@mcp-abap-adt/auth-broker 3.0.0 → 3.0.1

package/CHANGELOG.md

@@ -11,6 +11,27 @@ Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the co
 
 ## [Unreleased]
 
+## [3.0.1] - 2026-09-26
+
+### Fixed
+
+- **A store failure other than a missing file reaches the caller as raised.**
+  The broker answered every store error as absence — logged, then `null` — so
+  a service key that is there but not valid JSON, or a file the process may
+  not read, surfaced only as its consequence: "Session for destination … is
+  missing required field 'serviceUrl'", which sends users to create a file
+  that already exists. Absence is still `null` or `FILE_NOT_FOUND`, and the
+  flow goes on to the next source; anything else is thrown unchanged — before
+  the provider is asked when it comes from the reads that precede the token,
+  and after the provider answered and the token was written when it comes
+  from the reads that save the refresh token.
+
+  Measured on auth-stores 1.2.3: the service key stores throw on an invalid or
+  unreadable file (`Invalid JSON in file …`, `EACCES`), so this change is what
+  a broker user sees. The session stores answer an unreadable or unparsable
+  file with `null` themselves; that is theirs to change, and this release does
+  not see it.
+
 ## [3.0.0] - 2026-09-26
 
 ### Security

package/README.md

@@ -513,13 +513,20 @@ The session's configuration, else the service key's, else `null`.
 
 - **Provider errors propagate unchanged** — the same object, with its class,
   `code`, `missingFields` and `cause`: auth-providers' `ValidationError`,
-  `RefreshError`, `AssertionValidationError`, network errors (`ECONNREFUSED`,
+  `BrowserAuthError`, `AssertionValidationError`, network errors (`ECONNREFUSED`,
   `ETIMEDOUT`, `ENOTFOUND`), and whatever your authorization strategy throws.
   The broker does not retry a failed call.
-- **Store reads do not stop the flow**: a missing (`FILE_NOT_FOUND`, logged at
-  debug) or unreadable entry (logged as a warning) is treated as absent, and
-  whatever needed it fails later with its own message — for instance the
-  missing `serviceUrl`.
+- **Store reads: absence is an answer, a failure is not.** A store that answers
+  `null`, or fails with `FILE_NOT_FOUND` (logged at debug), means "nothing
+  here", and the broker goes on to the next source. Any other store failure —
+  a service key that is not valid JSON, a file the process may not read — is
+  thrown unchanged. A failure in the reads that come before the token (the
+  session's connection config, the service key) stops the call before the
+  provider is asked; one in the reads that save it (the session's
+  authorization config, the session) arrives after the provider answered and
+  the new token was written. (The session stores of
+  auth-stores answer an unreadable session file with `null` themselves, so it
+  reads as absent before the broker sees it.)
 - **Store writes propagate**: a token that cannot be saved is an error.
 - **A provider result without a token** is an error.
 

package/dist/AuthBroker.d.ts

@@ -89,9 +89,15 @@ export declare class AuthBroker {
      */
     private persist;
     /**
-     * A store read that does not stop the flow: a missing or unreadable entry is
-     * logged and answered as absent, and whatever needed it fails with its own
-     * message later.
+     * A store read where absence is an answer and anything else is not.
+     *
+     * A store says "nothing here" with `null`, or with `FILE_NOT_FOUND`, and the
+     * flow goes on to the next source. Any other failure — a service key that is
+     * not valid JSON, a file the process may not read — is a different problem
+     * with a different fix, and reaches the caller as the store raised it. It
+     * used to be logged and answered as absent, so the caller saw only the
+     * consequence ("missing required field 'serviceUrl'") and went looking for a
+     * file that was there.
      */
     private read;
     /**

package/dist/AuthBroker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,yBAAyB,EACzB,eAAe,EAEhB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAS7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,EACvC,UAAU,EAAE,iBAAiB,KAC1B,yBAAyB,CAAC;AAE/B;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,YAAY,EAAE,aAAa,CAAC;IAC5B,yEAAyE;IACzE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,EAAE,yBAAyB,GAAG,oBAAoB,CAAC;CAC5D;AAcD;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;IAC5E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgD;IAE1E;;;OAGG;gBACS,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO;IA2DtD;;;;;;OAMG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpD;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,MAAM;YA2BN,WAAW;IA4BzB;;;;;;OAMG;YACW,0BAA0B;YAiC1B,iBAAiB;IAuB/B;;;;;;;OAOG;YACW,OAAO;IAoDrB;;;;OAIG;YACW,IAAI;IAoBlB;;;OAGG;IACG,sBAAsB,CAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAkBvC;;;OAGG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAkBpC;;;;OAIG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe;CAM3D"}
+{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,yBAAyB,EACzB,eAAe,EAEhB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAS7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,EACvC,UAAU,EAAE,iBAAiB,KAC1B,yBAAyB,CAAC;AAE/B;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,YAAY,EAAE,aAAa,CAAC;IAC5B,yEAAyE;IACzE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,EAAE,yBAAyB,GAAG,oBAAoB,CAAC;CAC5D;AAUD;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;IAC5E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgD;IAE1E;;;OAGG;gBACS,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO;IA2DtD;;;;;;OAMG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpD;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,MAAM;YA2BN,WAAW;IA4BzB;;;;;;OAMG;YACW,0BAA0B;YAiC1B,iBAAiB;IAuB/B;;;;;;;OAOG;YACW,OAAO;IAoDrB;;;;;;;;;;OAUG;YACW,IAAI;IAgBlB;;;OAGG;IACG,sBAAsB,CAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAkBvC;;;OAGG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAkBpC;;;;OAIG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe;CAM3D"}

package/dist/AuthBroker.js

@@ -18,9 +18,6 @@ const noOpLogger = {
     warn: () => { },
     debug: () => { },
 };
-function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
 function errorCode(error) {
     if (error !== null && typeof error === 'object' && 'code' in error) {
         const code = error.code;
@@ -232,23 +229,26 @@ class AuthBroker {
         });
     }
     /**
-     * A store read that does not stop the flow: a missing or unreadable entry is
-     * logged and answered as absent, and whatever needed it fails with its own
-     * message later.
+     * A store read where absence is an answer and anything else is not.
+     *
+     * A store says "nothing here" with `null`, or with `FILE_NOT_FOUND`, and the
+     * flow goes on to the next source. Any other failure — a service key that is
+     * not valid JSON, a file the process may not read — is a different problem
+     * with a different fix, and reaches the caller as the store raised it. It
+     * used to be logged and answered as absent, so the caller saw only the
+     * consequence ("missing required field 'serviceUrl'") and went looking for a
+     * file that was there.
      */
     async read(destination, what, fn) {
         try {
             return await fn();
         }
         catch (error) {
-            const code = errorCode(error);
-            if (code === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
+            if (errorCode(error) === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
                 this.logger.debug(`No ${what} for ${destination}: file not found`);
+                return null;
             }
-            else {
-                this.logger.warn(`Failed to read ${what} for ${destination}: ${errorMessage(error)}`);
-            }
-            return null;
+            throw error;
         }
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "3.0.0",
+  "version": "3.0.1",
   "description": "Per-destination token broker for SAP BTP and ABAP: sessions and service keys from stores, tokens from an injected provider, results persisted - plus the mcp-auth and mcp-sso CLIs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",