@mcp-abap-adt/auth-providers 1.1.0 → 2.0.0

package/dist/__tests__/helpers/netHelpers.d.ts

@@ -1,3 +1,19 @@
 export declare function getAvailablePort(): Promise<number>;
 export declare function canListenOnLocalhost(): Promise<boolean>;
+/**
+ * Whether a login in this test could own `port` — and therefore whether
+ * asserting that it released the port means anything.
+ *
+ * A release assertion is a claim about our own cleanup. When an unrelated
+ * process already holds the port, the login fails at the probe, never binds
+ * anything, and cannot release anything: the port is still held afterwards,
+ * the code is behaving exactly as it should, and the assertion fails anyway.
+ * That is a test reporting on what else is running on the machine.
+ *
+ * So the gate is placed *before* the login rather than the assertion being
+ * widened until it always passes — a `toBe(true)` relaxed into "free or held"
+ * would also pass when our own cleanup leaked, which is the one thing these
+ * cases exist to catch.
+ */
+export declare function canOwnPort(port: number, context: string): Promise<boolean>;
 //# sourceMappingURL=netHelpers.d.ts.map

package/dist/__tests__/helpers/netHelpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"netHelpers.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/netHelpers.ts"],"names":[],"mappings":"AAEA,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAcxD;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D"}
+{"version":3,"file":"netHelpers.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/netHelpers.ts"],"names":[],"mappings":"AAEA,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAcxD;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAclB"}

package/dist/__tests__/helpers/netHelpers.js

@@ -35,6 +35,7 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.getAvailablePort = getAvailablePort;
 exports.canListenOnLocalhost = canListenOnLocalhost;
+exports.canOwnPort = canOwnPort;
 const net = __importStar(require("node:net"));
 async function getAvailablePort() {
     return new Promise((resolve, reject) => {
@@ -61,3 +62,31 @@ async function canListenOnLocalhost() {
         });
     });
 }
+/**
+ * Whether a login in this test could own `port` — and therefore whether
+ * asserting that it released the port means anything.
+ *
+ * A release assertion is a claim about our own cleanup. When an unrelated
+ * process already holds the port, the login fails at the probe, never binds
+ * anything, and cannot release anything: the port is still held afterwards,
+ * the code is behaving exactly as it should, and the assertion fails anyway.
+ * That is a test reporting on what else is running on the machine.
+ *
+ * So the gate is placed *before* the login rather than the assertion being
+ * widened until it always passes — a `toBe(true)` relaxed into "free or held"
+ * would also pass when our own cleanup leaked, which is the one thing these
+ * cases exist to catch.
+ */
+async function canOwnPort(port, context) {
+    const free = await new Promise((resolve) => {
+        const probe = net.createServer();
+        probe.once('error', () => resolve(false));
+        probe.listen(port, () => probe.close(() => resolve(true)));
+    });
+    if (!free) {
+        console.warn(`⚠️  Port ${port} is held by another process — skipping the port-release ` +
+            `assertions in "${context}". A login that never bound the socket cannot ` +
+            'release it; the remaining assertions in this case still run.');
+    }
+    return free;
+}

package/dist/auth/announce.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Where an essential, user-facing prompt goes.
+ *
+ * Prompts are not log lines: a device code or an authorization URL the user
+ * cannot see makes the flow impassable, so they must survive the absence of a
+ * logger. They must equally never reach stdout, which carries protocol traffic
+ * under an MCP or LSP stdio transport.
+ */
+import type { ILogger } from '@mcp-abap-adt/interfaces';
+export declare function announcer(logger?: ILogger): (msg: string) => void;
+//# sourceMappingURL=announce.d.ts.map

package/dist/auth/announce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"announce.d.ts","sourceRoot":"","sources":["../../src/auth/announce.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,wBAAgB,SAAS,CAAC,MAAM,CAAC,EAAE,OAAO,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAKjE"}

package/dist/auth/announce.js

@@ -0,0 +1,19 @@
+"use strict";
+/**
+ * Where an essential, user-facing prompt goes.
+ *
+ * Prompts are not log lines: a device code or an authorization URL the user
+ * cannot see makes the flow impassable, so they must survive the absence of a
+ * logger. They must equally never reach stdout, which carries protocol traffic
+ * under an MCP or LSP stdio transport.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.announcer = announcer;
+function announcer(logger) {
+    return (msg) => {
+        if (logger)
+            logger.info(msg);
+        else
+            process.stderr.write(`${msg}\n`);
+    };
+}

package/dist/auth/browserAuth.d.ts

@@ -2,9 +2,6 @@
  * Browser authentication - OAuth2 flow for obtaining tokens
  */
 import type { IAuthorizationConfig, ILogger } from '@mcp-abap-adt/interfaces';
-type BrowserAuthConfig = IAuthorizationConfig & {
-    authorizationUrl?: string;
-};
 /**
  * Extract an OAuth2 authorization code from arbitrary pasted input.
  *
@@ -17,26 +14,35 @@ type BrowserAuthConfig = IAuthorizationConfig & {
  * @internal - Exported for testing and for manual-paste flows.
  */
 export declare function extractCode(input: string): string | null;
+/**
+ * Build the OAuth2 authorization URL for a redirect URI that is already known.
+ *
+ * The URI is a parameter rather than a port because the port may have been
+ * chosen by the OS moments earlier — see `ICallbackServerOptions.port`.
+ */
+export declare function getJwtAuthorizationUrl(authConfig: IAuthorizationConfig, redirectUri: string): string;
 /**
  * Exchange authorization code for tokens
  * @internal - Exported for testing
  */
-export declare function exchangeCodeForToken(authConfig: IAuthorizationConfig, code: string, port?: number, log?: ILogger | null): Promise<{
+export declare function exchangeCodeForToken(authConfig: IAuthorizationConfig, code: string, redirectUri: string, log?: ILogger | null): Promise<{
     accessToken: string;
     refreshToken?: string;
 }>;
 /**
- * Start browser authentication flow
- * @param authConfig Authorization configuration with UAA credentials
- * @param browser Browser name (chrome, edge, firefox, system, none)
- * @param logger Optional logger instance. If not provided, uses default logger.
- * @param port Port for OAuth callback server (default: 3001)
- * @returns Promise that resolves to tokens
- * @internal - Internal function, not exported from package
+ * Open the authorization URL, or tell the user how to do it.
+ *
+ * Never awaited on the critical path by the caller: a launcher that hangs must
+ * not delay the login timeout or the release of the port. A launcher that fails
+ * is reported through the scope's `fail`, which is just another way for the
+ * scope to end.
  */
-export declare function startBrowserAuth(authConfig: BrowserAuthConfig, browser?: string, logger?: ILogger, port?: number): Promise<{
-    accessToken: string;
-    refreshToken?: string;
-}>;
-export {};
+export declare function launchBrowser(authorizationUrl: string, browser: string, callbackUri: string, announce: (msg: string) => void, log: ILogger | null, 
+/**
+ * Extra guidance for 'none'/'headless', supplied only by a flow whose
+ * transport really offers another way in. The UAA callback server has a paste
+ * form on `/`; the OIDC and SAML ones do not, and promising one there sends
+ * the user to a 404.
+ */
+remoteHint?: string): Promise<void>;
 //# sourceMappingURL=browserAuth.d.ts.map

package/dist/auth/browserAuth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"browserAuth.d.ts","sourceRoot":"","sources":["../../src/auth/browserAuth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAMH,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAI9E,KAAK,iBAAiB,GAAG,oBAAoB,GAAG;IAC9C,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B,CAAC;AAYF;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxD;AAoBD;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,MAAa,EACnB,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAgDzD;AA6BD;;;;;;;;GAQG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,iBAAiB,EAC7B,OAAO,GAAE,MAAiB,EAC1B,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,MAAa,GAClB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAumBzD"}
+{"version":3,"file":"browserAuth.d.ts","sourceRoot":"","sources":["../../src/auth/browserAuth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAa9E;;;;;;;;;;GAUG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAiBxD;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,UAAU,EAAE,oBAAoB,EAChC,WAAW,EAAE,MAAM,GAClB,MAAM,CASR;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,UAAU,EAAE,oBAAoB,EAChC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,GACnB,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CA+CzD;AAeD;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,gBAAgB,EAAE,MAAM,EACxB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAC/B,GAAG,EAAE,OAAO,GAAG,IAAI;AACnB;;;;;GAKG;AACH,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAiGf"}