@mcp-abap-adt/auth-providers 0.2.8 → 0.2.10

package/CHANGELOG.md

@@ -7,6 +7,62 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.10] - 2025-12-25
+
+### Changed
+- **Logging Improvements**: Enhanced logging for better debugging and readability
+  - **Date Formatting**: Expiration dates now displayed in readable format (`YYYY-MM-DD HH:MM:SS UTC`) instead of ISO format (`2025-12-25T11:08:15.000Z`)
+  - **Token Formatting**: Tokens are logged in truncated format (start...end) for security and readability
+  - **Browser Information**: Added logging of browser type and authorization URL before starting browser authentication
+  - **Token Lifecycle**: Improved logging of token acquisition, validation, and refresh operations with formatted dates
+  - **Structured Logging**: Replaced `console.log/info/warn/error` with `DefaultLogger` from `@mcp-abap-adt/logger` in test helpers
+    - Proper formatting with icons and level prefixes (ℹ️, 🐛, ⚠️, ❌)
+    - Respects `LOG_LEVEL` or `AUTH_LOG_LEVEL` environment variable
+    - Consistent logging format across all packages
+  - **Environment Variable Names**: Added short names for debug flags (backward compatible)
+    - `DEBUG_PROVIDER=true` (short) or `DEBUG_AUTH_PROVIDERS=true` (long)
+    - Both names are supported for backward compatibility
+
+### Added
+- **Browser Auth Timeout**: Added 30-second timeout for browser-based authentication
+  - Prevents provider from blocking consumer indefinitely when user doesn't complete authentication
+  - Timeout error is thrown if authentication is not completed within 30 seconds
+  - Helps prevent hanging in automated tests and CI/CD environments
+- **Logger Package Dependency**: Added `@mcp-abap-adt/logger` to devDependencies
+  - Required for `DefaultLogger` and `getLogLevel()` utilities in test helpers
+  - Added `pino` and `pino-pretty` to devDependencies to support PinoLogger initialization
+
+### Fixed
+- **Test Hanging Issues**: Fixed Jest tests hanging after completion
+  - Added `forceExit: true` to Jest configuration to force exit after tests complete
+  - Improved cleanup of HTTP server and timers to prevent open handles
+  - Added protection against double execution of server close handlers
+  - Proper cleanup of `finishTimeoutId` timer in all scenarios (success, error, timeout)
+  - Server now resolves promise only after fully closing to ensure Jest can exit cleanly
+
+## [0.2.9] - 2025-12-25
+
+### Changed
+- **Logging Improvements**: Enhanced logging for better debugging and readability
+  - **Date Formatting**: Expiration dates now displayed in readable format (`YYYY-MM-DD HH:MM:SS UTC`) instead of ISO format (`2025-12-25T11:08:15.000Z`)
+  - **Token Formatting**: Tokens are logged in truncated format (start...end) for security and readability
+  - **Browser Information**: Added logging of browser type and authorization URL before starting browser authentication
+  - **Token Lifecycle**: Improved logging of token acquisition, validation, and refresh operations with formatted dates
+
+### Added
+- **Browser Auth Timeout**: Added 30-second timeout for browser-based authentication
+  - Prevents provider from blocking consumer indefinitely when user doesn't complete authentication
+  - Timeout error is thrown if authentication is not completed within 30 seconds
+  - Helps prevent hanging in automated tests and CI/CD environments
+
+### Fixed
+- **Test Hanging Issues**: Fixed Jest tests hanging after completion
+  - Added `forceExit: true` to Jest configuration to force exit after tests complete
+  - Improved cleanup of HTTP server and timers to prevent open handles
+  - Added protection against double execution of server close handlers
+  - Proper cleanup of `finishTimeoutId` timer in all scenarios (success, error, timeout)
+  - Server now resolves promise only after fully closing to ensure Jest can exit cleanly
+
 ## [0.2.8] - 2025-12-24
 
 ### Changed

package/README.md

@@ -207,7 +207,9 @@ const result = await provider.getTokens();
 // result.refreshToken is undefined (client_credentials doesn't provide refresh tokens)
 ```
 
-**Note**: The `browserAuthPort` parameter (default: 3001) configures the OAuth callback server port. If the requested port is already in use, an error will be thrown. You must specify a different port or free the port before starting authentication. The server properly closes all connections and frees the port after authentication completes, ensuring no lingering port occupation. 
+**Note**: The `browserAuthPort` parameter (default: 3001) configures the OAuth callback server port. If the requested port is already in use, an error will be thrown. You must specify a different port or free the port before starting authentication. The server properly closes all connections and frees the port after authentication completes, ensuring no lingering port occupation.
+
+**Timeout**: Browser authentication has a 30-second timeout to prevent blocking the consumer. If authentication is not completed within 30 seconds, the operation will fail with a timeout error. This prevents the provider from hanging indefinitely when the user doesn't complete authentication. 
 
 **Process Termination Handling**: The OAuth callback server registers cleanup handlers for `SIGTERM`, `SIGINT`, `SIGHUP`, and `exit` signals. This ensures ports are properly freed even when MCP clients (like Cline) terminate the process before authentication completes. This is especially important for stdio servers where the client may kill the process at any time. On Windows, the `SIGBREAK` signal (Ctrl+Break) is also handled.
 
@@ -368,9 +370,20 @@ Integration tests will skip if `test-config.yaml` is not configured or contains
 To enable detailed logging during tests or runtime, set environment variables:
 
 ```bash
-# Enable logging for auth providers
+# Enable logging for auth providers (short name)
 DEBUG_PROVIDER=true npm test
 
+# Or use long name (backward compatibility)
+DEBUG_AUTH_PROVIDERS=true npm test
+
+# Or enable via general DEBUG variable
+DEBUG=true npm test
+
+# Or include in DEBUG list
+DEBUG=provider npm test
+# Or
+DEBUG=auth-providers npm test
+
 # Set log level (debug, info, warn, error)
 LOG_LEVEL=debug npm test
 ```
@@ -385,9 +398,17 @@ Example output:
 ```
 [INFO] ℹ️ [browserAuth] Exchanging code for token...
 [INFO] ℹ️ Tokens received: accessToken(2263 chars), refreshToken(34 chars)
-[DEBUG] 🐛 [BaseTokenProvider] Token validation check {"expiresAt":"2025-12-25T11:08:15.000Z","isValid":true}
+[DEBUG] 🐛 [BaseTokenProvider] Token validation check {"expiresAt":"2025-12-25 11:08:15 UTC","isValid":true}
+[INFO] ℹ️ [browserAuth] Authorization URL: https://.../oauth/authorize?...
+[INFO] ℹ️ [browserAuth] Browser: system
 ```
 
+**Logging Features**:
+- **Token Formatting**: Tokens are logged in truncated format (start...end) for security
+- **Date Formatting**: Expiration dates are displayed in readable format (YYYY-MM-DD HH:MM:SS UTC) instead of ISO format
+- **Browser Information**: Logs browser type and authorization URL for debugging
+- **Token Lifecycle**: Detailed logging of token acquisition, validation, and refresh operations
+
 ## Dependencies
 
 - `@mcp-abap-adt/interfaces` (^0.2.2) - Interface definitions and error code constants

package/dist/__tests__/helpers/testLogger.d.ts

@@ -1,5 +1,6 @@
 /**
  * Test logger with environment variable control
+ * Uses DefaultLogger from @mcp-abap-adt/logger for proper formatting
  */
 import type { ILogger } from '@mcp-abap-adt/interfaces';
 export declare function createTestLogger(prefix?: string): ILogger;

package/dist/__tests__/helpers/testLogger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"testLogger.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/testLogger.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAgBxD,wBAAgB,gBAAgB,CAAC,MAAM,GAAE,MAAe,GAAG,OAAO,CA6BjE"}
+{"version":3,"file":"testLogger.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/testLogger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAGxD,wBAAgB,gBAAgB,CAAC,MAAM,GAAE,MAAe,GAAG,OAAO,CAwCjE"}

package/dist/__tests__/helpers/testLogger.js

@@ -1,43 +1,44 @@
 "use strict";
 /**
  * Test logger with environment variable control
+ * Uses DefaultLogger from @mcp-abap-adt/logger for proper formatting
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createTestLogger = createTestLogger;
-function getLogLevel() {
-    const level = process.env.LOG_LEVEL?.toLowerCase() || 'info';
-    const levels = ['debug', 'info', 'warn', 'error'];
-    return levels.includes(level) ? level : 'info';
-}
-function shouldLog(level) {
-    const currentLevel = getLogLevel();
-    const levels = ['debug', 'info', 'warn', 'error'];
-    return levels.indexOf(level) >= levels.indexOf(currentLevel);
-}
+const logger_1 = require("@mcp-abap-adt/logger");
 function createTestLogger(prefix = 'TEST') {
-    const level = getLogLevel();
-    const enabled = process.env.DEBUG_AUTH_PROVIDERS === 'true' ||
-        process.env.DEBUG_BROWSER_AUTH === 'true' ||
-        process.env.DEBUG === 'true';
+    // Check if logging is enabled
+    const isEnabled = () => {
+        return (process.env.DEBUG_PROVIDER === 'true' ||
+            process.env.DEBUG_AUTH_PROVIDERS === 'true' ||
+            process.env.DEBUG_BROWSER_AUTH === 'true' ||
+            process.env.DEBUG === 'true' ||
+            process.env.DEBUG?.includes('provider') === true ||
+            process.env.DEBUG?.includes('auth-providers') === true);
+    };
+    // Create DefaultLogger with appropriate log level
+    // getLogLevel respects AUTH_LOG_LEVEL env var and defaults to INFO
+    const baseLogger = new logger_1.DefaultLogger((0, logger_1.getLogLevel)());
+    // Return wrapper that checks if logging is enabled
     return {
         debug: (message, meta) => {
-            if (enabled && shouldLog('debug')) {
-                console.debug(`[${prefix}] [DEBUG] ${message}`, meta || '');
+            if (isEnabled()) {
+                baseLogger.debug(`[${prefix}] ${message}`, meta);
             }
         },
         info: (message, meta) => {
-            if (enabled && shouldLog('info')) {
-                console.info(`[${prefix}] ${message}`, meta || '');
+            if (isEnabled()) {
+                baseLogger.info(`[${prefix}] ${message}`, meta);
             }
         },
         warn: (message, meta) => {
-            if (enabled && shouldLog('warn')) {
-                console.warn(`[${prefix}] [WARN] ${message}`, meta || '');
+            if (isEnabled()) {
+                baseLogger.warn(`[${prefix}] ${message}`, meta);
             }
         },
         error: (message, meta) => {
-            if (enabled && shouldLog('error')) {
-                console.error(`[${prefix}] [ERROR] ${message}`, meta || '');
+            if (isEnabled()) {
+                baseLogger.error(`[${prefix}] ${message}`, meta);
             }
         },
     };

package/dist/auth/browserAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browserAuth.d.ts","sourceRoot":"","sources":["../../src/auth/browserAuth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAI9E,KAAK,iBAAiB,GAAG,oBAAoB,GAAG;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AA8BF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAa,EACnB,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgDzD;AA6BD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,MAAa,GAClB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAihBzD"}
+{"version":3,"file":"browserAuth.d.ts","sourceRoot":"","sources":["../../src/auth/browserAuth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAI9E,KAAK,iBAAiB,GAAG,oBAAoB,GAAG;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AA8BF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAa,EACnB,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgDzD;AA6BD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,MAAa,GAClB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqjBzD"}

package/dist/auth/browserAuth.js

@@ -146,7 +146,9 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
     }
     return new Promise((originalResolve, originalReject) => {
         let timeoutId = null;
+        let finishTimeoutId = null;
         let cleanupDone = false;
+        let resolved = false;
         const app = (0, express_1.default)();
         const server = http.createServer(app);
         // Disable keep-alive to ensure connections close immediately
@@ -164,6 +166,10 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                 clearTimeout(timeoutId);
                 timeoutId = null;
             }
+            if (finishTimeoutId) {
+                clearTimeout(finishTimeoutId);
+                finishTimeoutId = null;
+            }
             if (server) {
                 try {
                     if (typeof server.closeAllConnections === 'function') {
@@ -189,8 +195,17 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
             }
         };
         const resolve = (value) => {
-            if (timeoutId)
+            if (resolved)
+                return; // Prevent double resolution
+            resolved = true;
+            if (timeoutId) {
                 clearTimeout(timeoutId);
+                timeoutId = null;
+            }
+            if (finishTimeoutId) {
+                clearTimeout(finishTimeoutId);
+                finishTimeoutId = null;
+            }
             removeCleanupListeners();
             originalResolve(value);
         };
@@ -379,24 +394,40 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                     log?.info(`[browserAuth] Starting token exchange...`);
                     const tokens = await exchangeCodeForToken(authConfig, code, PORT, log);
                     log?.info(`[browserAuth] Tokens received: accessToken(${tokens.accessToken?.length || 0} chars), refreshToken(${tokens.refreshToken?.length || 0} chars)`);
-                    // Resolve promise FIRST - this allows test to continue immediately
-                    log?.info(`[browserAuth] Resolving promise with tokens...`);
-                    resolve(tokens);
-                    log?.info(`[browserAuth] Promise resolved, sending response...`);
                     // Send success page (non-blocking, doesn't affect promise)
                     res.send(html);
                     log?.info(`[browserAuth] Response sent, waiting for finish...`);
                     // Close all connections and server after response is sent
-                    res.once('finish', () => {
+                    // Resolve promise AFTER server is closed to prevent Jest from hanging
+                    let serverClosing = false;
+                    const closeServerAndResolve = () => {
+                        if (serverClosing)
+                            return; // Prevent double execution
+                        serverClosing = true;
+                        if (finishTimeoutId) {
+                            clearTimeout(finishTimeoutId);
+                            finishTimeoutId = null;
+                        }
                         log?.info(`[browserAuth] Response finished, closing server...`);
                         if (typeof server.closeAllConnections === 'function') {
                             server.closeAllConnections();
                         }
+                        // Wait for server to close before resolving to prevent Jest from hanging
                         server.close(() => {
                             // Server closed - port should be freed
                             log?.info(`[browserAuth] Server closed, port ${PORT} should be freed`);
+                            // Resolve after server is fully closed
+                            log?.info(`[browserAuth] Resolving promise with tokens...`);
+                            resolve({
+                                accessToken: tokens.accessToken,
+                                refreshToken: tokens.refreshToken,
+                            });
                         });
-                    });
+                    };
+                    // Wait for response to finish, but add timeout to prevent hanging
+                    res.once('finish', closeServerAndResolve);
+                    // Fallback: if finish event doesn't fire within 1 second, close anyway
+                    finishTimeoutId = setTimeout(closeServerAndResolve, 1000);
                 }
                 catch (error) {
                     if (typeof server.closeAllConnections === 'function') {
@@ -565,7 +596,7 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                 }
             }
         });
-        // Timeout after 5 minutes
+        // Timeout after 30 seconds to prevent blocking consumer
         timeoutId = setTimeout(() => {
             if (serverInstance) {
                 if (typeof server.closeAllConnections === 'function') {
@@ -578,8 +609,8 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                         log?.debug(`Server closed on timeout, port ${PORT} should be freed`);
                     });
                 }, 100);
-                reject(new Error('Authentication timeout. Process aborted.'));
+                reject(new Error('Authentication timeout after 30 seconds. Please try again.'));
             }
-        }, 5 * 60 * 1000);
+        }, 30 * 1000);
     });
 }

package/dist/providers/AuthorizationCodeProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationCodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/AuthorizationCodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAEV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAE9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAGrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IAuD7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cA+CrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAsCxD"}
+{"version":3,"file":"AuthorizationCodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/AuthorizationCodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAEV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAE9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAGrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IA8D7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cA2ErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA0CxD"}

package/dist/providers/AuthorizationCodeProvider.js

@@ -28,6 +28,8 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
             clientId: config.clientId,
             hasAccessToken: !!config.accessToken,
             hasRefreshToken: !!config.refreshToken,
+            accessToken: this.formatToken(config.accessToken),
+            refreshToken: this.formatToken(config.refreshToken),
             browser: config.browser || 'none',
             redirectPort: config.redirectPort || 3001,
         });
@@ -53,15 +55,18 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
             // Parse expiration from JWT
             this.expiresAt = this.parseExpirationFromJWT(config.accessToken);
             this.logger?.info('[AuthorizationCodeProvider] Initialized with access token', {
+                accessToken: this.formatToken(config.accessToken),
                 hasExpiresAt: !!this.expiresAt,
                 expiresAt: this.expiresAt
-                    ? new Date(this.expiresAt).toISOString()
+                    ? this.formatExpirationDate(this.expiresAt)
                     : undefined,
             });
         }
         if (config.refreshToken) {
             this.refreshToken = config.refreshToken;
-            this.logger?.info('[AuthorizationCodeProvider] Initialized with refresh token');
+            this.logger?.info('[AuthorizationCodeProvider] Initialized with refresh token', {
+                refreshToken: this.formatToken(config.refreshToken),
+            });
         }
     }
     async getTokens() {
@@ -71,10 +76,6 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE;
     }
     async performLogin() {
-        this.logger?.info('[AuthorizationCodeProvider] Performing login via browser', {
-            redirectPort: this.config.redirectPort || 3001,
-            browser: this.config.browser || 'none',
-        });
         // Build authorization config
         // If authorizationUrl is provided, use it; otherwise startBrowserAuth will build it from uaaUrl + clientId
         const authConfig = {
@@ -88,11 +89,34 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
         }
         // Use provided browser or default to 'none' (prints URL to console)
         const browser = this.config.browser || 'none';
-        const result = await (0, browserAuth_1.startBrowserAuth)(authConfig, browser, this.logger || undefined, // Pass logger to browserAuth
-        this.config.redirectPort || 3001);
+        const redirectPort = this.config.redirectPort || 3001;
+        // Build authorization URL for logging (same logic as in startBrowserAuth)
+        const authorizationUrl = authConfig.authorizationUrl ??
+            `${authConfig.uaaUrl}/oauth/authorize?client_id=${encodeURIComponent(authConfig.uaaClientId)}&redirect_uri=${encodeURIComponent(`http://localhost:${redirectPort}/callback`)}&response_type=code`;
+        this.logger?.info('[AuthorizationCodeProvider] Performing login via browser', {
+            browser,
+            redirectPort,
+            authorizationUrl,
+            uaaUrl: authConfig.uaaUrl,
+            clientId: authConfig.uaaClientId,
+        });
+        // Wrap startBrowserAuth with timeout
+        const timeoutMs = 30 * 1000; // 30 seconds
+        const timeoutPromise = new Promise((_, reject) => {
+            setTimeout(() => {
+                reject(new Error(`Authentication timeout after ${timeoutMs / 1000} seconds. Please try again.`));
+            }, timeoutMs);
+        });
+        const result = await Promise.race([
+            (0, browserAuth_1.startBrowserAuth)(authConfig, browser, this.logger || undefined, // Pass logger to browserAuth
+            redirectPort),
+            timeoutPromise,
+        ]);
         this.logger?.info('[AuthorizationCodeProvider] Login completed', {
             hasAccessToken: !!result.accessToken,
             hasRefreshToken: !!result.refreshToken,
+            accessToken: this.formatToken(result.accessToken),
+            refreshToken: this.formatToken(result.refreshToken),
             accessTokenLength: result.accessToken?.length || 0,
         });
         // Parse expiration from JWT
@@ -115,6 +139,9 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
             this.logger?.info('[AuthorizationCodeProvider] Token refresh completed', {
                 hasAccessToken: !!result.accessToken,
                 hasRefreshToken: !!result.refreshToken,
+                newAccessToken: this.formatToken(result.accessToken),
+                newRefreshToken: this.formatToken(result.refreshToken),
+                oldRefreshToken: this.formatToken(this.refreshToken),
             });
             const expiresIn = this.calculateExpiresIn(result.accessToken);
             return {

package/dist/providers/BaseTokenProvider.d.ts

@@ -22,6 +22,16 @@ export declare abstract class BaseTokenProvider implements ITokenProvider {
     protected refreshToken?: string;
     protected expiresAt?: number;
     protected logger?: ILogger;
+    /**
+     * Format timestamp to readable date/time string
+     * @param timestamp Timestamp in milliseconds
+     * @returns Formatted date string (e.g., "2025-12-25 19:21:27 UTC")
+     */
+    protected formatExpirationDate(timestamp: number): string;
+    /**
+     * Format token for logging (start...end)
+     */
+    protected formatToken(token?: string): string | undefined;
     /**
      * Check if current token is valid (not expired)
      * @returns true if token exists and is not expired, false otherwise

package/dist/providers/BaseTokenProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"BaseTokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/BaseTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;GAQG;AACH,8BAAsB,iBAAkB,YAAW,cAAc;IAC/D,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAE3B;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IAyBjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAExD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAE1D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;IAEjD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IA2DlC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB3E;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAWlD;;;;OAIG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IA0BnE;;;;OAIG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAShE"}
+{"version":3,"file":"BaseTokenProvider.d.ts","sourceRoot":"","sources":["../../src/providers/BaseTokenProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,cAAc,EACd,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC;;;;;;;;GAQG;AACH,8BAAsB,iBAAkB,YAAW,cAAc;IAC/D,SAAS,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IACtC,SAAS,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAE3B;;;;OAIG;IACH,SAAS,CAAC,oBAAoB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM;IAWzD;;OAEG;IACH,SAAS,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAMzD;;;OAGG;IACH,SAAS,CAAC,YAAY,IAAI,OAAO;IAyBjC;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAExD;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAE1D;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,WAAW,IAAI,eAAe;IAEjD;;;;;;;;OAQG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAuElC,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAmB3E;;;OAGG;IACH,SAAS,CAAC,YAAY,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI;IAoBlD;;;;OAIG;IACH,SAAS,CAAC,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IA0BnE;;;;OAIG;IACH,SAAS,CAAC,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;CAShE"}

package/dist/providers/BaseTokenProvider.js

@@ -24,6 +24,31 @@ class BaseTokenProvider {
     refreshToken;
     expiresAt; // timestamp in milliseconds
     logger;
+    /**
+     * Format timestamp to readable date/time string
+     * @param timestamp Timestamp in milliseconds
+     * @returns Formatted date string (e.g., "2025-12-25 19:21:27 UTC")
+     */
+    formatExpirationDate(timestamp) {
+        const date = new Date(timestamp);
+        const year = date.getUTCFullYear();
+        const month = String(date.getUTCMonth() + 1).padStart(2, '0');
+        const day = String(date.getUTCDate()).padStart(2, '0');
+        const hours = String(date.getUTCHours()).padStart(2, '0');
+        const minutes = String(date.getUTCMinutes()).padStart(2, '0');
+        const seconds = String(date.getUTCSeconds()).padStart(2, '0');
+        return `${year}-${month}-${day} ${hours}:${minutes}:${seconds} UTC`;
+    }
+    /**
+     * Format token for logging (start...end)
+     */
+    formatToken(token) {
+        if (!token)
+            return undefined;
+        if (token.length <= 50)
+            return token;
+        return `${token.substring(0, 25)}...${token.substring(token.length - 25)}`;
+    }
     /**
      * Check if current token is valid (not expired)
      * @returns true if token exists and is not expired, false otherwise
@@ -41,8 +66,8 @@ class BaseTokenProvider {
         const now = Date.now();
         const isValid = now < this.expiresAt - bufferMs;
         this.logger?.debug('[BaseTokenProvider] Token validation check', {
-            now: new Date(now).toISOString(),
-            expiresAt: new Date(this.expiresAt).toISOString(),
+            now: this.formatExpirationDate(now),
+            expiresAt: this.formatExpirationDate(this.expiresAt),
             expiresIn: Math.floor((this.expiresAt - now) / 1000),
             isValid,
             bufferMs,
@@ -63,6 +88,7 @@ class BaseTokenProvider {
             hasToken: !!this.authorizationToken,
             hasExpiresAt: !!this.expiresAt,
             hasRefreshToken: !!this.refreshToken,
+            currentToken: this.formatToken(this.authorizationToken),
         });
         // If token is valid, return cached
         const isValid = this.isTokenValid();
@@ -72,6 +98,7 @@ class BaseTokenProvider {
                 throw new Error('Authorization token is missing.');
             }
             this.logger?.info('[BaseTokenProvider] Returning cached valid token', {
+                token: this.formatToken(authorizationToken),
                 expiresIn: this.expiresAt
                     ? Math.floor((this.expiresAt - Date.now()) / 1000)
                     : undefined,
@@ -87,11 +114,17 @@ class BaseTokenProvider {
         }
         // Try refresh if we have refresh token
         if (this.refreshToken) {
-            this.logger?.info('[BaseTokenProvider] Token invalid, attempting refresh');
+            this.logger?.info('[BaseTokenProvider] Token invalid, attempting refresh', {
+                oldToken: this.formatToken(this.authorizationToken),
+                refreshToken: this.formatToken(this.refreshToken),
+            });
             try {
                 const result = await this.performRefresh();
                 this.updateTokens(result);
-                this.logger?.info('[BaseTokenProvider] Token refreshed successfully');
+                this.logger?.info('[BaseTokenProvider] Token refreshed successfully', {
+                    newToken: this.formatToken(result.authorizationToken),
+                    newRefreshToken: this.formatToken(result.refreshToken),
+                });
                 return result;
             }
             catch (error) {
@@ -108,7 +141,10 @@ class BaseTokenProvider {
         this.logger?.info('[BaseTokenProvider] Token invalid and no refresh token, performing login');
         const result = await this.performLogin();
         this.updateTokens(result);
-        this.logger?.info('[BaseTokenProvider] Login completed');
+        this.logger?.info('[BaseTokenProvider] Login completed', {
+            newToken: this.formatToken(result.authorizationToken),
+            newRefreshToken: this.formatToken(result.refreshToken),
+        });
         return result;
     }
     async validateToken(_token, _serviceUrl) {
@@ -122,7 +158,7 @@ class BaseTokenProvider {
         const isValid = Date.now() < expiresAt - bufferMs;
         this.logger?.info('[BaseTokenProvider] Token validation result', {
             isValid,
-            expiresAt: new Date(expiresAt).toISOString(),
+            expiresAt: this.formatExpirationDate(expiresAt),
             expiresIn: Math.floor((expiresAt - Date.now()) / 1000),
         });
         return isValid;
@@ -132,6 +168,7 @@ class BaseTokenProvider {
      * @param result Token result to cache
      */
     updateTokens(result) {
+        const oldToken = this.formatToken(this.authorizationToken);
         this.authorizationToken = result.authorizationToken;
         this.refreshToken = result.refreshToken;
         if (result.expiresIn) {
@@ -141,6 +178,14 @@ class BaseTokenProvider {
             // Try to parse expiration from JWT if expiresIn not provided
             this.expiresAt = this.parseExpirationFromJWT(result.authorizationToken);
         }
+        this.logger?.info('[BaseTokenProvider] Tokens updated', {
+            oldToken,
+            newToken: this.formatToken(result.authorizationToken),
+            newRefreshToken: this.formatToken(result.refreshToken),
+            expiresAt: this.expiresAt
+                ? this.formatExpirationDate(this.expiresAt)
+                : undefined,
+        });
     }
     /**
      * Parse expiration time from JWT token

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "0.2.8",
+  "version": "0.2.10",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",