@mcp-abap-adt/auth-broker 0.2.3 → 0.2.5

package/CHANGELOG.md

@@ -10,6 +10,63 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the complete list.
 
 ## [Unreleased]
+
+## [0.2.5] - 2025-01-XX
+
+### Dependencies
+- Updated `@mcp-abap-adt/auth-providers` to `^0.2.1` for automatic port selection and improved server shutdown
+  - Browser auth server now automatically finds an available port if the requested port is in use
+  - Improved server shutdown ensures ports are properly freed after authentication completes
+  - Prevents `EADDRINUSE` errors when multiple stdio servers run simultaneously
+  - Ports are properly released after server shutdown, preventing lingering port occupation
+
+## [0.2.4] - 2025-12-19
+
+### Changed
+- **Comprehensive Error Handling**: Added robust error handling for all external operations
+  - **SessionStore errors**: Handle FILE_NOT_FOUND, PARSE_ERROR from session files (graceful degradation)
+  - **ServiceKeyStore errors**: Handle FILE_NOT_FOUND, PARSE_ERROR, INVALID_CONFIG from service key files (log and fallback)
+  - **TokenProvider errors**: Handle network errors (ECONNREFUSED, ETIMEDOUT, ENOTFOUND), validation errors, browser auth failures
+  - **Write operation errors**: Handle failures when saving tokens/config to session files
+  - All errors logged with detailed context (file paths, error codes, missing fields)
+  - Broker continues with fallback mechanisms when possible instead of crashing
+- **Token Refresh Architecture**: Removed direct UAA HTTP requests from AuthBroker
+  - `getToken()` now uses provider's `refreshTokenFromSession()` (Step 2a) and `refreshTokenFromServiceKey()` (Step 2b) methods
+  - All authentication logic delegated to providers (XsuaaTokenProvider, BtpTokenProvider)
+  - Providers handle browser-based authentication and client_credentials flow internally
+  - Better error handling with typed errors from `@mcp-abap-adt/auth-providers@0.2.0`
+- **Error Handling**: Improved error handling in token requests
+  - Network errors (connection issues) are now handled separately from HTTP errors (401, 403)
+  - Better error messages with UAA URL context when network errors occur
+  - No retry attempts for network errors (retries cannot fix infrastructure issues)
+
+### Fixed
+- **Defensive Programming**: Treat all injected dependencies as untrusted
+  - File operations (session/service key stores) may fail - files missing, corrupted, permission issues
+  - Network operations (token provider) may fail - timeouts, connection refused, invalid responses
+  - All external operations wrapped in try-catch with specific error handling per operation type
+  - Prevents broker crashes when consumers misconfigure files or network issues occur
+- **Network Error Detection**: Add proper network error detection in token requests
+  - Detect network errors: `ECONNREFUSED`, `ETIMEDOUT`, `ENOTFOUND`, `ECONNRESET`, `ENETUNREACH`, `EHOSTUNREACH`
+  - Throw network errors immediately with clear error message indicating connectivity issues
+  - Prevents confusing error messages when VPN is down or server is unreachable
+  - Network errors now clearly indicate infrastructure issues vs authentication failures
+- **Simplified Refresh**: `refreshToken()` now simply delegates to `getToken()` for full refresh flow
+  - Ensures consistent refresh behavior across all token operations
+  - No code duplication between getToken and refreshToken methods
+
+### Removed
+- **Direct UAA Code**: Removed direct UAA request methods and old credential flow
+  - Removed `getTokenWithClientCredentials()` private method (logic moved to providers)
+  - Removed `refreshTokenDirect()` private method (logic moved to providers)
+  - Removed `allowClientCredentials` constructor parameter (handled by providers)
+  - Removed old "Step 2: UAA Credentials Flow" (replaced with provider-based Step 2a/2b)
+
+### Dependencies
+- Updated `@mcp-abap-adt/interfaces` to `^0.2.3` for STORE_ERROR_CODES and TOKEN_PROVIDER_ERROR_CODES
+- Updated `@mcp-abap-adt/auth-stores` to `^0.2.5` for typed errors (ParseError, FileNotFoundError, etc.)
+- Updated `@mcp-abap-adt/auth-providers` to `^0.2.0` for new refresh methods and typed errors
+
 ## [0.2.3] - 2025-12-18
 
 ### Added

package/README.md

@@ -98,6 +98,8 @@ const broker = new AuthBroker({
 }, 'chrome');
 ```
 
+**Note**: The `BtpTokenProvider` automatically finds an available port if the requested port is in use. This prevents `EADDRINUSE` errors when multiple stdio servers run simultaneously. The server properly closes all connections and frees the port after authentication completes, ensuring no lingering port occupation.
+
 ### Getting Tokens
 
 ```typescript
@@ -418,6 +420,54 @@ Gets authentication token for destination. Implements a three-step flow:
 - If `sessionStore` contains valid UAA credentials, neither `serviceKeyStore` nor `tokenProvider` are required. Direct UAA HTTP requests will be used automatically.
 - `tokenProvider` is only needed for browser authentication or when direct UAA requests fail.
 - Token validation is performed only when checking existing session. Tokens obtained through refresh/UAA/browser authentication are not validated before being saved.
+- **Store errors are handled gracefully**: If service key files are missing or malformed, the broker logs the error and continues with fallback mechanisms (session store data or provider-based auth)
+
+##### Error Handling
+
+The broker implements comprehensive error handling for all external operations, treating all injected dependencies as untrusted:
+
+```typescript
+import { STORE_ERROR_CODES } from '@mcp-abap-adt/interfaces';
+
+try {
+  const token = await broker.getToken('TRIAL');
+} catch (error: any) {
+  // Broker handles errors internally where possible, but critical errors propagate
+  console.error('Failed to get token:', error.message);
+}
+```
+
+**Error Categories** (handled by broker with graceful degradation):
+
+**1. SessionStore Errors** (reading session files):
+- `STORE_ERROR_CODES.FILE_NOT_FOUND` - Session file missing (logged, tries serviceKeyStore fallback)
+- `STORE_ERROR_CODES.PARSE_ERROR` - Corrupted session file (logged with file path, tries fallback)
+- Write failures when saving tokens (logged and thrown - critical)
+
+**2. ServiceKeyStore Errors** (reading service key files):
+- `STORE_ERROR_CODES.FILE_NOT_FOUND` - Service key file missing (logged, continues with session data)
+- `STORE_ERROR_CODES.PARSE_ERROR` - Invalid JSON in service key (logged with file path and cause)
+- `STORE_ERROR_CODES.INVALID_CONFIG` - Missing required fields (logged with missing field names)
+- `STORE_ERROR_CODES.STORAGE_ERROR` - Permission/write errors (logged)
+
+**3. TokenProvider Errors** (network operations):
+- Network errors: `ECONNREFUSED`, `ETIMEDOUT`, `ENOTFOUND` (logged, throws with descriptive message)
+- `VALIDATION_ERROR` - Missing required auth fields (logged with field names, throws)
+- `BROWSER_AUTH_ERROR` - Browser authentication failed or cancelled (logged, throws)
+- `REFRESH_ERROR` - Token refresh failed at UAA server (logged, throws)
+
+**Defensive Design Principles:**
+- **All external operations wrapped in try-catch**: Files may be missing/corrupted, network may fail
+- **Graceful degradation**: Store errors trigger fallback mechanisms (serviceKey → session → provider)
+- **Detailed error context**: Logs include file paths, error codes, missing fields for debugging
+- **Fail-fast for critical errors**: Write failures and provider errors throw immediately (cannot recover)
+- **No assumptions about injected dependencies**: All stores/providers treated as potentially unreliable
+
+Example error scenarios handled:
+- Session file deleted mid-operation → uses service key
+- Service key has invalid JSON → logs parse error, uses session data
+- Network timeout during token refresh → logs timeout, throws descriptive error
+- File permission denied → logs error with file path, throws
 
 ##### `refreshToken(destination: string): Promise<string>`
 
@@ -448,6 +498,8 @@ The package uses `ITokenProvider` interface for token acquisition. Two implement
 
 - **`BtpTokenProvider`** - For BTP/ABAP authentication (full scope)
   - Constructor accepts optional `browserAuthPort?: number` parameter (default: 3001)
+  - Automatically finds an available port if the requested port is in use (prevents `EADDRINUSE` errors)
+  - Server properly closes all connections and frees the port after authentication completes
   - Use custom port to avoid conflicts when running alongside other services (e.g., proxy server)
   - Uses browser-based OAuth2 flow (if no refresh token)
   - Uses refresh token if available

package/dist/AuthBroker.d.ts

@@ -12,80 +12,69 @@ export interface AuthBrokerConfig {
     sessionStore: ISessionStore;
     /** Service key store (optional) - stores and retrieves service keys */
     serviceKeyStore?: IServiceKeyStore;
-    /** Token provider (optional) - handles token refresh and authentication flows. If not provided, direct UAA HTTP requests will be used when UAA credentials are available */
-    tokenProvider?: ITokenProvider;
-    /** Allow direct UAA client_credentials flow (default: true). Set false to force provider/interactive login (e.g., ABAP ADT). */
-    allowClientCredentials?: boolean;
+    /** Token provider (required) - handles token refresh and authentication flows through browser-based authorization (e.g., XSUAA provider) */
+    tokenProvider: ITokenProvider;
 }
+/**
+ * AuthBroker manages JWT authentication tokens for destinations
+ */
 export declare class AuthBroker {
     private browser;
     private logger;
     private serviceKeyStore;
     private sessionStore;
     private tokenProvider;
-    private allowClientCredentials;
     /**
      * Create a new AuthBroker instance
      * @param config Configuration object with stores and token provider
      *               - sessionStore: Store for session data (required)
      *               - serviceKeyStore: Store for service keys (optional)
-     *               - tokenProvider: Token provider implementing ITokenProvider interface (optional). If not provided, direct UAA HTTP requests will be used when UAA credentials are available
+     *               - tokenProvider: Token provider implementing ITokenProvider interface (required) - handles browser-based authorization
      * @param browser Optional browser name for authentication (chrome, edge, firefox, system, none).
      *                Default: 'system' (system default browser).
      *                Use 'none' to print URL instead of opening browser.
      * @param logger Optional logger instance implementing ILogger interface. If not provided, uses no-op logger.
      */
     constructor(config: AuthBrokerConfig, browser?: string, logger?: ILogger);
-    /**
-     * Refresh token using refresh_token grant type (direct UAA HTTP request)
-     * @param refreshToken Refresh token
-     * @param authConfig UAA authorization configuration
-     * @returns Promise that resolves to new tokens
-     */
-    private refreshTokenDirect;
-    /**
-     * Get token using client_credentials grant type (direct UAA HTTP request)
-     * @param authConfig UAA authorization configuration
-     * @returns Promise that resolves to access token
-     */
-    private getTokenWithClientCredentials;
     /**
      * Get authentication token for destination.
-     * Implements a three-step flow: Step 0 (initialize), Step 1 (refresh), Step 2 (UAA).
+     * Uses tokenProvider for all authentication operations (browser-based authorization).
      *
      * **Flow:**
      * **Step 0: Initialize Session with Token (if needed)**
      * - Check if session has `authorizationToken` AND UAA credentials
      * - If both are empty AND serviceKeyStore is available:
-     *   - Try direct UAA request from service key (if UAA credentials available)
-     *   - If failed and tokenProvider available → use provider
-     * - If session has token OR UAA credentials → proceed to Step 1
+     *   - Get UAA credentials from service key
+     *   - Use tokenProvider for browser-based authentication
+     *   - Save token and refresh token to session
+     *
+     * **Step 1: Token Validation**
+     * - If token exists in session, validate it (if provider supports validation)
+     * - If valid → return token
+     * - If invalid or no token → continue to refresh
      *
-     * **Step 1: Refresh Token Flow**
+     * **Step 2: Refresh Token Flow**
      * - Check if refresh token exists in session
      * - If refresh token exists:
-     *   - Try direct UAA refresh (if UAA credentials in session)
-     *   - If failed and tokenProvider available → use provider
-     *   - If successful → return new token
-     * - Otherwise → proceed to Step 2
+     *   - Use tokenProvider to refresh token (browser-based or refresh grant)
+     *   - Save new token to session
+     *   - Return new token
+     * - Otherwise → proceed to Step 3
      *
-     * **Step 2: UAA Credentials Flow**
-     * - Check if UAA credentials exist in session or service key
-     * - Try direct UAA client_credentials request (if UAA credentials available)
-     * - If failed and tokenProvider available → use provider
-     * - If successful → return new token
-     * - If all failed → return error
+     * **Step 3: New Token Flow**
+     * - Get UAA credentials from session or service key
+     * - Use tokenProvider for browser-based authentication
+     * - Save new token to session
+     * - Return new token
      *
      * **Important Notes:**
-     * - If sessionStore contains valid UAA credentials, neither serviceKeyStore nor tokenProvider are required.
-     *   Direct UAA HTTP requests will be used automatically.
-     * - tokenProvider is only needed when:
-     *   - Initializing session from service key via browser authentication (Step 0)
-     *   - Direct UAA requests fail and fallback to provider is needed
+     * - All authentication is handled by tokenProvider (e.g., XSUAA provider)
+     * - Provider uses browser-based authorization to ensure proper role assignment
+     * - Direct UAA HTTP requests are not used to avoid role assignment issues
      *
      * @param destination Destination name (e.g., "TRIAL")
      * @returns Promise that resolves to JWT token string
-     * @throws Error if session initialization fails or all authentication methods failed
+     * @throws Error if session initialization fails or authentication failed
      */
     getToken(destination: string): Promise<string>;
     /**

package/dist/AuthBroker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAAW,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAa7C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,YAAY,EAAE,aAAa,CAAC;IAC5B,uEAAuE;IACvE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,4KAA4K;IAC5K,aAAa,CAAC,EAAE,cAAc,CAAC;IAC/B,gIAAgI;IAChI,sBAAsB,CAAC,EAAE,OAAO,CAAC;CAClC;AAcD,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,aAAa,CAA6B;IAClD,OAAO,CAAC,sBAAsB,CAAU;IAExC;;;;;;;;;;OAUG;gBAED,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,OAAO;IAmElB;;;;;OAKG;YACW,kBAAkB;IA4ChC;;;;OAIG;YACW,6BAA6B;IA0C3C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAqCG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA8SpD;;;;;OAKG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAuFxD;;;;OAIG;IACG,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA2BvF;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CAyBlF"}
+{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,OAAO,EAA8C,MAAM,0BAA0B,CAAC;AAC/F,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/G,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAa7C;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mEAAmE;IACnE,YAAY,EAAE,aAAa,CAAC;IAC5B,uEAAuE;IACvE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC,4IAA4I;IAC5I,aAAa,EAAE,cAAc,CAAC;CAC/B;AAED;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAqB;IACpC,OAAO,CAAC,MAAM,CAAU;IACxB,OAAO,CAAC,eAAe,CAA+B;IACtD,OAAO,CAAC,YAAY,CAAgB;IACpC,OAAO,CAAC,aAAa,CAAiB;IAEtC;;;;;;;;;;OAUG;gBAED,MAAM,EAAE,gBAAgB,EACxB,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,OAAO;IAsElB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAuCG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAkWpD;;;;;OAKG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOxD;;;;OAIG;IACG,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IA4CvF;;;;OAIG;IACG,mBAAmB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;CA0ClF"}

package/dist/AuthBroker.js

@@ -2,12 +2,9 @@
 /**
  * Main AuthBroker class for managing JWT tokens based on destinations
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthBroker = void 0;
-const axios_1 = __importDefault(require("axios"));
+const interfaces_1 = require("@mcp-abap-adt/interfaces");
 /**
  * No-op logger implementation for default fallback when logger is not provided
  */
@@ -17,19 +14,21 @@ const noOpLogger = {
     warn: () => { },
     debug: () => { },
 };
+/**
+ * AuthBroker manages JWT authentication tokens for destinations
+ */
 class AuthBroker {
     browser;
     logger;
     serviceKeyStore;
     sessionStore;
     tokenProvider;
-    allowClientCredentials;
     /**
      * Create a new AuthBroker instance
      * @param config Configuration object with stores and token provider
      *               - sessionStore: Store for session data (required)
      *               - serviceKeyStore: Store for service keys (optional)
-     *               - tokenProvider: Token provider implementing ITokenProvider interface (optional). If not provided, direct UAA HTTP requests will be used when UAA credentials are available
+     *               - tokenProvider: Token provider implementing ITokenProvider interface (required) - handles browser-based authorization
      * @param browser Optional browser name for authentication (chrome, edge, firefox, system, none).
      *                Default: 'system' (system default browser).
      *                Use 'none' to print URL instead of opening browser.
@@ -44,6 +43,10 @@ class AuthBroker {
         if (!config.sessionStore) {
             throw new Error('AuthBroker: sessionStore is required');
         }
+        // Validate required tokenProvider
+        if (!config.tokenProvider) {
+            throw new Error('AuthBroker: tokenProvider is required');
+        }
         // Validate that stores and provider are correctly instantiated (have required methods)
         const sessionStore = config.sessionStore;
         const tokenProvider = config.tokenProvider;
@@ -61,13 +64,11 @@ class AuthBroker {
         if (typeof sessionStore.setConnectionConfig !== 'function') {
             throw new Error('AuthBroker: sessionStore.setConnectionConfig must be a function');
         }
-        // Check tokenProvider methods (if provided)
-        if (tokenProvider) {
-            if (typeof tokenProvider.getConnectionConfig !== 'function') {
-                throw new Error('AuthBroker: tokenProvider.getConnectionConfig must be a function');
-            }
-            // validateToken is optional, so we don't check it
+        // Check tokenProvider methods (required)
+        if (typeof tokenProvider.getConnectionConfig !== 'function') {
+            throw new Error('AuthBroker: tokenProvider.getConnectionConfig must be a function');
         }
+        // validateToken is optional, so we don't check it
         // Check serviceKeyStore methods (if provided)
         if (serviceKeyStore) {
             if (typeof serviceKeyStore.getServiceKey !== 'function') {
@@ -85,153 +86,107 @@ class AuthBroker {
         this.tokenProvider = tokenProvider;
         this.browser = browser || 'system';
         this.logger = logger || noOpLogger;
-        this.allowClientCredentials = config.allowClientCredentials !== false;
         // Log successful initialization
         const hasServiceKeyStore = !!this.serviceKeyStore;
-        const hasTokenProvider = !!this.tokenProvider;
-        this.logger?.debug(`AuthBroker initialized: sessionStore(ok), serviceKeyStore(${hasServiceKeyStore ? 'ok' : 'none'}), tokenProvider(${hasTokenProvider ? 'ok' : 'none'}), allowClientCredentials(${this.allowClientCredentials})`);
-    }
-    /**
-     * Refresh token using refresh_token grant type (direct UAA HTTP request)
-     * @param refreshToken Refresh token
-     * @param authConfig UAA authorization configuration
-     * @returns Promise that resolves to new tokens
-     */
-    async refreshTokenDirect(refreshToken, authConfig) {
-        if (!authConfig.uaaUrl || !authConfig.uaaClientId || !authConfig.uaaClientSecret) {
-            throw new Error('UAA credentials incomplete: uaaUrl, uaaClientId, and uaaClientSecret are required');
-        }
-        const tokenUrl = `${authConfig.uaaUrl}/oauth/token`;
-        const params = new URLSearchParams();
-        params.append('grant_type', 'refresh_token');
-        params.append('refresh_token', refreshToken);
-        const authString = Buffer.from(`${authConfig.uaaClientId}:${authConfig.uaaClientSecret}`).toString('base64');
-        try {
-            const response = await (0, axios_1.default)({
-                method: 'post',
-                url: tokenUrl,
-                headers: {
-                    Authorization: `Basic ${authString}`,
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                },
-                data: params.toString(),
-                timeout: 30000,
-            });
-            if (response.data && response.data.access_token) {
-                return {
-                    accessToken: response.data.access_token,
-                    refreshToken: response.data.refresh_token || refreshToken,
-                    expiresIn: response.data.expires_in,
-                };
-            }
-            else {
-                throw new Error('Response does not contain access_token');
-            }
-        }
-        catch (error) {
-            if (error.response) {
-                throw new Error(`Token refresh failed (${error.response.status}): ${JSON.stringify(error.response.data)}`);
-            }
-            else {
-                throw new Error(`Token refresh failed: ${error.message}`);
-            }
-        }
-    }
-    /**
-     * Get token using client_credentials grant type (direct UAA HTTP request)
-     * @param authConfig UAA authorization configuration
-     * @returns Promise that resolves to access token
-     */
-    async getTokenWithClientCredentials(authConfig) {
-        if (!authConfig.uaaUrl || !authConfig.uaaClientId || !authConfig.uaaClientSecret) {
-            throw new Error('UAA credentials incomplete: uaaUrl, uaaClientId, and uaaClientSecret are required');
-        }
-        const tokenUrl = `${authConfig.uaaUrl}/oauth/token`;
-        const params = new URLSearchParams();
-        params.append('grant_type', 'client_credentials');
-        params.append('client_id', authConfig.uaaClientId);
-        params.append('client_secret', authConfig.uaaClientSecret);
-        try {
-            const response = await (0, axios_1.default)({
-                method: 'post',
-                url: tokenUrl,
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded',
-                },
-                data: params.toString(),
-                timeout: 30000,
-            });
-            if (response.data && response.data.access_token) {
-                return {
-                    accessToken: response.data.access_token,
-                    refreshToken: response.data.refresh_token,
-                    expiresIn: response.data.expires_in,
-                };
-            }
-            else {
-                throw new Error('Response does not contain access_token');
-            }
-        }
-        catch (error) {
-            if (error.response) {
-                throw new Error(`Client credentials authentication failed (${error.response.status}): ${JSON.stringify(error.response.data)}`);
-            }
-            else {
-                throw new Error(`Client credentials authentication failed: ${error.message}`);
-            }
-        }
+        this.logger?.debug(`AuthBroker initialized: sessionStore(ok), serviceKeyStore(${hasServiceKeyStore ? 'ok' : 'none'}), tokenProvider(ok)`);
     }
     /**
      * Get authentication token for destination.
-     * Implements a three-step flow: Step 0 (initialize), Step 1 (refresh), Step 2 (UAA).
+     * Uses tokenProvider for all authentication operations (browser-based authorization).
      *
      * **Flow:**
      * **Step 0: Initialize Session with Token (if needed)**
      * - Check if session has `authorizationToken` AND UAA credentials
      * - If both are empty AND serviceKeyStore is available:
-     *   - Try direct UAA request from service key (if UAA credentials available)
-     *   - If failed and tokenProvider available → use provider
-     * - If session has token OR UAA credentials → proceed to Step 1
+     *   - Get UAA credentials from service key
+     *   - Use tokenProvider for browser-based authentication
+     *   - Save token and refresh token to session
+     *
+     * **Step 1: Token Validation**
+     * - If token exists in session, validate it (if provider supports validation)
+     * - If valid → return token
+     * - If invalid or no token → continue to refresh
      *
-     * **Step 1: Refresh Token Flow**
+     * **Step 2: Refresh Token Flow**
      * - Check if refresh token exists in session
      * - If refresh token exists:
-     *   - Try direct UAA refresh (if UAA credentials in session)
-     *   - If failed and tokenProvider available → use provider
-     *   - If successful → return new token
-     * - Otherwise → proceed to Step 2
+     *   - Use tokenProvider to refresh token (browser-based or refresh grant)
+     *   - Save new token to session
+     *   - Return new token
+     * - Otherwise → proceed to Step 3
      *
-     * **Step 2: UAA Credentials Flow**
-     * - Check if UAA credentials exist in session or service key
-     * - Try direct UAA client_credentials request (if UAA credentials available)
-     * - If failed and tokenProvider available → use provider
-     * - If successful → return new token
-     * - If all failed → return error
+     * **Step 3: New Token Flow**
+     * - Get UAA credentials from session or service key
+     * - Use tokenProvider for browser-based authentication
+     * - Save new token to session
+     * - Return new token
      *
      * **Important Notes:**
-     * - If sessionStore contains valid UAA credentials, neither serviceKeyStore nor tokenProvider are required.
-     *   Direct UAA HTTP requests will be used automatically.
-     * - tokenProvider is only needed when:
-     *   - Initializing session from service key via browser authentication (Step 0)
-     *   - Direct UAA requests fail and fallback to provider is needed
+     * - All authentication is handled by tokenProvider (e.g., XSUAA provider)
+     * - Provider uses browser-based authorization to ensure proper role assignment
+     * - Direct UAA HTTP requests are not used to avoid role assignment issues
      *
      * @param destination Destination name (e.g., "TRIAL")
      * @returns Promise that resolves to JWT token string
-     * @throws Error if session initialization fails or all authentication methods failed
+     * @throws Error if session initialization fails or authentication failed
      */
     async getToken(destination) {
         this.logger?.debug(`Getting token for destination: ${destination}`);
         // Step 0: Initialize Session with Token (if needed)
-        const connConfig = await this.sessionStore.getConnectionConfig(destination);
-        const authConfig = await this.sessionStore.getAuthorizationConfig(destination);
+        let connConfig = null;
+        let authConfig = null;
+        try {
+            connConfig = await this.sessionStore.getConnectionConfig(destination);
+        }
+        catch (error) {
+            // Handle typed store errors from session store
+            if (error.code === interfaces_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
+                this.logger?.debug(`Session file not found for ${destination}: ${error.filePath || 'unknown path'}`);
+            }
+            else if (error.code === interfaces_1.STORE_ERROR_CODES.PARSE_ERROR) {
+                this.logger?.warn(`Failed to parse session file for ${destination}: ${error.filePath || 'unknown path'} - ${error.message}`);
+            }
+            else {
+                this.logger?.warn(`Failed to get connection config from session store for ${destination}: ${error.message}`);
+            }
+        }
+        try {
+            authConfig = await this.sessionStore.getAuthorizationConfig(destination);
+        }
+        catch (error) {
+            // Handle typed store errors from session store
+            if (error.code === interfaces_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
+                this.logger?.debug(`Session file not found for ${destination}: ${error.filePath || 'unknown path'}`);
+            }
+            else if (error.code === interfaces_1.STORE_ERROR_CODES.PARSE_ERROR) {
+                this.logger?.warn(`Failed to parse session file for ${destination}: ${error.filePath || 'unknown path'} - ${error.message}`);
+            }
+            else {
+                this.logger?.warn(`Failed to get authorization config from session store for ${destination}: ${error.message}`);
+            }
+        }
         // Check if session has serviceUrl (required)
         // If not in session, try to get it from serviceKeyStore
         let serviceUrl = connConfig?.serviceUrl;
         if (!serviceUrl && this.serviceKeyStore) {
-            const serviceKeyConnConfig = await this.serviceKeyStore.getConnectionConfig(destination);
-            serviceUrl = serviceKeyConnConfig?.serviceUrl;
-            if (serviceUrl) {
-                this.logger?.debug(`serviceUrl not in session for ${destination}, found in serviceKeyStore`);
+            try {
+                const serviceKeyConnConfig = await this.serviceKeyStore.getConnectionConfig(destination);
+                serviceUrl = serviceKeyConnConfig?.serviceUrl;
+                if (serviceUrl) {
+                    this.logger?.debug(`serviceUrl not in session for ${destination}, found in serviceKeyStore`);
+                }
+            }
+            catch (error) {
+                // Handle typed store errors
+                if (error.code === interfaces_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
+                    this.logger?.debug(`Service key file not found for ${destination}: ${error.filePath || 'unknown path'}`);
+                }
+                else if (error.code === interfaces_1.STORE_ERROR_CODES.PARSE_ERROR) {
+                    this.logger?.warn(`Failed to parse service key for ${destination}: ${error.filePath || 'unknown path'} - ${error.message}`);
+                }
+                else {
+                    this.logger?.warn(`Failed to get serviceUrl from service key store for ${destination}: ${error.message}`);
+                }
             }
         }
         if (!serviceUrl) {
@@ -258,32 +213,31 @@ class AuthBroker {
                     this.logger?.error(`Step 0: Service key for ${destination} missing UAA credentials`);
                     throw new Error(`Service key for destination "${destination}" does not contain UAA credentials`);
                 }
-                // Try direct UAA request first if UAA credentials are available in service key
+                // Use tokenProvider for browser-based authentication
+                this.logger?.debug(`Step 0: Authenticating via provider (browser) for ${destination} using service key UAA credentials`);
                 let tokenResult;
                 try {
-                    // Use direct UAA HTTP request (preferred when UAA credentials are available)
-                    this.logger?.debug(`Step 0: Authenticating via direct UAA request for ${destination} using service key UAA credentials`);
-                    const uaaResult = await this.getTokenWithClientCredentials(serviceKeyAuthConfig);
-                    tokenResult = {
-                        connectionConfig: {
-                            authorizationToken: uaaResult.accessToken,
-                        },
-                        refreshToken: uaaResult.refreshToken,
-                    };
-                }
-                catch (directError) {
-                    this.logger?.debug(`Step 0: Direct UAA request failed for ${destination}: ${directError.message}, trying provider`);
-                    // If direct UAA failed and we have provider, try provider
-                    if (this.tokenProvider) {
-                        this.logger?.debug(`Step 0: Authenticating via provider for ${destination} using service key UAA credentials`);
-                        tokenResult = await this.tokenProvider.getConnectionConfig(serviceKeyAuthConfig, {
-                            browser: this.browser,
-                            logger: this.logger,
-                        });
+                    tokenResult = await this.tokenProvider.getConnectionConfig(serviceKeyAuthConfig, {
+                        browser: this.browser,
+                        logger: this.logger,
+                    });
+                }
+                catch (error) {
+                    // Handle provider errors (network, auth, validation)
+                    if (error.code === 'VALIDATION_ERROR') {
+                        this.logger?.error(`Step 0: Provider validation error for ${destination}: missing ${error.missingFields?.join(', ') || 'required fields'}`);
+                        throw new Error(`Cannot initialize session for destination "${destination}": provider validation failed - missing ${error.missingFields?.join(', ') || 'required fields'}`);
+                    }
+                    else if (error.code === 'BROWSER_AUTH_ERROR') {
+                        this.logger?.error(`Step 0: Browser authentication failed for ${destination}: ${error.message}`);
+                        throw new Error(`Cannot initialize session for destination "${destination}": browser authentication failed - ${error.message}`);
                     }
-                    else {
-                        throw directError; // No provider, re-throw direct error
+                    else if (error.code === 'ECONNREFUSED' || error.code === 'ETIMEDOUT' || error.code === 'ENOTFOUND') {
+                        this.logger?.error(`Step 0: Network error for ${destination}: ${error.code}`);
+                        throw new Error(`Cannot initialize session for destination "${destination}": network error - cannot reach authentication server (${error.code})`);
                     }
+                    this.logger?.error(`Step 0: Provider error for ${destination}: ${error.message}`);
+                    throw new Error(`Cannot initialize session for destination "${destination}": provider error - ${error.message}`);
                 }
                 const tokenLength = tokenResult.connectionConfig.authorizationToken?.length || 0;
                 this.logger?.info(`Step 0: Token initialized for ${destination}: token(${tokenLength} chars), hasRefreshToken(${!!tokenResult.refreshToken})`);
@@ -294,31 +248,61 @@ class AuthBroker {
                     serviceUrl: tokenResult.connectionConfig.serviceUrl || serviceKeyConnConfig?.serviceUrl || serviceUrl,
                 };
                 // Save token and UAA credentials to session
-                await this.sessionStore.setConnectionConfig(destination, connectionConfigWithServiceUrl);
-                await this.sessionStore.setAuthorizationConfig(destination, {
-                    ...serviceKeyAuthConfig,
-                    refreshToken: tokenResult.refreshToken || serviceKeyAuthConfig.refreshToken,
-                });
+                try {
+                    await this.sessionStore.setConnectionConfig(destination, connectionConfigWithServiceUrl);
+                }
+                catch (error) {
+                    this.logger?.error(`Step 0: Failed to save connection config to session for ${destination}: ${error.message}`);
+                    throw new Error(`Failed to save connection config for destination "${destination}": ${error.message}`);
+                }
+                try {
+                    await this.sessionStore.setAuthorizationConfig(destination, {
+                        ...serviceKeyAuthConfig,
+                        refreshToken: tokenResult.refreshToken || serviceKeyAuthConfig.refreshToken,
+                    });
+                }
+                catch (error) {
+                    this.logger?.error(`Step 0: Failed to save authorization config to session for ${destination}: ${error.message}`);
+                    throw new Error(`Failed to save authorization config for destination "${destination}": ${error.message}`);
+                }
                 return tokenResult.connectionConfig.authorizationToken;
             }
             catch (error) {
+                // Handle typed store errors
+                if (error.code === interfaces_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
+                    this.logger?.error(`Step 0: Service key file not found for ${destination}: ${error.filePath || 'unknown path'}`);
+                    throw new Error(`Cannot initialize session for destination "${destination}": service key file not found`);
+                }
+                else if (error.code === interfaces_1.STORE_ERROR_CODES.PARSE_ERROR) {
+                    this.logger?.error(`Step 0: Failed to parse service key for ${destination}: ${error.filePath || 'unknown path'} - ${error.message}`);
+                    throw new Error(`Cannot initialize session for destination "${destination}": service key parsing failed - ${error.message}`);
+                }
+                else if (error.code === interfaces_1.STORE_ERROR_CODES.INVALID_CONFIG) {
+                    this.logger?.error(`Step 0: Invalid service key config for ${destination}: missing fields ${error.missingFields?.join(', ') || 'unknown'}`);
+                    throw new Error(`Cannot initialize session for destination "${destination}": invalid service key - missing ${error.missingFields?.join(', ') || 'required fields'}`);
+                }
                 this.logger?.error(`Step 0: Failed to initialize session for ${destination}: ${error.message}`);
-                const errorMessage = `Cannot initialize session for destination "${destination}": ${error.message}. ` +
-                    `Ensure serviceKeyStore contains valid service key with UAA credentials${this.tokenProvider ? ' or provide tokenProvider for alternative authentication' : ''}.`;
-                throw new Error(errorMessage);
+                throw new Error(`Cannot initialize session for destination "${destination}": ${error.message}`);
             }
         }
         // If we have a token, validate it first
-        if (hasToken && connConfig.authorizationToken) {
+        if (hasToken && connConfig?.authorizationToken) {
             this.logger?.debug(`Step 0: Token found for ${destination}, validating`);
             // Validate token if provider supports validation and we have service URL
             if (this.tokenProvider?.validateToken && serviceUrl) {
-                const isValid = await this.tokenProvider.validateToken(connConfig.authorizationToken, serviceUrl);
-                if (isValid) {
-                    this.logger?.info(`Step 0: Token valid for ${destination}: token(${connConfig.authorizationToken.length} chars)`);
-                    return connConfig.authorizationToken;
+                try {
+                    const isValid = await this.tokenProvider.validateToken(connConfig.authorizationToken, serviceUrl);
+                    if (isValid) {
+                        this.logger?.info(`Step 0: Token valid for ${destination}: token(${connConfig.authorizationToken.length} chars)`);
+                        return connConfig.authorizationToken;
+                    }
+                    this.logger?.debug(`Step 0: Token invalid for ${destination}, continuing to refresh`);
+                }
+                catch (error) {
+                    // Validation failed due to network/server error - log and continue to refresh
+                    this.logger?.warn(`Step 0: Token validation failed for ${destination} (network error): ${error.message}. Continuing to refresh.`);
+                    // Don't throw - continue to refresh flow
                 }
-                this.logger?.debug(`Step 0: Token invalid for ${destination}, continuing to refresh`);
             }
             else {
                 // No service URL or provider doesn't support validation - just return token
@@ -326,167 +310,167 @@ class AuthBroker {
                 return connConfig.authorizationToken;
             }
         }
-        // Step 1: Refresh Token Flow
-        this.logger?.debug(`Step 1: Checking refresh token for ${destination}`);
+        // Step 2: Refresh Token Flow
+        this.logger?.debug(`Step 2: Attempting token refresh for ${destination}`);
+        // Get UAA credentials from session or service key
+        let serviceKeyAuthConfig = null;
+        if (!authConfig && this.serviceKeyStore) {
+            try {
+                serviceKeyAuthConfig = await this.serviceKeyStore.getAuthorizationConfig(destination);
+            }
+            catch (error) {
+                // Handle typed store errors
+                if (error.code === interfaces_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
+                    this.logger?.debug(`Service key file not found for ${destination}: ${error.filePath || 'unknown path'}`);
+                }
+                else if (error.code === interfaces_1.STORE_ERROR_CODES.PARSE_ERROR) {
+                    this.logger?.warn(`Failed to parse service key for ${destination}: ${error.filePath || 'unknown path'} - ${error.message}`);
+                }
+                else {
+                    this.logger?.warn(`Failed to get UAA credentials from service key store for ${destination}: ${error.message}`);
+                }
+            }
+        }
+        const uaaCredentials = authConfig || serviceKeyAuthConfig;
+        if (!uaaCredentials || !uaaCredentials.uaaUrl || !uaaCredentials.uaaClientId || !uaaCredentials.uaaClientSecret) {
+            const errorMessage = `Step 2: UAA credentials not found for ${destination}. ` +
+                `Session has no UAA credentials${this.serviceKeyStore ? ' and serviceKeyStore has no UAA credentials' : ' and serviceKeyStore is not available'}.`;
+            this.logger?.error(errorMessage);
+            throw new Error(errorMessage);
+        }
+        // Try refresh from session first (if refresh token exists)
         const refreshToken = authConfig?.refreshToken;
         if (refreshToken) {
             try {
-                this.logger?.debug(`Step 1: Trying refresh token flow for ${destination}`);
-                // Get UAA credentials from session or service key
-                const uaaCredentials = authConfig || (this.serviceKeyStore ? await this.serviceKeyStore.getAuthorizationConfig(destination) : null);
-                if (!uaaCredentials || !uaaCredentials.uaaUrl || !uaaCredentials.uaaClientId || !uaaCredentials.uaaClientSecret) {
-                    throw new Error('UAA credentials not found in session and serviceKeyStore not available');
-                }
+                this.logger?.debug(`Step 2a: Trying refreshTokenFromSession for ${destination}`);
+                const authConfigWithRefresh = { ...uaaCredentials, refreshToken };
                 let tokenResult;
-                // Try direct UAA request if UAA credentials are available
-                if (uaaCredentials.uaaUrl && uaaCredentials.uaaClientId && uaaCredentials.uaaClientSecret) {
-                    try {
-                        this.logger?.debug(`Step 1: Trying direct UAA refresh for ${destination}`);
-                        const uaaResult = await this.refreshTokenDirect(refreshToken, uaaCredentials);
-                        tokenResult = {
-                            connectionConfig: {
-                                authorizationToken: uaaResult.accessToken,
-                            },
-                            refreshToken: uaaResult.refreshToken,
-                        };
-                        this.logger?.debug(`Step 1: Direct UAA refresh succeeded for ${destination}`);
-                    }
-                    catch (directError) {
-                        this.logger?.debug(`Step 1: Direct UAA refresh failed for ${destination}: ${directError.message}, trying provider`);
-                        // If direct UAA failed and we have provider, try provider
-                        if (this.tokenProvider) {
-                            const authConfigWithRefresh = { ...uaaCredentials, refreshToken };
-                            tokenResult = await this.tokenProvider.getConnectionConfig(authConfigWithRefresh, {
-                                browser: this.browser,
-                                logger: this.logger,
-                            });
-                        }
-                        else {
-                            throw directError; // No provider, re-throw direct error
-                        }
-                    }
-                }
-                else if (this.tokenProvider) {
-                    // No UAA credentials but have provider
-                    const authConfigWithRefresh = { ...uaaCredentials, refreshToken };
-                    tokenResult = await this.tokenProvider.getConnectionConfig(authConfigWithRefresh, {
+                try {
+                    tokenResult = await this.tokenProvider.refreshTokenFromSession(authConfigWithRefresh, {
                         browser: this.browser,
                         logger: this.logger,
                     });
                 }
-                else {
-                    throw new Error('UAA credentials incomplete and tokenProvider not available');
+                catch (providerError) {
+                    // Handle provider network/auth errors
+                    if (providerError.code === 'ECONNREFUSED' || providerError.code === 'ETIMEDOUT' || providerError.code === 'ENOTFOUND') {
+                        this.logger?.debug(`Step 2a: Network error during refreshTokenFromSession for ${destination}: ${providerError.code}. Trying refreshTokenFromServiceKey`);
+                        throw providerError; // Re-throw to trigger fallback to Step 2b
+                    }
+                    throw providerError; // Re-throw other errors
                 }
                 const tokenLength = tokenResult.connectionConfig.authorizationToken?.length || 0;
-                this.logger?.info(`Step 1: Token refreshed for ${destination}: token(${tokenLength} chars), hasRefreshToken(${!!tokenResult.refreshToken})`);
-                // Get serviceUrl from session or service key (use the one we already have from the beginning of the method)
-                const finalServiceUrl = tokenResult.connectionConfig.serviceUrl ||
-                    serviceUrl ||
-                    (this.serviceKeyStore ? (await this.serviceKeyStore.getConnectionConfig(destination))?.serviceUrl : undefined);
+                this.logger?.info(`Step 2a: Token refreshed from session for ${destination}: token(${tokenLength} chars), hasRefreshToken(${!!tokenResult.refreshToken})`);
+                // Get serviceUrl from session or service key
+                let serviceKeyServiceUrl;
+                if (this.serviceKeyStore) {
+                    try {
+                        const serviceKeyConn = await this.serviceKeyStore.getConnectionConfig(destination);
+                        serviceKeyServiceUrl = serviceKeyConn?.serviceUrl;
+                    }
+                    catch (error) {
+                        this.logger?.debug(`Could not get serviceUrl from service key store: ${error.message}`);
+                    }
+                }
+                const finalServiceUrl = tokenResult.connectionConfig.serviceUrl || serviceUrl || serviceKeyServiceUrl;
                 const connectionConfigWithServiceUrl = {
                     ...tokenResult.connectionConfig,
                     serviceUrl: finalServiceUrl,
                 };
                 // Update session with new token
-                await this.sessionStore.setConnectionConfig(destination, connectionConfigWithServiceUrl);
+                try {
+                    await this.sessionStore.setConnectionConfig(destination, connectionConfigWithServiceUrl);
+                }
+                catch (error) {
+                    this.logger?.error(`Step 2a: Failed to save connection config to session for ${destination}: ${error.message}`);
+                    throw new Error(`Failed to save connection config for destination "${destination}": ${error.message}`);
+                }
                 if (tokenResult.refreshToken) {
-                    await this.sessionStore.setAuthorizationConfig(destination, {
-                        ...uaaCredentials,
-                        refreshToken: tokenResult.refreshToken,
-                    });
+                    try {
+                        await this.sessionStore.setAuthorizationConfig(destination, {
+                            ...uaaCredentials,
+                            refreshToken: tokenResult.refreshToken,
+                        });
+                    }
+                    catch (error) {
+                        this.logger?.error(`Step 2a: Failed to save authorization config to session for ${destination}: ${error.message}`);
+                        throw new Error(`Failed to save authorization config for destination "${destination}": ${error.message}`);
+                    }
                 }
                 return tokenResult.connectionConfig.authorizationToken;
             }
             catch (error) {
-                this.logger?.debug(`Step 1: Refresh token flow failed for ${destination}: ${error.message}, trying Step 2`);
-                // Continue to Step 2
+                this.logger?.debug(`Step 2a: refreshTokenFromSession failed for ${destination}: ${error.message}, trying refreshTokenFromServiceKey`);
+                // Continue to try service key refresh
             }
         }
         else {
-            this.logger?.debug(`Step 1: No refresh token found for ${destination}, proceeding to Step 2`);
-        }
-        // Step 2: UAA Credentials Flow
-        this.logger?.debug(`Step 2: Checking UAA credentials for ${destination}`);
-        // Get UAA credentials from session or service key
-        const uaaCredentials = authConfig || (this.serviceKeyStore ? await this.serviceKeyStore.getAuthorizationConfig(destination) : null);
-        if (!uaaCredentials || !uaaCredentials.uaaUrl || !uaaCredentials.uaaClientId || !uaaCredentials.uaaClientSecret) {
-            const errorMessage = `Step 2: UAA credentials not found for ${destination}. ` +
-                `Session has no UAA credentials${this.serviceKeyStore ? ' and serviceKeyStore has no UAA credentials' : ' and serviceKeyStore is not available'}.`;
-            this.logger?.error(errorMessage);
-            throw new Error(errorMessage);
+            this.logger?.debug(`Step 2a: No refresh token in session for ${destination}, skipping to service key refresh`);
         }
+        // Try refresh from service key (browser authentication)
         try {
-            this.logger?.debug(`Step 2: Trying UAA (client_credentials/provider) flow for ${destination}`);
-            let tokenResult;
-            // Try direct UAA request first if allowed and UAA credentials are available
-            if (this.allowClientCredentials && uaaCredentials.uaaUrl && uaaCredentials.uaaClientId && uaaCredentials.uaaClientSecret) {
+            this.logger?.debug(`Step 2b: Trying refreshTokenFromServiceKey for ${destination}`);
+            const tokenResult = await this.tokenProvider.refreshTokenFromServiceKey(uaaCredentials, {
+                browser: this.browser,
+                logger: this.logger,
+            });
+            const tokenLength = tokenResult.connectionConfig.authorizationToken?.length || 0;
+            this.logger?.info(`Step 2b: Token refreshed from service key for ${destination}: token(${tokenLength} chars), hasRefreshToken(${!!tokenResult.refreshToken})`);
+            // Get serviceUrl from session or service key
+            let serviceKeyServiceUrl;
+            if (this.serviceKeyStore) {
                 try {
-                    this.logger?.debug(`Step 2: Trying direct UAA client_credentials for ${destination}`);
-                    const uaaResult = await this.getTokenWithClientCredentials(uaaCredentials);
-                    tokenResult = {
-                        connectionConfig: {
-                            authorizationToken: uaaResult.accessToken,
-                        },
-                        refreshToken: uaaResult.refreshToken,
-                    };
-                    this.logger?.debug(`Step 2: Direct UAA client_credentials succeeded for ${destination}`);
-                }
-                catch (directError) {
-                    this.logger?.debug(`Step 2: Direct UAA client_credentials failed for ${destination}: ${directError.message}, trying provider`);
-                    // If direct UAA failed and we have provider, try provider
-                    if (this.tokenProvider) {
-                        const authConfigWithoutRefresh = { ...uaaCredentials, refreshToken: undefined };
-                        tokenResult = await this.tokenProvider.getConnectionConfig(authConfigWithoutRefresh, {
-                            browser: this.browser,
-                            logger: this.logger,
-                        });
-                    }
-                    else {
-                        throw directError; // No provider, re-throw direct error
-                    }
+                    const serviceKeyConn = await this.serviceKeyStore.getConnectionConfig(destination);
+                    serviceKeyServiceUrl = serviceKeyConn?.serviceUrl;
+                }
+                catch (error) {
+                    this.logger?.debug(`Could not get serviceUrl from service key store: ${error.message}`);
                 }
             }
-            else if (this.tokenProvider) {
-                // No client_credentials (disabled) or missing UAA creds -> use provider
-                const authConfigWithoutRefresh = { ...uaaCredentials, refreshToken: undefined };
-                tokenResult = await this.tokenProvider.getConnectionConfig(authConfigWithoutRefresh, {
-                    browser: this.browser,
-                    logger: this.logger,
-                });
-            }
-            else {
-                throw new Error(this.allowClientCredentials
-                    ? 'UAA credentials incomplete and tokenProvider not available'
-                    : 'Client credentials flow disabled and no tokenProvider available for interactive login');
-            }
-            const tokenLength = tokenResult.connectionConfig.authorizationToken?.length || 0;
-            this.logger?.info(`Step 2: Token obtained via UAA for ${destination}: token(${tokenLength} chars), hasRefreshToken(${!!tokenResult.refreshToken})`);
-            // Get serviceUrl from session or service key (use the one we already have from the beginning of the method)
-            const finalServiceUrl = tokenResult.connectionConfig.serviceUrl ||
-                serviceUrl ||
-                (this.serviceKeyStore ? (await this.serviceKeyStore.getConnectionConfig(destination))?.serviceUrl : undefined);
+            const finalServiceUrl = tokenResult.connectionConfig.serviceUrl || serviceUrl || serviceKeyServiceUrl;
             const connectionConfigWithServiceUrl = {
                 ...tokenResult.connectionConfig,
                 serviceUrl: finalServiceUrl,
             };
             // Update session with new token
-            await this.sessionStore.setConnectionConfig(destination, connectionConfigWithServiceUrl);
+            try {
+                await this.sessionStore.setConnectionConfig(destination, connectionConfigWithServiceUrl);
+            }
+            catch (error) {
+                this.logger?.error(`Step 2b: Failed to save connection config to session for ${destination}: ${error.message}`);
+                throw new Error(`Failed to save connection config for destination "${destination}": ${error.message}`);
+            }
             if (tokenResult.refreshToken) {
-                await this.sessionStore.setAuthorizationConfig(destination, {
-                    ...uaaCredentials,
-                    refreshToken: tokenResult.refreshToken,
-                });
+                try {
+                    await this.sessionStore.setAuthorizationConfig(destination, {
+                        ...uaaCredentials,
+                        refreshToken: tokenResult.refreshToken,
+                    });
+                }
+                catch (error) {
+                    this.logger?.error(`Step 2b: Failed to save authorization config to session for ${destination}: ${error.message}`);
+                    throw new Error(`Failed to save authorization config for destination "${destination}": ${error.message}`);
+                }
             }
             return tokenResult.connectionConfig.authorizationToken;
         }
         catch (error) {
-            this.logger?.error(`Step 2: UAA flow failed for ${destination}: ${error.message}`);
-            // If we have serviceKeyStore, we already tried it, so throw error
-            const errorMessage = `All authentication methods failed for destination "${destination}". ` +
-                `Step 1 (refresh token): ${refreshToken ? 'failed' : 'not available'}. ` +
-                `Step 2 (UAA credentials): failed (${error.message}).`;
-            this.logger?.error(errorMessage);
-            throw new Error(errorMessage);
+            this.logger?.error(`Step 2b: refreshTokenFromServiceKey failed for ${destination}: ${error.message}`);
+            // Determine error cause and throw meaningful error
+            if (error.code === 'VALIDATION_ERROR') {
+                throw new Error(`Token refresh failed: Missing required fields in authConfig - ${error.missingFields?.join(', ')}`);
+            }
+            else if (error.code === 'BROWSER_AUTH_ERROR') {
+                throw new Error(`Token refresh failed: Browser authentication failed or was cancelled - ${error.message}`);
+            }
+            else if (error.code === 'ECONNREFUSED' || error.code === 'ETIMEDOUT' || error.code === 'ENOTFOUND') {
+                throw new Error(`Token refresh failed: Network error - ${error.code}: Cannot reach authentication server`);
+            }
+            else if (error.code === 'SERVICE_KEY_ERROR') {
+                throw new Error(`Token refresh failed: Service key not found or invalid for ${destination}`);
+            }
+            // Generic error
+            throw new Error(`Token refresh failed for ${destination}: ${error.message}`);
         }
     }
     /**
@@ -497,81 +481,8 @@ class AuthBroker {
      */
     async refreshToken(destination) {
         this.logger?.debug(`Force refreshing token for destination: ${destination}`);
-        // Get authorization config from session or service key
-        const sessionAuthConfig = await this.sessionStore.getAuthorizationConfig(destination);
-        const serviceKeyAuthConfig = this.serviceKeyStore
-            ? await this.serviceKeyStore.getAuthorizationConfig(destination)
-            : null;
-        const authConfig = sessionAuthConfig || serviceKeyAuthConfig;
-        if (!authConfig) {
-            this.logger?.error(`Authorization config not found for ${destination}`);
-            throw new Error(`Authorization config not found for destination "${destination}". ` +
-                `Session has no UAA credentials${this.serviceKeyStore ? ' and serviceKeyStore has no UAA credentials' : ' and serviceKeyStore is not available'}.`);
-        }
-        // Get refresh token from session or service key
-        const refreshToken = sessionAuthConfig?.refreshToken || authConfig.refreshToken;
-        this.logger?.debug(`Refresh token check for ${destination}: hasRefreshToken(${!!refreshToken})`);
-        let tokenResult;
-        // Try direct UAA request if UAA credentials are available
-        if (authConfig.uaaUrl && authConfig.uaaClientId && authConfig.uaaClientSecret && refreshToken) {
-            try {
-                this.logger?.debug(`Trying direct UAA refresh for ${destination}`);
-                const uaaResult = await this.refreshTokenDirect(refreshToken, authConfig);
-                tokenResult = {
-                    connectionConfig: {
-                        authorizationToken: uaaResult.accessToken,
-                    },
-                    refreshToken: uaaResult.refreshToken,
-                };
-            }
-            catch (directError) {
-                this.logger?.debug(`Direct UAA refresh failed for ${destination}: ${directError.message}, trying provider`);
-                // If direct UAA failed and we have provider, try provider
-                if (this.tokenProvider) {
-                    const authConfigWithRefresh = { ...authConfig, refreshToken };
-                    tokenResult = await this.tokenProvider.getConnectionConfig(authConfigWithRefresh, {
-                        browser: this.browser,
-                        logger: this.logger,
-                    });
-                }
-                else {
-                    throw directError; // No provider, re-throw direct error
-                }
-            }
-        }
-        else if (this.tokenProvider) {
-            // No UAA credentials or refresh token, but have provider
-            const authConfigWithRefresh = { ...authConfig, refreshToken };
-            tokenResult = await this.tokenProvider.getConnectionConfig(authConfigWithRefresh, {
-                browser: this.browser,
-                logger: this.logger,
-            });
-        }
-        else {
-            throw new Error('UAA credentials incomplete and tokenProvider not available');
-        }
-        const tokenLength = tokenResult.connectionConfig.authorizationToken?.length || 0;
-        this.logger?.info(`Token refreshed for ${destination}: token(${tokenLength} chars), hasRefreshToken(${!!tokenResult.refreshToken})`);
-        // Get serviceUrl from session or service key
-        const connConfig = await this.sessionStore.getConnectionConfig(destination);
-        const serviceKeyConnConfig = this.serviceKeyStore
-            ? await this.serviceKeyStore.getConnectionConfig(destination)
-            : null;
-        const connectionConfigWithServiceUrl = {
-            ...tokenResult.connectionConfig,
-            serviceUrl: tokenResult.connectionConfig.serviceUrl ||
-                connConfig?.serviceUrl ||
-                serviceKeyConnConfig?.serviceUrl,
-        };
-        // Update or create session with new token (stores handle creation if session doesn't exist)
-        await this.sessionStore.setConnectionConfig(destination, connectionConfigWithServiceUrl);
-        if (tokenResult.refreshToken) {
-            await this.sessionStore.setAuthorizationConfig(destination, {
-                ...authConfig,
-                refreshToken: tokenResult.refreshToken,
-            });
-        }
-        return tokenResult.connectionConfig.authorizationToken;
+        // Call getToken to trigger full refresh flow
+        return this.getToken(destination);
     }
     /**
      * Get authorization configuration for destination
@@ -582,7 +493,13 @@ class AuthBroker {
         this.logger?.debug(`Getting authorization config for ${destination}`);
         // Try session store first (has tokens)
         this.logger?.debug(`Checking session store for authorization config: ${destination}`);
-        const sessionAuthConfig = await this.sessionStore.getAuthorizationConfig(destination);
+        let sessionAuthConfig = null;
+        try {
+            sessionAuthConfig = await this.sessionStore.getAuthorizationConfig(destination);
+        }
+        catch (error) {
+            this.logger?.warn(`Failed to get authorization config from session store for ${destination}: ${error.message}`);
+        }
         if (sessionAuthConfig) {
             this.logger?.debug(`Authorization config from session for ${destination}: hasUaaUrl(${!!sessionAuthConfig.uaaUrl}), hasRefreshToken(${!!sessionAuthConfig.refreshToken})`);
             return sessionAuthConfig;
@@ -590,7 +507,22 @@ class AuthBroker {
         // Fall back to service key store (has UAA credentials) if available
         if (this.serviceKeyStore) {
             this.logger?.debug(`Checking service key store for authorization config: ${destination}`);
-            const serviceKeyAuthConfig = await this.serviceKeyStore.getAuthorizationConfig(destination);
+            let serviceKeyAuthConfig = null;
+            try {
+                serviceKeyAuthConfig = await this.serviceKeyStore.getAuthorizationConfig(destination);
+            }
+            catch (error) {
+                // Handle typed store errors
+                if (error.code === interfaces_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
+                    this.logger?.debug(`Service key file not found for ${destination}: ${error.filePath || 'unknown path'}`);
+                }
+                else if (error.code === interfaces_1.STORE_ERROR_CODES.PARSE_ERROR) {
+                    this.logger?.warn(`Failed to parse service key for ${destination}: ${error.filePath || 'unknown path'} - ${error.message}`);
+                }
+                else {
+                    this.logger?.warn(`Failed to get authorization config from service key store for ${destination}: ${error.message}`);
+                }
+            }
             if (serviceKeyAuthConfig) {
                 this.logger?.debug(`Authorization config from service key for ${destination}: hasUaaUrl(${!!serviceKeyAuthConfig.uaaUrl})`);
                 return serviceKeyAuthConfig;
@@ -610,14 +542,35 @@ class AuthBroker {
     async getConnectionConfig(destination) {
         this.logger?.debug(`Getting connection config for ${destination}`);
         // Try session store first (has tokens and URLs)
-        const sessionConnConfig = await this.sessionStore.getConnectionConfig(destination);
+        let sessionConnConfig = null;
+        try {
+            sessionConnConfig = await this.sessionStore.getConnectionConfig(destination);
+        }
+        catch (error) {
+            this.logger?.warn(`Failed to get connection config from session store for ${destination}: ${error.message}`);
+        }
         if (sessionConnConfig) {
             this.logger?.debug(`Connection config from session for ${destination}: token(${sessionConnConfig.authorizationToken?.length || 0} chars), serviceUrl(${sessionConnConfig.serviceUrl ? 'yes' : 'no'})`);
             return sessionConnConfig;
         }
         // Fall back to service key store (has URLs but no tokens) if available
         if (this.serviceKeyStore) {
-            const serviceKeyConnConfig = await this.serviceKeyStore.getConnectionConfig(destination);
+            let serviceKeyConnConfig = null;
+            try {
+                serviceKeyConnConfig = await this.serviceKeyStore.getConnectionConfig(destination);
+            }
+            catch (error) {
+                // Handle typed store errors
+                if (error.code === interfaces_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
+                    this.logger?.debug(`Service key file not found for ${destination}: ${error.filePath || 'unknown path'}`);
+                }
+                else if (error.code === interfaces_1.STORE_ERROR_CODES.PARSE_ERROR) {
+                    this.logger?.warn(`Failed to parse service key for ${destination}: ${error.filePath || 'unknown path'} - ${error.message}`);
+                }
+                else {
+                    this.logger?.warn(`Failed to get connection config from service key store for ${destination}: ${error.message}`);
+                }
+            }
             if (serviceKeyConnConfig) {
                 this.logger?.debug(`Connection config from service key for ${destination}: serviceUrl(${serviceKeyConnConfig.serviceUrl ? 'yes' : 'no'}), token(none)`);
                 return serviceKeyConnConfig;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "0.2.3",
+  "version": "0.2.5",
   "description": "JWT authentication broker for MCP ABAP ADT - manages tokens based on destination headers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -51,12 +51,12 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@mcp-abap-adt/interfaces": "^0.1.16",
+    "@mcp-abap-adt/interfaces": "^0.2.3",
     "axios": "^1.13.2"
   },
   "devDependencies": {
-    "@mcp-abap-adt/auth-providers": "^0.1.4",
-    "@mcp-abap-adt/auth-stores": "^0.2.1",
+    "@mcp-abap-adt/auth-providers": "^0.2.1",
+    "@mcp-abap-adt/auth-stores": "^0.2.5",
     "@types/express": "^5.0.5",
     "@types/jest": "^30.0.0",
     "@types/js-yaml": "^4.0.9",