@mcp-abap-adt/auth-providers 1.0.4 → 1.1.0

package/CHANGELOG.md

@@ -7,6 +7,31 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-06-02
+
+### Added
+- `extractCode(input)` helper: pulls an OAuth2 authorization code out of a bare
+  code, a `code=...` string, or a full redirected URL.
+- Manual paste authentication for `none`/`headless` browser modes, so login can
+  complete when the automatic `localhost` callback can't reach the process
+  (browser on another machine / container / SSH). Three racing channels, first
+  one wins:
+  - the existing automatic `GET /callback?code=...` redirect;
+  - an HTML paste form on the same callback server (`GET /` + `GET /submit`);
+  - stdin paste, only when `process.stdin.isTTY` (never consumed under stdio
+    RPC transports).
+
+### Fixed
+- `none`/`headless` mode now prints the authorization URL even when no logger is
+  supplied. The prompt previously rode on `log?.info(...)` and was silently
+  dropped without a logger; it now falls back to `stderr` (never stdout, to keep
+  stdio RPC transports uncorrupted).
+
+## [1.0.5] - 2026-02-12
+
+### Fixed
+- Log SAML bearer token exchange HTTP errors with response details for troubleshooting.
+
 ## [1.0.4] - 2026-02-11
 
 ### Changed

package/README.md

@@ -1,4 +1,5 @@
 # @mcp-abap-adt/auth-providers
+[![Stand With Ukraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://stand-with-ukraine.pp.ua)
 
 Token providers for MCP ABAP ADT auth-broker.
 
@@ -99,6 +100,36 @@ const clientCredsBroker = new AuthBroker({
 }, 'none');
 ```
 
+### Browser modes (`AuthorizationCodeProvider`)
+
+The `browser` option controls how the authorization URL is opened:
+
+| Mode | Behaviour |
+|------|-----------|
+| `system` (default) | Open the OS default browser |
+| `chrome` / `edge` / `firefox` | Open a specific browser |
+| `auto` | Try to open a browser; on failure, print the URL and wait |
+| `none` / `headless` | Do **not** open a browser — print the URL and wait for the code (SSH / remote / containers) |
+
+In `none`/`headless` mode the authorization URL is always shown, **even when no
+logger is supplied** (it falls back to `stderr`, never stdout, so stdio-based
+RPC transports are not corrupted).
+
+#### Manual paste (none / headless)
+
+Login can complete through any of three channels — whichever finishes first wins:
+
+1. **Automatic callback** — `GET /callback?code=...` on `http://localhost:<redirectPort>`.
+   Works when the browser is on the same machine as the process.
+2. **Paste form** — open `http://<host>:<redirectPort>/` and paste the code (or
+   the whole redirected URL). Works when the browser is on a *different* machine,
+   since the callback server listens on all interfaces.
+3. **Terminal paste** — paste the code on stdin and press Enter. Only active when
+   `process.stdin.isTTY` (stdin is never consumed under a stdio RPC transport).
+
+The exported `extractCode(input)` helper accepts a bare code, `code=...`, or a
+full redirected URL.
+
 ### SSO Providers
 
 This package also includes SSO providers for OIDC and SAML2, plus a small factory for DI-friendly creation.

package/dist/auth/browserAuth.d.ts

@@ -5,6 +5,18 @@ import type { IAuthorizationConfig, ILogger } from '@mcp-abap-adt/interfaces';
 type BrowserAuthConfig = IAuthorizationConfig & {
     authorizationUrl?: string;
 };
+/**
+ * Extract an OAuth2 authorization code from arbitrary pasted input.
+ *
+ * Accepts:
+ *  - a bare code: `abc123`
+ *  - `code=abc123`
+ *  - a full redirected URL: `http://localhost:7779/callback?code=abc123&state=...`
+ *
+ * Returns the decoded code, or null if nothing usable was found.
+ * @internal - Exported for testing and for manual-paste flows.
+ */
+export declare function extractCode(input: string): string | null;
 /**
  * Exchange authorization code for tokens
  * @internal - Exported for testing

package/dist/auth/browserAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browserAuth.d.ts","sourceRoot":"","sources":["../../src/auth/browserAuth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAI9E,KAAK,iBAAiB,GAAG,oBAAoB,GAAG;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AA8BF;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAa,EACnB,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgDzD;AA6BD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,MAAa,GAClB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAqjBzD"}
+{"version":3,"file":"browserAuth.d.ts","sourceRoot":"","sources":["../../src/auth/browserAuth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAI9E,KAAK,iBAAiB,GAAG,oBAAoB,GAAG;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAYF;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxD;AAoBD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAa,EACnB,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgDzD;AA6BD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,MAAa,GAClB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAumBzD"}

package/dist/auth/browserAuth.js

@@ -39,11 +39,13 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractCode = extractCode;
 exports.exchangeCodeForToken = exchangeCodeForToken;
 exports.startBrowserAuth = startBrowserAuth;
 const child_process = __importStar(require("node:child_process"));
 const http = __importStar(require("node:http"));
 const net = __importStar(require("node:net"));
+const readline = __importStar(require("node:readline"));
 const axios_1 = __importDefault(require("axios"));
 const express_1 = __importDefault(require("express"));
 const BROWSER_MAP = {
@@ -55,6 +57,37 @@ const BROWSER_MAP = {
     headless: null, // no browser, log URL and wait for callback (SSH/remote)
     none: null, // no browser, log URL and wait for callback (same as headless)
 };
+/**
+ * Extract an OAuth2 authorization code from arbitrary pasted input.
+ *
+ * Accepts:
+ *  - a bare code: `abc123`
+ *  - `code=abc123`
+ *  - a full redirected URL: `http://localhost:7779/callback?code=abc123&state=...`
+ *
+ * Returns the decoded code, or null if nothing usable was found.
+ * @internal - Exported for testing and for manual-paste flows.
+ */
+function extractCode(input) {
+    if (!input)
+        return null;
+    const trimmed = input.trim();
+    if (!trimmed)
+        return null;
+    // Anywhere a `code=` query parameter appears (full URL or query string)
+    const fromQuery = trimmed.match(/[?&]code=([^&\s]+)/);
+    if (fromQuery)
+        return decodeURIComponent(fromQuery[1]);
+    // Bare `code=XYZ`
+    const bareKv = trimmed.match(/^code=([^&\s]+)$/);
+    if (bareKv)
+        return decodeURIComponent(bareKv[1]);
+    // Otherwise treat the whole token as the code, but reject anything with
+    // whitespace (clearly not a single code).
+    if (/\s/.test(trimmed))
+        return null;
+    return trimmed;
+}
 /**
  * Get OAuth2 authorization URL
  */
@@ -139,6 +172,15 @@ function isPortAvailable(port) {
 async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3001) {
     // Use logger if provided, otherwise null (no logging)
     const log = logger || null;
+    // Essential, user-facing prompts (the auth URL, paste instructions) must be
+    // visible even when no logger is supplied. Fall back to stderr — never stdout,
+    // so stdio-based RPC transports (MCP/LSP) are not corrupted.
+    const announce = (msg) => {
+        if (log)
+            log.info(msg);
+        else
+            process.stderr.write(`${msg}\n`);
+    };
     // Check if requested port is available, throw error if not
     const portAvailable = await isPortAvailable(port);
     if (!portAvailable) {
@@ -149,6 +191,14 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
         let finishTimeoutId = null;
         let cleanupDone = false;
         let resolved = false;
+        // Optional stdin reader for the manual paste channel (none/headless + TTY).
+        let stdinReader = null;
+        const stopStdin = () => {
+            if (stdinReader) {
+                stdinReader.close();
+                stdinReader = null;
+            }
+        };
         const app = (0, express_1.default)();
         const server = http.createServer(app);
         // Disable keep-alive to ensure connections close immediately
@@ -170,6 +220,7 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                 clearTimeout(finishTimeoutId);
                 finishTimeoutId = null;
             }
+            stopStdin();
             if (server) {
                 try {
                     if (typeof server.closeAllConnections === 'function') {
@@ -206,6 +257,7 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                 clearTimeout(finishTimeoutId);
                 finishTimeoutId = null;
             }
+            stopStdin();
             removeCleanupListeners();
             originalResolve(value);
         };
@@ -244,6 +296,75 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                 }
             }
         }
+        // Success page shown in the browser after a code is exchanged for tokens.
+        const successHtml = `<!DOCTYPE html>
+<html lang="en"><head><meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>SAP BTP Authentication</title>
+<style>body{font-family:'Segoe UI',Tahoma,sans-serif;text-align:center;padding:50px 20px;background:linear-gradient(135deg,#0070f3,#00d4ff);color:#fff;min-height:100vh;display:flex;flex-direction:column;justify-content:center;align-items:center}.container{background:rgba(255,255,255,.1);border-radius:20px;padding:40px;max-width:500px}.success-icon{font-size:4rem;margin-bottom:20px;color:#4ade80}h1{font-weight:300}</style>
+</head><body><div class="container"><div class="success-icon">✓</div>
+<h1>Authentication Successful!</h1>
+<p>You have successfully authenticated with SAP BTP. You can close this window.</p>
+</div></body></html>`;
+        // Manual paste form (GET /). Used when the automatic localhost callback
+        // cannot reach this server (browser on another machine). Accepts a bare
+        // code or a full redirected URL; re-renders with a message on a bad paste.
+        const pasteFormHtml = (message) => `<!DOCTYPE html>
+<html lang="en"><head><meta charset="UTF-8">
+<meta name="viewport" content="width=device-width, initial-scale=1.0">
+<title>SAP BTP Authentication — paste code</title>
+<style>body{font-family:'Segoe UI',Tahoma,sans-serif;text-align:center;padding:50px 20px;background:linear-gradient(135deg,#0070f3,#00d4ff);color:#fff;min-height:100vh;display:flex;flex-direction:column;justify-content:center;align-items:center}.container{background:rgba(255,255,255,.1);border-radius:20px;padding:40px;max-width:560px;width:100%}h1{font-weight:300}input{width:100%;padding:12px;border-radius:8px;border:none;font-size:1rem;box-sizing:border-box;margin:14px 0}button{padding:12px 24px;border-radius:8px;border:none;background:#fff;color:#0070f3;font-size:1rem;cursor:pointer}.msg{color:#fde68a;margin-bottom:10px}</style>
+</head><body><div class="container">
+<h1>Paste authorization code</h1>
+${message ? `<p class="msg">${message}</p>` : ''}
+<p>After signing in, copy the <code>code</code> from your browser's address bar
+(or paste the whole redirected URL) and submit it here.</p>
+<form action="/submit" method="get">
+<input name="input" autofocus placeholder="code=... or http://localhost/callback?code=..." />
+<button type="submit">Submit</button>
+</form></div></body></html>`;
+        // Resolve the outer promise once a code has been turned into tokens.
+        const finalizeSuccess = (tokens, res) => {
+            let serverClosing = false;
+            const closeServerAndResolve = () => {
+                if (serverClosing)
+                    return;
+                serverClosing = true;
+                if (finishTimeoutId) {
+                    clearTimeout(finishTimeoutId);
+                    finishTimeoutId = null;
+                }
+                if (typeof server.closeAllConnections === 'function') {
+                    server.closeAllConnections();
+                }
+                server.close(() => {
+                    log?.info(`[browserAuth] Server closed, port ${PORT} freed`);
+                    resolve({
+                        accessToken: tokens.accessToken,
+                        refreshToken: tokens.refreshToken,
+                    });
+                });
+            };
+            if (res) {
+                res.send(successHtml);
+                res.once('finish', closeServerAndResolve);
+                // Fallback if the finish event doesn't fire promptly.
+                finishTimeoutId = setTimeout(closeServerAndResolve, 1000);
+            }
+            else {
+                closeServerAndResolve();
+            }
+        };
+        // Exchange a code for tokens and resolve. Throws on exchange failure so the
+        // caller decides: reject (auto callback) or keep waiting (manual paste).
+        const completeWithCode = async (code, res) => {
+            if (resolved)
+                return;
+            log?.info(`[browserAuth] Exchanging code for token...`);
+            const tokens = await exchangeCodeForToken(authConfig, code, PORT, log);
+            log?.info(`[browserAuth] Tokens received: accessToken(${tokens.accessToken?.length || 0} chars), refreshToken(${tokens.refreshToken?.length || 0} chars)`);
+            finalizeSuccess(tokens, res);
+        };
         // OAuth2 callback handler
         app.get('/callback', async (req, res) => {
             try {
@@ -330,104 +451,9 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                     res.status(400).send('Error: Authorization code missing');
                     return reject(new Error('Authorization code missing'));
                 }
-                log?.info(`[browserAuth] Exchanging code for token...`);
-                // Send success page
-                const html = `<!DOCTYPE html>
-<html lang="en">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>SAP BTP Authentication</title>
-    <style>
-        body {
-            font-family: 'Segoe UI', Tahoma, Geneva, Verdana, sans-serif;
-            text-align: center;
-            margin: 0;
-            padding: 50px 20px;
-            background: linear-gradient(135deg, #0070f3 0%, #00d4ff 100%);
-            color: white;
-            min-height: 100vh;
-            display: flex;
-            flex-direction: column;
-            justify-content: center;
-            align-items: center;
-        }
-        .container {
-            background: rgba(255, 255, 255, 0.1);
-            border-radius: 20px;
-            padding: 40px;
-            backdrop-filter: blur(10px);
-            box-shadow: 0 8px 32px rgba(0, 0, 0, 0.1);
-            max-width: 500px;
-            width: 100%;
-        }
-        .success-icon {
-            font-size: 4rem;
-            margin-bottom: 20px;
-            color: #4ade80;
-            text-shadow: 0 2px 4px rgba(0, 0, 0, 0.3);
-        }
-        h1 {
-            margin: 0 0 20px 0;
-            font-size: 2rem;
-            font-weight: 300;
-        }
-        p {
-            margin: 0;
-            font-size: 1.1rem;
-            opacity: 0.9;
-            line-height: 1.5;
-        }
-    </style>
-</head>
-<body>
-    <div class="container">
-        <div class="success-icon">✓</div>
-        <h1>Authentication Successful!</h1>
-        <p>You have successfully authenticated with SAP BTP.</p>
-        <p>You can now close this browser window.</p>
-    </div>
-</body>
-</html>`;
-                // Exchange code for tokens first
+                // Exchange code for tokens; on failure the auto-callback path rejects.
                 try {
-                    log?.info(`[browserAuth] Starting token exchange...`);
-                    const tokens = await exchangeCodeForToken(authConfig, code, PORT, log);
-                    log?.info(`[browserAuth] Tokens received: accessToken(${tokens.accessToken?.length || 0} chars), refreshToken(${tokens.refreshToken?.length || 0} chars)`);
-                    // Send success page (non-blocking, doesn't affect promise)
-                    res.send(html);
-                    log?.info(`[browserAuth] Response sent, waiting for finish...`);
-                    // Close all connections and server after response is sent
-                    // Resolve promise AFTER server is closed to prevent Jest from hanging
-                    let serverClosing = false;
-                    const closeServerAndResolve = () => {
-                        if (serverClosing)
-                            return; // Prevent double execution
-                        serverClosing = true;
-                        if (finishTimeoutId) {
-                            clearTimeout(finishTimeoutId);
-                            finishTimeoutId = null;
-                        }
-                        log?.info(`[browserAuth] Response finished, closing server...`);
-                        if (typeof server.closeAllConnections === 'function') {
-                            server.closeAllConnections();
-                        }
-                        // Wait for server to close before resolving to prevent Jest from hanging
-                        server.close(() => {
-                            // Server closed - port should be freed
-                            log?.info(`[browserAuth] Server closed, port ${PORT} should be freed`);
-                            // Resolve after server is fully closed
-                            log?.info(`[browserAuth] Resolving promise with tokens...`);
-                            resolve({
-                                accessToken: tokens.accessToken,
-                                refreshToken: tokens.refreshToken,
-                            });
-                        });
-                    };
-                    // Wait for response to finish, but add timeout to prevent hanging
-                    res.once('finish', closeServerAndResolve);
-                    // Fallback: if finish event doesn't fire within 1 second, close anyway
-                    finishTimeoutId = setTimeout(closeServerAndResolve, 1000);
+                    await completeWithCode(code, res);
                 }
                 catch (error) {
                     if (typeof server.closeAllConnections === 'function') {
@@ -436,7 +462,6 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                     // Use setTimeout to ensure connections are closed before server.close()
                     setTimeout(() => {
                         server.close(() => {
-                            // Server closed on error - port should be freed
                             log?.debug(`Server closed on error, port ${PORT} should be freed`);
                         });
                     }, 100);
@@ -458,6 +483,31 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                 reject(error);
             }
         });
+        // Manual paste form (served on the same already-listening server).
+        app.get('/', (_req, res) => {
+            res.send(pasteFormHtml());
+        });
+        // Manual paste submit: accept a bare code or a full redirected URL.
+        app.get('/submit', async (req, res) => {
+            const raw = req.query.input ?? req.query.code;
+            const code = typeof raw === 'string' ? extractCode(raw) : null;
+            if (!code) {
+                res
+                    .status(400)
+                    .send(pasteFormHtml('Could not read an authorization code from that input. Try again.'));
+                return;
+            }
+            try {
+                await completeWithCode(code, res);
+            }
+            catch (error) {
+                // Recoverable: a wrong/expired code shouldn't end the whole flow.
+                log?.warn(`[browserAuth] Manual code exchange failed: ${error instanceof Error ? error.message : String(error)}`);
+                res
+                    .status(400)
+                    .send(pasteFormHtml('Code exchange failed. Check the code and try again.'));
+            }
+        });
         // Handle server errors (e.g., EADDRINUSE)
         server.on('error', (error) => {
             if (error.code === 'EADDRINUSE') {
@@ -472,13 +522,36 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
         serverInstance = server.listen(PORT, async () => {
             log?.info(`[browserAuth] Server started on port ${PORT}`);
             const browserApp = BROWSER_MAP[browser];
-            // Handle 'none' and 'headless' modes - log URL and wait for callback
-            // (for SSH/remote sessions or when browser should not be opened)
+            // Handle 'none' and 'headless' modes - show URL and wait for the code
+            // (for SSH/remote sessions or when no browser should be opened).
+            // Use announce() so the URL is visible even without a logger.
             if (browser === 'none' || browser === 'headless') {
-                log?.info(`🔗 Open this URL in your browser to authenticate:`);
-                log?.info(`   ${authorizationUrl}`);
-                log?.info(`   Waiting for callback on http://localhost:${PORT}/callback ...`);
-                // Don't open browser, don't reject - just wait for the callback
+                announce(`🔗 Open this URL in your browser to authenticate:`);
+                announce(`   ${authorizationUrl}`);
+                announce(`   Waiting for callback on http://localhost:${PORT}/callback ...`);
+                announce(`   If your browser is on another machine, after login copy the ` +
+                    `\`code\` from the address bar and paste it at ` +
+                    `http://<this-host>:${PORT}/ — or paste it here and press Enter.`);
+                // Manual stdin paste — only when attached to an interactive terminal.
+                // Under a stdio RPC transport stdin carries the protocol, so we must
+                // never consume it; isTTY guards that.
+                if (process.stdin.isTTY) {
+                    stdinReader = readline.createInterface({ input: process.stdin });
+                    stdinReader.on('line', async (line) => {
+                        const code = extractCode(line);
+                        if (!code) {
+                            process.stderr.write('Could not read an authorization code from that input. Try again.\n');
+                            return;
+                        }
+                        try {
+                            await completeWithCode(code);
+                        }
+                        catch (error) {
+                            process.stderr.write(`Code exchange failed: ${error instanceof Error ? error.message : String(error)}. Try again.\n`);
+                        }
+                    });
+                }
+                // Don't open browser, don't reject - just wait for callback or paste.
                 return;
             }
             // Handle 'auto' mode - try to open browser, fallback to showing URL
@@ -495,9 +568,9 @@ async function startBrowserAuth(authConfig, browser = 'system', logger, port = 3
                     // If browser cannot be opened, show URL and wait
                     const errorMessage = error instanceof Error ? error.message : String(error);
                     log?.warn(`⚠️  Could not open browser automatically: ${errorMessage}`);
-                    log?.info(`🔗 Please open this URL in your browser to authenticate:`);
-                    log?.info(`   ${authorizationUrl}`);
-                    log?.info(`   Waiting for callback on http://localhost:${PORT}/callback ...`);
+                    announce(`🔗 Please open this URL in your browser to authenticate:`);
+                    announce(`   ${authorizationUrl}`);
+                    announce(`   Waiting for callback on http://localhost:${PORT}/callback ...`);
                     // Don't reject - wait for callback
                     return;
                 }

package/dist/auth/saml2TokenExchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2TokenExchange.d.ts","sourceRoot":"","sources":["../../src/auth/saml2TokenExchange.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAGxD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CA6BrC"}
+{"version":3,"file":"saml2TokenExchange.d.ts","sourceRoot":"","sources":["../../src/auth/saml2TokenExchange.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAGxD,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CAwCrC"}

package/dist/auth/saml2TokenExchange.js

@@ -25,7 +25,19 @@ async function exchangeSamlAssertion(samlResponse, tokenUrl, clientId, clientSec
     if (clientId && clientSecret) {
         headers.Authorization = `Basic ${toBasicAuth(clientId, clientSecret)}`;
     }
-    const response = await axios_1.default.post(tokenUrl, params.toString(), { headers });
+    let response;
+    try {
+        response = await axios_1.default.post(tokenUrl, params.toString(), { headers });
+    }
+    catch (error) {
+        if (axios_1.default.isAxiosError(error)) {
+            logger?.error('[SAML] Token exchange failed', {
+                status: error.response?.status,
+                data: error.response?.data,
+            });
+        }
+        throw error;
+    }
     const data = response.data;
     if (!data?.access_token) {
         throw new Error('Token response missing access_token');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "1.0.4",
+  "version": "1.1.0",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",