@mcp-abap-adt/auth-broker 1.0.8 → 2.1.0

package/dist/bin/mcp-sso.js

@@ -60,15 +60,15 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-const node_readline_1 = require("node:readline");
 const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 // Use require for CommonJS dist files with absolute path
 const distPath = path.resolve(__dirname, '..', 'index.js');
 const { AuthBroker } = require(distPath);
-const logger_1 = require("@mcp-abap-adt/logger");
 const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
 const auth_stores_1 = require("@mcp-abap-adt/auth-stores");
+const logger_1 = require("@mcp-abap-adt/logger");
+const mcpSsoConfig_1 = require("./mcpSsoConfig");
 function getVersion() {
     try {
         const candidates = [
@@ -112,7 +112,7 @@ function showHelp() {
     console.log('  --service-url <url>       Service URL (ABAP: SAP URL, XSUAA: MCP URL)');
     console.log('  --config <path>           JSON config file (SSO provider config)');
     console.log('  --browser <browser>       Browser: auto|none|system|chrome|edge|firefox');
-    console.log('  --redirect-port <port>    Redirect port for browser flows (default: 3001)');
+    console.log('  --redirect-port <port>    Redirect port for browser flows (default: from auth-providers, currently 61001)');
     console.log('  --redirect-uri <uri>      Custom redirect URI (OOB/manual code flows)');
     console.log('');
     console.log('OIDC Options:');
@@ -158,18 +158,6 @@ function parseScopes(value) {
         .filter(Boolean);
     return parts.length > 0 ? parts : undefined;
 }
-function readManualInput(prompt) {
-    const rl = (0, node_readline_1.createInterface)({
-        input: process.stdin,
-        output: process.stdout,
-    });
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => {
-            rl.close();
-            resolve(answer.trim());
-        });
-    });
-}
 function createCliLogger(prefix = 'SSO') {
     const isEnabled = () => {
         if (process.env.DEBUG_SSO === 'false' ||
@@ -520,190 +508,6 @@ function resolveSamlTokenAlias(metadataXml) {
     const match = metadataXml.match(regex);
     return match?.[1];
 }
-function normalizeProviderConfig(raw) {
-    if (!raw || typeof raw !== 'object') {
-        return null;
-    }
-    if (raw.provider) {
-        return raw.provider;
-    }
-    if (raw.protocol && raw.flow) {
-        const { protocol, flow, config, ...rest } = raw;
-        return {
-            protocol,
-            flow,
-            config: config ?? rest,
-        };
-    }
-    return null;
-}
-function mergeConfig(target, source) {
-    const result = { ...target };
-    for (const [key, value] of Object.entries(source)) {
-        if (value !== undefined) {
-            result[key] = value;
-        }
-    }
-    return result;
-}
-function buildOidcConfig(options) {
-    const scopeList = options.scopes;
-    const tokenEndpoint = options.tokenEndpoint ||
-        (options.uaaUrl
-            ? `${options.uaaUrl.replace(/\/+$/, '')}/oauth/token`
-            : undefined);
-    const passcode = options.passcode;
-    const username = options.username || (passcode ? 'passcode' : undefined);
-    const password = options.password || passcode;
-    return {
-        issuerUrl: options.issuerUrl,
-        authorizationEndpoint: options.authorizationEndpoint,
-        tokenEndpoint,
-        deviceAuthorizationEndpoint: options.deviceAuthorizationEndpoint,
-        clientId: options.clientId,
-        clientSecret: options.clientSecret,
-        scopes: scopeList,
-        scope: options.scope,
-        authorizationCode: options.code,
-        username,
-        password,
-        subjectToken: options.subjectToken,
-        subjectTokenType: options.subjectTokenType ||
-            'urn:ietf:params:oauth:token-type:access_token',
-        audience: options.audience,
-        actorToken: options.actorToken,
-        actorTokenType: options.actorTokenType,
-        browser: options.browser,
-        redirectPort: options.redirectPort,
-        redirectUri: options.redirectUri,
-    };
-}
-function buildSamlConfig(options) {
-    const assertionFlow = options.assertionFlow || (options.assertion ? 'assertion' : 'browser');
-    const tokenUrl = options.tokenEndpoint ||
-        (options.uaaUrl
-            ? `${options.uaaUrl.replace(/\/+$/, '')}/oauth/token`
-            : undefined);
-    const assertionProvider = options.assertion
-        ? async () => options.assertion
-        : assertionFlow === 'assertion'
-            ? async () => readManualInput('Paste SAMLResponse: ')
-            : undefined;
-    const cookieProvider = async (samlResponse) => {
-        if (options.cookie) {
-            return options.cookie;
-        }
-        if (assertionFlow === 'assertion') {
-            return `SAMLResponse=${samlResponse}`;
-        }
-        return readManualInput('Paste session cookies: ');
-    };
-    return {
-        idpSsoUrl: options.idpSsoUrl,
-        spEntityId: options.spEntityId,
-        acsUrl: options.acsUrl,
-        relayState: options.relayState,
-        assertionFlow,
-        assertionProvider,
-        tokenUrl,
-        uaaUrl: options.uaaUrl,
-        clientId: options.clientId,
-        clientSecret: options.clientSecret,
-        browser: options.browser,
-        redirectPort: options.redirectPort,
-        cookieProvider,
-    };
-}
-function buildProviderConfig(options, existingAuth, existingConn, fileConfig) {
-    let configFromCli = null;
-    if (options.protocol && options.flow) {
-        if (options.protocol === 'oidc') {
-            switch (options.flow) {
-                case 'browser':
-                    configFromCli = {
-                        protocol: 'oidc',
-                        flow: 'browser',
-                        config: buildOidcConfig(options),
-                    };
-                    break;
-                case 'device':
-                    configFromCli = {
-                        protocol: 'oidc',
-                        flow: 'device',
-                        config: buildOidcConfig(options),
-                    };
-                    break;
-                case 'password':
-                    configFromCli = {
-                        protocol: 'oidc',
-                        flow: 'password',
-                        config: buildOidcConfig(options),
-                    };
-                    break;
-                case 'token_exchange':
-                    configFromCli = {
-                        protocol: 'oidc',
-                        flow: 'token_exchange',
-                        config: buildOidcConfig(options),
-                    };
-                    break;
-                default:
-                    throw new Error(`Unsupported OIDC flow: ${options.flow}`);
-            }
-        }
-        else if (options.protocol === 'saml2') {
-            switch (options.flow) {
-                case 'bearer':
-                    configFromCli = {
-                        protocol: 'saml2',
-                        flow: 'bearer',
-                        config: buildSamlConfig(options),
-                    };
-                    break;
-                case 'pure':
-                    configFromCli = {
-                        protocol: 'saml2',
-                        flow: 'pure',
-                        config: buildSamlConfig(options),
-                    };
-                    break;
-                default:
-                    throw new Error(`Unsupported SAML flow: ${options.flow}`);
-            }
-        }
-    }
-    const base = fileConfig ?? configFromCli;
-    if (!base) {
-        throw new Error('Provider config is missing. Use --config or --protocol/--flow options.');
-    }
-    let result = base;
-    if (options.protocol) {
-        result = { ...result, protocol: options.protocol };
-    }
-    if (options.flow) {
-        result = { ...result, flow: options.flow };
-    }
-    if (configFromCli) {
-        result = {
-            ...result,
-            config: mergeConfig(result.config || {}, configFromCli.config || {}),
-        };
-    }
-    const accessToken = existingConn?.authorizationToken;
-    const refreshToken = existingAuth?.refreshToken;
-    if ((result.protocol === 'oidc' ||
-        (result.protocol === 'saml2' && result.flow === 'bearer')) &&
-        (accessToken || refreshToken)) {
-        result = {
-            ...result,
-            config: mergeConfig(result.config || {}, {
-                accessToken,
-                refreshToken,
-            }),
-        };
-    }
-    return result;
-}
 async function main() {
     const options = parseArgs();
     if (!options) {
@@ -768,12 +572,21 @@ async function main() {
             process.exit(1);
         }
         const raw = JSON.parse(fs.readFileSync(resolvedConfigPath, 'utf8'));
-        providerConfigFromFile = normalizeProviderConfig(raw);
+        providerConfigFromFile = (0, mcpSsoConfig_1.normalizeProviderConfig)(raw);
         if (!providerConfigFromFile) {
             console.error(`❌ Config file does not contain provider config`);
             process.exit(1);
         }
     }
+    // Merge the file into `options` *before* anything downstream reads
+    // options.protocol/flow or builds a strategy from them — a run driven by
+    // --config alone must reach exactly the same validation and
+    // strategy-building code a --protocol/--flow run does, or a field the file
+    // carries (including a legacy one 2.0.0 removed) can reach the provider
+    // untouched with no error and no warning. CLI flags already parsed above
+    // are left alone; the file only fills what they didn't set. A no-op when
+    // --config wasn't given.
+    (0, mcpSsoConfig_1.applyFileConfig)(options, providerConfigFromFile);
     if (options.serviceKeyPath) {
         const resolvedServiceKeyPath = path.resolve(options.serviceKeyPath);
         const serviceKeyDir = path.dirname(resolvedServiceKeyPath);
@@ -836,7 +649,7 @@ async function main() {
     }
     if (options.protocol === 'oidc' && options.flow === 'password') {
         if (!options.passcode && !options.password) {
-            options.passcode = await readManualInput('Paste passcode: ');
+            options.passcode = await (0, mcpSsoConfig_1.readManualInput)('Paste passcode: ');
         }
     }
     const tempSessionDir = path.join(path.dirname(resolvedOutputPath), '.tmp');
@@ -893,7 +706,7 @@ async function main() {
             refreshToken: existingAuth?.refreshToken,
         });
     }
-    const providerConfig = buildProviderConfig(options, existingAuth, existingConn, providerConfigFromFile);
+    const providerConfig = (0, mcpSsoConfig_1.buildProviderConfig)(options, existingAuth, existingConn);
     const providerConfigWithLogger = providerConfig.config
         ? {
             ...providerConfig,

package/dist/bin/mcpSsoConfig.js

@@ -0,0 +1,398 @@
+"use strict";
+/**
+ * Pure config-building logic for `mcp-sso`, split out from bin/mcp-sso.ts so
+ * it can be imported by tests directly.
+ *
+ * bin/mcp-sso.ts itself cannot be `import`ed safely: it `require()`s the
+ * compiled `dist/index.js` at module load time (assuming it is always run
+ * from `dist/bin/`) and calls `main()` at the bottom of the file. Neither is
+ * true when a test loads the TypeScript source directly, so anything that
+ * needs unit coverage — building an `SsoProviderConfig` from CLI options and
+ * an optional `--config` file, and merging the two — lives here instead.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERACTIVE_LOGIN_TIMEOUT_MS = void 0;
+exports.readManualInput = readManualInput;
+exports.normalizeProviderConfig = normalizeProviderConfig;
+exports.applyFileConfig = applyFileConfig;
+exports.buildOidcBrowserConfig = buildOidcBrowserConfig;
+exports.buildOidcDeviceConfig = buildOidcDeviceConfig;
+exports.buildOidcPasswordConfig = buildOidcPasswordConfig;
+exports.buildOidcTokenExchangeConfig = buildOidcTokenExchangeConfig;
+exports.buildSamlBearerConfig = buildSamlBearerConfig;
+exports.buildSamlPureConfig = buildSamlPureConfig;
+exports.buildProviderConfig = buildProviderConfig;
+const node_readline_1 = require("node:readline");
+const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
+/**
+ * A person completes these logins at a browser; the library's own default
+ * (30s) is sized for an unattended caller instead.
+ */
+exports.INTERACTIVE_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
+function readManualInput(prompt) {
+    const rl = (0, node_readline_1.createInterface)({
+        input: process.stdin,
+        output: process.stdout,
+    });
+    return new Promise((resolve) => {
+        rl.question(prompt, (answer) => {
+            rl.close();
+            resolve(answer.trim());
+        });
+    });
+}
+function normalizeProviderConfig(raw) {
+    if (!raw || typeof raw !== 'object') {
+        return null;
+    }
+    if (raw.provider) {
+        return raw.provider;
+    }
+    if (raw.protocol && raw.flow) {
+        const { protocol, flow, config, ...rest } = raw;
+        return {
+            protocol,
+            flow,
+            config: config ?? rest,
+        };
+    }
+    return null;
+}
+/**
+ * Pre-2.0.0 provider config fields that named a JavaScript function
+ * (`() => Promise<string>` or similar) rather than a value. JSON cannot
+ * carry a function, so a `--config` file can never legitimately supply one —
+ * if a key like this shows up, the file is stale in a way no conversion can
+ * fix. Refuse rather than silently drop it, and say what to write instead.
+ */
+const UNSUPPORTED_LEGACY_CONFIG_FIELDS = {
+    authorizationCodeProvider: "'authorizationCodeProvider' (a function) cannot be expressed in a --config file. Use --code for a value you already hold, or drive the OIDC browser flow interactively without it.",
+    assertionProvider: "'assertionProvider' (a function) cannot be expressed in a --config file. Use --assertion for a value you already hold, or --assertion-flow to choose how it is obtained.",
+    manualInput: "'manualInput' (a function) cannot be expressed in a --config file. Use --assertion-flow manual to prompt on this CLI's own stdin instead.",
+};
+/**
+ * `--config` file fields that map 1:1 onto a `McpSsoOptions` field of the
+ * same name — every pre-2.0.0 config field the strategies still need, other
+ * than `authorizationCode` (see `applyFileConfig`), lands here.
+ */
+const CONFIG_BACKFILL_FIELDS = [
+    'browser',
+    'redirectPort',
+    'redirectUri',
+    'issuerUrl',
+    'authorizationEndpoint',
+    'tokenEndpoint',
+    'deviceAuthorizationEndpoint',
+    'clientId',
+    'clientSecret',
+    'scopes',
+    'scope',
+    'username',
+    'password',
+    'passcode',
+    'subjectToken',
+    'subjectTokenType',
+    'audience',
+    'actorToken',
+    'actorTokenType',
+    'idpSsoUrl',
+    'spEntityId',
+    'acsUrl',
+    'relayState',
+    'assertionFlow',
+    'assertion',
+    'cookie',
+    'uaaUrl',
+];
+/**
+ * Backfills `options` in place from a `--config` file's raw `config` object.
+ * CLI flags always win — a field already set on `options` is left alone; the
+ * file only fills gaps.
+ *
+ * This is what makes a config-file-only run (no --protocol/--flow on the
+ * CLI) reach the same strategy-building code as a CLI-flag run: without it,
+ * the file's fields — including a `browser`/`redirectPort` a 2.0.0 provider
+ * no longer accepts directly — would reach `SsoProviderFactory.create()`
+ * untouched and be silently ignored.
+ *
+ * Every field a pre-2.0.0 config could carry either lands on its
+ * `McpSsoOptions` equivalent here (which the strategy built from `options`
+ * then consumes) or the run is refused via `process.exit(1)` naming what to
+ * write instead. Nothing may reach the provider without one of those two
+ * happening.
+ *
+ * Also backfills `options.protocol`/`options.flow` from the file when the
+ * CLI didn't set them — a `--config`-only run (no `--protocol`/`--flow`
+ * flags at all) must still resolve to a real flow, or nothing downstream
+ * ever calls a builder at all.
+ *
+ * A no-op when `fileConfig` is `null` (no `--config` was given), so callers
+ * can invoke this unconditionally.
+ */
+function applyFileConfig(options, fileConfig) {
+    if (!fileConfig) {
+        return;
+    }
+    options.protocol = options.protocol ?? fileConfig.protocol;
+    options.flow = options.flow ?? fileConfig.flow;
+    const fields = (fileConfig.config ?? {});
+    for (const [field, guidance] of Object.entries(UNSUPPORTED_LEGACY_CONFIG_FIELDS)) {
+        if (fields[field] !== undefined) {
+            console.error(`❌ --config: ${guidance}`);
+            process.exit(1);
+        }
+    }
+    // Pre-2.0.0 field name for the OIDC manual/OOB code paste path; maps onto
+    // the same slot --code fills.
+    if (options.code === undefined &&
+        typeof fields.authorizationCode === 'string') {
+        options.code = fields.authorizationCode;
+    }
+    for (const field of CONFIG_BACKFILL_FIELDS) {
+        if (options[field] === undefined && fields[field] !== undefined) {
+            options[field] = fields[field];
+        }
+    }
+}
+function requireOption(value, flagName) {
+    if (!value) {
+        console.error(`❌ ${flagName} is required for this flow.`);
+        process.exit(1);
+    }
+    return value;
+}
+function resolveOidcTokenEndpoint(options) {
+    return (options.tokenEndpoint ||
+        (options.uaaUrl
+            ? `${options.uaaUrl.replace(/\/+$/, '')}/oauth/token`
+            : undefined));
+}
+/**
+ * Only the OIDC 'browser' flow opens a browser; routes `--browser`,
+ * `--redirect-port` and manual/OOB code paste into the strategy that
+ * replaces them.
+ */
+function buildOidcBrowserAuthorization(options) {
+    if (options.code) {
+        // The consumer already holds the code (manual paste / OOB redirect
+        // URI); no callback server is opened at all.
+        return (0, auth_providers_1.asOidcResult)((0, auth_providers_1.staticCodeStrategy)({
+            redirectUri: options.redirectUri,
+            payload: options.code,
+        }));
+    }
+    // No fallback: an omitted --redirect-port lets the strategy bind its own
+    // default port rather than this CLI pinning a number it doesn't own.
+    return (0, auth_providers_1.oidcCallbackStrategy)({
+        port: options.redirectPort,
+        browser: options.browser,
+        timeoutMs: exports.INTERACTIVE_LOGIN_TIMEOUT_MS,
+    });
+}
+function buildOidcCommon(options) {
+    return {
+        issuerUrl: options.issuerUrl,
+        clientId: requireOption(options.clientId, '--client-id'),
+        clientSecret: options.clientSecret,
+    };
+}
+function buildOidcBrowserConfig(options) {
+    return {
+        ...buildOidcCommon(options),
+        authorizationEndpoint: options.authorizationEndpoint,
+        tokenEndpoint: resolveOidcTokenEndpoint(options),
+        scopes: options.scopes,
+        authorization: buildOidcBrowserAuthorization(options),
+    };
+}
+function buildOidcDeviceConfig(options) {
+    // Device flow never opens a browser from this process; --browser and
+    // --redirect-port have nothing to attach to here.
+    return {
+        ...buildOidcCommon(options),
+        deviceAuthorizationEndpoint: options.deviceAuthorizationEndpoint,
+        tokenEndpoint: resolveOidcTokenEndpoint(options),
+        scopes: options.scopes,
+    };
+}
+function buildOidcPasswordConfig(options) {
+    // Password flow never opens a browser; --browser and --redirect-port are
+    // not meaningful here either.
+    const passcode = options.passcode;
+    const username = options.username || (passcode ? 'passcode' : undefined);
+    const password = options.password || passcode;
+    return {
+        ...buildOidcCommon(options),
+        username: requireOption(username, '--username (or --passcode)'),
+        password: requireOption(password, '--password (or --passcode)'),
+        tokenEndpoint: resolveOidcTokenEndpoint(options),
+        scopes: options.scopes,
+    };
+}
+function buildOidcTokenExchangeConfig(options) {
+    // Token exchange never opens a browser; --browser and --redirect-port are
+    // not meaningful here either.
+    return {
+        ...buildOidcCommon(options),
+        subjectToken: requireOption(options.subjectToken, '--subject-token'),
+        subjectTokenType: options.subjectTokenType ||
+            'urn:ietf:params:oauth:token-type:access_token',
+        scope: options.scope,
+        audience: options.audience,
+        actorToken: options.actorToken,
+        actorTokenType: options.actorTokenType,
+        tokenEndpoint: resolveOidcTokenEndpoint(options),
+    };
+}
+/**
+ * Both SAML flows (bearer, pure) can open a browser; routes `--browser`,
+ * `--redirect-port` and the manual/static assertion options into the
+ * strategy that replaces them.
+ */
+function buildSamlAuthorization(options) {
+    if (options.assertion) {
+        // The consumer already holds the assertion; nothing is opened or asked.
+        return (0, auth_providers_1.staticCodeStrategy)({
+            redirectUri: options.acsUrl,
+            payload: options.assertion,
+        });
+    }
+    const assertionFlow = options.assertionFlow || 'browser';
+    if (assertionFlow !== 'browser') {
+        // 'manual', and an 'assertion' flow given no value, both need a human to
+        // lift the SAMLResponse out of the POST body by hand.
+        return (0, auth_providers_1.manualSamlResponseStrategy)({
+            redirectUri: options.acsUrl,
+            read: readManualInput,
+        });
+    }
+    // No fallback: an omitted --redirect-port lets the strategy bind its own
+    // default port rather than this CLI pinning a number it doesn't own.
+    return (0, auth_providers_1.samlCallbackStrategy)({
+        port: options.redirectPort,
+        browser: options.browser,
+        timeoutMs: exports.INTERACTIVE_LOGIN_TIMEOUT_MS,
+    });
+}
+function buildSamlCookieProvider(options) {
+    const assertionFlow = options.assertionFlow || (options.assertion ? 'assertion' : 'browser');
+    return async (samlResponse) => {
+        if (options.cookie) {
+            return options.cookie;
+        }
+        if (assertionFlow === 'assertion') {
+            return `SAMLResponse=${samlResponse}`;
+        }
+        return readManualInput('Paste session cookies: ');
+    };
+}
+function buildSamlBearerConfig(options) {
+    return {
+        idpSsoUrl: requireOption(options.idpSsoUrl, '--idp-sso-url'),
+        spEntityId: requireOption(options.spEntityId, '--sp-entity-id'),
+        acsUrl: options.acsUrl,
+        relayState: options.relayState,
+        tokenUrl: options.tokenEndpoint,
+        uaaUrl: options.uaaUrl,
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        authorization: buildSamlAuthorization(options),
+    };
+}
+function buildSamlPureConfig(options) {
+    return {
+        idpSsoUrl: requireOption(options.idpSsoUrl, '--idp-sso-url'),
+        spEntityId: requireOption(options.spEntityId, '--sp-entity-id'),
+        acsUrl: options.acsUrl,
+        relayState: options.relayState,
+        authorization: buildSamlAuthorization(options),
+        cookieProvider: buildSamlCookieProvider(options),
+    };
+}
+/**
+ * Builds the effective `SsoProviderConfig` from `options` alone.
+ *
+ * `options` must already be the *merged* view — `--config` file fields
+ * backfilled beneath whatever the CLI flags set, via `applyFileConfig` — so
+ * this never needs a separate file/CLI merge step, and required-field
+ * validation (`requireOption`, inside each builder above) sees the same
+ * merged data regardless of whether a value came from the file or a flag.
+ */
+function buildProviderConfig(options, existingAuth, existingConn) {
+    if (!options.protocol || !options.flow) {
+        throw new Error('Provider config is missing. Use --config or --protocol/--flow options.');
+    }
+    let result;
+    if (options.protocol === 'oidc') {
+        switch (options.flow) {
+            case 'browser':
+                result = {
+                    protocol: 'oidc',
+                    flow: 'browser',
+                    config: buildOidcBrowserConfig(options),
+                };
+                break;
+            case 'device':
+                result = {
+                    protocol: 'oidc',
+                    flow: 'device',
+                    config: buildOidcDeviceConfig(options),
+                };
+                break;
+            case 'password':
+                result = {
+                    protocol: 'oidc',
+                    flow: 'password',
+                    config: buildOidcPasswordConfig(options),
+                };
+                break;
+            case 'token_exchange':
+                result = {
+                    protocol: 'oidc',
+                    flow: 'token_exchange',
+                    config: buildOidcTokenExchangeConfig(options),
+                };
+                break;
+            default:
+                throw new Error(`Unsupported OIDC flow: ${options.flow}`);
+        }
+    }
+    else if (options.protocol === 'saml2') {
+        switch (options.flow) {
+            case 'bearer':
+                result = {
+                    protocol: 'saml2',
+                    flow: 'bearer',
+                    config: buildSamlBearerConfig(options),
+                };
+                break;
+            case 'pure':
+                result = {
+                    protocol: 'saml2',
+                    flow: 'pure',
+                    config: buildSamlPureConfig(options),
+                };
+                break;
+            default:
+                throw new Error(`Unsupported SAML flow: ${options.flow}`);
+        }
+    }
+    else {
+        throw new Error(`Unsupported protocol: ${options.protocol}`);
+    }
+    const accessToken = existingConn?.authorizationToken;
+    const refreshToken = existingAuth?.refreshToken;
+    if ((result.protocol === 'oidc' ||
+        (result.protocol === 'saml2' && result.flow === 'bearer')) &&
+        (accessToken || refreshToken)) {
+        result = {
+            ...result,
+            config: {
+                ...result.config,
+                accessToken,
+                refreshToken,
+            },
+        };
+    }
+    return result;
+}