@mcp-abap-adt/auth-broker 3.0.4 → 4.0.0

package/dist/destinations.d.ts

@@ -0,0 +1,139 @@
+/**
+ * What a destination states, and the provider it states.
+ *
+ * Two fields choose the provider — `authType` and, for `jwt` and `saml`,
+ * `grantType` — and nothing else: no field's presence or absence is ever
+ * read to pick a row. Both come from the key store's means.
+ */
+import { type IDeviceCodePresenter, type OidcCallbackResult } from '@mcp-abap-adt/auth-providers';
+import type { IAssertionReplayStore, IAuthorizationStrategy, IAuthProvider, ITokenResult } from '@mcp-abap-adt/interfaces-auth';
+import type { DestinationGrant, IConfig, IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-broker';
+import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+import { type Binding } from './binding';
+type StatedAuthType = NonNullable<IConnectionConfig['authType']>;
+/** The stated `authType`, or the error naming it. */
+export declare function statedAuthType(destination: string, means: IConnectionConfig | null): StatedAuthType;
+/** The stated grant of a `jwt` or `saml` destination, or the error naming it. */
+export declare function statedGrant(destination: string, authType: 'jwt' | 'saml', means: IConnectionConfig): DestinationGrant;
+/** `basic` → `BasicAuthProvider(username, password)`, from the means alone. */
+export declare function basicProvider(destination: string, means: IConnectionConfig): IAuthProvider;
+/**
+ * `snc` → the Secure Login Client recipe, from the four SNC fields. Only the
+ * partner name is required: the contract says the library is discovered when
+ * `sncLib` is absent and the user's name taken from the credential when
+ * `sncMyName` is, and the provider documents its own `qop` default.
+ */
+export declare function sncProvider(destination: string, means: IConnectionConfig, logger: ILogger): IAuthProvider;
+/**
+ * `none` → the credential handed over, from the session: the only way in, so
+ * required. Read from the secret alone — the means are not a seed.
+ *
+ * The broker did not obtain it and cannot obtain it again, so a binding that
+ * does not match is refused, never discarded: `issuedFor`
+ * must always equal the destination's resource — it is what stops the
+ * credential going to another one; `issuedBy` is compared only when the means
+ * state an issuer.
+ */
+export declare function handedOverProvider(destination: string, authType: 'jwt' | 'saml', secret: IConfig | null, binding: Binding): IAuthProvider;
+/** The UAA grants: one client, one token endpoint (`<uaaUrl>/oauth/token`). */
+export type UaaGrant = 'authorization_code' | 'client_credentials' | 'passcode';
+export declare function isUaaGrant(grant: DestinationGrant): grant is UaaGrant;
+/** What a UAA row is built from. */
+export interface UaaRow {
+    destination: string;
+    grant: UaaGrant;
+    /** The client, from the key store's `getAuthorizationConfig`. */
+    client: IAuthorizationConfig | null;
+    /** The session secret — the seed; `null` when there is no session. */
+    secret: IConfig | null;
+    /** The consumer's `authorization` option. */
+    authorization: ((destination: string, grant: 'authorization_code' | 'passcode') => IAuthorizationStrategy<string>) | undefined;
+    logger: ILogger;
+    onTokens: (result: ITokenResult) => Promise<void>;
+}
+/**
+ * `jwt` / `authorization_code` → `AuthorizationCodeProvider`,
+ * `client_credentials` → `ClientCredentialsProvider`, `passcode` →
+ * `UaaPasscodeProvider`: the client from the key store, the seed from the
+ * session (not for `client_credentials`, whose row takes the client alone).
+ *
+ * Every field and option the row lacks is named in one error, before the
+ * consumer's `authorization` is called. `serviceUrl` is not among them: the
+ * providers read the client and `uaaUrl` only. `uaaClientSecret: ''` is a public
+ * client: `passcode` takes it as no secret; the other two rows' providers
+ * require a secret, so for them `''` is missing.
+ */
+export declare function uaaProvider(row: UaaRow): IAuthProvider;
+/** The OIDC grants: a client, and an issuer or explicit endpoints. */
+export type OidcGrant = 'oidc_authorization_code' | 'device_code' | 'password' | 'token_exchange';
+export declare function isOidcGrant(grant: DestinationGrant): grant is OidcGrant;
+/** What an OIDC row is built from. */
+export interface OidcRow {
+    destination: string;
+    grant: OidcGrant;
+    means: IConnectionConfig;
+    /** The client, from the key store's `getAuthorizationConfig`. */
+    client: IAuthorizationConfig | null;
+    /** The session secret — the seed; `null` when there is none, or it is not bound here. */
+    secret: IConfig | null;
+    oidcAuthorization: ((destination: string) => IAuthorizationStrategy<OidcCallbackResult>) | undefined;
+    deviceCodePresenter: ((destination: string) => IDeviceCodePresenter) | undefined;
+    logger: ILogger;
+    onTokens: (result: ITokenResult) => Promise<void>;
+}
+/**
+ * `jwt` / `oidc_authorization_code` → `OidcBrowserProvider`, `device_code` →
+ * `OidcDeviceFlowProvider`, `password` → `OidcPasswordProvider`,
+ * `token_exchange` → `OidcTokenExchangeProvider`: the client id (and secret,
+ * `''` being a public client) from the key store's client, the grant's data
+ * from its `oidc*` fields, the seed from the session.
+ *
+ * The endpoints: `oidcIssuerUrl`, from which the provider discovers them, or
+ * every explicit endpoint the row uses — without either the error names the
+ * issuer and the endpoints missing. Every field and option the row lacks is
+ * named in one error, before any collaborator is called. `token_exchange`
+ * takes one scope string: the stored scopes joined by a space.
+ */
+export declare function oidcProvider(row: OidcRow): IAuthProvider;
+/** The SAML grants: an identity provider's assertion, validated first. */
+export type SamlGrant = 'saml2_pure' | 'saml2_bearer';
+export declare function isSamlGrant(grant: DestinationGrant): grant is SamlGrant;
+/** What a SAML row is built from. */
+export interface SamlRow {
+    destination: string;
+    grant: SamlGrant;
+    means: IConnectionConfig;
+    /** `saml2_bearer`'s client, from the key store; `null` for `saml2_pure`. */
+    client: IAuthorizationConfig | null;
+    /** The session secret — the seed; `null` when there is none, or it is not bound here. */
+    secret: IConfig | null;
+    authorization: ((destination: string, grant: SamlGrant) => IAuthorizationStrategy<string>) | undefined;
+    samlCookies: ((destination: string) => (samlResponse: string) => Promise<string>) | undefined;
+    assertionReplayStore: ((destination: string) => IAssertionReplayStore) | undefined;
+    logger: ILogger;
+    onTokens: (result: ITokenResult) => Promise<void>;
+}
+/**
+ * `saml` / `saml2_pure` → `Saml2PureProvider`, `saml2_bearer` →
+ * `Saml2BearerProvider`, each validating the assertion before anything uses
+ * it, with the validator the broker composes from the destination's trust and
+ * the consumer's replay store: `createSignedResponseValidator` for
+ * `saml2_pure` — the Response signed, as the cookies' system receives it whole
+ * — and `createSignedAssertionValidator` for `saml2_bearer`, whose token
+ * endpoint gets the Assertion alone (auth-providers' own pairing). The
+ * expected issuer is `samlIdpEntityId`.
+ *
+ * `saml2_pure` is seeded with the stored cookies and `expiresAt`;
+ * `saml2_bearer` with the stored token, its refresh token and expiry, and
+ * takes the client (`uaaUrl`, `uaaClientId`; `uaaClientSecret` `''` a public
+ * client) and `samlTokenUrl` when stated.
+ *
+ * Every field and option the row lacks is named in one error, before any
+ * collaborator is called; so is a `samlClockSkewMs` that is not a whole number
+ * of milliseconds, and a certificate the validator cannot read — by name, never
+ * the value.
+ */
+export declare function samlProvider(row: SamlRow): IAuthProvider;
+export {};
+//# sourceMappingURL=destinations.d.ts.map

package/dist/destinations.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destinations.d.ts","sourceRoot":"","sources":["../src/destinations.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAML,KAAK,oBAAoB,EAEzB,KAAK,kBAAkB,EAWxB,MAAM,8BAA8B,CAAC;AACtC,OAAO,KAAK,EACV,qBAAqB,EAErB,sBAAsB,EACtB,aAAa,EACb,YAAY,EACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,gBAAgB,EAChB,OAAO,EACP,iBAAiB,EAClB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAC9E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,KAAK,OAAO,EAA4B,MAAM,WAAW,CAAC;AAGnE,KAAK,cAAc,GAAG,WAAW,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC,CAAC;AAwBjE,qDAAqD;AACrD,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GAAG,IAAI,GAC9B,cAAc,CAmBhB;AAED,iFAAiF;AACjF,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,KAAK,EAAE,iBAAiB,GACvB,gBAAgB,CAiBlB;AAUD,+EAA+E;AAC/E,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,GACvB,aAAa,CAaf;AAUD;;;;;GAKG;AACH,wBAAgB,WAAW,CACzB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,iBAAiB,EACxB,MAAM,EAAE,OAAO,GACd,aAAa,CA0Bf;AAED;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,KAAK,GAAG,MAAM,EACxB,MAAM,EAAE,OAAO,GAAG,IAAI,EACtB,OAAO,EAAE,OAAO,GACf,aAAa,CA2Bf;AAED,+EAA+E;AAC/E,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG,oBAAoB,GAAG,UAAU,CAAC;AAEhF,wBAAgB,UAAU,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,QAAQ,CAMrE;AAED,oCAAoC;AACpC,MAAM,WAAW,MAAM;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,QAAQ,CAAC;IAChB,iEAAiE;IACjE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,sEAAsE;IACtE,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,6CAA6C;IAC7C,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,oBAAoB,GAAG,UAAU,KACrC,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,CA4DtD;AAyBD,sEAAsE;AACtE,MAAM,MAAM,SAAS,GACjB,yBAAyB,GACzB,aAAa,GACb,UAAU,GACV,gBAAgB,CAAC;AAErB,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAOvE;AAeD,sCAAsC;AACtC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,iEAAiE;IACjE,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,iBAAiB,EACb,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,sBAAsB,CAAC,kBAAkB,CAAC,CAAC,GACrE,SAAS,CAAC;IACd,mBAAmB,EACf,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,oBAAoB,CAAC,GAC/C,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAqFxD;AAED,0EAA0E;AAC1E,MAAM,MAAM,SAAS,GAAG,YAAY,GAAG,cAAc,CAAC;AAEtD,wBAAgB,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,KAAK,IAAI,SAAS,CAEvE;AAED,qCAAqC;AACrC,MAAM,WAAW,OAAO;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,SAAS,CAAC;IACjB,KAAK,EAAE,iBAAiB,CAAC;IACzB,4EAA4E;IAC5E,MAAM,EAAE,oBAAoB,GAAG,IAAI,CAAC;IACpC,yFAAyF;IACzF,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IACvB,aAAa,EACT,CAAC,CACC,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,SAAS,KACb,sBAAsB,CAAC,MAAM,CAAC,CAAC,GACpC,SAAS,CAAC;IACd,WAAW,EACP,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC,GACpE,SAAS,CAAC;IACd,oBAAoB,EAChB,CAAC,CAAC,WAAW,EAAE,MAAM,KAAK,qBAAqB,CAAC,GAChD,SAAS,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,CAAC,MAAM,EAAE,YAAY,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACnD;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,CAgGxD"}

package/dist/destinations.js

@@ -0,0 +1,429 @@
+"use strict";
+/**
+ * What a destination states, and the provider it states.
+ *
+ * Two fields choose the provider — `authType` and, for `jwt` and `saml`,
+ * `grantType` — and nothing else: no field's presence or absence is ever
+ * read to pick a row. Both come from the key store's means.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.statedAuthType = statedAuthType;
+exports.statedGrant = statedGrant;
+exports.basicProvider = basicProvider;
+exports.sncProvider = sncProvider;
+exports.handedOverProvider = handedOverProvider;
+exports.isUaaGrant = isUaaGrant;
+exports.uaaProvider = uaaProvider;
+exports.isOidcGrant = isOidcGrant;
+exports.oidcProvider = oidcProvider;
+exports.isSamlGrant = isSamlGrant;
+exports.samlProvider = samlProvider;
+const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
+const binding_1 = require("./binding");
+const DestinationConfigError_1 = require("./DestinationConfigError");
+/** The allowed `authType` / `grantType` pairs. `basic` and `snc` read no grant. */
+const GRANTS = {
+    jwt: [
+        'authorization_code',
+        'client_credentials',
+        'passcode',
+        'oidc_authorization_code',
+        'device_code',
+        'password',
+        'token_exchange',
+        'none',
+    ],
+    saml: ['saml2_pure', 'saml2_bearer', 'none'],
+};
+const AUTH_TYPES = ['basic', 'jwt', 'saml', 'snc'];
+/** A stored string that counts as present: `''` is missing. */
+function present(value) {
+    return typeof value === 'string' && value !== '';
+}
+/** The stated `authType`, or the error naming it. */
+function statedAuthType(destination, means) {
+    const authType = means?.authType;
+    if (!present(authType)) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, ['authType'], means
+            ? 'the key store states no authType'
+            : 'the key store has no means for this destination');
+    }
+    if (!AUTH_TYPES.includes(authType)) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, ['authType'], `authType is not one of ${AUTH_TYPES.join(', ')}`);
+    }
+    return authType;
+}
+/** The stated grant of a `jwt` or `saml` destination, or the error naming it. */
+function statedGrant(destination, authType, means) {
+    const grantType = means.grantType;
+    if (!present(grantType)) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, ['grantType'], `a ${authType} destination must state its grantType`);
+    }
+    if (!GRANTS[authType].includes(grantType)) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, ['grantType'], `grantType is not one a ${authType} destination allows (${GRANTS[authType].join(', ')})`);
+    }
+    return grantType;
+}
+/** The names of the fields among `names` that `source` lacks or holds as `''`. */
+function missing(source, names) {
+    return names.filter((name) => !present(source?.[name]));
+}
+/** `basic` → `BasicAuthProvider(username, password)`, from the means alone. */
+function basicProvider(destination, means) {
+    const lacking = missing(means, ['username', 'password']);
+    if (lacking.length > 0) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, lacking, 'a basic destination needs a user and a password');
+    }
+    return new auth_providers_1.BasicAuthProvider(means.username, means.password);
+}
+/** The provider's own config names, mapped to the store fields they come from. */
+const SNC_FIELDS = {
+    partnerName: 'sncPartnerName',
+    qop: 'sncQop',
+    myName: 'sncMyName',
+    sncLib: 'sncLib',
+};
+/**
+ * `snc` → the Secure Login Client recipe, from the four SNC fields. Only the
+ * partner name is required: the contract says the library is discovered when
+ * `sncLib` is absent and the user's name taken from the credential when
+ * `sncMyName` is, and the provider documents its own `qop` default.
+ */
+function sncProvider(destination, means, logger) {
+    if (!present(means.sncPartnerName)) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, ['sncPartnerName'], 'an snc destination needs the system’s SNC name');
+    }
+    try {
+        return auth_providers_1.SncLogonProvider.forSecureLoginClient({
+            partnerName: means.sncPartnerName,
+            qop: present(means.sncQop) ? means.sncQop : undefined,
+            sncLib: present(means.sncLib) ? means.sncLib : undefined,
+            myName: present(means.sncMyName) ? means.sncMyName : undefined,
+            logger,
+        });
+    }
+    catch (error) {
+        if (error instanceof auth_providers_1.ValidationError) {
+            throw new DestinationConfigError_1.DestinationConfigError(destination, (error.missingFields ?? []).map((field) => SNC_FIELDS[field] ?? field), 'the SNC provider refused the destination’s SNC settings');
+        }
+        throw error;
+    }
+}
+/**
+ * `none` → the credential handed over, from the session: the only way in, so
+ * required. Read from the secret alone — the means are not a seed.
+ *
+ * The broker did not obtain it and cannot obtain it again, so a binding that
+ * does not match is refused, never discarded: `issuedFor`
+ * must always equal the destination's resource — it is what stops the
+ * credential going to another one; `issuedBy` is compared only when the means
+ * state an issuer.
+ */
+function handedOverProvider(destination, authType, secret, binding) {
+    const credential = authType === 'jwt' ? secret?.authorizationToken : secret?.sessionCookies;
+    if (!present(credential)) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, [authType === 'jwt' ? 'authorizationToken' : 'sessionCookies'], authType === 'jwt'
+            ? 'a jwt destination with grantType none needs the token in its session'
+            : 'a saml destination with grantType none needs the cookies in its session');
+    }
+    const unbound = [];
+    if (!(0, binding_1.sameResource)(secret, binding))
+        unbound.push('issuedFor');
+    if (binding.issuerStated && !(0, binding_1.sameIssuer)(secret, binding)) {
+        unbound.push('issuedBy');
+    }
+    if (unbound.length > 0) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, unbound, 'the credential in the session is not bound to this destination’s means');
+    }
+    return authType === 'jwt'
+        ? auth_providers_1.TokenAuthProvider.fixed(credential)
+        : new auth_providers_1.SamlAuthProvider(credential);
+}
+function isUaaGrant(grant) {
+    return (grant === 'authorization_code' ||
+        grant === 'client_credentials' ||
+        grant === 'passcode');
+}
+/**
+ * `jwt` / `authorization_code` → `AuthorizationCodeProvider`,
+ * `client_credentials` → `ClientCredentialsProvider`, `passcode` →
+ * `UaaPasscodeProvider`: the client from the key store, the seed from the
+ * session (not for `client_credentials`, whose row takes the client alone).
+ *
+ * Every field and option the row lacks is named in one error, before the
+ * consumer's `authorization` is called. `serviceUrl` is not among them: the
+ * providers read the client and `uaaUrl` only. `uaaClientSecret: ''` is a public
+ * client: `passcode` takes it as no secret; the other two rows' providers
+ * require a secret, so for them `''` is missing.
+ */
+function uaaProvider(row) {
+    const { destination, grant, client, secret } = row;
+    const lacking = [];
+    if (!present(client?.uaaUrl))
+        lacking.push('uaaUrl');
+    if (!present(client?.uaaClientId))
+        lacking.push('uaaClientId');
+    if (grant !== 'passcode' && !present(client?.uaaClientSecret)) {
+        lacking.push('uaaClientSecret');
+    }
+    if (grant !== 'client_credentials' && !row.authorization) {
+        lacking.push('authorization');
+    }
+    if (lacking.length > 0) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, lacking, `a jwt destination with grantType ${grant} lacks what its grant needs`);
+    }
+    const uaaUrl = client?.uaaUrl;
+    const clientId = client?.uaaClientId;
+    const clientSecret = present(client?.uaaClientSecret)
+        ? client.uaaClientSecret
+        : undefined;
+    const hooks = { onTokens: row.onTokens };
+    if (grant === 'client_credentials') {
+        return new auth_providers_1.ClientCredentialsProvider({
+            uaaUrl,
+            clientId,
+            clientSecret: clientSecret,
+            logger: row.logger,
+            ...hooks,
+        });
+    }
+    const seed = tokenSeed(secret);
+    // Checked above: the rows that reach here need it.
+    const authorization = row.authorization(destination, grant);
+    if (grant === 'authorization_code') {
+        return new auth_providers_1.AuthorizationCodeProvider({
+            uaaUrl,
+            clientId,
+            clientSecret: clientSecret,
+            authorization,
+            ...seed,
+            logger: row.logger,
+            ...hooks,
+        });
+    }
+    return new auth_providers_1.UaaPasscodeProvider({
+        uaaUrl,
+        clientId,
+        clientSecret,
+        authorization,
+        ...seed,
+        logger: row.logger,
+        ...hooks,
+    });
+}
+/** The seed of a token provider: the stored token, its refresh token and expiry. */
+function tokenSeed(secret) {
+    return {
+        accessToken: present(secret?.authorizationToken)
+            ? secret.authorizationToken
+            : undefined,
+        refreshToken: present(secret?.refreshToken)
+            ? secret.refreshToken
+            : undefined,
+        expiresAt: typeof secret?.expiresAt === 'number' ? secret.expiresAt : undefined,
+    };
+}
+/** A stored string, or `undefined` for one absent or `''`. */
+function stated(value) {
+    return present(value) ? value : undefined;
+}
+function isOidcGrant(grant) {
+    return (grant === 'oidc_authorization_code' ||
+        grant === 'device_code' ||
+        grant === 'password' ||
+        grant === 'token_exchange');
+}
+/**
+ * The endpoints each OIDC row reads when the means state no issuer to
+ * discover them from — the ones its provider asks discovery for otherwise.
+ */
+const OIDC_ENDPOINTS = {
+    oidc_authorization_code: ['oidcAuthorizationEndpoint', 'oidcTokenEndpoint'],
+    device_code: ['oidcDeviceAuthorizationEndpoint', 'oidcTokenEndpoint'],
+    password: ['oidcTokenEndpoint'],
+    token_exchange: ['oidcTokenEndpoint'],
+};
+/**
+ * `jwt` / `oidc_authorization_code` → `OidcBrowserProvider`, `device_code` →
+ * `OidcDeviceFlowProvider`, `password` → `OidcPasswordProvider`,
+ * `token_exchange` → `OidcTokenExchangeProvider`: the client id (and secret,
+ * `''` being a public client) from the key store's client, the grant's data
+ * from its `oidc*` fields, the seed from the session.
+ *
+ * The endpoints: `oidcIssuerUrl`, from which the provider discovers them, or
+ * every explicit endpoint the row uses — without either the error names the
+ * issuer and the endpoints missing. Every field and option the row lacks is
+ * named in one error, before any collaborator is called. `token_exchange`
+ * takes one scope string: the stored scopes joined by a space.
+ */
+function oidcProvider(row) {
+    const { destination, grant, means, client } = row;
+    const lacking = [];
+    if (!present(client?.uaaClientId))
+        lacking.push('uaaClientId');
+    if (!present(means.oidcIssuerUrl)) {
+        const endpoints = OIDC_ENDPOINTS[grant].filter((name) => !present(means[name]));
+        if (endpoints.length > 0)
+            lacking.push('oidcIssuerUrl', ...endpoints);
+    }
+    if (grant === 'password') {
+        lacking.push(...missing(means, ['username', 'password']));
+    }
+    if (grant === 'token_exchange') {
+        lacking.push(...missing(means, ['oidcSubjectToken', 'oidcSubjectTokenType']));
+    }
+    if (grant === 'oidc_authorization_code' && !row.oidcAuthorization) {
+        lacking.push('oidcAuthorization');
+    }
+    if (grant === 'device_code' && !row.deviceCodePresenter) {
+        lacking.push('deviceCodePresenter');
+    }
+    if (lacking.length > 0) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, lacking, `a jwt destination with grantType ${grant} lacks what its grant needs`);
+    }
+    const scopes = Array.isArray(means.oidcScopes) && means.oidcScopes.length > 0
+        ? means.oidcScopes
+        : undefined;
+    const common = {
+        issuerUrl: stated(means.oidcIssuerUrl),
+        clientId: client?.uaaClientId,
+        clientSecret: stated(client?.uaaClientSecret),
+        tokenEndpoint: stated(means.oidcTokenEndpoint),
+        ...tokenSeed(row.secret),
+        logger: row.logger,
+        onTokens: row.onTokens,
+    };
+    switch (grant) {
+        case 'oidc_authorization_code':
+            return new auth_providers_1.OidcBrowserProvider({
+                ...common,
+                scopes,
+                authorizationEndpoint: stated(means.oidcAuthorizationEndpoint),
+                // Checked above.
+                authorization: row.oidcAuthorization(destination),
+            });
+        case 'device_code':
+            return new auth_providers_1.OidcDeviceFlowProvider({
+                ...common,
+                scopes,
+                deviceAuthorizationEndpoint: stated(means.oidcDeviceAuthorizationEndpoint),
+                presenter: row.deviceCodePresenter(destination),
+            });
+        case 'password':
+            return new auth_providers_1.OidcPasswordProvider({
+                ...common,
+                scopes,
+                username: means.username,
+                password: means.password,
+            });
+        case 'token_exchange':
+            return new auth_providers_1.OidcTokenExchangeProvider({
+                ...common,
+                scope: scopes?.join(' '),
+                subjectToken: means.oidcSubjectToken,
+                subjectTokenType: means.oidcSubjectTokenType,
+                audience: stated(means.oidcAudience),
+                actorToken: stated(means.oidcActorToken),
+                actorTokenType: stated(means.oidcActorTokenType),
+            });
+    }
+}
+function isSamlGrant(grant) {
+    return grant === 'saml2_pure' || grant === 'saml2_bearer';
+}
+/**
+ * `saml` / `saml2_pure` → `Saml2PureProvider`, `saml2_bearer` →
+ * `Saml2BearerProvider`, each validating the assertion before anything uses
+ * it, with the validator the broker composes from the destination's trust and
+ * the consumer's replay store: `createSignedResponseValidator` for
+ * `saml2_pure` — the Response signed, as the cookies' system receives it whole
+ * — and `createSignedAssertionValidator` for `saml2_bearer`, whose token
+ * endpoint gets the Assertion alone (auth-providers' own pairing). The
+ * expected issuer is `samlIdpEntityId`.
+ *
+ * `saml2_pure` is seeded with the stored cookies and `expiresAt`;
+ * `saml2_bearer` with the stored token, its refresh token and expiry, and
+ * takes the client (`uaaUrl`, `uaaClientId`; `uaaClientSecret` `''` a public
+ * client) and `samlTokenUrl` when stated.
+ *
+ * Every field and option the row lacks is named in one error, before any
+ * collaborator is called; so is a `samlClockSkewMs` that is not a whole number
+ * of milliseconds, and a certificate the validator cannot read — by name, never
+ * the value.
+ */
+function samlProvider(row) {
+    const { destination, grant, means, client } = row;
+    const lacking = missing(means, [
+        'samlIdpSsoUrl',
+        'samlSpEntityId',
+        'samlIdpEntityId',
+    ]);
+    const certificates = means.samlIdpCertificates;
+    if (!Array.isArray(certificates) ||
+        certificates.length === 0 ||
+        !certificates.every(present)) {
+        lacking.push('samlIdpCertificates');
+    }
+    if (grant === 'saml2_bearer') {
+        lacking.push(...missing(client, ['uaaUrl', 'uaaClientId']));
+    }
+    if (!row.authorization)
+        lacking.push('authorization');
+    if (grant === 'saml2_pure' && !row.samlCookies)
+        lacking.push('samlCookies');
+    if (!row.assertionReplayStore)
+        lacking.push('assertionReplayStore');
+    if (lacking.length > 0) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, lacking, `a saml destination with grantType ${grant} lacks what its grant needs`);
+    }
+    const skew = means.samlClockSkewMs;
+    if (skew !== undefined && !(Number.isInteger(skew) && skew >= 0)) {
+        throw new DestinationConfigError_1.DestinationConfigError(destination, ['samlClockSkewMs'], 'samlClockSkewMs is not a whole, non-negative number of milliseconds');
+    }
+    const replayStore = row.assertionReplayStore(destination);
+    const createValidator = grant === 'saml2_pure'
+        ? auth_providers_1.createSignedResponseValidator
+        : auth_providers_1.createSignedAssertionValidator;
+    let assertionValidator;
+    try {
+        assertionValidator = createValidator({
+            idpCertificates: certificates,
+            clockSkewMs: skew,
+            replayStore,
+        });
+    }
+    catch {
+        // The validator's own message may quote what it could not read; the
+        // error names the field only.
+        throw new DestinationConfigError_1.DestinationConfigError(destination, ['samlIdpCertificates'], 'a SAML signing certificate the destination states is not a valid X.509 certificate');
+    }
+    const common = {
+        idpSsoUrl: means.samlIdpSsoUrl,
+        spEntityId: means.samlSpEntityId,
+        acsUrl: stated(means.samlAcsUrl),
+        relayState: stated(means.samlRelayState),
+        idpEntityId: means.samlIdpEntityId,
+        idpInitiated: means.samlIdpInitiated === true,
+        assertionValidator,
+        authorization: row.authorization(destination, grant),
+        logger: row.logger,
+        onTokens: row.onTokens,
+    };
+    if (grant === 'saml2_pure') {
+        const secret = row.secret;
+        return new auth_providers_1.Saml2PureProvider({
+            ...common,
+            cookieProvider: row.samlCookies(destination),
+            accessToken: stated(secret?.sessionCookies),
+            expiresAt: typeof secret?.expiresAt === 'number' ? secret.expiresAt : undefined,
+        });
+    }
+    return new auth_providers_1.Saml2BearerProvider({
+        ...common,
+        tokenUrl: stated(means.samlTokenUrl),
+        uaaUrl: client?.uaaUrl,
+        clientId: client?.uaaClientId,
+        clientSecret: stated(client?.uaaClientSecret),
+        ...tokenSeed(row.secret),
+    });
+}

package/dist/index.d.ts

@@ -1,12 +1,16 @@
 /**
  * @mcp-abap-adt/auth-broker
- * Per-destination token broker: sessions and service keys from stores,
- * tokens from an injected provider, results persisted.
+ * Per-destination credential broker: `getProvider` builds the `IAuthProvider`
+ * a destination states from its key store's means and its session store's
+ * secret, and stores back what that provider obtains; the token API serves a
+ * token from the same provider, or from one the consumer injects.
  */
 export type { ITokenRefresher } from '@mcp-abap-adt/interfaces-auth';
 export type { AuthType } from '@mcp-abap-adt/interfaces-auth-sap';
 export type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-export { AuthBroker, type AuthBrokerConfig, type TokenProviderFactory, } from './AuthBroker';
+export { AuthBroker, type AuthBrokerConfig, type StrategyGrant, type TokenProviderFactory, } from './AuthBroker';
+export { bindingOf, type SecretBinding } from './bindingOf';
+export { DestinationConfigError } from './DestinationConfigError';
 export type { IRefreshableTokenProvider, ITokenProvider, ITokenResult, TokenProviderOptions, } from './providers';
 export type { IAuthorizationConfig, IConnectionConfig, IServiceKeyStore, ISessionStore, } from './stores/interfaces';
 export type { IConfig } from './types';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH,YAAY,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAClE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AAEtB,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,YAAY,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AACrE,YAAY,EAAE,QAAQ,EAAE,MAAM,mCAAmC,CAAC;AAClE,YAAY,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EACL,UAAU,EACV,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAElE,YAAY,EACV,yBAAyB,EACzB,cAAc,EACd,YAAY,EACZ,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAGrB,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,gBAAgB,EAChB,aAAa,GACd,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC"}

package/dist/index.js

@@ -1,14 +1,18 @@
 "use strict";
 /**
  * @mcp-abap-adt/auth-broker
- * Per-destination token broker: sessions and service keys from stores,
- * tokens from an injected provider, results persisted.
+ * Per-destination credential broker: `getProvider` builds the `IAuthProvider`
+ * a destination states from its key store's means and its session store's
+ * secret, and stores back what that provider obtains; the token API serves a
+ * token from the same provider, or from one the consumer injects.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthBroker = void 0;
+exports.DestinationConfigError = exports.bindingOf = exports.AuthBroker = void 0;
 var AuthBroker_1 = require("./AuthBroker");
 Object.defineProperty(exports, "AuthBroker", { enumerable: true, get: function () { return AuthBroker_1.AuthBroker; } });
-// Store and provider implementations are in separate packages:
-// - @mcp-abap-adt/auth-stores-btp - BTP and ABAP stores
-// - @mcp-abap-adt/auth-stores-xsuaa - XSUAA stores
-// - @mcp-abap-adt/auth-providers - XSUAA and BTP token providers
+var bindingOf_1 = require("./bindingOf");
+Object.defineProperty(exports, "bindingOf", { enumerable: true, get: function () { return bindingOf_1.bindingOf; } });
+var DestinationConfigError_1 = require("./DestinationConfigError");
+Object.defineProperty(exports, "DestinationConfigError", { enumerable: true, get: function () { return DestinationConfigError_1.DestinationConfigError; } });
+// Store implementations: `@mcp-abap-adt/auth-stores`, or any `ISessionStore` /
+// `IServiceKeyStore`. Provider implementations: `@mcp-abap-adt/auth-providers`.

package/dist/providers/ITokenProvider.d.ts

@@ -4,7 +4,8 @@
  * Stateful providers handle token lifecycle internally (refresh/relogin).
  */
 import type { IRefreshableTokenProvider, ITokenProvider, ITokenProviderOptions, ITokenResult } from '@mcp-abap-adt/interfaces-auth';
-import type { IAuthorizationConfig, IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-sap';
+import type { IConnectionConfig } from '@mcp-abap-adt/interfaces-auth-broker';
+import type { IAuthorizationConfig } from '@mcp-abap-adt/interfaces-auth-sap';
 export type { IAuthorizationConfig, IConnectionConfig, IRefreshableTokenProvider, ITokenProvider, ITokenResult, };
 export type TokenProviderOptions = ITokenProviderOptions;
 //# sourceMappingURL=ITokenProvider.d.ts.map

package/dist/providers/ITokenProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ITokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/ITokenProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,yBAAyB,EACzB,cAAc,EACd,qBAAqB,EACrB,YAAY,EACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EAClB,MAAM,mCAAmC,CAAC;AAG3C,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,cAAc,EACd,YAAY,GACb,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,CAAC"}
+{"version":3,"file":"ITokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/ITokenProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,KAAK,EACV,yBAAyB,EACzB,cAAc,EACd,qBAAqB,EACrB,YAAY,EACb,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sCAAsC,CAAC;AAC9E,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mCAAmC,CAAC;AAG9E,YAAY,EACV,oBAAoB,EACpB,iBAAiB,EACjB,yBAAyB,EACzB,cAAc,EACd,YAAY,GACb,CAAC;AACF,MAAM,MAAM,oBAAoB,GAAG,qBAAqB,CAAC"}

package/dist/providers/index.d.ts

@@ -1,8 +1,8 @@
 /**
  * Token provider interface
  *
- * Provider implementations are in separate packages:
- * - @mcp-abap-adt/auth-providers - XSUAA and BTP providers
+ * Provider implementations: `@mcp-abap-adt/auth-providers`, or any
+ * `IRefreshableTokenProvider`.
  */
 export type { IRefreshableTokenProvider, ITokenProvider, ITokenResult, TokenProviderOptions, } from './ITokenProvider';
 //# sourceMappingURL=index.d.ts.map