@mcp-abap-adt/auth-broker 3.0.0 → 3.0.2

package/CHANGELOG.md

@@ -11,6 +11,33 @@ Thank you to all contributors! See [CONTRIBUTORS.md](CONTRIBUTORS.md) for the co
 
 ## [Unreleased]
 
+## [3.0.2] - 2026-09-27
+
+### Changed
+
+- **Node.js 26 is supported**: `engines` is `"^22 || ^24 || ^26"`. Under Node 26 npm skipped every release whose `engines` did not admit it and installed the newest one that did — silently an older major, for this package one without the restriction. Measured: `npm i -g @mcp-abap-adt/proxy` on Node 26.7.0 installed 4.2.0 while 5.0.1 was `latest`. The release build runs on Node 22 (it was 18, below `engines`).
+
+## [3.0.1] - 2026-09-26
+
+### Fixed
+
+- **A store failure other than a missing file reaches the caller as raised.**
+  The broker answered every store error as absence — logged, then `null` — so
+  a service key that is there but not valid JSON, or a file the process may
+  not read, surfaced only as its consequence: "Session for destination … is
+  missing required field 'serviceUrl'", which sends users to create a file
+  that already exists. Absence is still `null` or `FILE_NOT_FOUND`, and the
+  flow goes on to the next source; anything else is thrown unchanged — before
+  the provider is asked when it comes from the reads that precede the token,
+  and after the provider answered and the token was written when it comes
+  from the reads that save the refresh token.
+
+  Measured on auth-stores 1.2.3: the service key stores throw on an invalid or
+  unreadable file (`Invalid JSON in file …`, `EACCES`), so this change is what
+  a broker user sees. The session stores answer an unreadable or unparsable
+  file with `null` themselves; that is theirs to change, and this release does
+  not see it.
+
 ## [3.0.0] - 2026-09-26
 
 ### Security

package/README.md

@@ -26,8 +26,9 @@ authorization code or client credentials) and `mcp-sso` (OIDC and SAML single si
 npm install @mcp-abap-adt/auth-broker
 ```
 
-Requires Node.js 22 or 24 (`engines: "^22 || ^24"`), the versions SAP BTP's Cloud Foundry
-Node.js buildpack offers.
+Requires Node.js 22, 24 or 26 (`engines: "^22 || ^24 || ^26"`): 22 and 24 are
+the versions SAP BTP's Cloud Foundry Node.js buildpack offers, and 26 is
+supported as well.
 
 ## Usage
 
@@ -206,7 +207,7 @@ const connection = new JwtAbapConnection(config, tokenRefresher);
 5. The broker no longer writes the client secret into the session store. Read
    it from the service key store if you relied on finding it in the session.
 6. `refreshToken()` now forces a new token; it used to return `getToken()`'s.
-7. Node.js 22 or 24; SAML runs need the IdP trust (see *Migrating `mcp-sso`
+7. Node.js 22, 24 or 26; SAML runs need the IdP trust (see *Migrating `mcp-sso`
    SAML runs from 2.2.0*).
 
 ## Configuration
@@ -513,13 +514,20 @@ The session's configuration, else the service key's, else `null`.
 
 - **Provider errors propagate unchanged** — the same object, with its class,
   `code`, `missingFields` and `cause`: auth-providers' `ValidationError`,
-  `RefreshError`, `AssertionValidationError`, network errors (`ECONNREFUSED`,
+  `BrowserAuthError`, `AssertionValidationError`, network errors (`ECONNREFUSED`,
   `ETIMEDOUT`, `ENOTFOUND`), and whatever your authorization strategy throws.
   The broker does not retry a failed call.
-- **Store reads do not stop the flow**: a missing (`FILE_NOT_FOUND`, logged at
-  debug) or unreadable entry (logged as a warning) is treated as absent, and
-  whatever needed it fails later with its own message — for instance the
-  missing `serviceUrl`.
+- **Store reads: absence is an answer, a failure is not.** A store that answers
+  `null`, or fails with `FILE_NOT_FOUND` (logged at debug), means "nothing
+  here", and the broker goes on to the next source. Any other store failure —
+  a service key that is not valid JSON, a file the process may not read — is
+  thrown unchanged. A failure in the reads that come before the token (the
+  session's connection config, the service key) stops the call before the
+  provider is asked; one in the reads that save it (the session's
+  authorization config, the session) arrives after the provider answered and
+  the new token was written. (The session stores of
+  auth-stores answer an unreadable session file with `null` themselves, so it
+  reads as absent before the broker sees it.)
 - **Store writes propagate**: a token that cannot be saved is an error.
 - **A provider result without a token** is an error.
 
@@ -850,7 +858,7 @@ With 4.x every `mcp-sso` SAML run (`bearer`, `saml2 --flow pure`, and `mcp-auth
    `--assertion-flow manual`. For any other `--assertion` from an SP-initiated login:
    `--authn-request-id`.
 
-Node.js 22 or 24 is required.
+Node.js 22, 24 or 26 is required.
 
 ### Utility Script
 

package/dist/AuthBroker.d.ts

@@ -89,9 +89,15 @@ export declare class AuthBroker {
      */
     private persist;
     /**
-     * A store read that does not stop the flow: a missing or unreadable entry is
-     * logged and answered as absent, and whatever needed it fails with its own
-     * message later.
+     * A store read where absence is an answer and anything else is not.
+     *
+     * A store says "nothing here" with `null`, or with `FILE_NOT_FOUND`, and the
+     * flow goes on to the next source. Any other failure — a service key that is
+     * not valid JSON, a file the process may not read — is a different problem
+     * with a different fix, and reaches the caller as the store raised it. It
+     * used to be logged and answered as absent, so the caller saw only the
+     * consequence ("missing required field 'serviceUrl'") and went looking for a
+     * file that was there.
      */
     private read;
     /**

package/dist/AuthBroker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,yBAAyB,EACzB,eAAe,EAEhB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAS7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,EACvC,UAAU,EAAE,iBAAiB,KAC1B,yBAAyB,CAAC;AAE/B;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,YAAY,EAAE,aAAa,CAAC;IAC5B,yEAAyE;IACzE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,EAAE,yBAAyB,GAAG,oBAAoB,CAAC;CAC5D;AAcD;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;IAC5E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgD;IAE1E;;;OAGG;gBACS,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO;IA2DtD;;;;;;OAMG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpD;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,MAAM;YA2BN,WAAW;IA4BzB;;;;;;OAMG;YACW,0BAA0B;YAiC1B,iBAAiB;IAuB/B;;;;;;;OAOG;YACW,OAAO;IAoDrB;;;;OAIG;YACW,IAAI;IAoBlB;;;OAGG;IACG,sBAAsB,CAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAkBvC;;;OAGG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAkBpC;;;;OAIG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe;CAM3D"}
+{"version":3,"file":"AuthBroker.d.ts","sourceRoot":"","sources":["../src/AuthBroker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACV,yBAAyB,EACzB,eAAe,EAEhB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAS7B;;;;;;;;;;;GAWG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,oBAAoB,GAAG,IAAI,EACvC,UAAU,EAAE,iBAAiB,KAC1B,yBAAyB,CAAC;AAE/B;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,6EAA6E;IAC7E,YAAY,EAAE,aAAa,CAAC;IAC5B,yEAAyE;IACzE,eAAe,CAAC,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,EAAE,yBAAyB,GAAG,oBAAoB,CAAC;CAC5D;AAUD;;GAEG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAA+B;IAC/D,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAgB;IAC7C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAmD;IAC5E,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAgD;IAE1E;;;OAGG;gBACS,MAAM,EAAE,gBAAgB,EAAE,MAAM,CAAC,EAAE,OAAO;IA2DtD;;;;;;OAMG;IACG,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIpD;;;;OAIG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;YAI1C,MAAM;YA2BN,WAAW;IA4BzB;;;;;;OAMG;YACW,0BAA0B;YAiC1B,iBAAiB;IAuB/B;;;;;;;OAOG;YACW,OAAO;IAoDrB;;;;;;;;;;OAUG;YACW,IAAI;IAgBlB;;;OAGG;IACG,sBAAsB,CAC1B,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC;IAkBvC;;;OAGG;IACG,mBAAmB,CACvB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAkBpC;;;;OAIG;IACH,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,eAAe;CAM3D"}

package/dist/AuthBroker.js

@@ -18,9 +18,6 @@ const noOpLogger = {
     warn: () => { },
     debug: () => { },
 };
-function errorMessage(error) {
-    return error instanceof Error ? error.message : String(error);
-}
 function errorCode(error) {
     if (error !== null && typeof error === 'object' && 'code' in error) {
         const code = error.code;
@@ -232,23 +229,26 @@ class AuthBroker {
         });
     }
     /**
-     * A store read that does not stop the flow: a missing or unreadable entry is
-     * logged and answered as absent, and whatever needed it fails with its own
-     * message later.
+     * A store read where absence is an answer and anything else is not.
+     *
+     * A store says "nothing here" with `null`, or with `FILE_NOT_FOUND`, and the
+     * flow goes on to the next source. Any other failure — a service key that is
+     * not valid JSON, a file the process may not read — is a different problem
+     * with a different fix, and reaches the caller as the store raised it. It
+     * used to be logged and answered as absent, so the caller saw only the
+     * consequence ("missing required field 'serviceUrl'") and went looking for a
+     * file that was there.
      */
     async read(destination, what, fn) {
         try {
             return await fn();
         }
         catch (error) {
-            const code = errorCode(error);
-            if (code === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
+            if (errorCode(error) === interfaces_auth_1.STORE_ERROR_CODES.FILE_NOT_FOUND) {
                 this.logger.debug(`No ${what} for ${destination}: file not found`);
+                return null;
             }
-            else {
-                this.logger.warn(`Failed to read ${what} for ${destination}: ${errorMessage(error)}`);
-            }
-            return null;
+            throw error;
         }
     }
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-broker",
-  "version": "3.0.0",
+  "version": "3.0.2",
   "description": "Per-destination token broker for SAP BTP and ABAP: sessions and service keys from stores, tokens from an injected provider, results persisted - plus the mcp-auth and mcp-sso CLIs",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -64,7 +64,7 @@
     "mcp-sso": "./dist/bin/mcp-sso.js"
   },
   "engines": {
-    "node": "^22 || ^24"
+    "node": "^22 || ^24 || ^26"
   },
   "dependencies": {
     "@mcp-abap-adt/auth-providers": "^4.2.0",