Dynatrace Platform Environment');
     }
-    if (!oauthClientId && !oauthClientSecret && !dtPlatformToken) {
-        throw new Error('Please set either OAUTH_CLIENT_ID and OAUTH_CLIENT_SECRET, or DT_PLATFORM_TOKEN environment variables');
-    }
+    // Allow case where no auth credentials are provided - OAuth auth code flow will be inferred
+    // We only require DT_ENVIRONMENT to be set
     // For dev and hardening stages, set unlimited budget (-1) unless explicitly overridden
     if (dtEnvironment.includes('apps.dynatracelabs.com') && !env.DT_GRAIL_QUERY_BUDGET_GB) {
         grailBudgetGB = -1;

package/dist/getDynatraceEnv.test.js

@@ -26,14 +26,18 @@ describe('getDynatraceEnv', () => {
         const result = (0, getDynatraceEnv_1.getDynatraceEnv)(env);
         expect(result.slackConnectionId).toBe('fake-slack-connection-id');
     });
-    it('throws if environment variables for auth credentials are missing', () => {
+    it('allows missing auth credentials (OAuth auth code flow will be inferred)', () => {
         const env = {
             ...baseEnv,
             OAUTH_CLIENT_ID: undefined,
             OAUTH_CLIENT_SECRET: undefined,
             DT_PLATFORM_TOKEN: undefined,
         };
-        expect(() => (0, getDynatraceEnv_1.getDynatraceEnv)(env)).toThrow(/OAUTH_CLIENT_ID/);
+        expect(() => (0, getDynatraceEnv_1.getDynatraceEnv)(env)).not.toThrow();
+        const result = (0, getDynatraceEnv_1.getDynatraceEnv)(env);
+        expect(result.oauthClientId).toBeUndefined();
+        expect(result.oauthClientSecret).toBeUndefined();
+        expect(result.dtPlatformToken).toBeUndefined();
     });
     it('throws if DT_ENVIRONMENT is missing', () => {
         const env = { ...baseEnv, DT_ENVIRONMENT: undefined };