@mcp-abap-adt/auth-broker 2.2.0 → 3.0.1

package/dist/AuthBroker.js

@@ -1,653 +1,295 @@
 "use strict";
 /**
- * Main AuthBroker class for managing JWT tokens based on destinations
+ * AuthBroker: tokens for a destination, from a provider, kept in a session store.
+ *
+ * The broker orchestrates and nothing more. It resolves what the stores know
+ * about a destination, hands it to the provider, asks the provider for a token
+ * and writes the answer back. Whether a token is still valid, whether to use the
+ * refresh token or log in, and how a login is conducted (browser, headless,
+ * pasted code) are the provider's decisions — made by its strategy — and the
+ * broker does not repeat or override any of them.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthBroker = void 0;
 const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
-const formatting_1 = require("./utils/formatting");
-/**
- * No-op logger implementation for default fallback when logger is not provided
- */
 const noOpLogger = {
     info: () => { },
     error: () => { },
     warn: () => { },
     debug: () => { },
 };
-/**
- * Helper function to check if error has a code property
- */
-// biome-ignore lint/suspicious/noExplicitAny: Helper function needs to accept any error type
-function hasErrorCode(error) {
-    return (error !== null &&
-        typeof error === 'object' &&
-        'code' in error &&
-        typeof error.code === 'string');
-}
-/**
- * Helper function to get error message safely
- */
-// biome-ignore lint/suspicious/noExplicitAny: Helper function needs to accept any error type
-function getErrorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
-/**
- * Whether an error represents a failed *interactive* browser login (the user
- * did not complete the OAuth flow / it timed out), as opposed to a transient or
- * configuration error. Such failures must not be retried via a second
- * provider.getTokens() — that would start a duplicate browser login on the same
- * redirect port and mask the real cause with a "Port in use" error.
- */
-function isInteractiveAuthFailure(error) {
-    if (hasErrorCode(error) && error.code === 'BROWSER_AUTH_ERROR') {
-        return true;
+function errorCode(error) {
+    if (error !== null && typeof error === 'object' && 'code' in error) {
+        const code = error.code;
+        return typeof code === 'string' ? code : undefined;
     }
-    const message = getErrorMessage(error);
-    return /authentication timeout|browser authentication|already in use/i.test(message);
+    return undefined;
 }
 /**
- * AuthBroker manages JWT authentication tokens for destinations
+ * AuthBroker manages authentication tokens for destinations
  */
 class AuthBroker {
-    browser;
     logger;
     serviceKeyStore;
     sessionStore;
-    tokenProvider;
-    allowBrowserAuth;
+    provider;
+    providers = new Map();
     /**
-     * Create a new AuthBroker instance
-     * @param config Configuration object with stores and token provider
-     *               - sessionStore: Store for session data (required)
-     *               - serviceKeyStore: Store for service keys (optional)
-     *               - tokenProvider: Token provider implementing ITokenProvider interface (required) - handles browser-based authorization
-     * @param browser Optional browser name for authentication (chrome, edge, firefox, system, headless, none).
-     *                Default: 'system' (system default browser).
-     *                Use 'headless' for SSH/remote sessions - logs URL and waits for manual callback.
-     *                Use 'none' for automated tests - logs URL and rejects immediately.
-     * @param logger Optional logger instance implementing ILogger interface. If not provided, uses no-op logger.
+     * @param config Stores and the provider (instance or factory)
+     * @param logger Optional logger. Nothing the broker logs contains a token.
      */
-    constructor(config, browser, logger) {
-        // Validate that config is provided
+    constructor(config, logger) {
         if (!config) {
             throw new Error('AuthBroker: config parameter is required');
         }
-        // Validate required sessionStore
-        if (!config.sessionStore) {
+        const { sessionStore, serviceKeyStore, provider } = config;
+        if (!sessionStore) {
             throw new Error('AuthBroker: sessionStore is required');
         }
-        // Validate required tokenProvider
-        if (!config.tokenProvider) {
-            throw new Error('AuthBroker: tokenProvider is required');
-        }
-        // Validate that stores and provider are correctly instantiated (have required methods)
-        const sessionStore = config.sessionStore;
-        const tokenProvider = config.tokenProvider;
-        const serviceKeyStore = config.serviceKeyStore;
-        // Check sessionStore methods
-        if (typeof sessionStore.getAuthorizationConfig !== 'function') {
-            throw new Error('AuthBroker: sessionStore.getAuthorizationConfig must be a function');
-        }
-        if (typeof sessionStore.getConnectionConfig !== 'function') {
-            throw new Error('AuthBroker: sessionStore.getConnectionConfig must be a function');
-        }
-        if (typeof sessionStore.setAuthorizationConfig !== 'function') {
-            throw new Error('AuthBroker: sessionStore.setAuthorizationConfig must be a function');
-        }
-        if (typeof sessionStore.setConnectionConfig !== 'function') {
-            throw new Error('AuthBroker: sessionStore.setConnectionConfig must be a function');
-        }
-        // Check tokenProvider methods (required)
-        if (typeof tokenProvider.getTokens !== 'function') {
-            throw new Error('AuthBroker: tokenProvider.getTokens must be a function');
-        }
-        // validateToken is optional, so we don't check it
-        // Check serviceKeyStore methods (if provided)
-        if (serviceKeyStore) {
-            if (typeof serviceKeyStore.getServiceKey !== 'function') {
-                throw new Error('AuthBroker: serviceKeyStore.getServiceKey must be a function');
-            }
-            if (typeof serviceKeyStore.getAuthorizationConfig !== 'function') {
-                throw new Error('AuthBroker: serviceKeyStore.getAuthorizationConfig must be a function');
-            }
-            if (typeof serviceKeyStore.getConnectionConfig !== 'function') {
-                throw new Error('AuthBroker: serviceKeyStore.getConnectionConfig must be a function');
+        if (!provider) {
+            throw new Error('AuthBroker: provider is required');
+        }
+        for (const method of [
+            'getAuthorizationConfig',
+            'getConnectionConfig',
+            'setAuthorizationConfig',
+            'setConnectionConfig',
+            'loadSession',
+            'saveSession',
+        ]) {
+            if (typeof sessionStore[method] !== 'function') {
+                throw new Error(`AuthBroker: sessionStore.${method} must be a function`);
             }
         }
-        this.serviceKeyStore = serviceKeyStore;
-        this.sessionStore = sessionStore;
-        this.tokenProvider = tokenProvider;
-        this.browser = browser || 'system';
-        this.logger = logger || noOpLogger;
-        this.allowBrowserAuth = config.allowBrowserAuth ?? true;
-        // Log successful initialization
-        const hasServiceKeyStore = !!this.serviceKeyStore;
-        this.logger?.info('[AuthBroker] Broker initialized', {
-            hasServiceKeyStore,
-            hasSessionStore: true,
-            hasTokenProvider: true,
-            browser: this.browser,
-            allowBrowserAuth: this.allowBrowserAuth,
-        });
-    }
-    /**
-     * Load session data (connection and authorization configs)
-     */
-    async loadSessionData(destination) {
-        let connConfig = null;
-        let authConfig = null;
-        try {
-            connConfig = await this.sessionStore.getConnectionConfig(destination);
-        }
-        catch (error) {
-            if (hasErrorCode(error)) {
-                if (error.code === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
-                    this.logger?.debug(`Session file not found for ${destination}: ${error.filePath || 'unknown path'}`);
-                }
-                else if (error.code === interfaces_auth_1.STORE_ERROR_CODES.PARSE_ERROR) {
-                    this.logger?.warn(`Failed to parse session file for ${destination}: ${error.filePath || 'unknown path'} - ${getErrorMessage(error)}`);
-                }
-                else {
-                    this.logger?.warn(`Failed to get connection config from session store for ${destination}: ${getErrorMessage(error)}`);
-                }
+        if (typeof provider !== 'function') {
+            if (typeof provider.getTokens !== 'function') {
+                throw new Error('AuthBroker: provider.getTokens must be a function');
             }
-            else {
-                this.logger?.warn(`Failed to get connection config from session store for ${destination}: ${getErrorMessage(error)}`);
+            if (typeof provider.refreshTokens !== 'function') {
+                throw new Error('AuthBroker: provider.refreshTokens must be a function');
             }
         }
-        try {
-            authConfig = await this.sessionStore.getAuthorizationConfig(destination);
-        }
-        catch (error) {
-            if (hasErrorCode(error)) {
-                if (error.code === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
-                    this.logger?.debug(`Session file not found for ${destination}: ${error.filePath || 'unknown path'}`);
-                }
-                else if (error.code === interfaces_auth_1.STORE_ERROR_CODES.PARSE_ERROR) {
-                    this.logger?.warn(`Failed to parse session file for ${destination}: ${error.filePath || 'unknown path'} - ${getErrorMessage(error)}`);
-                }
-                else {
-                    this.logger?.warn(`Failed to get authorization config from session store for ${destination}: ${getErrorMessage(error)}`);
+        if (serviceKeyStore) {
+            for (const method of [
+                'getServiceKey',
+                'getAuthorizationConfig',
+                'getConnectionConfig',
+            ]) {
+                if (typeof serviceKeyStore[method] !== 'function') {
+                    throw new Error(`AuthBroker: serviceKeyStore.${method} must be a function`);
                 }
             }
-            else {
-                this.logger?.warn(`Failed to get authorization config from session store for ${destination}: ${getErrorMessage(error)}`);
-            }
         }
-        return { connConfig, authConfig };
+        this.sessionStore = sessionStore;
+        this.serviceKeyStore = serviceKeyStore;
+        this.provider = provider;
+        this.logger = logger ?? noOpLogger;
+        this.logger.debug('[AuthBroker] Broker initialized', {
+            hasServiceKeyStore: !!serviceKeyStore,
+            providerForm: typeof provider === 'function' ? 'factory' : 'instance',
+        });
     }
     /**
-     * Get serviceUrl from session or service key store
+     * A token for the destination: the provider's current one, which it refreshes
+     * or obtains by login when it judges the cached one unusable.
+     *
+     * The result is written to the session store. Errors from the provider
+     * (its typed errors included) propagate unchanged.
      */
-    async getServiceUrl(destination, connConfig) {
-        let serviceUrl = connConfig?.serviceUrl;
-        if (!serviceUrl && this.serviceKeyStore) {
-            try {
-                const serviceKeyConnConfig = await this.serviceKeyStore.getConnectionConfig(destination);
-                serviceUrl = serviceKeyConnConfig?.serviceUrl;
-                if (serviceUrl) {
-                    this.logger?.debug(`serviceUrl not in session for ${destination}, found in serviceKeyStore`);
-                }
-            }
-            catch (error) {
-                if (hasErrorCode(error)) {
-                    if (error.code === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
-                        this.logger?.debug(`Service key file not found for ${destination}: ${error.filePath || 'unknown path'}`);
-                    }
-                    else if (error.code === interfaces_auth_1.STORE_ERROR_CODES.PARSE_ERROR) {
-                        this.logger?.warn(`Failed to parse service key for ${destination}: ${error.filePath || 'unknown path'} - ${getErrorMessage(error)}`);
-                    }
-                    else {
-                        this.logger?.warn(`Failed to get serviceUrl from service key store for ${destination}: ${getErrorMessage(error)}`);
-                    }
-                }
-                else {
-                    this.logger?.warn(`Failed to get serviceUrl from service key store for ${destination}: ${getErrorMessage(error)}`);
-                }
-            }
-        }
-        if (!serviceUrl) {
-            this.logger?.error(`Session for destination "${destination}" is missing required field 'serviceUrl'. SessionStore must contain initial session with serviceUrl${this.serviceKeyStore ? ' or serviceKeyStore must contain serviceUrl' : ''}.`);
-            throw new Error(`Session for destination "${destination}" is missing required field 'serviceUrl'. ` +
-                `SessionStore must contain initial session with serviceUrl${this.serviceKeyStore ? ' or serviceKeyStore must contain serviceUrl' : ''}.`);
-        }
-        return serviceUrl;
+    async getToken(destination) {
+        return this.obtain(destination, 'getTokens');
     }
     /**
-     * Get UAA credentials from session or service key
+     * A new token for the destination, never the cached one — for a caller whose
+     * token the server has just refused. Calls the provider's `refreshTokens()`,
+     * writes the result to the session store and returns it.
      */
-    async getAuthorizationConfigFromServiceKey(destination) {
-        if (!this.serviceKeyStore) {
-            throw new Error(`Authorization config not found for ${destination}. Session has no auth config and serviceKeyStore is not available.`);
-        }
-        let serviceKeyAuthConfig = null;
-        try {
-            serviceKeyAuthConfig =
-                await this.serviceKeyStore.getAuthorizationConfig(destination);
+    async refreshToken(destination) {
+        return this.obtain(destination, 'refreshTokens');
+    }
+    async obtain(destination, method) {
+        const connConfig = await this.read(destination, 'session connection config', () => this.sessionStore.getConnectionConfig(destination));
+        const serviceUrl = await this.resolveServiceUrl(destination, connConfig);
+        const provider = await this.providerFor(destination, serviceUrl, connConfig);
+        this.logger.debug(`[AuthBroker] ${method} for ${destination}`);
+        const result = await provider[method]();
+        if (!result?.authorizationToken) {
+            throw new Error(`Token provider did not return authorization token for destination "${destination}"`);
         }
-        catch (error) {
-            if (hasErrorCode(error)) {
-                if (error.code === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
-                    this.logger?.debug(`Service key file not found for ${destination}: ${error.filePath || 'unknown path'}`);
-                }
-                else if (error.code === interfaces_auth_1.STORE_ERROR_CODES.PARSE_ERROR) {
-                    this.logger?.warn(`Failed to parse service key for ${destination}: ${error.filePath || 'unknown path'} - ${getErrorMessage(error)}`);
-                }
-                else {
-                    this.logger?.warn(`Failed to get authorization config from service key store for ${destination}: ${getErrorMessage(error)}`);
-                }
-            }
-            else {
-                this.logger?.warn(`Failed to get authorization config from service key store for ${destination}: ${getErrorMessage(error)}`);
-            }
+        await this.persist(destination, serviceUrl, connConfig, result);
+        return result.authorizationToken;
+    }
+    async providerFor(destination, serviceUrl, connConfig) {
+        if (typeof this.provider !== 'function') {
+            return this.provider;
         }
-        if (!serviceKeyAuthConfig) {
-            throw new Error(`Authorization config not found for ${destination}. Session has no auth config${this.serviceKeyStore ? ' and serviceKeyStore has no auth config' : ' and serviceKeyStore is not available'}.`);
+        const existing = this.providers.get(destination);
+        if (existing) {
+            return existing;
         }
-        return serviceKeyAuthConfig;
+        const authConfig = await this.resolveAuthorizationConfig(destination);
+        const built = this.provider(destination, authConfig, {
+            ...(connConfig ?? {}),
+            serviceUrl,
+        });
+        this.providers.set(destination, built);
+        this.logger.debug(`[AuthBroker] Provider built for ${destination}`, {
+            hasCredentials: !!authConfig,
+            hasRefreshToken: !!authConfig?.refreshToken,
+            hasStoredToken: !!(connConfig?.authorizationToken || connConfig?.sessionCookies),
+        });
+        return built;
     }
     /**
-     * Save token and config to session
+     * The credentials the provider is built with: the session's own when it holds
+     * them, else the service key's, carrying the refresh token the session
+     * stored. The session keeps a refresh token without credentials when the
+     * credentials came from the service key, since the broker does not copy the
+     * client secret into it; `loadSession` is where such a token is read.
      */
-    async saveTokenToSession(destination, connectionConfig, authorizationConfig) {
-        try {
-            await this.sessionStore.setConnectionConfig(destination, connectionConfig);
-        }
-        catch (error) {
-            this.logger?.error(`Failed to save connection config to session for ${destination}: ${getErrorMessage(error)}`);
-            throw new Error(`Failed to save connection config for destination "${destination}": ${getErrorMessage(error)}`);
-        }
-        if (authorizationConfig.uaaUrl &&
-            authorizationConfig.uaaClientId &&
-            authorizationConfig.uaaClientSecret) {
-            try {
-                await this.sessionStore.setAuthorizationConfig(destination, authorizationConfig);
-            }
-            catch (error) {
-                this.logger?.error(`Failed to save authorization config to session for ${destination}: ${getErrorMessage(error)}`);
-                throw new Error(`Failed to save authorization config for destination "${destination}": ${getErrorMessage(error)}`);
-            }
-        }
-        else {
-            this.logger?.debug(`Skipping authorization config save for ${destination}: missing UAA fields`);
+    async resolveAuthorizationConfig(destination) {
+        const sessionAuth = await this.read(destination, 'session authorization config', () => this.sessionStore.getAuthorizationConfig(destination));
+        if (sessionAuth) {
+            return sessionAuth;
+        }
+        const session = await this.read(destination, 'session', () => this.sessionStore.loadSession(destination));
+        const storedRefreshToken = typeof session?.refreshToken === 'string'
+            ? session.refreshToken
+            : undefined;
+        const serviceKeyStore = this.serviceKeyStore;
+        const keyAuth = serviceKeyStore
+            ? await this.read(destination, 'service key authorization config', () => serviceKeyStore.getAuthorizationConfig(destination))
+            : null;
+        if (!keyAuth) {
+            return null;
         }
+        return {
+            ...keyAuth,
+            refreshToken: storedRefreshToken ?? keyAuth.refreshToken,
+        };
     }
-    async requestTokens(destination, sourceLabel) {
-        this.logger?.info(`[AuthBroker] Requesting tokens for ${destination} via ${sourceLabel}`);
-        try {
-            const getTokens = this.tokenProvider.getTokens;
-            if (!getTokens) {
-                throw new Error('AuthBroker: tokenProvider.getTokens is required');
-            }
-            const tokenResult = await getTokens.call(this.tokenProvider);
-            const expiresAt = tokenResult.expiresIn
-                ? Date.now() + tokenResult.expiresIn * 1000
-                : undefined;
-            this.logger?.info(`[AuthBroker] Tokens received for ${destination}`, {
-                authorizationToken: (0, formatting_1.formatToken)(tokenResult.authorizationToken),
-                hasRefreshToken: !!tokenResult.refreshToken,
-                refreshToken: (0, formatting_1.formatToken)(tokenResult.refreshToken),
-                authType: tokenResult.authType,
-                expiresIn: tokenResult.expiresIn,
-                expiresAt: expiresAt ? (0, formatting_1.formatExpirationDate)(expiresAt) : undefined,
-            });
-            return tokenResult;
-        }
-        catch (error) {
-            if (hasErrorCode(error)) {
-                if (error.code === 'VALIDATION_ERROR') {
-                    throw new Error(`Token provider validation failed for ${destination}: missing ${error.missingFields?.join(', ') || 'required fields'}`);
-                }
-                if (error.code === 'BROWSER_AUTH_ERROR') {
-                    throw new Error(`Token provider browser authentication failed for ${destination}: ${getErrorMessage(error)}`);
-                }
-                if (error.code === 'ECONNREFUSED' ||
-                    error.code === 'ETIMEDOUT' ||
-                    error.code === 'ENOTFOUND') {
-                    throw new Error(`Token provider network error for ${destination}: ${error.code}`);
-                }
-                if (error.code === 'SERVICE_KEY_ERROR') {
-                    throw new Error(`Token provider service key error for ${destination}: ${getErrorMessage(error)}`);
-                }
-            }
-            throw new Error(`Token provider error for ${destination}: ${getErrorMessage(error)}`);
+    async resolveServiceUrl(destination, connConfig) {
+        let serviceUrl = connConfig?.serviceUrl;
+        const serviceKeyStore = this.serviceKeyStore;
+        if (!serviceUrl && serviceKeyStore) {
+            const keyConn = await this.read(destination, 'service key connection config', () => serviceKeyStore.getConnectionConfig(destination));
+            serviceUrl = keyConn?.serviceUrl;
         }
-    }
-    async persistTokenResult(destination, serviceUrl, baseConnConfig, authConfig, tokenResult) {
-        const token = tokenResult.authorizationToken;
-        if (!token) {
-            throw new Error(`Token provider did not return authorization token for destination "${destination}"`);
+        if (!serviceUrl) {
+            throw new Error(`Session for destination "${destination}" is missing required field 'serviceUrl'. ` +
+                `SessionStore must contain initial session with serviceUrl${this.serviceKeyStore ? ' or serviceKeyStore must contain serviceUrl' : ''}.`);
         }
-        const isSaml = tokenResult.tokenType === 'saml';
-        const connectionConfigWithServiceUrl = {
-            ...baseConnConfig,
-            serviceUrl,
-            authorizationToken: isSaml ? undefined : token,
-            sessionCookies: isSaml ? token : undefined,
-            authType: isSaml ? 'saml' : 'jwt',
-        };
-        const authorizationConfig = {
-            ...authConfig,
-            refreshToken: tokenResult.refreshToken ?? authConfig.refreshToken,
-        };
-        const expiresAt = tokenResult.expiresIn
-            ? Date.now() + tokenResult.expiresIn * 1000
-            : undefined;
-        this.logger?.info(`[AuthBroker] Saving tokens to session for ${destination}`, {
-            serviceUrl,
-            authorizationToken: (0, formatting_1.formatToken)(token),
-            hasRefreshToken: !!authorizationConfig.refreshToken,
-            refreshToken: (0, formatting_1.formatToken)(authorizationConfig.refreshToken),
-            expiresIn: tokenResult.expiresIn,
-            expiresAt: expiresAt ? (0, formatting_1.formatExpirationDate)(expiresAt) : undefined,
-        });
-        await this.saveTokenToSession(destination, connectionConfigWithServiceUrl, authorizationConfig);
+        return serviceUrl;
     }
     /**
-     * Get authentication token for destination.
-     * Uses tokenProvider for all authentication operations (browser-based authorization).
-     *
-     * **Flow:**
-     * **Step 0: Initialize Session with Token (if needed)**
-     * - Check if session has `authorizationToken` AND UAA credentials
-     * - If both are empty AND serviceKeyStore is available:
-     *   - Get UAA credentials from service key
-     *   - Use tokenProvider for browser-based authentication
-     *   - Save token and refresh token to session
+     * Writes the result by its type: a SAML result is session cookies, anything
+     * else a bearer token. The refresh token is written only when the result has
+     * one, so a provider that returns none does not erase the stored one.
      *
-     * **Step 1: Token Validation**
-     * - If token exists in session, validate it (if provider supports validation)
-     * - If valid → return token
-     * - If invalid or no token → continue to refresh
-     *
-     * **Step 2: Refresh Token Flow**
-     * - Check if refresh token exists in session
-     * - If refresh token exists:
-     *   - Use tokenProvider to refresh token (browser-based or refresh grant)
-     *   - Save new token to session
-     *   - Return new token
-     * - Otherwise → proceed to Step 3
-     *
-     * **Step 3: New Token Flow**
-     * - Get UAA credentials from session or service key
-     * - Use tokenProvider for browser-based authentication
-     * - Save new token to session
-     * - Return new token
-     *
-     * **Important Notes:**
-     * - All authentication is handled by tokenProvider (e.g., XSUAA provider)
-     * - Provider uses browser-based authorization to ensure proper role assignment
-     * - Direct UAA HTTP requests are not used to avoid role assignment issues
-     *
-     * @param destination Destination name (e.g., "TRIAL")
-     * @returns Promise that resolves to JWT token string
-     * @throws Error if session initialization fails or authentication failed
+     * `ITokenResult.expiresAt` has no field in `IConnectionConfig` to go to; the
+     * provider seeded with the stored token reads the expiry from the JWT itself.
      */
-    async getToken(destination) {
-        this.logger?.info(`[AuthBroker] Getting token for destination: ${destination}`);
-        // Load session data
-        const { connConfig, authConfig } = await this.loadSessionData(destination);
-        // Get serviceUrl (required)
-        const serviceUrl = await this.getServiceUrl(destination, connConfig);
-        // Check if we have token or UAA credentials
-        const sessionToken = connConfig?.authorizationToken || connConfig?.sessionCookies;
-        const hasToken = !!sessionToken;
-        const hasAuthConfig = !!authConfig;
-        this.logger?.info(`[AuthBroker] Session check for ${destination}`, {
-            hasToken,
-            hasAuthConfig,
-            hasServiceUrl: !!serviceUrl,
+    async persist(destination, serviceUrl, connConfig, result) {
+        const isSaml = result.tokenType === 'saml';
+        await this.sessionStore.setConnectionConfig(destination, {
+            ...(connConfig ?? {}),
             serviceUrl,
-            authorizationToken: (0, formatting_1.formatToken)(connConfig?.authorizationToken || connConfig?.sessionCookies),
-            hasRefreshToken: !!authConfig?.refreshToken,
-            refreshToken: (0, formatting_1.formatToken)(authConfig?.refreshToken),
+            authorizationToken: isSaml ? undefined : result.authorizationToken,
+            sessionCookies: isSaml ? result.authorizationToken : undefined,
+            authType: isSaml ? 'saml' : 'jwt',
         });
-        // Step 0: Initialize Session with Token (if needed)
-        if (!hasToken && !hasAuthConfig) {
-            if (!this.allowBrowserAuth) {
-                const error = new Error(`Browser authentication required for destination "${destination}" but allowBrowserAuth is disabled. Either enable browser auth or provide a valid session with token.`);
-                error.code = 'BROWSER_AUTH_REQUIRED';
-                error.destination = destination;
-                this.logger?.error(`Step 0: Browser auth required but disabled for ${destination}`);
-                throw error;
-            }
-            const serviceKeyAuthConfig = await this.getAuthorizationConfigFromServiceKey(destination);
-            const tokenResult = await this.requestTokens(destination, 'serviceKey');
-            await this.persistTokenResult(destination, serviceUrl, connConfig, serviceKeyAuthConfig, tokenResult);
-            this.logger?.info(`[AuthBroker] Token retrieved for ${destination} (initialized from service key)`, {
-                authorizationToken: (0, formatting_1.formatToken)(tokenResult.authorizationToken),
-            });
-            return tokenResult.authorizationToken;
-        }
-        // Step 1: Request tokens via provider (provider handles token lifecycle internally)
-        // Broker always calls provider.getTokens() - provider decides whether to return cached token,
-        // refresh, or perform login. Consumer doesn't need to know about token issues.
-        this.logger?.debug(`Step 1: Requesting tokens via provider for ${destination}`);
-        let lastError = null;
-        if (authConfig) {
-            if (!this.allowBrowserAuth && !authConfig.refreshToken) {
-                const error = new Error(`Browser authentication required for destination "${destination}" but allowBrowserAuth is disabled. Session has no refresh token.`);
-                error.code = 'BROWSER_AUTH_REQUIRED';
-                error.destination = destination;
-                this.logger?.error(`Step 2: Browser auth required but disabled for ${destination}`);
-                throw error;
-            }
-            try {
-                const tokenResult = await this.requestTokens(destination, 'session');
-                await this.persistTokenResult(destination, serviceUrl, connConfig, authConfig, tokenResult);
-                this.logger?.info(`[AuthBroker] Token retrieved for ${destination} (via session)`, {
-                    authorizationToken: (0, formatting_1.formatToken)(tokenResult.authorizationToken),
+        if (result.refreshToken) {
+            const sessionAuth = await this.read(destination, 'session authorization config', () => this.sessionStore.getAuthorizationConfig(destination));
+            if (sessionAuth) {
+                // The session holds its own credentials: only the refresh token changes.
+                await this.sessionStore.setAuthorizationConfig(destination, {
+                    ...sessionAuth,
+                    refreshToken: result.refreshToken,
                 });
-                return tokenResult.authorizationToken;
-            }
-            catch (error) {
-                lastError = error instanceof Error ? error : new Error(String(error));
-                this.logger?.debug(`Step 2: Token request via session failed for ${destination}: ${getErrorMessage(error)}, trying service key`);
             }
-        }
-        if (!this.allowBrowserAuth) {
-            const error = new Error(`Browser authentication required for destination "${destination}" but allowBrowserAuth is disabled. Token refresh via session failed and browser auth is not allowed. Either enable browser auth or ensure a valid refresh token exists in session.`);
-            error.code = 'BROWSER_AUTH_REQUIRED';
-            error.destination = destination;
-            this.logger?.error(`Step 2: Browser auth required but disabled for ${destination}`);
-            throw error;
-        }
-        if (!this.serviceKeyStore) {
-            const tokenType = this.tokenProvider?.tokenType;
-            if (tokenType === 'saml') {
-                const tokenResult = await this.requestTokens(destination, 'session');
-                await this.persistTokenResult(destination, serviceUrl, connConfig, authConfig || {}, tokenResult);
-                this.logger?.info(`[AuthBroker] Token retrieved for ${destination} (SAML without auth config)`, {
-                    authorizationToken: (0, formatting_1.formatToken)(tokenResult.authorizationToken),
+            else {
+                // The credentials live in the service key and stay there. The session
+                // gets the refresh token alone — never the client secret.
+                const session = await this.read(destination, 'session', () => this.sessionStore.loadSession(destination));
+                await this.sessionStore.saveSession(destination, {
+                    ...(session ?? {}),
+                    serviceUrl: session?.serviceUrl ?? serviceUrl,
+                    refreshToken: result.refreshToken,
                 });
-                return tokenResult.authorizationToken;
-            }
-            if (lastError) {
-                throw lastError;
             }
-            throw new Error(`Authorization config not found for ${destination}. Session has no auth config and serviceKeyStore is not available.`);
-        }
-        // If the session attempt already performed an *interactive* browser login
-        // and it failed (the user didn't complete it / it timed out), the serviceKey
-        // strategy would call the SAME provider.getTokens() again and start a
-        // duplicate browser login on the same redirect port — surfacing a misleading
-        // "Port in use" instead of the real cause. Don't retry interactive failures;
-        // propagate the original error. Transient/non-interactive session failures
-        // still fall through to the serviceKey attempt below.
-        if (lastError && isInteractiveAuthFailure(lastError)) {
-            this.logger?.debug(`Step 2: session login failed interactively for ${destination}; not retrying via service key (${getErrorMessage(lastError)})`);
-            throw lastError;
         }
-        const serviceKeyAuthConfig = await this.getAuthorizationConfigFromServiceKey(destination);
-        const tokenResult = await this.requestTokens(destination, 'serviceKey');
-        await this.persistTokenResult(destination, serviceUrl, connConfig, serviceKeyAuthConfig, tokenResult);
-        this.logger?.info(`[AuthBroker] Token retrieved for ${destination} (fallback to service key)`, {
-            authorizationToken: (0, formatting_1.formatToken)(tokenResult.authorizationToken),
+        this.logger.info(`[AuthBroker] Token saved for ${destination}`, {
+            tokenType: result.tokenType ?? 'jwt',
+            authType: result.authType,
+            hasRefreshToken: !!result.refreshToken,
+            expiresAt: result.expiresAt
+                ? new Date(result.expiresAt).toISOString()
+                : undefined,
+            expiresIn: result.expiresIn,
         });
-        return tokenResult.authorizationToken;
-    }
-    /**
-     * Force refresh token for destination.
-     * Uses refresh token from session if available, otherwise uses UAA credentials from session or service key.
-     * @param destination Destination name (e.g., "TRIAL")
-     * @returns Promise that resolves to new JWT token string
-     */
-    async refreshToken(destination) {
-        this.logger?.debug(`Force refreshing token for destination: ${destination}`);
-        // Call getToken to trigger full refresh flow
-        return this.getToken(destination);
     }
     /**
-     * Get authorization configuration for destination
-     * @param destination Destination name (e.g., "TRIAL")
-     * @returns Promise that resolves to IAuthorizationConfig or null if not found
+     * A store read where absence is an answer and anything else is not.
+     *
+     * A store says "nothing here" with `null`, or with `FILE_NOT_FOUND`, and the
+     * flow goes on to the next source. Any other failure — a service key that is
+     * not valid JSON, a file the process may not read — is a different problem
+     * with a different fix, and reaches the caller as the store raised it. It
+     * used to be logged and answered as absent, so the caller saw only the
+     * consequence ("missing required field 'serviceUrl'") and went looking for a
+     * file that was there.
      */
-    async getAuthorizationConfig(destination) {
-        this.logger?.debug(`Getting authorization config for ${destination}`);
-        // Try session store first (has tokens)
-        this.logger?.debug(`Checking session store for authorization config: ${destination}`);
-        let sessionAuthConfig = null;
+    async read(destination, what, fn) {
         try {
-            sessionAuthConfig =
-                await this.sessionStore.getAuthorizationConfig(destination);
+            return await fn();
         }
         catch (error) {
-            this.logger?.warn(`Failed to get authorization config from session store for ${destination}: ${getErrorMessage(error)}`);
-        }
-        if (sessionAuthConfig) {
-            this.logger?.debug(`Authorization config from session for ${destination}: hasUaaUrl(${!!sessionAuthConfig.uaaUrl}), hasRefreshToken(${!!sessionAuthConfig.refreshToken})`);
-            return sessionAuthConfig;
-        }
-        // Fall back to service key store (has UAA credentials) if available
-        if (this.serviceKeyStore) {
-            this.logger?.debug(`Checking service key store for authorization config: ${destination}`);
-            let serviceKeyAuthConfig = null;
-            try {
-                serviceKeyAuthConfig =
-                    await this.serviceKeyStore.getAuthorizationConfig(destination);
-            }
-            catch (error) {
-                // Handle typed store errors
-                if (hasErrorCode(error)) {
-                    if (error.code === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
-                        this.logger?.debug(`Service key file not found for ${destination}: ${error.filePath || 'unknown path'}`);
-                    }
-                    else if (error.code === interfaces_auth_1.STORE_ERROR_CODES.PARSE_ERROR) {
-                        this.logger?.warn(`Failed to parse service key for ${destination}: ${error.filePath || 'unknown path'} - ${getErrorMessage(error)}`);
-                    }
-                    else {
-                        this.logger?.warn(`Failed to get authorization config from service key store for ${destination}: ${getErrorMessage(error)}`);
-                    }
-                }
-                else {
-                    this.logger?.warn(`Failed to get authorization config from service key store for ${destination}: ${getErrorMessage(error)}`);
-                }
-            }
-            if (serviceKeyAuthConfig) {
-                this.logger?.debug(`Authorization config from service key for ${destination}: hasUaaUrl(${!!serviceKeyAuthConfig.uaaUrl})`);
-                return serviceKeyAuthConfig;
+            if (errorCode(error) === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
+                this.logger.debug(`No ${what} for ${destination}: file not found`);
+                return null;
             }
+            throw error;
         }
-        else {
-            this.logger?.debug(`Service key store not available for ${destination}`);
-        }
-        this.logger?.debug(`No authorization config found for ${destination}`);
-        return null;
     }
     /**
-     * Get connection configuration for destination
-     * @param destination Destination name (e.g., "TRIAL")
-     * @returns Promise that resolves to IConnectionConfig or null if not found
+     * Authorization configuration for the destination: the session's, else the
+     * service key's, else null.
      */
-    async getConnectionConfig(destination) {
-        this.logger?.debug(`Getting connection config for ${destination}`);
-        // Try session store first (has tokens and URLs)
-        let sessionConnConfig = null;
-        try {
-            sessionConnConfig =
-                await this.sessionStore.getConnectionConfig(destination);
-        }
-        catch (error) {
-            this.logger?.warn(`Failed to get connection config from session store for ${destination}: ${getErrorMessage(error)}`);
+    async getAuthorizationConfig(destination) {
+        const sessionAuth = await this.read(destination, 'session authorization config', () => this.sessionStore.getAuthorizationConfig(destination));
+        if (sessionAuth) {
+            return sessionAuth;
         }
-        if (sessionConnConfig) {
-            const tokenLength = (sessionConnConfig.authorizationToken ||
-                sessionConnConfig.sessionCookies)?.length || 0;
-            const formattedToken = (0, formatting_1.formatToken)(sessionConnConfig.authorizationToken ||
-                sessionConnConfig.sessionCookies);
-            this.logger?.debug(`Connection config from session for ${destination}: token(${tokenLength} chars${formattedToken ? `, ${formattedToken}` : ''}), serviceUrl(${sessionConnConfig.serviceUrl ? 'yes' : 'no'})`);
-            return sessionConnConfig;
+        const serviceKeyStore = this.serviceKeyStore;
+        if (!serviceKeyStore) {
+            return null;
         }
-        // Fall back to service key store (has URLs but no tokens) if available
-        if (this.serviceKeyStore) {
-            let serviceKeyConnConfig = null;
-            try {
-                serviceKeyConnConfig =
-                    await this.serviceKeyStore.getConnectionConfig(destination);
-            }
-            catch (error) {
-                // Handle typed store errors
-                if (hasErrorCode(error)) {
-                    if (error.code === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
-                        this.logger?.debug(`Service key file not found for ${destination}: ${error.filePath || 'unknown path'}`);
-                    }
-                    else if (error.code === interfaces_auth_1.STORE_ERROR_CODES.PARSE_ERROR) {
-                        this.logger?.warn(`Failed to parse service key for ${destination}: ${error.filePath || 'unknown path'} - ${getErrorMessage(error)}`);
-                    }
-                    else {
-                        this.logger?.warn(`Failed to get connection config from service key store for ${destination}: ${getErrorMessage(error)}`);
-                    }
-                }
-                else {
-                    this.logger?.warn(`Failed to get connection config from service key store for ${destination}: ${getErrorMessage(error)}`);
-                }
-            }
-            if (serviceKeyConnConfig) {
-                this.logger?.debug(`Connection config from service key for ${destination}: serviceUrl(${serviceKeyConnConfig.serviceUrl ? 'yes' : 'no'}), token(none)`);
-                return serviceKeyConnConfig;
-            }
+        return this.read(destination, 'service key authorization config', () => serviceKeyStore.getAuthorizationConfig(destination));
+    }
+    /**
+     * Connection configuration for the destination: the session's, else the
+     * service key's (which has URLs but no token), else null.
+     */
+    async getConnectionConfig(destination) {
+        const sessionConn = await this.read(destination, 'session connection config', () => this.sessionStore.getConnectionConfig(destination));
+        if (sessionConn) {
+            return sessionConn;
         }
-        else {
-            this.logger?.debug(`Service key store not available for ${destination}`);
+        const serviceKeyStore = this.serviceKeyStore;
+        if (!serviceKeyStore) {
+            return null;
         }
-        this.logger?.debug(`No connection config found for ${destination}`);
-        return null;
+        return this.read(destination, 'service key connection config', () => serviceKeyStore.getConnectionConfig(destination));
     }
     /**
-     * Create a token refresher for a specific destination.
-     *
-     * The token refresher is designed to be injected into JwtAbapConnection via DI,
-     * allowing the connection to handle token refresh transparently without knowing
-     * about authentication internals.
-     *
-     * **Usage:**
-     * ```typescript
-     * const broker = new AuthBroker(config);
-     * const tokenRefresher = broker.createTokenRefresher('TRIAL');
-     * const connection = new JwtAbapConnection(config, tokenRefresher);
-     * ```
-     *
-     * @param destination Destination name (e.g., "TRIAL")
-     * @returns ITokenRefresher implementation for the given destination
+     * An `ITokenRefresher` for one destination, for injection into a connection:
+     * `getToken()` is the broker's `getToken`, `refreshToken()` its forced
+     * `refreshToken`.
      */
     createTokenRefresher(destination) {
-        const broker = this;
         return {
-            /**
-             * Get current valid token.
-             * Returns cached token if valid, otherwise refreshes and returns new token.
-             */
-            async getToken() {
-                return broker.getToken(destination);
-            },
-            /**
-             * Force refresh token and save to session store.
-             * Always performs refresh, ignoring cached token validity.
-             */
-            async refreshToken() {
-                return broker.refreshToken(destination);
-            },
+            getToken: () => this.getToken(destination),
+            refreshToken: () => this.refreshToken(destination),
         };
     }
 }