@mcp-abap-adt/auth-broker 2.2.0 → 3.0.1

package/dist/bin/samlMetadata.js

@@ -0,0 +1,175 @@
+"use strict";
+/**
+ * SAML metadata, read for what a SAML run would otherwise be told by hand.
+ *
+ * Two documents, two sides:
+ * - the identity provider's (`--idp-metadata`): its entityID, its signing
+ *   certificates and its SSO URL — what the assertion is validated against;
+ * - the service provider's, which for XSUAA is `<uaa.url>/saml/metadata`: its
+ *   entityID (the assertion's Audience) and the bearer endpoint
+ *   `/oauth/token/alias/<alias>`, which is both the assertion's Recipient and
+ *   the token endpoint of the saml2-bearer grant.
+ *
+ * What is read here is trust material. A certificate taken from metadata is
+ * only as trustworthy as the channel that delivered it, so a URL must be
+ * https; plain http is accepted for loopback hosts only, which is a local test
+ * identity provider and nothing else.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.loadMetadata = loadMetadata;
+exports.readIdpMetadata = readIdpMetadata;
+exports.readSpMetadata = readSpMetadata;
+exports.applySamlMetadata = applySamlMetadata;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const LOOPBACK = new Set(['localhost', '127.0.0.1', '[::1]']);
+/** A metadata document from an https URL, a loopback http URL, or a file. */
+async function loadMetadata(source) {
+    if (/^https?:\/\//i.test(source)) {
+        const url = new URL(source);
+        if (url.protocol !== 'https:' && !LOOPBACK.has(url.hostname)) {
+            throw new Error(`refusing SAML metadata over ${url.protocol} from ${url.hostname}: it carries the certificates assertions are verified against, so it must come over https`);
+        }
+        const response = await fetch(url);
+        if (!response.ok) {
+            throw new Error(`SAML metadata ${source} answered ${response.status}`);
+        }
+        return response.text();
+    }
+    return (0, node_fs_1.readFileSync)((0, node_path_1.resolve)(source), 'utf8');
+}
+function attribute(tag, name) {
+    return tag.match(new RegExp(`\\s${name}="([^"]*)"`))?.[1];
+}
+/**
+ * Every `EntityDescriptor` in the document, whether it is the root or one of
+ * many inside an `EntitiesDescriptor` (federation metadata). An entity's
+ * entityID, keys and endpoints are read from the same element — taking the
+ * first entityID in the document paired one entity's ID with another's
+ * certificate.
+ */
+function entitiesOf(xml) {
+    return [
+        ...xml.matchAll(/<(?:[\w-]+:)?EntityDescriptor\b([^>]*)>([\s\S]*?)<\/(?:[\w-]+:)?EntityDescriptor>/g),
+    ].map(([, attributes, body]) => ({
+        entityId: attribute(attributes, 'entityID'),
+        body,
+    }));
+}
+/** The inner XML of the first `<prefix:name>` element, whatever the prefix. */
+function section(xml, name) {
+    return xml.match(new RegExp(`<(?:[\\w-]+:)?${name}\\b[^>]*>([\\s\\S]*?)</(?:[\\w-]+:)?${name}>`))?.[1];
+}
+/**
+ * The one entity the caller means. With a wanted entityID, the entity with
+ * it; without one, the only candidate — several are a question only the
+ * caller can answer, and picking the first would trust an identity provider
+ * nobody named.
+ */
+function chooseEntity(candidates, wanted, role, flag) {
+    if (wanted !== undefined) {
+        const match = candidates.find((entity) => entity.entityId === wanted);
+        if (!match) {
+            throw new Error(`the metadata has no ${role} with entityID ${JSON.stringify(wanted)}; it has: ${candidates
+                .map((entity) => JSON.stringify(entity.entityId))
+                .join(', ') || 'none'}`);
+        }
+        return match;
+    }
+    if (candidates.length === 0) {
+        throw new Error(`the metadata describes no ${role}`);
+    }
+    if (candidates.length > 1) {
+        throw new Error(`the metadata describes ${candidates.length} ${role}s; name the one to use with ${flag}: ${candidates
+            .map((entity) => JSON.stringify(entity.entityId))
+            .join(', ')}`);
+    }
+    return candidates[0];
+}
+/**
+ * The identity provider in `xml`: the one whose entityID is `entityId`, or the
+ * only one there is.
+ */
+function readIdpMetadata(xml, entityId) {
+    const candidates = entitiesOf(xml).filter((entity) => section(entity.body, 'IDPSSODescriptor') !== undefined);
+    if (candidates.length === 0) {
+        throw new Error('the metadata has no IDPSSODescriptor: not an identity provider');
+    }
+    const entity = chooseEntity(candidates, entityId, 'identity provider', '--idp-entity-id');
+    const descriptor = section(entity.body, 'IDPSSODescriptor') ?? '';
+    const certificates = [];
+    const keyDescriptors = descriptor.matchAll(/<(?:[\w-]+:)?KeyDescriptor\b([^>]*)>([\s\S]*?)<\/(?:[\w-]+:)?KeyDescriptor>/g);
+    for (const [, attributes, body] of keyDescriptors) {
+        // No `use` means the key serves both purposes (SAML metadata 2.4.1.1).
+        if (attribute(attributes, 'use') === 'encryption')
+            continue;
+        for (const [, certificate] of body.matchAll(/<(?:[\w-]+:)?X509Certificate>([^<]+)</g)) {
+            certificates.push(certificate.replace(/\s+/g, ''));
+        }
+    }
+    const ssoServices = [
+        ...descriptor.matchAll(/<(?:[\w-]+:)?SingleSignOnService\b[^>]*>/g),
+    ].map(([tag]) => ({
+        binding: attribute(tag, 'Binding') ?? '',
+        location: attribute(tag, 'Location'),
+    }));
+    const ssoUrl = ssoServices.find((s) => s.binding.endsWith(':HTTP-Redirect'))?.location ??
+        ssoServices.find((s) => s.binding.endsWith(':HTTP-POST'))?.location;
+    return { entityId: entity.entityId, certificates, ssoUrl };
+}
+/** The bearer ACS of an entity: the one at `/oauth/token/alias/…`. */
+function bearerAcsOf(body) {
+    return [...body.matchAll(/<(?:[\w-]+:)?AssertionConsumerService\b[^>]*>/g)]
+        .map(([tag]) => attribute(tag, 'Location'))
+        .find((location) => location?.includes('/oauth/token/alias/'));
+}
+/**
+ * The XSUAA service provider in `xml`: the entity publishing a bearer ACS,
+ * `spEntityId`'s when several do.
+ */
+function readSpMetadata(xml, spEntityId) {
+    const candidates = entitiesOf(xml).filter((entity) => bearerAcsOf(entity.body));
+    if (candidates.length === 0)
+        return {};
+    const entity = chooseEntity(candidates, spEntityId, 'XSUAA service provider', '--sp-entity-id');
+    return { entityId: entity.entityId, bearerAcsUrl: bearerAcsOf(entity.body) };
+}
+/**
+ * Fills what the metadata states and the caller did not. An explicit option
+ * always wins, and trust is replaced rather than widened: a `--idp-cert`
+ * means no certificate from the metadata is trusted alongside it.
+ *
+ * `explicitTokenEndpoint` is the `--token-endpoint` the user gave, if any —
+ * distinct from `options.tokenEndpoint`, which a service key may already have
+ * set to the plain `/oauth/token` that a bearer grant must not use.
+ */
+async function applySamlMetadata(options, explicitTokenEndpoint, load = loadMetadata) {
+    if (options.protocol !== 'saml2')
+        return;
+    if (options.idpMetadata) {
+        const idp = readIdpMetadata(await load(options.idpMetadata), options.idpEntityId);
+        options.idpEntityId ??= idp.entityId;
+        options.idpSsoUrl ??= idp.ssoUrl;
+        if (options.idpCertificates === undefined &&
+            options.idpCertificateFiles === undefined &&
+            idp.certificates.length > 0) {
+            options.idpCertificates = idp.certificates;
+        }
+    }
+    if (options.flow !== 'bearer')
+        return;
+    // The file wins over the service key's UAA, as an explicit source does.
+    const spSource = options.samlMetadataPath ??
+        (options.uaaUrl
+            ? `${options.uaaUrl.replace(/\/+$/, '')}/saml/metadata`
+            : undefined);
+    if (!spSource)
+        return;
+    const sp = readSpMetadata(await load(spSource), options.spEntityId);
+    if (!sp.bearerAcsUrl) {
+        throw new Error(`${spSource} names no /oauth/token/alias/ endpoint: not an XSUAA service provider's metadata`);
+    }
+    options.spEntityId ??= sp.entityId;
+    options.acsUrl ??= sp.bearerAcsUrl;
+    options.tokenEndpoint = explicitTokenEndpoint ?? sp.bearerAcsUrl;
+}

package/dist/bin/workDir.js

@@ -0,0 +1,79 @@
+"use strict";
+/**
+ * A private working directory for one CLI run, removed however the run ends.
+ *
+ * The CLIs keep a temporary session store (and, for a `credentials`-wrapped
+ * service key, an unwrapped copy of the key) while they log in. Both hold the
+ * client secret. They used to live in `.tmp` beside the output file — in the
+ * user's sessions folder, shared by every run — and were removed only on
+ * success: a failed or interrupted login left the secret there, and two runs
+ * at once shared one directory that each removed on exit.
+ *
+ * Now each run gets its own directory under the OS temp dir, readable by the
+ * user alone, and it is removed on any exit: success, error, or a signal.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createWorkDir = createWorkDir;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const path = __importStar(require("node:path"));
+const SIGNAL_EXIT_CODES = {
+    SIGINT: 130,
+    SIGTERM: 143,
+    SIGHUP: 129,
+};
+function createWorkDir(prefix) {
+    // mkdtemp creates the directory with mode 0700: the secret is the user's alone.
+    const dir = fs.mkdtempSync(path.join(os.tmpdir(), `${prefix}-`));
+    const remove = () => {
+        try {
+            fs.rmSync(dir, { recursive: true, force: true });
+        }
+        catch {
+            // Nothing left to do on the way out.
+        }
+    };
+    // `exit` covers process.exit() and a normal end; it does not fire for a
+    // signal, so each is handled too, and exits with the conventional code.
+    process.once('exit', remove);
+    for (const [signal, code] of Object.entries(SIGNAL_EXIT_CODES)) {
+        process.once(signal, () => {
+            remove();
+            process.exit(code);
+        });
+    }
+    return dir;
+}

package/dist/index.d.ts

@@ -1,12 +1,13 @@
 /**
  * @mcp-abap-adt/auth-broker
- * JWT authentication broker for MCP ABAP ADT server
+ * Per-destination token broker: sessions and service keys from stores,
+ * tokens from an injected provider, results persisted.
  */
 export type { ITokenRefresher } from '@mcp-abap-adt/interfaces-auth';
 export type { AuthType } from '@mcp-abap-adt/interfaces-auth-sap';
 export type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-export { AuthBroker, type AuthBrokerConfig } from './AuthBroker';
-export type { ITokenProvider, ITokenResult, TokenProviderOptions, } from './providers';
+export { AuthBroker, type AuthBrokerConfig, type TokenProviderFactory, } from './AuthBroker';
+export type { IRefreshableTokenProvider, ITokenProvider, ITokenResult, TokenProviderOptions, } from './providers';
 export type { IAuthorizationConfig, IConnectionConfig, IServiceKeyStore, ISessionStore, } from './stores/interfaces';
 export type { IConfig } from './types';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,YAAY,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAClE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEjE,YAAY,EACV,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,YAAY,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAClE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -1,7 +1,8 @@
 "use strict";
 /**
  * @mcp-abap-adt/auth-broker
- * JWT authentication broker for MCP ABAP ADT server
+ * Per-destination token broker: sessions and service keys from stores,
+ * tokens from an injected provider, results persisted.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AuthBroker = void 0;

package/dist/providers/ITokenProvider.d.ts

@@ -3,8 +3,8 @@
  *
  * Stateful providers handle token lifecycle internally (refresh/relogin).
  */
-import type { ITokenProvider, ITokenProviderOptions, ITokenResult } from '@mcp-abap-adt/interfaces-auth';
+import type { IRefreshableTokenProvider, ITokenProvider, ITokenProviderOptions, ITokenResult } from '@mcp-abap-adt/interfaces-auth';
 import type { IAuthorizationConfig, IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-sap';
-export type { IAuthorizationConfig, IConnectionConfig, ITokenProvider, ITokenResult, };
+export type { IAuthorizationConfig, IConnectionConfig, IRefreshableTokenProvider, ITokenProvider, ITokenResult, };
 export type TokenProviderOptions = ITokenProviderOptions;
 //# sourceMappingURL=ITokenProvider.d.ts.map

package/dist/providers/ITokenProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ITokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/ITokenProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACrB,YAAY,EACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,mCAAmC,CAAC;AAG3C,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,cAAc,EACd,YAAY,GACb,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,CAAC"}
+{"version":3,"file":"ITokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/ITokenProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,yBAAyB,EACzB,cAAc,EACd,qBAAqB,EACrB,YAAY,EACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,mCAAmC,CAAC;AAG3C,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,cAAc,EACd,YAAY,GACb,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,CAAC"}

package/dist/providers/index.d.ts

@@ -4,5 +4,5 @@
  * Provider implementations are in separate packages:
  * - @mcp-abap-adt/auth-providers - XSUAA and BTP providers
  */
-export type { ITokenProvider, ITokenResult, TokenProviderOptions, } from './ITokenProvider';
+export type { IRefreshableTokenProvider, ITokenProvider, ITokenResult, TokenProviderOptions, } from './ITokenProvider';
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,kBAAkB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "2.2.0",
-  "description": "JWT authentication broker for MCP ABAP ADT - manages tokens based on destination headers",
+  "version": "3.0.1",
+  "description": "Per-destination token broker for SAP BTP and ABAP: sessions and service keys from stores, tokens from an injected provider, results persisted - plus the mcp-auth and mcp-sso CLIs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
@@ -21,7 +21,11 @@
     "token",
     "broker",
     "mcp",
-    "abap-adt"
+    "abap-adt",
+    "xsuaa",
+    "oauth2",
+    "saml",
+    "sso"
   ],
   "author": "Oleksii Kyslytsia <oleksij.kyslytsja@gmail.com>",
   "license": "LGPL-3.0-only",
@@ -60,13 +64,13 @@
     "mcp-sso": "./dist/bin/mcp-sso.js"
   },
   "engines": {
-    "node": ">=18.2.0"
+    "node": "^22 || ^24"
   },
   "dependencies": {
-    "@mcp-abap-adt/auth-providers": "^2.2.0",
-    "@mcp-abap-adt/auth-stores": "^1.2.0",
-    "@mcp-abap-adt/interfaces-auth": "^1.2.0",
-    "@mcp-abap-adt/interfaces-auth-sap": "^1.0.0",
+    "@mcp-abap-adt/auth-providers": "^4.2.0",
+    "@mcp-abap-adt/auth-stores": "^1.2.3",
+    "@mcp-abap-adt/interfaces-auth": "^2.1.0",
+    "@mcp-abap-adt/interfaces-auth-sap": "^1.0.1",
     "@mcp-abap-adt/interfaces-utils": "^1.1.0",
     "axios": "^1.13.5"
   },

package/dist/utils/formatting.d.ts

@@ -1,16 +0,0 @@
-/**
- * Formatting utilities for logging
- */
-/**
- * Format token for logging (start...end)
- * @param token Token string to format
- * @returns Formatted token string or undefined if token is empty
- */
-export declare function formatToken(token?: string): string | undefined;
-/**
- * Format timestamp to readable date/time string
- * @param timestamp Timestamp in milliseconds
- * @returns Formatted date string (e.g., "2025-12-25 19:21:27 UTC")
- */
-export declare function formatExpirationDate(timestamp: number): string;
-//# sourceMappingURL=formatting.d.ts.map

package/dist/utils/formatting.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"formatting.d.ts","sourceRoot":"","sources":["../../src/utils/formatting.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAI9D;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAS9D"}

package/dist/utils/formatting.js

@@ -1,34 +0,0 @@
-"use strict";
-/**
- * Formatting utilities for logging
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.formatToken = formatToken;
-exports.formatExpirationDate = formatExpirationDate;
-/**
- * Format token for logging (start...end)
- * @param token Token string to format
- * @returns Formatted token string or undefined if token is empty
- */
-function formatToken(token) {
-    if (!token)
-        return undefined;
-    if (token.length <= 50)
-        return token;
-    return `${token.substring(0, 25)}...${token.substring(token.length - 25)}`;
-}
-/**
- * Format timestamp to readable date/time string
- * @param timestamp Timestamp in milliseconds
- * @returns Formatted date string (e.g., "2025-12-25 19:21:27 UTC")
- */
-function formatExpirationDate(timestamp) {
-    const date = new Date(timestamp);
-    const year = date.getUTCFullYear();
-    const month = String(date.getUTCMonth() + 1).padStart(2, '0');
-    const day = String(date.getUTCDate()).padStart(2, '0');
-    const hours = String(date.getUTCHours()).padStart(2, '0');
-    const minutes = String(date.getUTCMinutes()).padStart(2, '0');
-    const seconds = String(date.getUTCSeconds()).padStart(2, '0');
-    return `${year}-${month}-${day} ${hours}:${minutes}:${seconds} UTC`;
-}