@mcp-abap-adt/auth-broker 1.0.8 → 2.0.0

package/CHANGELOG.md

@@ -11,6 +11,89 @@ Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the co
 
 ## [Unreleased]
 
+## [2.0.0] - 2026-08-02
+
+### Breaking Changes
+
+**⚠️ The default OAuth callback port for `mcp-auth` and `mcp-sso` moves from `3001` to
+whatever `@mcp-abap-adt/auth-providers` supplies (currently `61001`).** `3001` was never a
+default this package chose: neither CLI listens on a port of its own — `auth-broker` is a
+library plus these two CLIs, not a server — so `3001` only ever arrived by accident, carried in
+from inside the token-provider library's old internal default. That default was itself moved,
+deliberately, in `auth-providers` 2.0.0, to sit above the ephemeral port range and clear of the
+`3001`/`3333` range application servers and proxies typically use. **If you registered
+`http://localhost:3001/callback` (or any other specific port) with your identity provider, pass
+`--redirect-port <that-port>` explicitly from now on** — omitting it no longer lands on `3001`.
+
+- Requires `@mcp-abap-adt/auth-providers` `^2.0.0` (was `^1.2.0`). Every provider config's
+  `browser`/`redirectPort` fields are gone; how a login is conducted is now an
+  `IAuthorizationStrategy` passed as `authorization`. `AuthBroker` itself never imported those
+  fields — the exposure was entirely in the `mcp-auth`/`mcp-sso` CLIs and
+  `generate-env-from-service-key` (`bin/`), which construct providers directly.
+
+### Changed
+- **`mcp-auth`, `mcp-sso`, `npm run generate-env`**: every browser-opening flow (`mcp-auth`'s
+  default `authorization_code` flow, `mcp-sso oidc --flow browser`, `mcp-sso saml2`/`bearer`
+  with the default browser assertion flow) now routes `--browser` and `--redirect-port` into
+  `browserCallbackStrategy` / `oidcCallbackStrategy` / `samlCallbackStrategy` instead of a
+  removed provider field. `--redirect-port` still overrides the port when given; see Breaking
+  Changes above for what happens when it is omitted.
+
+- **Login timeout for these three CLIs raised from 30s to 5 minutes.** 30s was the token
+  provider's own default, sized for an unattended caller. These CLIs hand the login to a person
+  at a keyboard, who needs time to reach the browser, authenticate — possibly through SSO/MFA —
+  and get redirected back.
+
+- `mcp-sso oidc --flow browser --code <value>`: manual/OOB code paste now goes through the
+  library's `staticCodeStrategy` (adapted with `asOidcResult`) instead of a removed
+  `authorizationCode` field. Behaviour for this combination is unchanged.
+
+- `--redirect-uri` now only takes effect on the manual/static (OOB) code path. Combining it
+  with the listening browser flow is no longer meaningful: the local callback server always
+  derives its own redirect URI from `--redirect-port`.
+
+- OIDC `device`/`password`/`token_exchange` flows never accepted `--browser`/`--redirect-port`
+  in the underlying library, before or after this change — `mcp-sso` was building them into the
+  config regardless, where they were silently ignored (masked by a cast, see below). They are
+  no longer passed at all; passing them for these flows now has visibly no effect, same as it
+  always did.
+
+- `mcp-sso`'s per-flow config builders now construct the real `@mcp-abap-adt/auth-providers`
+  config types directly (`OidcBrowserProviderConfig`, `Saml2BearerProviderConfig`, etc.)
+  instead of building an untyped bag and force-casting it with `as unknown as X`. That cast is
+  exactly what let the `browser`/`redirectPort` regression above compile silently. Required
+  fields (`--client-id`, `--idp-sso-url`, `--sp-entity-id`, `--subject-token`,
+  `--username`/`--password`) are now checked and reported per flow instead of reaching the
+  provider as `undefined` behind the cast.
+
+### Fixed
+- **`mcp-sso --config <path.json>` now reaches the strategy-building code at all.** Until this
+  fix, `buildProviderConfig` only built a config when `--protocol`/`--flow` were given on the
+  command line; a run driven by `--config` alone (the documented, supported way to use this flag)
+  left the file's fields completely untouched, and they reached `SsoProviderFactory.create()`
+  exactly as written — including a `browser`, `redirectPort`, `authorizationCode`, or
+  `assertionFlow` a 2.0.0 provider no longer accepts directly, with no error and no warning. The
+  merge between the file and CLI flags now happens once, before any validation or strategy
+  building, so `--config` alone, `--protocol`/`--flow` alone, and any combination of the two all
+  go through the same code. `--protocol`/`--flow`/CLI option flags still override the
+  corresponding value from the file. Every field a pre-2.0.0 config could carry either converts
+  onto the strategy (`browser`, `redirectPort`, `authorizationCode`, `assertionFlow`) or the run
+  is refused with a message naming the replacement (`authorizationCodeProvider`,
+  `assertionProvider`, `manualInput` — all function-valued, so a JSON file could never carry a
+  working one regardless).
+- Relatedly, required-field validation (`--client-id`, `--idp-sso-url`, etc.) now runs against
+  the *merged* result. Previously it ran only against CLI options before the file was merged in,
+  so `--config file-with-credentials.json --protocol oidc --flow browser --redirect-port 3001`
+  demanded credentials that were already in the file.
+- `mcp-sso saml2`/`bearer --assertion-flow manual`, and an `--assertion-flow assertion` with no
+  `--assertion` value supplied, now announce the authorization URL before prompting for a pasted
+  `SAMLResponse` (via `manualSamlResponseStrategy`). The old fallback for the latter combination
+  prompted without ever showing the URL the user needed to visit.
+
+### Notes
+- `AuthBroker`'s own constructor and public API are unchanged; this is a realignment with the
+  provider library plus the CLI-level fixes above.
+
 ## [1.0.8] - 2026-07-29
 
 ### Changed

package/README.md

@@ -26,13 +26,16 @@ AuthBroker requires a token provider configured for the destination:
 
 ```typescript
 import { AuthBroker, AbapSessionStore } from '@mcp-abap-adt/auth-broker';
-import { AuthorizationCodeProvider } from '@mcp-abap-adt/auth-providers';
+import {
+  AuthorizationCodeProvider,
+  browserCallbackStrategy,
+} from '@mcp-abap-adt/auth-providers';
 
 const tokenProvider = new AuthorizationCodeProvider({
   uaaUrl: 'https://...authentication...hana.ondemand.com',
   clientId: '...',
   clientSecret: '...',
-  browser: 'system',
+  authorization: browserCallbackStrategy({ browser: 'system' }),
 });
 
 const broker = new AuthBroker({
@@ -53,7 +56,10 @@ import {
   AbapServiceKeyStore,
   AbapSessionStore,
 } from '@mcp-abap-adt/auth-broker';
-import { AuthorizationCodeProvider } from '@mcp-abap-adt/auth-providers';
+import {
+  AuthorizationCodeProvider,
+  browserCallbackStrategy,
+} from '@mcp-abap-adt/auth-providers';
 
 const broker = new AuthBroker({
   sessionStore: new AbapSessionStore('/path/to/destinations'),
@@ -62,7 +68,7 @@ const broker = new AuthBroker({
     uaaUrl: 'https://...authentication...hana.ondemand.com',
     clientId: '...',
     clientSecret: '...',
-    browser: 'system',
+    authorization: browserCallbackStrategy({ browser: 'system' }),
   }),
 }, 'chrome', logger);
 
@@ -74,7 +80,7 @@ const brokerNoBrowser = new AuthBroker({
     uaaUrl: 'https://...authentication...hana.ondemand.com',
     clientId: '...',
     clientSecret: '...',
-    browser: 'none',
+    authorization: browserCallbackStrategy({ browser: 'none' }),
   }),
   allowBrowserAuth: false, // Throws BROWSER_AUTH_REQUIRED if browser auth needed
 }, 'chrome', logger);
@@ -92,7 +98,7 @@ const broker = new AuthBroker({
     uaaUrl: 'https://...authentication...hana.ondemand.com',
     clientId: '...',
     clientSecret: '...',
-    browser: 'system',
+    authorization: browserCallbackStrategy({ browser: 'system' }),
   }),
 });
 ```
@@ -111,7 +117,13 @@ const broker = new AuthBroker({
 
 ### Custom Browser Auth Port
 
-To avoid port conflicts with browser authentication:
+How a login is conducted — including which port the local OAuth2 callback
+listens on — is an `IAuthorizationStrategy` passed as `authorization`, not a
+field on the provider config. `browserCallbackStrategy` from
+`@mcp-abap-adt/auth-providers` builds the ready-made one; its default port is
+`61001`, chosen to sit well clear of the range application servers and
+proxies typically use (e.g. `3001`/`3333`). Pass `port` to avoid conflicts
+with a specific redirect URI registered at the identity provider:
 
 ```typescript
 const broker = new AuthBroker({
@@ -121,8 +133,7 @@ const broker = new AuthBroker({
     uaaUrl: 'https://...authentication...hana.ondemand.com',
     clientId: '...',
     clientSecret: '...',
-    browser: 'system',
-    redirectPort: 4001,
+    authorization: browserCallbackStrategy({ browser: 'system', port: 4001 }),
   }),
 }, 'chrome');
 ```
@@ -572,10 +583,13 @@ The package uses the `ITokenProvider` interface for token acquisition. Provider
   - No refresh token provided
 
 - **`AuthorizationCodeProvider`** - For BTP/ABAP authentication (full scope)
-  - Constructor accepts optional `browserAuthPort?: number` parameter (default: 3001)
-  - Automatically finds an available port if the requested port is in use (prevents `EADDRINUSE` errors)
-  - Server properly closes all connections and frees the port after authentication completes
-  - Use custom port to avoid conflicts when running alongside other services (e.g., proxy server)
+  - How the login is conducted is an `authorization?: IAuthorizationStrategy<string>`, not a
+    provider field. Omitted, it defaults to a browser callback on port `61001`
+  - `browserCallbackStrategy({ browser?, port?, timeoutMs? })` from `@mcp-abap-adt/auth-providers`
+    builds the ready-made strategy; pass `port` to avoid conflicts when running alongside other
+    services (e.g. a proxy server) or to match a redirect URI registered at the identity provider
+  - The callback port is held only for the duration of a login and released when it ends —
+    by success, failure, timeout, or cancellation
   - Uses browser-based OAuth2 flow (if no refresh token)
   - Uses refresh token if available
   - Provides refresh token for future use
@@ -593,6 +607,7 @@ import {
 import {
   ClientCredentialsProvider,
   AuthorizationCodeProvider,
+  browserCallbackStrategy,
 } from '@mcp-abap-adt/auth-providers';
 
 // XSUAA authentication
@@ -623,7 +638,7 @@ const btpBroker = new AuthBroker({
     uaaUrl: 'https://auth.example.com',
     clientId: '...',
     clientSecret: '...',
-    browser: 'system',
+    authorization: browserCallbackStrategy({ browser: 'system' }),
   }),
 });
 
@@ -635,7 +650,7 @@ const btpBrokerFull = new AuthBroker({
     uaaUrl: 'https://auth.example.com',
     clientId: '...',
     clientSecret: '...',
-    browser: 'system',
+    authorization: browserCallbackStrategy({ browser: 'system' }),
   }),
 });
 ```
@@ -660,6 +675,14 @@ mcp-auth --service-key <path> --output <path> [--env <path>] [--type abap|xsuaa]
 - `none`: Show URL in console and wait for callback (no browser)
 - `system/chrome/edge/firefox`: Open specific browser
 
+`--browser` and `--redirect-port` are routed into `browserCallbackStrategy`. This CLI has no
+default of its own for the callback port: `--redirect-port` overrides it when given; omitted,
+the port comes from `auth-providers` (currently `61001`, chosen to sit above the ephemeral range
+and clear of the `3001`/`3333` range servers and proxies typically use). If you registered a
+redirect URI with a specific port at your identity provider, pass `--redirect-port` to match it.
+A login is given 5 minutes to complete (this is a person switching to a browser and signing in
+by hand, not an unattended caller).
+
 **Examples:**
 ```bash
 # Auth code (default via service key)
@@ -703,12 +726,22 @@ mcp-sso --protocol <oidc|saml2> --flow <flow> --output <path> [--type abap|xsuaa
 - OIDC: `browser`, `device`, `password`, `token_exchange`
 - SAML2: `bearer`, `pure`
 
+Only the flows that actually open a browser (OIDC `browser`; SAML2 `bearer`/`pure` with the
+default `--assertion-flow browser`) use `--browser` and `--redirect-port` — they are routed
+into `browserCallbackStrategy`/`oidcCallbackStrategy`/`samlCallbackStrategy`. This CLI has no
+default of its own for the callback port: `--redirect-port` overrides it when given; omitted,
+the port comes from `auth-providers` (currently `61001`). A login is given 5 minutes to
+complete. `device`, `password`, and `token_exchange` never open a browser from this process, so
+`--browser`/`--redirect-port` have no effect for them. This applies the same way whether
+`--protocol`/`--flow` come from CLI flags or from `--config` (below) — a field's origin doesn't
+change how it's handled, and CLI flags always take precedence over the same field in a file.
+
 **Examples:**
 ```bash
 # OIDC browser flow
 mcp-sso oidc --flow browser --issuer https://issuer --client-id my-client --output ./sso.env --type xsuaa
 
-# OIDC browser flow (manual code / OOB)
+# OIDC browser flow (manual code / OOB — no callback server is opened for this combination)
 mcp-sso oidc --flow browser --token-endpoint https://issuer/token --client-id my-client --code <auth_code> --redirect-uri urn:ietf:wg:oauth:2.0:oob --output ./sso.env --type xsuaa
 
 # OIDC device flow
@@ -765,7 +798,8 @@ It enables `authorization_code` and `saml2-bearer` grant types and provides a
 simple `CatalogService`. See `tests/sso-demo/readme.md` for deploy steps.
 
 **Config file:**
-You can pass a JSON file with provider config:
+You can pass a JSON file with provider config instead of (or alongside) `--protocol`/`--flow`
+and the OIDC/SAML flags — `--config` alone is enough to run a flow, with no other flags required:
 
 ```json
 {
@@ -777,6 +811,14 @@ You can pass a JSON file with provider config:
 }
 ```
 
+Any CLI flag given alongside `--config` overrides the same field in the file; a field the file
+sets and no flag overrides is used as-is. A file written for a pre-2.0.0 config still works:
+`browser` and `redirectPort` are routed into the strategy exactly as the equivalent CLI flags
+are, and `authorizationCode`/`assertionFlow` are honored the same way `--code`/`--assertion-flow`
+are. A file that sets `authorizationCodeProvider`, `assertionProvider`, or `manualInput` — all
+functions, which JSON cannot express — is refused with an error naming the CLI flag to use
+instead, rather than having the field silently dropped.
+
 ### Utility Script
 
 Generate `.env` files from service keys:

package/dist/bin/mcp-auth.js

@@ -61,6 +61,11 @@ const distPath = path.resolve(__dirname, '..', 'index.js');
 const { AuthBroker } = require(distPath);
 const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
 const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
+/**
+ * A person completes this login at a browser; the provider's own default
+ * (30s) is sized for an unattended caller instead.
+ */
+const INTERACTIVE_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 function getVersion() {
     try {
         const candidates = [
@@ -108,7 +113,8 @@ function showHelp() {
     console.log('                            - system/chrome/edge/firefox: Open specific browser');
     console.log('  --format <format>       Output format: json or env (default: env)');
     console.log('  --service-url <url>     Service URL (SAP URL for ABAP, MCP URL for XSUAA). For XSUAA, optional.');
-    console.log('  --redirect-port <port>  Port for OAuth redirect URI (default: 3001). Must match XSUAA redirect-uris config.');
+    console.log('  --redirect-port <port>  Port for OAuth redirect URI (default: from auth-providers, currently 61001).');
+    console.log('                          Must match XSUAA redirect-uris config.');
     console.log('');
     console.log('  --version, -v          Show version number');
     console.log('  --help, -h             Show this help message');
@@ -159,9 +165,9 @@ function showHelp() {
     console.log('    * none/headless: Show URL in console and wait for callback');
     console.log('    * system/chrome/edge/firefox: Open specific browser');
     console.log('  - Both providers (xsuaa and abap) support both flows');
-    console.log('  - --redirect-port: Port for OAuth redirect URI (default: 3001)');
+    console.log('  - --redirect-port: Port for OAuth redirect URI (default: from auth-providers, currently 61001)');
     console.log('    * Must match redirect_uri configured in XSUAA/ABAP OAuth2 settings');
-    console.log('    * Common values: 3001 (default), 8080 (SAP examples)');
+    console.log('    * If your registered redirect URI uses a different port (e.g. 3001, 8080), pass it explicitly');
     console.log('  - For XSUAA, serviceUrl (MCP URL) is optional - can be provided via --service-url or service key');
     console.log('  - For ABAP, serviceUrl (SAP URL) is required - can be provided via --service-url or service key');
     console.log('  - SAP_URL/XSUAA_MCP_URL is written to .env (from --service-url, service key, or placeholder)');
@@ -599,7 +605,12 @@ async function main() {
         }
         // Default: authorization_code flow with browser
         // --credential: client_credentials flow (no browser needed)
-        const redirectPort = options.redirectPort || 3001;
+        // The callback port is the provider's own choice (DEFAULT_CALLBACK_PORT,
+        // currently 61001) unless the user overrides it with --redirect-port.
+        // Only resolved to a concrete number here for the URL preview below —
+        // the strategy itself re-derives the same default independently when
+        // `port` is left undefined.
+        const redirectPort = options.redirectPort ?? auth_providers_1.DEFAULT_CALLBACK_PORT;
         // Log authorization URL for debugging
         if (!options.credential) {
             const redirectUri = `http://localhost:${redirectPort}/callback`;
@@ -618,8 +629,14 @@ async function main() {
                 clientId: authConfig.uaaClientId,
                 clientSecret: authConfig.uaaClientSecret,
                 refreshToken: authConfig.refreshToken,
-                browser: options.browser,
-                redirectPort: redirectPort,
+                // Passing `options.redirectPort` (not the resolved `redirectPort`
+                // above) so an omitted --redirect-port lets the strategy bind its
+                // own default rather than this CLI pinning a number it doesn't own.
+                authorization: (0, auth_providers_1.browserCallbackStrategy)({
+                    browser: options.browser,
+                    port: options.redirectPort,
+                    timeoutMs: INTERACTIVE_LOGIN_TIMEOUT_MS,
+                }),
             });
         const broker = new AuthBroker({
             sessionStore,

package/dist/bin/mcp-sso.js

@@ -60,15 +60,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const node_readline_1 = require("node:readline");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 // Use require for CommonJS dist files with absolute path
 const distPath = path.resolve(__dirname, '..', 'index.js');
 const { AuthBroker } = require(distPath);
-const logger_1 = require("@mcp-abap-adt/logger");
 const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
 const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
+const logger_1 = require("@mcp-abap-adt/logger");
+const mcpSsoConfig_1 = require("./mcpSsoConfig");
 function getVersion() {
     try {
         const candidates = [
@@ -112,7 +112,7 @@ function showHelp() {
     console.log('  --service-url <url>       Service URL (ABAP: SAP URL, XSUAA: MCP URL)');
     console.log('  --config <path>           JSON config file (SSO provider config)');
     console.log('  --browser <browser>       Browser: auto|none|system|chrome|edge|firefox');
-    console.log('  --redirect-port <port>    Redirect port for browser flows (default: 3001)');
+    console.log('  --redirect-port <port>    Redirect port for browser flows (default: from auth-providers, currently 61001)');
     console.log('  --redirect-uri <uri>      Custom redirect URI (OOB/manual code flows)');
     console.log('');
     console.log('OIDC Options:');
@@ -158,18 +158,6 @@ function parseScopes(value) {
         .filter(Boolean);
     return parts.length > 0 ? parts : undefined;
 }
-function readManualInput(prompt) {
-    const rl = (0, node_readline_1.createInterface)({
-        input: process.stdin,
-        output: process.stdout,
-    });
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => {
-            rl.close();
-            resolve(answer.trim());
-        });
-    });
-}
 function createCliLogger(prefix = 'SSO') {
     const isEnabled = () => {
         if (process.env.DEBUG_SSO === 'false' ||
@@ -520,190 +508,6 @@ function resolveSamlTokenAlias(metadataXml) {
     const match = metadataXml.match(regex);
     return match?.[1];
 }
-function normalizeProviderConfig(raw) {
-    if (!raw || typeof raw !== 'object') {
-        return null;
-    }
-    if (raw.provider) {
-        return raw.provider;
-    }
-    if (raw.protocol && raw.flow) {
-        const { protocol, flow, config, ...rest } = raw;
-        return {
-            protocol,
-            flow,
-            config: config ?? rest,
-        };
-    }
-    return null;
-}
-function mergeConfig(target, source) {
-    const result = { ...target };
-    for (const [key, value] of Object.entries(source)) {
-        if (value !== undefined) {
-            result[key] = value;
-        }
-    }
-    return result;
-}
-function buildOidcConfig(options) {
-    const scopeList = options.scopes;
-    const tokenEndpoint = options.tokenEndpoint ||
-        (options.uaaUrl
-            ? `${options.uaaUrl.replace(/\/+$/, '')}/oauth/token`
-            : undefined);
-    const passcode = options.passcode;
-    const username = options.username || (passcode ? 'passcode' : undefined);
-    const password = options.password || passcode;
-    return {
-        issuerUrl: options.issuerUrl,
-        authorizationEndpoint: options.authorizationEndpoint,
-        tokenEndpoint,
-        deviceAuthorizationEndpoint: options.deviceAuthorizationEndpoint,
-        clientId: options.clientId,
-        clientSecret: options.clientSecret,
-        scopes: scopeList,
-        scope: options.scope,
-        authorizationCode: options.code,
-        username,
-        password,
-        subjectToken: options.subjectToken,
-        subjectTokenType: options.subjectTokenType ||
-            'urn:ietf:params:oauth:token-type:access_token',
-        audience: options.audience,
-        actorToken: options.actorToken,
-        actorTokenType: options.actorTokenType,
-        browser: options.browser,
-        redirectPort: options.redirectPort,
-        redirectUri: options.redirectUri,
-    };
-}
-function buildSamlConfig(options) {
-    const assertionFlow = options.assertionFlow || (options.assertion ? 'assertion' : 'browser');
-    const tokenUrl = options.tokenEndpoint ||
-        (options.uaaUrl
-            ? `${options.uaaUrl.replace(/\/+$/, '')}/oauth/token`
-            : undefined);
-    const assertionProvider = options.assertion
-        ? async () => options.assertion
-        : assertionFlow === 'assertion'
-            ? async () => readManualInput('Paste SAMLResponse: ')
-            : undefined;
-    const cookieProvider = async (samlResponse) => {
-        if (options.cookie) {
-            return options.cookie;
-        }
-        if (assertionFlow === 'assertion') {
-            return `SAMLResponse=${samlResponse}`;
-        }
-        return readManualInput('Paste session cookies: ');
-    };
-    return {
-        idpSsoUrl: options.idpSsoUrl,
-        spEntityId: options.spEntityId,
-        acsUrl: options.acsUrl,
-        relayState: options.relayState,
-        assertionFlow,
-        assertionProvider,
-        tokenUrl,
-        uaaUrl: options.uaaUrl,
-        clientId: options.clientId,
-        clientSecret: options.clientSecret,
-        browser: options.browser,
-        redirectPort: options.redirectPort,
-        cookieProvider,
-    };
-}
-function buildProviderConfig(options, existingAuth, existingConn, fileConfig) {
-    let configFromCli = null;
-    if (options.protocol && options.flow) {
-        if (options.protocol === 'oidc') {
-            switch (options.flow) {
-                case 'browser':
-                    configFromCli = {
-                        protocol: 'oidc',
-                        flow: 'browser',
-                        config: buildOidcConfig(options),
-                    };
-                    break;
-                case 'device':
-                    configFromCli = {
-                        protocol: 'oidc',
-                        flow: 'device',
-                        config: buildOidcConfig(options),
-                    };
-                    break;
-                case 'password':
-                    configFromCli = {
-                        protocol: 'oidc',
-                        flow: 'password',
-                        config: buildOidcConfig(options),
-                    };
-                    break;
-                case 'token_exchange':
-                    configFromCli = {
-                        protocol: 'oidc',
-                        flow: 'token_exchange',
-                        config: buildOidcConfig(options),
-                    };
-                    break;
-                default:
-                    throw new Error(`Unsupported OIDC flow: ${options.flow}`);
-            }
-        }
-        else if (options.protocol === 'saml2') {
-            switch (options.flow) {
-                case 'bearer':
-                    configFromCli = {
-                        protocol: 'saml2',
-                        flow: 'bearer',
-                        config: buildSamlConfig(options),
-                    };
-                    break;
-                case 'pure':
-                    configFromCli = {
-                        protocol: 'saml2',
-                        flow: 'pure',
-                        config: buildSamlConfig(options),
-                    };
-                    break;
-                default:
-                    throw new Error(`Unsupported SAML flow: ${options.flow}`);
-            }
-        }
-    }
-    const base = fileConfig ?? configFromCli;
-    if (!base) {
-        throw new Error('Provider config is missing. Use --config or --protocol/--flow options.');
-    }
-    let result = base;
-    if (options.protocol) {
-        result = { ...result, protocol: options.protocol };
-    }
-    if (options.flow) {
-        result = { ...result, flow: options.flow };
-    }
-    if (configFromCli) {
-        result = {
-            ...result,
-            config: mergeConfig(result.config || {}, configFromCli.config || {}),
-        };
-    }
-    const accessToken = existingConn?.authorizationToken;
-    const refreshToken = existingAuth?.refreshToken;
-    if ((result.protocol === 'oidc' ||
-        (result.protocol === 'saml2' && result.flow === 'bearer')) &&
-        (accessToken || refreshToken)) {
-        result = {
-            ...result,
-            config: mergeConfig(result.config || {}, {
-                accessToken,
-                refreshToken,
-            }),
-        };
-    }
-    return result;
-}
 async function main() {
     const options = parseArgs();
     if (!options) {
@@ -768,12 +572,21 @@ async function main() {
             process.exit(1);
         }
         const raw = JSON.parse(fs.readFileSync(resolvedConfigPath, 'utf8'));
-        providerConfigFromFile = normalizeProviderConfig(raw);
+        providerConfigFromFile = (0, mcpSsoConfig_1.normalizeProviderConfig)(raw);
         if (!providerConfigFromFile) {
             console.error(`❌ Config file does not contain provider config`);
             process.exit(1);
         }
     }
+    // Merge the file into `options` *before* anything downstream reads
+    // options.protocol/flow or builds a strategy from them — a run driven by
+    // --config alone must reach exactly the same validation and
+    // strategy-building code a --protocol/--flow run does, or a field the file
+    // carries (including a legacy one 2.0.0 removed) can reach the provider
+    // untouched with no error and no warning. CLI flags already parsed above
+    // are left alone; the file only fills what they didn't set. A no-op when
+    // --config wasn't given.
+    (0, mcpSsoConfig_1.applyFileConfig)(options, providerConfigFromFile);
     if (options.serviceKeyPath) {
         const resolvedServiceKeyPath = path.resolve(options.serviceKeyPath);
         const serviceKeyDir = path.dirname(resolvedServiceKeyPath);
@@ -836,7 +649,7 @@ async function main() {
     }
     if (options.protocol === 'oidc' && options.flow === 'password') {
         if (!options.passcode && !options.password) {
-            options.passcode = await readManualInput('Paste passcode: ');
+            options.passcode = await (0, mcpSsoConfig_1.readManualInput)('Paste passcode: ');
         }
     }
     const tempSessionDir = path.join(path.dirname(resolvedOutputPath), '.tmp');
@@ -893,7 +706,7 @@ async function main() {
             refreshToken: existingAuth?.refreshToken,
         });
     }
-    const providerConfig = buildProviderConfig(options, existingAuth, existingConn, providerConfigFromFile);
+    const providerConfig = (0, mcpSsoConfig_1.buildProviderConfig)(options, existingAuth, existingConn);
     const providerConfigWithLogger = providerConfig.config
         ? {
             ...providerConfig,

package/dist/bin/mcpSsoConfig.js

@@ -0,0 +1,398 @@
+"use strict";
+/**
+ * Pure config-building logic for `mcp-sso`, split out from bin/mcp-sso.ts so
+ * it can be imported by tests directly.
+ *
+ * bin/mcp-sso.ts itself cannot be `import`ed safely: it `require()`s the
+ * compiled `dist/index.js` at module load time (assuming it is always run
+ * from `dist/bin/`) and calls `main()` at the bottom of the file. Neither is
+ * true when a test loads the TypeScript source directly, so anything that
+ * needs unit coverage — building an `SsoProviderConfig` from CLI options and
+ * an optional `--config` file, and merging the two — lives here instead.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERACTIVE_LOGIN_TIMEOUT_MS = void 0;
+exports.readManualInput = readManualInput;
+exports.normalizeProviderConfig = normalizeProviderConfig;
+exports.applyFileConfig = applyFileConfig;
+exports.buildOidcBrowserConfig = buildOidcBrowserConfig;
+exports.buildOidcDeviceConfig = buildOidcDeviceConfig;
+exports.buildOidcPasswordConfig = buildOidcPasswordConfig;
+exports.buildOidcTokenExchangeConfig = buildOidcTokenExchangeConfig;
+exports.buildSamlBearerConfig = buildSamlBearerConfig;
+exports.buildSamlPureConfig = buildSamlPureConfig;
+exports.buildProviderConfig = buildProviderConfig;
+const node_readline_1 = require("node:readline");
+const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
+/**
+ * A person completes these logins at a browser; the library's own default
+ * (30s) is sized for an unattended caller instead.
+ */
+exports.INTERACTIVE_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+function readManualInput(prompt) {
+    const rl = (0, node_readline_1.createInterface)({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(prompt, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+function normalizeProviderConfig(raw) {
+    if (!raw || typeof raw !== 'object') {
+        return null;
+    }
+    if (raw.provider) {
+        return raw.provider;
+    }
+    if (raw.protocol && raw.flow) {
+        const { protocol, flow, config, ...rest } = raw;
+        return {
+            protocol,
+            flow,
+            config: config ?? rest,
+        };
+    }
+    return null;
+}
+/**
+ * Pre-2.0.0 provider config fields that named a JavaScript function
+ * (`() => Promise<string>` or similar) rather than a value. JSON cannot
+ * carry a function, so a `--config` file can never legitimately supply one —
+ * if a key like this shows up, the file is stale in a way no conversion can
+ * fix. Refuse rather than silently drop it, and say what to write instead.
+ */
+const UNSUPPORTED_LEGACY_CONFIG_FIELDS = {
+    authorizationCodeProvider: "'authorizationCodeProvider' (a function) cannot be expressed in a --config file. Use --code for a value you already hold, or drive the OIDC browser flow interactively without it.",
+    assertionProvider: "'assertionProvider' (a function) cannot be expressed in a --config file. Use --assertion for a value you already hold, or --assertion-flow to choose how it is obtained.",
+    manualInput: "'manualInput' (a function) cannot be expressed in a --config file. Use --assertion-flow manual to prompt on this CLI's own stdin instead.",
+};
+/**
+ * `--config` file fields that map 1:1 onto a `McpSsoOptions` field of the
+ * same name — every pre-2.0.0 config field the strategies still need, other
+ * than `authorizationCode` (see `applyFileConfig`), lands here.
+ */
+const CONFIG_BACKFILL_FIELDS = [
+    'browser',
+    'redirectPort',
+    'redirectUri',
+    'issuerUrl',
+    'authorizationEndpoint',
+    'tokenEndpoint',
+    'deviceAuthorizationEndpoint',
+    'clientId',
+    'clientSecret',
+    'scopes',
+    'scope',
+    'username',
+    'password',
+    'passcode',
+    'subjectToken',
+    'subjectTokenType',
+    'audience',
+    'actorToken',
+    'actorTokenType',
+    'idpSsoUrl',
+    'spEntityId',
+    'acsUrl',
+    'relayState',
+    'assertionFlow',
+    'assertion',
+    'cookie',
+    'uaaUrl',
+];
+/**
+ * Backfills `options` in place from a `--config` file's raw `config` object.
+ * CLI flags always win — a field already set on `options` is left alone; the
+ * file only fills gaps.
+ *
+ * This is what makes a config-file-only run (no --protocol/--flow on the
+ * CLI) reach the same strategy-building code as a CLI-flag run: without it,
+ * the file's fields — including a `browser`/`redirectPort` a 2.0.0 provider
+ * no longer accepts directly — would reach `SsoProviderFactory.create()`
+ * untouched and be silently ignored.
+ *
+ * Every field a pre-2.0.0 config could carry either lands on its
+ * `McpSsoOptions` equivalent here (which the strategy built from `options`
+ * then consumes) or the run is refused via `process.exit(1)` naming what to
+ * write instead. Nothing may reach the provider without one of those two
+ * happening.
+ *
+ * Also backfills `options.protocol`/`options.flow` from the file when the
+ * CLI didn't set them — a `--config`-only run (no `--protocol`/`--flow`
+ * flags at all) must still resolve to a real flow, or nothing downstream
+ * ever calls a builder at all.
+ *
+ * A no-op when `fileConfig` is `null` (no `--config` was given), so callers
+ * can invoke this unconditionally.
+ */
+function applyFileConfig(options, fileConfig) {
+    if (!fileConfig) {
+        return;
+    }
+    options.protocol = options.protocol ?? fileConfig.protocol;
+    options.flow = options.flow ?? fileConfig.flow;
+    const fields = (fileConfig.config ?? {});
+    for (const [field, guidance] of Object.entries(UNSUPPORTED_LEGACY_CONFIG_FIELDS)) {
+        if (fields[field] !== undefined) {
+            console.error(`❌ --config: ${guidance}`);
+            process.exit(1);
+        }
+    }
+    // Pre-2.0.0 field name for the OIDC manual/OOB code paste path; maps onto
+    // the same slot --code fills.
+    if (options.code === undefined &&
+        typeof fields.authorizationCode === 'string') {
+        options.code = fields.authorizationCode;
+    }
+    for (const field of CONFIG_BACKFILL_FIELDS) {
+        if (options[field] === undefined && fields[field] !== undefined) {
+            options[field] = fields[field];
+        }
+    }
+}
+function requireOption(value, flagName) {
+    if (!value) {
+        console.error(`❌ ${flagName} is required for this flow.`);
+        process.exit(1);
+    }
+    return value;
+}
+function resolveOidcTokenEndpoint(options) {
+    return (options.tokenEndpoint ||
+        (options.uaaUrl
+            ? `${options.uaaUrl.replace(/\/+$/, '')}/oauth/token`
+            : undefined));
+}
+/**
+ * Only the OIDC 'browser' flow opens a browser; routes `--browser`,
+ * `--redirect-port` and manual/OOB code paste into the strategy that
+ * replaces them.
+ */
+function buildOidcBrowserAuthorization(options) {
+    if (options.code) {
+        // The consumer already holds the code (manual paste / OOB redirect
+        // URI); no callback server is opened at all.
+        return (0, auth_providers_1.asOidcResult)((0, auth_providers_1.staticCodeStrategy)({
+            redirectUri: options.redirectUri,
+            payload: options.code,
+        }));
+    }
+    // No fallback: an omitted --redirect-port lets the strategy bind its own
+    // default port rather than this CLI pinning a number it doesn't own.
+    return (0, auth_providers_1.oidcCallbackStrategy)({
+        port: options.redirectPort,
+        browser: options.browser,
+        timeoutMs: exports.INTERACTIVE_LOGIN_TIMEOUT_MS,
+    });
+}
+function buildOidcCommon(options) {
+    return {
+        issuerUrl: options.issuerUrl,
+        clientId: requireOption(options.clientId, '--client-id'),
+        clientSecret: options.clientSecret,
+    };
+}
+function buildOidcBrowserConfig(options) {
+    return {
+        ...buildOidcCommon(options),
+        authorizationEndpoint: options.authorizationEndpoint,
+        tokenEndpoint: resolveOidcTokenEndpoint(options),
+        scopes: options.scopes,
+        authorization: buildOidcBrowserAuthorization(options),
+    };
+}
+function buildOidcDeviceConfig(options) {
+    // Device flow never opens a browser from this process; --browser and
+    // --redirect-port have nothing to attach to here.
+    return {
+        ...buildOidcCommon(options),
+        deviceAuthorizationEndpoint: options.deviceAuthorizationEndpoint,
+        tokenEndpoint: resolveOidcTokenEndpoint(options),
+        scopes: options.scopes,
+    };
+}
+function buildOidcPasswordConfig(options) {
+    // Password flow never opens a browser; --browser and --redirect-port are
+    // not meaningful here either.
+    const passcode = options.passcode;
+    const username = options.username || (passcode ? 'passcode' : undefined);
+    const password = options.password || passcode;
+    return {
+        ...buildOidcCommon(options),
+        username: requireOption(username, '--username (or --passcode)'),
+        password: requireOption(password, '--password (or --passcode)'),
+        tokenEndpoint: resolveOidcTokenEndpoint(options),
+        scopes: options.scopes,
+    };
+}
+function buildOidcTokenExchangeConfig(options) {
+    // Token exchange never opens a browser; --browser and --redirect-port are
+    // not meaningful here either.
+    return {
+        ...buildOidcCommon(options),
+        subjectToken: requireOption(options.subjectToken, '--subject-token'),
+        subjectTokenType: options.subjectTokenType ||
+            'urn:ietf:params:oauth:token-type:access_token',
+        scope: options.scope,
+        audience: options.audience,
+        actorToken: options.actorToken,
+        actorTokenType: options.actorTokenType,
+        tokenEndpoint: resolveOidcTokenEndpoint(options),
+    };
+}
+/**
+ * Both SAML flows (bearer, pure) can open a browser; routes `--browser`,
+ * `--redirect-port` and the manual/static assertion options into the
+ * strategy that replaces them.
+ */
+function buildSamlAuthorization(options) {
+    if (options.assertion) {
+        // The consumer already holds the assertion; nothing is opened or asked.
+        return (0, auth_providers_1.staticCodeStrategy)({
+            redirectUri: options.acsUrl,
+            payload: options.assertion,
+        });
+    }
+    const assertionFlow = options.assertionFlow || 'browser';
+    if (assertionFlow !== 'browser') {
+        // 'manual', and an 'assertion' flow given no value, both need a human to
+        // lift the SAMLResponse out of the POST body by hand.
+        return (0, auth_providers_1.manualSamlResponseStrategy)({
+            redirectUri: options.acsUrl,
+            read: readManualInput,
+        });
+    }
+    // No fallback: an omitted --redirect-port lets the strategy bind its own
+    // default port rather than this CLI pinning a number it doesn't own.
+    return (0, auth_providers_1.samlCallbackStrategy)({
+        port: options.redirectPort,
+        browser: options.browser,
+        timeoutMs: exports.INTERACTIVE_LOGIN_TIMEOUT_MS,
+    });
+}
+function buildSamlCookieProvider(options) {
+    const assertionFlow = options.assertionFlow || (options.assertion ? 'assertion' : 'browser');
+    return async (samlResponse) => {
+        if (options.cookie) {
+            return options.cookie;
+        }
+        if (assertionFlow === 'assertion') {
+            return `SAMLResponse=${samlResponse}`;
+        }
+        return readManualInput('Paste session cookies: ');
+    };
+}
+function buildSamlBearerConfig(options) {
+    return {
+        idpSsoUrl: requireOption(options.idpSsoUrl, '--idp-sso-url'),
+        spEntityId: requireOption(options.spEntityId, '--sp-entity-id'),
+        acsUrl: options.acsUrl,
+        relayState: options.relayState,
+        tokenUrl: options.tokenEndpoint,
+        uaaUrl: options.uaaUrl,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        authorization: buildSamlAuthorization(options),
+    };
+}
+function buildSamlPureConfig(options) {
+    return {
+        idpSsoUrl: requireOption(options.idpSsoUrl, '--idp-sso-url'),
+        spEntityId: requireOption(options.spEntityId, '--sp-entity-id'),
+        acsUrl: options.acsUrl,
+        relayState: options.relayState,
+        authorization: buildSamlAuthorization(options),
+        cookieProvider: buildSamlCookieProvider(options),
+    };
+}
+/**
+ * Builds the effective `SsoProviderConfig` from `options` alone.
+ *
+ * `options` must already be the *merged* view — `--config` file fields
+ * backfilled beneath whatever the CLI flags set, via `applyFileConfig` — so
+ * this never needs a separate file/CLI merge step, and required-field
+ * validation (`requireOption`, inside each builder above) sees the same
+ * merged data regardless of whether a value came from the file or a flag.
+ */
+function buildProviderConfig(options, existingAuth, existingConn) {
+    if (!options.protocol || !options.flow) {
+        throw new Error('Provider config is missing. Use --config or --protocol/--flow options.');
+    }
+    let result;
+    if (options.protocol === 'oidc') {
+        switch (options.flow) {
+            case 'browser':
+                result = {
+                    protocol: 'oidc',
+                    flow: 'browser',
+                    config: buildOidcBrowserConfig(options),
+                };
+                break;
+            case 'device':
+                result = {
+                    protocol: 'oidc',
+                    flow: 'device',
+                    config: buildOidcDeviceConfig(options),
+                };
+                break;
+            case 'password':
+                result = {
+                    protocol: 'oidc',
+                    flow: 'password',
+                    config: buildOidcPasswordConfig(options),
+                };
+                break;
+            case 'token_exchange':
+                result = {
+                    protocol: 'oidc',
+                    flow: 'token_exchange',
+                    config: buildOidcTokenExchangeConfig(options),
+                };
+                break;
+            default:
+                throw new Error(`Unsupported OIDC flow: ${options.flow}`);
+        }
+    }
+    else if (options.protocol === 'saml2') {
+        switch (options.flow) {
+            case 'bearer':
+                result = {
+                    protocol: 'saml2',
+                    flow: 'bearer',
+                    config: buildSamlBearerConfig(options),
+                };
+                break;
+            case 'pure':
+                result = {
+                    protocol: 'saml2',
+                    flow: 'pure',
+                    config: buildSamlPureConfig(options),
+                };
+                break;
+            default:
+                throw new Error(`Unsupported SAML flow: ${options.flow}`);
+        }
+    }
+    else {
+        throw new Error(`Unsupported protocol: ${options.protocol}`);
+    }
+    const accessToken = existingConn?.authorizationToken;
+    const refreshToken = existingAuth?.refreshToken;
+    if ((result.protocol === 'oidc' ||
+        (result.protocol === 'saml2' && result.flow === 'bearer')) &&
+        (accessToken || refreshToken)) {
+        result = {
+            ...result,
+            config: {
+                ...result.config,
+                accessToken,
+                refreshToken,
+            },
+        };
+    }
+    return result;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "1.0.8",
+  "version": "2.0.0",
   "description": "JWT authentication broker for MCP ABAP ADT - manages tokens based on destination headers",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -62,7 +62,7 @@
     "node": ">=18.2.0"
   },
   "dependencies": {
-    "@mcp-abap-adt/auth-providers": "^1.2.0",
+    "@mcp-abap-adt/auth-providers": "^2.0.0",
     "@mcp-abap-adt/auth-stores": "^1.0.2",
     "@mcp-abap-adt/interfaces": "^2.3.0",
     "axios": "^1.13.5"