@mcp-abap-adt/auth-broker 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -10,6 +10,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the complete list.
 
 ## [Unreleased]
+## [0.2.3] - 2025-12-18
+
+### Added
+- `allowClientCredentials` config flag (default: true). Set to `false` to skip UAA client_credentials flow and force provider/browser-based login (useful for ABAP ADT backends that reject service tokens).
+
+## [0.2.2] - 2025-12-13
+
+### Changed
+- Dependency bump: `@mcp-abap-adt/interfaces` to `^0.1.16` to align with latest interfaces release
 
 ## [0.2.1] - 2025-12-12
 
@@ -618,4 +627,3 @@ const broker = new AuthBroker({
 - **Module system**: CommonJS
 - **Build output**: TypeScript compiled to JavaScript with type definitions
 - **Logging**: Injectable logger interface with environment variable control
-

package/README.md

@@ -52,6 +52,14 @@ const broker = new AuthBroker({
   serviceKeyStore: new AbapServiceKeyStore('/path/to/destinations'), // optional
   tokenProvider: new BtpTokenProvider(), // optional
 }, 'chrome', logger);
+
+// Disable direct client_credentials (force provider/browser flow, e.g., for ABAP ADT)
+const brokerNoClientCreds = new AuthBroker({
+  sessionStore: new AbapSessionStore('/path/to/destinations'),
+  serviceKeyStore: new AbapServiceKeyStore('/path/to/destinations'),
+  tokenProvider: new BtpTokenProvider(),
+  allowClientCredentials: false,
+}, 'chrome', logger);
 ```
 
 ### Session + Service Key (For Initialization)
@@ -596,4 +604,3 @@ Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the co
 ## License
 
 MIT
-

package/dist/AuthBroker.d.ts

@@ -14,6 +14,8 @@ export interface AuthBrokerConfig {
     serviceKeyStore?: IServiceKeyStore;
     /** Token provider (optional) - handles token refresh and authentication flows. If not provided, direct UAA HTTP requests will be used when UAA credentials are available */
     tokenProvider?: ITokenProvider;
+    /** Allow direct UAA client_credentials flow (default: true). Set false to force provider/interactive login (e.g., ABAP ADT). */
+    allowClientCredentials?: boolean;
 }
 export declare class AuthBroker {
     private browser;
@@ -21,6 +23,7 @@ export declare class AuthBroker {
     private serviceKeyStore;
     private sessionStore;
     private tokenProvider;
+    private allowClientCredentials;
     /**
      * Create a new AuthBroker instance
      * @param config Configuration object with stores and token provider

package/dist/AuthBroker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAW,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAa7C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,YAAY,EAAE,aAAa,CAAC;IAC5B,uEAAuE;IACvE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,4KAA4K;IAC5K,aAAa,CAAC,EAAE,cAAc,CAAC;CAChC;AAcD,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,aAAa,CAA6B;IAElD;;;;;;;;;;OAUG;gBAED,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,OAAO;IAgElB;;;;;OAKG;YACW,kBAAkB;IA4ChC;;;;OAIG;YACW,6BAA6B;IA0C3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA0SpD;;;;;OAKG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuFxD;;;;OAIG;IACG,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA2BvF;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAyBlF"}
+{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAW,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAa7C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,YAAY,EAAE,aAAa,CAAC;IAC5B,uEAAuE;IACvE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,4KAA4K;IAC5K,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,gIAAgI;IAChI,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAcD,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,sBAAsB,CAAU;IAExC;;;;;;;;;;OAUG;gBAED,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,OAAO;IAmElB;;;;;OAKG;YACW,kBAAkB;IA4ChC;;;;OAIG;YACW,6BAA6B;IA0C3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8SpD;;;;;OAKG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuFxD;;;;OAIG;IACG,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA2BvF;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAyBlF"}

package/dist/AuthBroker.js

@@ -23,6 +23,7 @@ class AuthBroker {
     serviceKeyStore;
     sessionStore;
     tokenProvider;
+    allowClientCredentials;
     /**
      * Create a new AuthBroker instance
      * @param config Configuration object with stores and token provider
@@ -84,10 +85,11 @@ class AuthBroker {
         this.tokenProvider = tokenProvider;
         this.browser = browser || 'system';
         this.logger = logger || noOpLogger;
+        this.allowClientCredentials = config.allowClientCredentials !== false;
         // Log successful initialization
         const hasServiceKeyStore = !!this.serviceKeyStore;
         const hasTokenProvider = !!this.tokenProvider;
-        this.logger?.debug(`AuthBroker initialized: sessionStore(ok), serviceKeyStore(${hasServiceKeyStore ? 'ok' : 'none'}), tokenProvider(${hasTokenProvider ? 'ok' : 'none'})`);
+        this.logger?.debug(`AuthBroker initialized: sessionStore(ok), serviceKeyStore(${hasServiceKeyStore ? 'ok' : 'none'}), tokenProvider(${hasTokenProvider ? 'ok' : 'none'}), allowClientCredentials(${this.allowClientCredentials})`);
     }
     /**
      * Refresh token using refresh_token grant type (direct UAA HTTP request)
@@ -414,10 +416,10 @@ class AuthBroker {
             throw new Error(errorMessage);
         }
         try {
-            this.logger?.debug(`Step 2: Trying UAA (client_credentials) flow for ${destination}`);
+            this.logger?.debug(`Step 2: Trying UAA (client_credentials/provider) flow for ${destination}`);
             let tokenResult;
-            // Try direct UAA request first if UAA credentials are available
-            if (uaaCredentials.uaaUrl && uaaCredentials.uaaClientId && uaaCredentials.uaaClientSecret) {
+            // Try direct UAA request first if allowed and UAA credentials are available
+            if (this.allowClientCredentials && uaaCredentials.uaaUrl && uaaCredentials.uaaClientId && uaaCredentials.uaaClientSecret) {
                 try {
                     this.logger?.debug(`Step 2: Trying direct UAA client_credentials for ${destination}`);
                     const uaaResult = await this.getTokenWithClientCredentials(uaaCredentials);
@@ -445,7 +447,7 @@ class AuthBroker {
                 }
             }
             else if (this.tokenProvider) {
-                // No UAA credentials but have provider
+                // No client_credentials (disabled) or missing UAA creds -> use provider
                 const authConfigWithoutRefresh = { ...uaaCredentials, refreshToken: undefined };
                 tokenResult = await this.tokenProvider.getConnectionConfig(authConfigWithoutRefresh, {
                     browser: this.browser,
@@ -453,7 +455,9 @@ class AuthBroker {
                 });
             }
             else {
-                throw new Error('UAA credentials incomplete and tokenProvider not available');
+                throw new Error(this.allowClientCredentials
+                    ? 'UAA credentials incomplete and tokenProvider not available'
+                    : 'Client credentials flow disabled and no tokenProvider available for interactive login');
             }
             const tokenLength = tokenResult.connectionConfig.authorizationToken?.length || 0;
             this.logger?.info(`Step 2: Token obtained via UAA for ${destination}: token(${tokenLength} chars), hasRefreshToken(${!!tokenResult.refreshToken})`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "JWT authentication broker for MCP ABAP ADT - manages tokens based on destination headers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -51,7 +51,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@mcp-abap-adt/interfaces": "^0.1.15",
+    "@mcp-abap-adt/interfaces": "^0.1.16",
     "axios": "^1.13.2"
   },
   "devDependencies": {