@mcp-abap-adt/auth-broker 0.1.6 → 0.1.7

package/CHANGELOG.md

@@ -9,7 +9,22 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the complete list.
 
-## [0.1.6] - 2025-01-XX
+## [0.1.7] - 2025-12-04
+
+### Changed
+- **getToken() Fallback Chain** - Improved authentication reliability with multi-step fallback chain
+  - **Step 1**: Check if session exists and token is valid (returns immediately if valid)
+  - **Step 2**: Verify service key exists (throws error if missing)
+  - **Step 3**: Try refresh token authentication (via tokenProvider) if refresh token is available
+  - **Step 4**: Try UAA client_credentials authentication (via tokenProvider) if refresh token missing or failed
+  - **Step 5**: Try browser authentication (via tokenProvider) if UAA failed or parameters missing
+  - **Step 6**: Throw comprehensive error if all methods failed
+  - All authentication attempts use `ITokenProvider` interface (no direct implementation imports)
+  - Token validation is performed only when checking existing session (step 1)
+  - Tokens obtained through refresh/UAA/browser authentication are not validated before being saved
+  - Improved error messages with details about which authentication methods failed
+
+## [0.1.6] - 2025-12-04
 
 ### Changed
 - **Package Split** - Extracted store and provider implementations into separate packages

package/README.md

@@ -191,7 +191,15 @@ new AuthBroker(
 
 ##### `getToken(destination: string): Promise<string>`
 
-Gets authentication token for destination. Tries to load from `.env` file, validates it, and refreshes if needed.
+Gets authentication token for destination. Tries to load from session store, validates it, and refreshes if needed using a fallback chain:
+
+1. **Check session**: Load token from session store and validate it
+2. **Try refresh token**: If refresh token is available, attempt to refresh using it (via tokenProvider)
+3. **Try UAA (client_credentials)**: Attempt to get token using UAA credentials (via tokenProvider)
+4. **Try browser authentication**: Attempt browser-based OAuth2 flow using service key (via tokenProvider)
+5. **Throw error**: If all authentication methods failed
+
+**Note**: Token validation is performed only when checking existing session. Tokens obtained through refresh/UAA/browser authentication are not validated before being saved.
 
 ##### `refreshToken(destination: string): Promise<string>`
 

package/dist/AuthBroker.d.ts

@@ -31,10 +31,36 @@ export declare class AuthBroker {
     }, browser?: string, logger?: Logger);
     /**
      * Get authentication token for destination.
-     * Tries to load from session store, validates it, and refreshes if needed.
+     * Tries to load from session store, validates it, and refreshes if needed using a fallback chain.
+     *
+     * **Fallback Chain:**
+     * 1. **Check session**: Load token from session store and validate it
+     *    - If token is valid, return it immediately
+     *    - If token is invalid or missing, continue to next step
+     *
+     * 2. **Check service key**: Verify that service key exists
+     *    - If no service key found, throw error
+     *
+     * 3. **Try refresh token**: If refresh token is available in session, attempt to refresh using it (via tokenProvider)
+     *    - If successful, save new token to session and return it
+     *    - If failed, continue to next step
+     *
+     * 4. **Try UAA (client_credentials)**: Attempt to get token using UAA credentials (via tokenProvider)
+     *    - If UAA parameters are available and authentication succeeds, save token to session and return it
+     *    - If failed or parameters missing, continue to next step
+     *
+     * 5. **Try browser authentication**: Attempt browser-based OAuth2 flow using service key (via tokenProvider)
+     *    - If successful, save token and refresh token to session and return it
+     *    - If failed, continue to next step
+     *
+     * 6. **Throw error**: If all authentication methods failed, throw comprehensive error with details
+     *
+     * **Note**: Token validation is performed only when checking existing session (step 1).
+     * Tokens obtained through refresh/UAA/browser authentication are not validated before being saved.
+     *
      * @param destination Destination name (e.g., "TRIAL")
      * @returns Promise that resolves to JWT token string
-     * @throws Error if neither session data nor service key found
+     * @throws Error if neither session data nor service key found, or if all authentication methods failed
      */
     getToken(destination: string): Promise<string>;
     /**

package/dist/AuthBroker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAiB,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,aAAa,CAAiB;IAEtC;;;;;;;;;;OAUG;gBAED,MAAM,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAC;QAAC,YAAY,EAAE,aAAa,CAAC;QAAC,aAAa,EAAE,cAAc,CAAA;KAAE,EACzG,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM;IASjB;;;;;;OAMG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAwDpD;;;;;OAKG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuCxD;;;;OAIG;IACG,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAWvF;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAWlF"}
+{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,MAAM,EAAiB,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,eAAe,CAAmB;IAC1C,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,aAAa,CAAiB;IAEtC;;;;;;;;;;OAUG;gBAED,MAAM,EAAE;QAAE,eAAe,EAAE,gBAAgB,CAAC;QAAC,YAAY,EAAE,aAAa,CAAC;QAAC,aAAa,EAAE,cAAc,CAAA;KAAE,EACzG,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM;IASjB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgCG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAmIpD;;;;;OAKG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuCxD;;;;OAIG;IACG,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAWvF;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAWlF"}

package/dist/AuthBroker.js

@@ -34,13 +34,39 @@ class AuthBroker {
     }
     /**
      * Get authentication token for destination.
-     * Tries to load from session store, validates it, and refreshes if needed.
+     * Tries to load from session store, validates it, and refreshes if needed using a fallback chain.
+     *
+     * **Fallback Chain:**
+     * 1. **Check session**: Load token from session store and validate it
+     *    - If token is valid, return it immediately
+     *    - If token is invalid or missing, continue to next step
+     *
+     * 2. **Check service key**: Verify that service key exists
+     *    - If no service key found, throw error
+     *
+     * 3. **Try refresh token**: If refresh token is available in session, attempt to refresh using it (via tokenProvider)
+     *    - If successful, save new token to session and return it
+     *    - If failed, continue to next step
+     *
+     * 4. **Try UAA (client_credentials)**: Attempt to get token using UAA credentials (via tokenProvider)
+     *    - If UAA parameters are available and authentication succeeds, save token to session and return it
+     *    - If failed or parameters missing, continue to next step
+     *
+     * 5. **Try browser authentication**: Attempt browser-based OAuth2 flow using service key (via tokenProvider)
+     *    - If successful, save token and refresh token to session and return it
+     *    - If failed, continue to next step
+     *
+     * 6. **Throw error**: If all authentication methods failed, throw comprehensive error with details
+     *
+     * **Note**: Token validation is performed only when checking existing session (step 1).
+     * Tokens obtained through refresh/UAA/browser authentication are not validated before being saved.
+     *
      * @param destination Destination name (e.g., "TRIAL")
      * @returns Promise that resolves to JWT token string
-     * @throws Error if neither session data nor service key found
+     * @throws Error if neither session data nor service key found, or if all authentication methods failed
      */
     async getToken(destination) {
-        // Load connection config from session store
+        // Step 1: Check if session exists and token is valid
         const connConfig = await this.sessionStore.getConnectionConfig(destination);
         if (connConfig?.authorizationToken) {
             // Validate token if provider supports validation and we have service URL
@@ -55,7 +81,7 @@ class AuthBroker {
                 return connConfig.authorizationToken;
             }
         }
-        // Token not found or expired, check if we have service key
+        // Step 2: No valid session, check if we have service key
         const serviceKey = await this.serviceKeyStore.getServiceKey(destination);
         if (!serviceKey) {
             // No service key and no valid token
@@ -67,24 +93,92 @@ class AuthBroker {
         if (!authConfig) {
             throw new Error(`Service key for destination "${destination}" does not contain UAA credentials`);
         }
-        // Get refresh token from session
+        // Get refresh token from session (if exists)
         const sessionAuthConfig = await this.sessionStore.getAuthorizationConfig(destination);
-        const authConfigWithRefresh = { ...authConfig, refreshToken: sessionAuthConfig?.refreshToken || authConfig.refreshToken };
-        // Get connection config with token from provider
-        const tokenResult = await this.tokenProvider.getConnectionConfig(authConfigWithRefresh, {
-            browser: this.browser,
-            logger: this.logger,
-        });
-        // Update session with new token
-        await this.sessionStore.setConnectionConfig(destination, tokenResult.connectionConfig);
-        // Update authorization config with new refresh token if available
-        if (tokenResult.refreshToken) {
-            await this.sessionStore.setAuthorizationConfig(destination, {
-                ...authConfig,
-                refreshToken: tokenResult.refreshToken,
+        const refreshToken = sessionAuthConfig?.refreshToken || authConfig.refreshToken;
+        let tokenResult;
+        let lastError = null;
+        // Step 3: Try to refresh using refresh token (if available) via tokenProvider
+        if (refreshToken) {
+            try {
+                this.logger.debug(`Attempting to refresh token using refresh token for destination "${destination}"...`);
+                const authConfigWithRefresh = { ...authConfig, refreshToken };
+                tokenResult = await this.tokenProvider.getConnectionConfig(authConfigWithRefresh, {
+                    browser: this.browser,
+                    logger: this.logger,
+                });
+                this.logger.debug(`Token refreshed successfully using refresh token for destination "${destination}"`);
+                // Update session with new token
+                await this.sessionStore.setConnectionConfig(destination, tokenResult.connectionConfig);
+                if (tokenResult.refreshToken) {
+                    await this.sessionStore.setAuthorizationConfig(destination, {
+                        ...authConfig,
+                        refreshToken: tokenResult.refreshToken,
+                    });
+                }
+                return tokenResult.connectionConfig.authorizationToken;
+            }
+            catch (error) {
+                lastError = error;
+                this.logger.debug(`Token refresh failed for destination "${destination}": ${error.message}. Trying without refresh token...`);
+                // Continue to next step
+            }
+        }
+        // Step 4: Try UAA (client_credentials) via tokenProvider (without refresh token)
+        // TokenProvider should try client_credentials if refresh token is not provided
+        try {
+            this.logger.debug(`Attempting to get token using UAA (client_credentials) for destination "${destination}"...`);
+            const authConfigWithoutRefresh = { ...authConfig, refreshToken: undefined };
+            tokenResult = await this.tokenProvider.getConnectionConfig(authConfigWithoutRefresh, {
+                browser: this.browser,
+                logger: this.logger,
+            });
+            this.logger.debug(`Token obtained successfully using UAA for destination "${destination}"`);
+            // Update session with new token
+            await this.sessionStore.setConnectionConfig(destination, tokenResult.connectionConfig);
+            if (tokenResult.refreshToken) {
+                await this.sessionStore.setAuthorizationConfig(destination, {
+                    ...authConfig,
+                    refreshToken: tokenResult.refreshToken,
+                });
+            }
+            return tokenResult.connectionConfig.authorizationToken;
+        }
+        catch (error) {
+            lastError = error;
+            this.logger.debug(`UAA authentication failed for destination "${destination}": ${error.message}. Trying browser authentication...`);
+            // Continue to next step
+        }
+        // Step 5: Try browser authentication via tokenProvider (should be last resort)
+        // TokenProvider should use browser auth if refresh token and client_credentials don't work
+        try {
+            this.logger.debug(`Starting browser authentication flow for destination "${destination}"...`);
+            const authConfigForBrowser = { ...authConfig, refreshToken: undefined };
+            tokenResult = await this.tokenProvider.getConnectionConfig(authConfigForBrowser, {
+                browser: this.browser,
+                logger: this.logger,
             });
+            this.logger.debug(`Token obtained successfully using browser authentication for destination "${destination}"`);
+            // Update session with new token
+            await this.sessionStore.setConnectionConfig(destination, tokenResult.connectionConfig);
+            if (tokenResult.refreshToken) {
+                await this.sessionStore.setAuthorizationConfig(destination, {
+                    ...authConfig,
+                    refreshToken: tokenResult.refreshToken,
+                });
+            }
+            return tokenResult.connectionConfig.authorizationToken;
+        }
+        catch (error) {
+            lastError = error;
+            // Step 6: All methods failed - throw error
+            const errorMessage = `All authentication methods failed for destination "${destination}". ` +
+                `Refresh token: ${refreshToken ? 'failed' : 'not available'}. ` +
+                `UAA: ${authConfig.uaaUrl && authConfig.uaaClientId && authConfig.uaaClientSecret ? 'failed' : 'parameters missing'}. ` +
+                `Browser authentication: failed (${error.message})`;
+            this.logger.error(errorMessage);
+            throw new Error(errorMessage);
         }
-        return tokenResult.connectionConfig.authorizationToken;
     }
     /**
      * Force refresh token for destination using service key.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "0.1.6",
+  "version": "0.1.7",
   "description": "JWT authentication broker for MCP ABAP ADT - manages tokens based on destination headers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",