@mcp-abap-adt/auth-providers 0.2.7 → 0.2.9

package/CHANGELOG.md

@@ -7,6 +7,61 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.9] - 2025-12-25
+
+### Changed
+- **Logging Improvements**: Enhanced logging for better debugging and readability
+  - **Date Formatting**: Expiration dates now displayed in readable format (`YYYY-MM-DD HH:MM:SS UTC`) instead of ISO format (`2025-12-25T11:08:15.000Z`)
+  - **Token Formatting**: Tokens are logged in truncated format (start...end) for security and readability
+  - **Browser Information**: Added logging of browser type and authorization URL before starting browser authentication
+  - **Token Lifecycle**: Improved logging of token acquisition, validation, and refresh operations with formatted dates
+
+### Added
+- **Browser Auth Timeout**: Added 30-second timeout for browser-based authentication
+  - Prevents provider from blocking consumer indefinitely when user doesn't complete authentication
+  - Timeout error is thrown if authentication is not completed within 30 seconds
+  - Helps prevent hanging in automated tests and CI/CD environments
+
+### Fixed
+- **Test Hanging Issues**: Fixed Jest tests hanging after completion
+  - Added `forceExit: true` to Jest configuration to force exit after tests complete
+  - Improved cleanup of HTTP server and timers to prevent open handles
+  - Added protection against double execution of server close handlers
+  - Proper cleanup of `finishTimeoutId` timer in all scenarios (success, error, timeout)
+  - Server now resolves promise only after fully closing to ensure Jest can exit cleanly
+
+## [0.2.8] - 2025-12-24
+
+### Changed
+- **Integration Tests**: Replaced mock-based unit tests with comprehensive integration tests using real YAML configuration
+  - Tests now use `test-config.yaml` for loading real service keys and session files
+  - Simplified test configuration structure: only `destination` and optional `destination_dir` (removed `abap`/`xsuaa` sections)
+  - Default paths: `~/.config/mcp-abap-adt` (Unix) or `%USERPROFILE%\Documents\mcp-abap-adt` (Windows)
+- **Logging**: Migrated from `console.log` to structured logging using `@mcp-abap-adt/logger`
+  - All providers and browser auth functions now use `ILogger` interface
+  - Consistent structured logging with log levels (debug, info, warn, error)
+  - Better debugging with token validation details and execution flow
+
+### Added
+- **Test Scenarios**: Comprehensive integration test coverage for token lifecycle
+  - Scenario 1 & 2: Token lifecycle - login via browser and reuse token from previous scenario
+  - Scenario 3: Expired session + expired refresh token - provider should re-authenticate via browser
+  - Token validation: Explicit validation of token expiration in all scenarios
+- **Test Configuration**: Simplified `test-config.yaml.template` with detailed comments
+  - Only requires `destination` name (service key and session files are auto-resolved)
+  - Optional `destination_dir` (commented out by default, can be uncommented for custom paths)
+  - Clear documentation of test scenarios and file formats
+
+### Fixed
+- **Test Hanging Issues**: Fixed tests hanging due to browser and port conflicts
+  - Changed `browser: 'none'` to `browser: 'system'` for interactive authentication
+  - Each test scenario uses unique ports (3101, 3102, 3103) to avoid conflicts
+  - Improved server cleanup: `resolve(tokens)` called immediately after token exchange, server closes asynchronously
+  - Added delays after browser-based tests to allow ports to free up
+- **Token Validation**: Added explicit token validation in all test scenarios
+  - Tests verify that returned tokens are valid and not expired
+  - Uses JWT `exp` claim validation with 60-second buffer (matching `BaseTokenProvider`)
+
 ## [0.2.7] - 2025-12-24
 
 ### Changed

package/README.md

@@ -207,7 +207,9 @@ const result = await provider.getTokens();
 // result.refreshToken is undefined (client_credentials doesn't provide refresh tokens)
 ```
 
-**Note**: The `browserAuthPort` parameter (default: 3001) configures the OAuth callback server port. If the requested port is already in use, an error will be thrown. You must specify a different port or free the port before starting authentication. The server properly closes all connections and frees the port after authentication completes, ensuring no lingering port occupation. 
+**Note**: The `browserAuthPort` parameter (default: 3001) configures the OAuth callback server port. If the requested port is already in use, an error will be thrown. You must specify a different port or free the port before starting authentication. The server properly closes all connections and frees the port after authentication completes, ensuring no lingering port occupation.
+
+**Timeout**: Browser authentication has a 30-second timeout to prevent blocking the consumer. If authentication is not completed within 30 seconds, the operation will fail with a timeout error. This prevents the provider from hanging indefinitely when the user doesn't complete authentication. 
 
 **Process Termination Handling**: The OAuth callback server registers cleanup handlers for `SIGTERM`, `SIGINT`, `SIGHUP`, and `exit` signals. This ensures ports are properly freed even when MCP clients (like Cline) terminate the process before authentication completes. This is especially important for stdio servers where the client may kill the process at any time. On Windows, the `SIGBREAK` signal (Ctrl+Break) is also handled.
 
@@ -335,27 +337,33 @@ npm test
 Integration tests work with real files from `tests/test-config.yaml`:
 
 1. Copy `tests/test-config.yaml.template` to `tests/test-config.yaml`
-2. Fill in real paths, destinations, and URLs
+2. Fill in real destination name
 3. Run tests - integration tests will use real services if configured
 
 ```yaml
-auth_broker:
-  paths:
-    service_keys_dir: ~/.config/mcp-abap-adt/service-keys/
-    sessions_dir: ~/.config/mcp-abap-adt/sessions/
-  abap:
-    destination: "TRIAL"  # For ABAP tests (uses AbapServiceKeyStore, AbapSessionStore)
-  xsuaa:
-    btp_destination: "mcp"  # For BTP tests (uses BtpServiceKeyStore, BtpSessionStore)
-    mcp_url: "https://..."
+# Destination name (used for service key file: <destination>.json and session file: <destination>.env)
+destination: "trial"  # Example: "trial" -> looks for trial.json and trial.env
+
+# Optional: Destination directory (base directory for service keys and sessions)
+# If not specified, uses default platform paths:
+#   Unix: ~/.config/mcp-abap-adt
+#   Windows: %USERPROFILE%\Documents\mcp-abap-adt
+# Uncomment and set if you need a custom path:
+# destination_dir: ~/.config/mcp-abap-adt
 ```
 
 Integration tests will skip if `test-config.yaml` is not configured or contains placeholder values.
 
+**Test Scenarios**:
+- **Scenario 1 & 2**: Token lifecycle - login via browser and reuse token from previous scenario
+- **Scenario 3**: Expired session + expired refresh token - provider should re-authenticate via browser
+- **Token validation**: Explicit validation of token expiration in all scenarios
+
 **Note**: 
-- BTP integration tests use `xsuaa.btp_destination` and require `BtpServiceKeyStore`/`BtpSessionStore` (without `sapUrl`)
-- ABAP integration tests use `abap.destination` and require `AbapServiceKeyStore`/`AbapSessionStore` (with `sapUrl`)
-- BTP/ABAP integration tests may open a browser for authentication if no refresh token is available. This is expected behavior.
+- Integration tests use `AbapServiceKeyStore` and `AbapSessionStore` for loading service keys and sessions
+- Tests may open a browser for authentication if no refresh token is available. This is expected behavior.
+- Each test scenario uses a unique port (3101, 3102, 3103) to avoid port conflicts
+- Tests use `browser: 'system'` for interactive authentication (not `'none'`)
 
 ### Debug Logging
 
@@ -363,26 +371,33 @@ To enable detailed logging during tests or runtime, set environment variables:
 
 ```bash
 # Enable logging for auth providers
-DEBUG_AUTH_PROVIDERS=true npm test
-
-# Or enable browser auth specific logging
-DEBUG_BROWSER_AUTH=true npm test
+DEBUG_PROVIDER=true npm test
 
 # Set log level (debug, info, warn, error)
 LOG_LEVEL=debug npm test
 ```
 
-Logging shows:
+Logging uses `@mcp-abap-adt/logger` package with structured logging:
 - Token exchange stages (what we send, what we receive)
-- Token information (lengths, previews)
+- Token information (lengths, previews, expiration)
+- Token validation checks (expiration, validity)
 - Errors with details
 
 Example output:
 ```
-[INTEGRATION] Exchanging code for token: https://.../oauth/token
-[INTEGRATION] Tokens received: accessToken(2263 chars), refreshToken(34 chars)
+[INFO] ℹ️ [browserAuth] Exchanging code for token...
+[INFO] ℹ️ Tokens received: accessToken(2263 chars), refreshToken(34 chars)
+[DEBUG] 🐛 [BaseTokenProvider] Token validation check {"expiresAt":"2025-12-25 11:08:15 UTC","isValid":true}
+[INFO] ℹ️ [browserAuth] Authorization URL: https://.../oauth/authorize?...
+[INFO] ℹ️ [browserAuth] Browser: system
 ```
 
+**Logging Features**:
+- **Token Formatting**: Tokens are logged in truncated format (start...end) for security
+- **Date Formatting**: Expiration dates are displayed in readable format (YYYY-MM-DD HH:MM:SS UTC) instead of ISO format
+- **Browser Information**: Logs browser type and authorization URL for debugging
+- **Token Lifecycle**: Detailed logging of token acquisition, validation, and refresh operations
+
 ## Dependencies
 
 - `@mcp-abap-adt/interfaces` (^0.2.2) - Interface definitions and error code constants

package/dist/__tests__/helpers/configHelpers.d.ts

@@ -1,22 +1,12 @@
 /**
  * Configuration helpers for auth-providers tests
- * Loads test configuration from test-config.yaml (same format as auth-broker)
+ * Loads test configuration from test-config.yaml
  */
 export interface TestConfig {
-    auth_broker?: {
-        paths?: {
-            service_keys_dir?: string;
-            sessions_dir?: string;
-        };
-        abap?: {
-            destination?: string;
-        };
-        xsuaa?: {
-            btp_destination?: string;
-            mcp_destination?: string;
-            mcp_url?: string;
-        };
-    };
+    destination?: string;
+    destination_dir?: string;
+    service_key_path?: string;
+    session_path?: string;
 }
 /**
  * Load test configuration from YAML
@@ -26,26 +16,31 @@ export declare function loadTestConfig(): TestConfig;
 /**
  * Check if test config has real values (not placeholders)
  */
-export declare function hasRealConfig(config: TestConfig, section: 'abap' | 'xsuaa'): boolean;
+export declare function hasRealConfigValue(config?: TestConfig): boolean;
 /**
- * Get ABAP destination from config
+ * Get destination from config
  */
-export declare function getAbapDestination(config?: TestConfig): string | null;
-/**
- * Get XSUAA destinations from config
- */
-export declare function getXsuaaDestinations(config?: TestConfig): {
-    btp_destination: string | null;
-    mcp_url: string | null;
-};
+export declare function getDestination(config?: TestConfig): string | null;
 /**
  * Get service keys directory from config
- * Expands ~ to home directory
+ * Uses base_dir/service-keys or default platform path
  */
-export declare function getServiceKeysDir(config?: TestConfig): string | null;
+export declare function getServiceKeysDir(config?: TestConfig): string;
 /**
  * Get sessions directory from config
- * Expands ~ to home directory
+ * Uses base_dir/sessions or default platform path
+ */
+export declare function getSessionsDir(config?: TestConfig): string;
+/**
+ * Get service key file path
+ * Returns full path to service key file
+ */
+export declare function getServiceKeyPath(config?: TestConfig): string | null;
+/**
+ * Get session file path
+ * Returns full path to session file
  */
-export declare function getSessionsDir(config?: TestConfig): string | null;
+export declare function getSessionPath(config?: TestConfig): string | null;
+export declare function getAbapDestination(config?: TestConfig): string | null;
+export declare function hasRealConfig(config?: TestConfig, _section?: 'abap' | 'xsuaa'): boolean;
 //# sourceMappingURL=configHelpers.d.ts.map

package/dist/__tests__/helpers/configHelpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"configHelpers.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/configHelpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE;QACZ,KAAK,CAAC,EAAE;YACN,gBAAgB,CAAC,EAAE,MAAM,CAAC;YAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;SACvB,CAAC;QACF,IAAI,CAAC,EAAE;YACL,WAAW,CAAC,EAAE,MAAM,CAAC;SACtB,CAAC;QACF,KAAK,CAAC,EAAE;YACN,eAAe,CAAC,EAAE,MAAM,CAAC;YACzB,eAAe,CAAC,EAAE,MAAM,CAAC;YACzB,OAAO,CAAC,EAAE,MAAM,CAAC;SAClB,CAAC;KACH,CAAC;CACH;AAkBD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAyD3C;AAED;;GAEG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,MAAM,GAAG,OAAO,GACxB,OAAO,CAwBT;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAGrE;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG;IACzD,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB,CAOA;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAYpE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAYjE"}
+{"version":3,"file":"configHelpers.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/configHelpers.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAQH,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAkBD;;;GAGG;AACH,wBAAgB,cAAc,IAAI,UAAU,CAyD3C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,OAAO,CAO/D;AAED;;GAEG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAGjE;AA+BD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,CAa7D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,CAa1D;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAcpE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAcjE;AAGD,wBAAgB,kBAAkB,CAAC,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,IAAI,CAErE;AAED,wBAAgB,aAAa,CAC3B,MAAM,CAAC,EAAE,UAAU,EACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,GAC1B,OAAO,CAET"}

package/dist/__tests__/helpers/configHelpers.js

@@ -1,7 +1,7 @@
 "use strict";
 /**
  * Configuration helpers for auth-providers tests
- * Loads test configuration from test-config.yaml (same format as auth-broker)
+ * Loads test configuration from test-config.yaml
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -38,11 +38,14 @@ var __importStar = (this && this.__importStar) || (function () {
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.loadTestConfig = loadTestConfig;
-exports.hasRealConfig = hasRealConfig;
-exports.getAbapDestination = getAbapDestination;
-exports.getXsuaaDestinations = getXsuaaDestinations;
+exports.hasRealConfigValue = hasRealConfigValue;
+exports.getDestination = getDestination;
 exports.getServiceKeysDir = getServiceKeysDir;
 exports.getSessionsDir = getSessionsDir;
+exports.getServiceKeyPath = getServiceKeyPath;
+exports.getSessionPath = getSessionPath;
+exports.getAbapDestination = getAbapDestination;
+exports.hasRealConfig = hasRealConfig;
 const fs = __importStar(require("node:fs"));
 const path = __importStar(require("node:path"));
 const yaml = __importStar(require("js-yaml"));
@@ -112,75 +115,118 @@ function loadTestConfig() {
 /**
  * Check if test config has real values (not placeholders)
  */
-function hasRealConfig(config, section) {
-    if (!config.auth_broker) {
+function hasRealConfigValue(config) {
+    const cfg = config || loadTestConfig();
+    if (!cfg.destination) {
         return false;
     }
-    if (section === 'abap') {
-        const abap = config.auth_broker.abap;
-        if (!abap?.destination) {
-            return false;
-        }
-        // Check if destination is not a placeholder
-        return !abap.destination.includes('<') && !abap.destination.includes('>');
-    }
-    if (section === 'xsuaa') {
-        const xsuaa = config.auth_broker.xsuaa;
-        if (!xsuaa?.btp_destination) {
-            return false;
-        }
-        // Check if values are not placeholders
-        return !xsuaa.btp_destination.includes('<');
-    }
-    return false;
+    // Check if destination is not a placeholder
+    return !cfg.destination.includes('<') && !cfg.destination.includes('>');
 }
 /**
- * Get ABAP destination from config
+ * Get destination from config
  */
-function getAbapDestination(config) {
+function getDestination(config) {
     const cfg = config || loadTestConfig();
-    return cfg.auth_broker?.abap?.destination || null;
+    return cfg.destination || null;
+}
+/**
+ * Get default destination directory based on platform
+ */
+function getDefaultDestinationDir() {
+    const homeDir = process.env.HOME || process.env.USERPROFILE || '';
+    if (process.platform === 'win32') {
+        return path.join(homeDir, 'Documents', 'mcp-abap-adt');
+    }
+    return path.join(homeDir, '.config', 'mcp-abap-adt');
 }
 /**
- * Get XSUAA destinations from config
+ * Get destination directory from config or use default
  */
-function getXsuaaDestinations(config) {
+function getDestinationDir(config) {
     const cfg = config || loadTestConfig();
-    const xsuaa = cfg.auth_broker?.xsuaa;
-    return {
-        btp_destination: xsuaa?.btp_destination || null,
-        mcp_url: xsuaa?.mcp_url || null,
-    };
+    if (cfg.destination_dir) {
+        // Expand ~ to home directory
+        if (cfg.destination_dir.startsWith('~')) {
+            const homeDir = process.env.HOME || process.env.USERPROFILE || '';
+            return cfg.destination_dir.replace('~', homeDir);
+        }
+        return cfg.destination_dir;
+    }
+    return getDefaultDestinationDir();
 }
 /**
  * Get service keys directory from config
- * Expands ~ to home directory
+ * Uses base_dir/service-keys or default platform path
  */
 function getServiceKeysDir(config) {
     const cfg = config || loadTestConfig();
-    const dir = cfg.auth_broker?.paths?.service_keys_dir;
-    if (!dir)
-        return null;
-    // Expand ~ to home directory
-    if (dir.startsWith('~')) {
-        const homeDir = process.env.HOME || process.env.USERPROFILE || '';
-        return dir.replace('~', homeDir);
+    // If service_key_path is specified, return its directory
+    if (cfg.service_key_path) {
+        const projectRoot = findProjectRoot();
+        const fullPath = path.resolve(projectRoot, cfg.service_key_path);
+        return path.dirname(fullPath);
     }
-    return dir;
+    // Use destination_dir/service-keys
+    const destinationDir = getDestinationDir(cfg);
+    return path.join(destinationDir, 'service-keys');
 }
 /**
  * Get sessions directory from config
- * Expands ~ to home directory
+ * Uses base_dir/sessions or default platform path
  */
 function getSessionsDir(config) {
     const cfg = config || loadTestConfig();
-    const dir = cfg.auth_broker?.paths?.sessions_dir;
-    if (!dir)
+    // If session_path is specified, return its directory
+    if (cfg.session_path) {
+        const projectRoot = findProjectRoot();
+        const fullPath = path.resolve(projectRoot, cfg.session_path);
+        return path.dirname(fullPath);
+    }
+    // Use destination_dir/sessions
+    const destinationDir = getDestinationDir(cfg);
+    return path.join(destinationDir, 'sessions');
+}
+/**
+ * Get service key file path
+ * Returns full path to service key file
+ */
+function getServiceKeyPath(config) {
+    const cfg = config || loadTestConfig();
+    const destination = cfg.destination;
+    if (!destination)
+        return null;
+    // If service_key_path is specified, use it
+    if (cfg.service_key_path) {
+        const projectRoot = findProjectRoot();
+        return path.resolve(projectRoot, cfg.service_key_path);
+    }
+    // Construct from directory + destination
+    const serviceKeysDir = getServiceKeysDir(cfg);
+    return path.join(serviceKeysDir, `${destination}.json`);
+}
+/**
+ * Get session file path
+ * Returns full path to session file
+ */
+function getSessionPath(config) {
+    const cfg = config || loadTestConfig();
+    const destination = cfg.destination;
+    if (!destination)
         return null;
-    // Expand ~ to home directory
-    if (dir.startsWith('~')) {
-        const homeDir = process.env.HOME || process.env.USERPROFILE || '';
-        return dir.replace('~', homeDir);
+    // If session_path is specified, use it
+    if (cfg.session_path) {
+        const projectRoot = findProjectRoot();
+        return path.resolve(projectRoot, cfg.session_path);
     }
-    return dir;
+    // Construct from directory + destination
+    const sessionsDir = getSessionsDir(cfg);
+    return path.join(sessionsDir, `${destination}.env`);
+}
+// Legacy functions for backward compatibility
+function getAbapDestination(config) {
+    return getDestination(config);
+}
+function hasRealConfig(config, _section) {
+    return hasRealConfigValue(config);
 }

package/dist/auth/browserAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browserAuth.d.ts","sourceRoot":"","sources":["../../src/auth/browserAuth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAI9E,KAAK,iBAAiB,GAAG,oBAAoB,GAAG;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AA8BF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAa,EACnB,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgDzD;AA6BD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,MAAa,GAClB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+fzD"}
+{"version":3,"file":"browserAuth.d.ts","sourceRoot":"","sources":["../../src/auth/browserAuth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAI9E,KAAK,iBAAiB,GAAG,oBAAoB,GAAG;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AA8BF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAa,EACnB,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgDzD;AA6BD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,MAAa,GAClB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqjBzD"}

package/dist/auth/browserAuth.js

@@ -146,7 +146,9 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
     }
     return new Promise((originalResolve, originalReject) => {
         let timeoutId = null;
+        let finishTimeoutId = null;
         let cleanupDone = false;
+        let resolved = false;
         const app = (0, express_1.default)();
         const server = http.createServer(app);
         // Disable keep-alive to ensure connections close immediately
@@ -164,6 +166,10 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                 clearTimeout(timeoutId);
                 timeoutId = null;
             }
+            if (finishTimeoutId) {
+                clearTimeout(finishTimeoutId);
+                finishTimeoutId = null;
+            }
             if (server) {
                 try {
                     if (typeof server.closeAllConnections === 'function') {
@@ -189,8 +195,17 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
             }
         };
         const resolve = (value) => {
-            if (timeoutId)
+            if (resolved)
+                return; // Prevent double resolution
+            resolved = true;
+            if (timeoutId) {
                 clearTimeout(timeoutId);
+                timeoutId = null;
+            }
+            if (finishTimeoutId) {
+                clearTimeout(finishTimeoutId);
+                finishTimeoutId = null;
+            }
             removeCleanupListeners();
             originalResolve(value);
         };
@@ -212,10 +227,27 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
         }
         // Use provided authorization URL or build from authConfig
         const authorizationUrl = authConfig.authorizationUrl ?? getJwtAuthorizationUrl(authConfig, PORT);
+        log?.info(`[browserAuth] Authorization URL: ${authorizationUrl}`);
+        log?.info(`[browserAuth] Server listening on port: ${PORT}`);
+        // Verify port in redirect_uri matches server port
+        const redirectUriMatch = authorizationUrl.match(/redirect_uri=([^&]+)/);
+        if (redirectUriMatch) {
+            const redirectUri = decodeURIComponent(redirectUriMatch[1]);
+            const urlPortMatch = redirectUri.match(/localhost:(\d+)/);
+            if (urlPortMatch) {
+                const urlPort = parseInt(urlPortMatch[1], 10);
+                if (urlPort !== PORT) {
+                    log?.warn(`[browserAuth] WARNING: Port mismatch! URL has port ${urlPort}, but server listens on ${PORT}`);
+                }
+                else {
+                    log?.info(`[browserAuth] Port match: URL and server both use port ${PORT}`);
+                }
+            }
+        }
         // OAuth2 callback handler
         app.get('/callback', async (req, res) => {
             try {
-                log?.info(`Callback received: ${req.url}`);
+                log?.info(`[browserAuth] Callback received: ${req.url}`);
                 log?.debug(`Callback query: ${JSON.stringify(req.query)}`);
                 // Check for OAuth2 error parameters
                 const { error, error_description, error_uri } = req.query;
@@ -291,13 +323,14 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                     return reject(new Error(`OAuth2 authentication failed: ${errorMsg}${error_uri ? ` (${error_uri})` : ''}`));
                 }
                 const { code } = req.query;
+                log?.info(`[browserAuth] Callback code received: ${code ? 'yes' : 'no'}`);
                 log?.debug(`Callback code received: ${code ? 'yes' : 'no'}`);
                 if (!code || typeof code !== 'string') {
-                    log?.error(`Callback code missing`);
+                    log?.error(`[browserAuth] Callback code missing`);
                     res.status(400).send('Error: Authorization code missing');
                     return reject(new Error('Authorization code missing'));
                 }
-                log?.debug(`Exchanging code for token`);
+                log?.info(`[browserAuth] Exchanging code for token...`);
                 // Send success page
                 const html = `<!DOCTYPE html>
 <html lang="en">
@@ -356,37 +389,45 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
     </div>
 </body>
 </html>`;
-                // Send success page first and ensure response is finished
-                res.send(html);
-                // Wait for response to finish before closing server
-                res.on('finish', () => {
-                    // Response finished, now we can safely close server
-                });
-                // Exchange code for tokens and close server
+                // Exchange code for tokens first
                 try {
+                    log?.info(`[browserAuth] Starting token exchange...`);
                     const tokens = await exchangeCodeForToken(authConfig, code, PORT, log);
-                    log?.info(`Tokens received: accessToken(${tokens.accessToken?.length || 0} chars), refreshToken(${tokens.refreshToken?.length || 0} chars)`);
-                    // Close all connections first to ensure port is freed
-                    if (typeof server.closeAllConnections === 'function') {
-                        server.closeAllConnections();
-                    }
-                    // Close server after response is finished
-                    // This ensures the response connection is closed before server.close()
-                    const closeServer = () => {
+                    log?.info(`[browserAuth] Tokens received: accessToken(${tokens.accessToken?.length || 0} chars), refreshToken(${tokens.refreshToken?.length || 0} chars)`);
+                    // Send success page (non-blocking, doesn't affect promise)
+                    res.send(html);
+                    log?.info(`[browserAuth] Response sent, waiting for finish...`);
+                    // Close all connections and server after response is sent
+                    // Resolve promise AFTER server is closed to prevent Jest from hanging
+                    let serverClosing = false;
+                    const closeServerAndResolve = () => {
+                        if (serverClosing)
+                            return; // Prevent double execution
+                        serverClosing = true;
+                        if (finishTimeoutId) {
+                            clearTimeout(finishTimeoutId);
+                            finishTimeoutId = null;
+                        }
+                        log?.info(`[browserAuth] Response finished, closing server...`);
+                        if (typeof server.closeAllConnections === 'function') {
+                            server.closeAllConnections();
+                        }
+                        // Wait for server to close before resolving to prevent Jest from hanging
                         server.close(() => {
                             // Server closed - port should be freed
-                            log?.debug(`Server closed, port ${PORT} should be freed`);
+                            log?.info(`[browserAuth] Server closed, port ${PORT} should be freed`);
+                            // Resolve after server is fully closed
+                            log?.info(`[browserAuth] Resolving promise with tokens...`);
+                            resolve({
+                                accessToken: tokens.accessToken,
+                                refreshToken: tokens.refreshToken,
+                            });
                         });
                     };
-                    if (res.finished) {
-                        // Response already finished, close immediately
-                        closeServer();
-                    }
-                    else {
-                        // Wait for response to finish
-                        res.once('finish', closeServer);
-                    }
-                    resolve(tokens);
+                    // Wait for response to finish, but add timeout to prevent hanging
+                    res.once('finish', closeServerAndResolve);
+                    // Fallback: if finish event doesn't fire within 1 second, close anyway
+                    finishTimeoutId = setTimeout(closeServerAndResolve, 1000);
                 }
                 catch (error) {
                     if (typeof server.closeAllConnections === 'function') {
@@ -429,6 +470,7 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
             }
         });
         serverInstance = server.listen(PORT, async () => {
+            log?.info(`[browserAuth] Server started on port ${PORT}`);
             const browserApp = BROWSER_MAP[browser];
             // Handle 'none' and 'headless' modes - log URL and wait for callback
             // (for SSH/remote sessions or when browser should not be opened)
@@ -554,7 +596,7 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                 }
             }
         });
-        // Timeout after 5 minutes
+        // Timeout after 30 seconds to prevent blocking consumer
         timeoutId = setTimeout(() => {
             if (serverInstance) {
                 if (typeof server.closeAllConnections === 'function') {
@@ -567,8 +609,8 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                         log?.debug(`Server closed on timeout, port ${PORT} should be freed`);
                     });
                 }, 100);
-                reject(new Error('Authentication timeout. Process aborted.'));
+                reject(new Error('Authentication timeout after 30 seconds. Please try again.'));
             }
-        }, 5 * 60 * 1000);
+        }, 30 * 1000);
     });
 }

package/dist/providers/AuthorizationCodeProvider.d.ts

@@ -4,7 +4,7 @@
  * Uses authorization_code grant type with browser-based OAuth2 flow.
  * Supports pre-built authorization URLs and automatic refresh.
  */
-import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface AuthorizationCodeProviderConfig {
     uaaUrl: string;
@@ -15,6 +15,7 @@ export interface AuthorizationCodeProviderConfig {
     redirectPort?: number;
     accessToken?: string;
     refreshToken?: string;
+    logger?: ILogger;
 }
 /**
  * Authorization Code token provider

package/dist/providers/AuthorizationCodeProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationCodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/AuthorizationCodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAEV,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAE9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAGrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IAkC7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAmCrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA2BxD"}
+{"version":3,"file":"AuthorizationCodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/AuthorizationCodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAEV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAE9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAGrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IA8D7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cA2ErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA0CxD"}

package/dist/providers/AuthorizationCodeProvider.js

@@ -22,6 +22,17 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
     constructor(config) {
         super();
         this.config = config;
+        this.logger = config.logger;
+        this.logger?.info('[AuthorizationCodeProvider] Provider created', {
+            uaaUrl: config.uaaUrl,
+            clientId: config.clientId,
+            hasAccessToken: !!config.accessToken,
+            hasRefreshToken: !!config.refreshToken,
+            accessToken: this.formatToken(config.accessToken),
+            refreshToken: this.formatToken(config.refreshToken),
+            browser: config.browser || 'none',
+            redirectPort: config.redirectPort || 3001,
+        });
         const missingFields = [];
         if (!config.uaaUrl) {
             missingFields.push('uaaUrl');
@@ -43,9 +54,19 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
             this.authorizationToken = config.accessToken;
             // Parse expiration from JWT
             this.expiresAt = this.parseExpirationFromJWT(config.accessToken);
+            this.logger?.info('[AuthorizationCodeProvider] Initialized with access token', {
+                accessToken: this.formatToken(config.accessToken),
+                hasExpiresAt: !!this.expiresAt,
+                expiresAt: this.expiresAt
+                    ? this.formatExpirationDate(this.expiresAt)
+                    : undefined,
+            });
         }
         if (config.refreshToken) {
             this.refreshToken = config.refreshToken;
+            this.logger?.info('[AuthorizationCodeProvider] Initialized with refresh token', {
+                refreshToken: this.formatToken(config.refreshToken),
+            });
         }
     }
     async getTokens() {
@@ -68,8 +89,36 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
         }
         // Use provided browser or default to 'none' (prints URL to console)
         const browser = this.config.browser || 'none';
-        const result = await (0, browserAuth_1.startBrowserAuth)(authConfig, browser, undefined, // logger
-        this.config.redirectPort || 3001);
+        const redirectPort = this.config.redirectPort || 3001;
+        // Build authorization URL for logging (same logic as in startBrowserAuth)
+        const authorizationUrl = authConfig.authorizationUrl ??
+            `${authConfig.uaaUrl}/oauth/authorize?client_id=${encodeURIComponent(authConfig.uaaClientId)}&redirect_uri=${encodeURIComponent(`http://localhost:${redirectPort}/callback`)}&response_type=code`;
+        this.logger?.info('[AuthorizationCodeProvider] Performing login via browser', {
+            browser,
+            redirectPort,
+            authorizationUrl,
+            uaaUrl: authConfig.uaaUrl,
+            clientId: authConfig.uaaClientId,
+        });
+        // Wrap startBrowserAuth with timeout
+        const timeoutMs = 30 * 1000; // 30 seconds
+        const timeoutPromise = new Promise((_, reject) => {
+            setTimeout(() => {
+                reject(new Error(`Authentication timeout after ${timeoutMs / 1000} seconds. Please try again.`));
+            }, timeoutMs);
+        });
+        const result = await Promise.race([
+            (0, browserAuth_1.startBrowserAuth)(authConfig, browser, this.logger || undefined, // Pass logger to browserAuth
+            redirectPort),
+            timeoutPromise,
+        ]);
+        this.logger?.info('[AuthorizationCodeProvider] Login completed', {
+            hasAccessToken: !!result.accessToken,
+            hasRefreshToken: !!result.refreshToken,
+            accessToken: this.formatToken(result.accessToken),
+            refreshToken: this.formatToken(result.refreshToken),
+            accessTokenLength: result.accessToken?.length || 0,
+        });
         // Parse expiration from JWT
         const expiresIn = this.calculateExpiresIn(result.accessToken);
         return {
@@ -83,9 +132,17 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
         if (!this.refreshToken) {
             throw new Error('Refresh token is required for refresh');
         }
+        this.logger?.info('[AuthorizationCodeProvider] Refreshing token');
         // Try refresh first
         try {
             const result = await (0, tokenRefresher_1.refreshJwtToken)(this.refreshToken, this.config.uaaUrl, this.config.clientId, this.config.clientSecret);
+            this.logger?.info('[AuthorizationCodeProvider] Token refresh completed', {
+                hasAccessToken: !!result.accessToken,
+                hasRefreshToken: !!result.refreshToken,
+                newAccessToken: this.formatToken(result.accessToken),
+                newRefreshToken: this.formatToken(result.refreshToken),
+                oldRefreshToken: this.formatToken(this.refreshToken),
+            });
             const expiresIn = this.calculateExpiresIn(result.accessToken);
             return {
                 authorizationToken: result.accessToken,
@@ -94,7 +151,10 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
                 expiresIn,
             };
         }
-        catch (_error) {
+        catch (error) {
+            this.logger?.warn('[AuthorizationCodeProvider] Token refresh failed, falling back to login', {
+                error: error instanceof Error ? error.message : String(error),
+            });
             // Refresh failed - try login (will use uaaUrl + clientId to build URL)
             return await this.performLogin();
         }

package/dist/providers/BaseTokenProvider.d.ts

@@ -7,7 +7,7 @@
  * - Expiration checking
  * - Automatic refresh/relogin
  */
-import type { ITokenProvider, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ILogger, ITokenProvider, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
 /**
  * Abstract base class for token providers
  *
@@ -21,6 +21,17 @@ export declare abstract class BaseTokenProvider implements ITokenProvider {
     protected authorizationToken?: string;
     protected refreshToken?: string;
     protected expiresAt?: number;
+    protected logger?: ILogger;
+    /**
+     * Format timestamp to readable date/time string
+     * @param timestamp Timestamp in milliseconds
+     * @returns Formatted date string (e.g., "2025-12-25 19:21:27 UTC")
+     */
+    protected formatExpirationDate(timestamp: number): string;
+    /**
+     * Format token for logging (start...end)
+     */
+    protected formatToken(token?: string): string | undefined;
     /**
      * Check if current token is valid (not expired)
      * @returns true if token exists and is not expired, false otherwise

package/dist/providers/BaseTokenProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseTokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/BaseTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;GAQG;AACH,8BAAsB,iBAAkB,YAAW,cAAc;IAC/D,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAE7B;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IASjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAExD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAE1D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;IAEjD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAqClC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAS3E;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAWlD;;;;OAIG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IA0BnE;;;;OAIG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAShE"}
+{"version":3,"file":"BaseTokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/BaseTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;GAQG;AACH,8BAAsB,iBAAkB,YAAW,cAAc;IAC/D,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWzD;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMzD;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IAyBjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAExD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAE1D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;IAEjD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAuElC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB3E;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAoBlD;;;;OAIG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IA0BnE;;;;OAIG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAShE"}

package/dist/providers/BaseTokenProvider.js

@@ -23,17 +23,56 @@ class BaseTokenProvider {
     authorizationToken;
     refreshToken;
     expiresAt; // timestamp in milliseconds
+    logger;
+    /**
+     * Format timestamp to readable date/time string
+     * @param timestamp Timestamp in milliseconds
+     * @returns Formatted date string (e.g., "2025-12-25 19:21:27 UTC")
+     */
+    formatExpirationDate(timestamp) {
+        const date = new Date(timestamp);
+        const year = date.getUTCFullYear();
+        const month = String(date.getUTCMonth() + 1).padStart(2, '0');
+        const day = String(date.getUTCDate()).padStart(2, '0');
+        const hours = String(date.getUTCHours()).padStart(2, '0');
+        const minutes = String(date.getUTCMinutes()).padStart(2, '0');
+        const seconds = String(date.getUTCSeconds()).padStart(2, '0');
+        return `${year}-${month}-${day} ${hours}:${minutes}:${seconds} UTC`;
+    }
+    /**
+     * Format token for logging (start...end)
+     */
+    formatToken(token) {
+        if (!token)
+            return undefined;
+        if (token.length <= 50)
+            return token;
+        return `${token.substring(0, 25)}...${token.substring(token.length - 25)}`;
+    }
     /**
      * Check if current token is valid (not expired)
      * @returns true if token exists and is not expired, false otherwise
      */
     isTokenValid() {
         if (!this.authorizationToken || !this.expiresAt) {
+            this.logger?.debug('[BaseTokenProvider] Token invalid: missing token or expiration', {
+                hasToken: !!this.authorizationToken,
+                hasExpiresAt: !!this.expiresAt,
+            });
             return false;
         }
         // Add 60 second buffer to account for clock skew and network latency
         const bufferMs = 60 * 1000;
-        return Date.now() < this.expiresAt - bufferMs;
+        const now = Date.now();
+        const isValid = now < this.expiresAt - bufferMs;
+        this.logger?.debug('[BaseTokenProvider] Token validation check', {
+            now: this.formatExpirationDate(now),
+            expiresAt: this.formatExpirationDate(this.expiresAt),
+            expiresIn: Math.floor((this.expiresAt - now) / 1000),
+            isValid,
+            bufferMs,
+        });
+        return isValid;
     }
     /**
      * Main method - handles token lifecycle
@@ -45,12 +84,25 @@ class BaseTokenProvider {
      * @returns Promise that resolves to token result
      */
     async getTokens() {
+        this.logger?.debug('[BaseTokenProvider] getTokens called', {
+            hasToken: !!this.authorizationToken,
+            hasExpiresAt: !!this.expiresAt,
+            hasRefreshToken: !!this.refreshToken,
+            currentToken: this.formatToken(this.authorizationToken),
+        });
         // If token is valid, return cached
-        if (this.isTokenValid()) {
+        const isValid = this.isTokenValid();
+        if (isValid) {
             const authorizationToken = this.authorizationToken;
             if (!authorizationToken) {
                 throw new Error('Authorization token is missing.');
             }
+            this.logger?.info('[BaseTokenProvider] Returning cached valid token', {
+                token: this.formatToken(authorizationToken),
+                expiresIn: this.expiresAt
+                    ? Math.floor((this.expiresAt - Date.now()) / 1000)
+                    : undefined,
+            });
             return {
                 authorizationToken,
                 refreshToken: this.refreshToken,
@@ -62,12 +114,23 @@ class BaseTokenProvider {
         }
         // Try refresh if we have refresh token
         if (this.refreshToken) {
+            this.logger?.info('[BaseTokenProvider] Token invalid, attempting refresh', {
+                oldToken: this.formatToken(this.authorizationToken),
+                refreshToken: this.formatToken(this.refreshToken),
+            });
             try {
                 const result = await this.performRefresh();
                 this.updateTokens(result);
+                this.logger?.info('[BaseTokenProvider] Token refreshed successfully', {
+                    newToken: this.formatToken(result.authorizationToken),
+                    newRefreshToken: this.formatToken(result.refreshToken),
+                });
                 return result;
             }
-            catch (_error) {
+            catch (error) {
+                this.logger?.warn('[BaseTokenProvider] Refresh failed', {
+                    error: error instanceof Error ? error.message : String(error),
+                });
                 // Refresh failed - need to login
                 // Clear refresh token as it's invalid
                 this.refreshToken = undefined;
@@ -75,23 +138,37 @@ class BaseTokenProvider {
             }
         }
         // Perform login
+        this.logger?.info('[BaseTokenProvider] Token invalid and no refresh token, performing login');
         const result = await this.performLogin();
         this.updateTokens(result);
+        this.logger?.info('[BaseTokenProvider] Login completed', {
+            newToken: this.formatToken(result.authorizationToken),
+            newRefreshToken: this.formatToken(result.refreshToken),
+        });
         return result;
     }
     async validateToken(_token, _serviceUrl) {
+        this.logger?.debug('[BaseTokenProvider] Validating token');
         const expiresAt = this.parseExpirationFromJWT(_token);
         if (!expiresAt) {
+            this.logger?.warn('[BaseTokenProvider] Token validation failed: cannot parse expiration');
             return false;
         }
         const bufferMs = 60 * 1000;
-        return Date.now() < expiresAt - bufferMs;
+        const isValid = Date.now() < expiresAt - bufferMs;
+        this.logger?.info('[BaseTokenProvider] Token validation result', {
+            isValid,
+            expiresAt: this.formatExpirationDate(expiresAt),
+            expiresIn: Math.floor((expiresAt - Date.now()) / 1000),
+        });
+        return isValid;
     }
     /**
      * Update internal token cache from result
      * @param result Token result to cache
      */
     updateTokens(result) {
+        const oldToken = this.formatToken(this.authorizationToken);
         this.authorizationToken = result.authorizationToken;
         this.refreshToken = result.refreshToken;
         if (result.expiresIn) {
@@ -101,6 +178,14 @@ class BaseTokenProvider {
             // Try to parse expiration from JWT if expiresIn not provided
             this.expiresAt = this.parseExpirationFromJWT(result.authorizationToken);
         }
+        this.logger?.info('[BaseTokenProvider] Tokens updated', {
+            oldToken,
+            newToken: this.formatToken(result.authorizationToken),
+            newRefreshToken: this.formatToken(result.refreshToken),
+            expiresAt: this.expiresAt
+                ? this.formatExpirationDate(this.expiresAt)
+                : undefined,
+        });
     }
     /**
      * Parse expiration time from JWT token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "0.2.7",
+  "version": "0.2.9",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",