@mcp-abap-adt/auth-providers 1.1.0 → 2.0.0

package/dist/auth/saml2Auth.js

@@ -2,70 +2,17 @@
 /**
  * SAML 2.0 auth helpers
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.withSamlCallbackServer = void 0;
 exports.buildSamlAuthorizationUrl = buildSamlAuthorizationUrl;
-exports.startSamlBrowserAuth = startSamlBrowserAuth;
 exports.parseSamlNotOnOrAfter = parseSamlNotOnOrAfter;
 const node_crypto_1 = require("node:crypto");
-const http = __importStar(require("node:http"));
-const net = __importStar(require("node:net"));
 const node_zlib_1 = require("node:zlib");
 const express_1 = __importDefault(require("express"));
-const BROWSER_MAP = {
-    chrome: 'chrome',
-    edge: 'msedge',
-    firefox: 'firefox',
-    system: undefined,
-    auto: undefined,
-    headless: null,
-    none: null,
-};
-function isPortAvailable(port) {
-    return new Promise((resolve) => {
-        const server = net.createServer();
-        server.listen(port, () => {
-            server.once('close', () => resolve(true));
-            server.close();
-        });
-        server.on('error', () => resolve(false));
-    });
-}
+const callbackServer_1 = require("./callbackServer");
 function base64Encode(input) {
     return Buffer.isBuffer(input)
         ? input.toString('base64')
@@ -99,96 +46,29 @@ function buildSamlAuthorizationUrl(config) {
         : '';
     return `${config.idpSsoUrl}?SAMLRequest=${samlRequest}${relayState}`;
 }
-async function openBrowserUrl(authorizationUrl, browser, logger) {
-    const browserApp = BROWSER_MAP[browser];
-    if (browserApp === null) {
-        logger?.info('[SAML] Browser suppressed, open URL manually', {
-            authorizationUrl,
-        });
-        return;
-    }
-    if (browser === 'auto') {
-        try {
-            const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-            const open = openModule.default;
-            await open(authorizationUrl);
-            logger?.info('[SAML] Browser opened');
-            return;
-        }
-        catch (error) {
-            logger?.warn('[SAML] Failed to open browser automatically', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            logger?.info('[SAML] Open URL manually', { authorizationUrl });
-            return;
-        }
-    }
-    try {
-        const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-        const open = openModule.default;
-        if (browserApp) {
-            await open(authorizationUrl, { app: { name: browserApp } });
-        }
-        else {
-            await open(authorizationUrl);
-        }
-    }
-    catch (error) {
-        logger?.warn('[SAML] Failed to open browser', {
-            error: error instanceof Error ? error.message : String(error),
-        });
-        logger?.info('[SAML] Open URL manually', { authorizationUrl });
-    }
-}
-async function startSamlBrowserAuth(config, browser, logger, port = 3001) {
-    const portAvailable = await isPortAvailable(port);
-    if (!portAvailable) {
-        throw new Error(`Port ${port} is already in use. Please specify a different port or free the port.`);
-    }
-    const authorizationUrl = buildSamlAuthorizationUrl(config);
-    return new Promise((resolve, reject) => {
-        const app = (0, express_1.default)();
-        app.use(express_1.default.urlencoded({ extended: false, limit: '5mb' }));
-        const server = http.createServer(app);
-        server.keepAliveTimeout = 0;
-        server.headersTimeout = 0;
-        const PORT = port;
-        let resolved = false;
-        const cleanup = () => {
-            if (resolved)
-                return;
-            resolved = true;
-            server.close();
-        };
-        const handleResponse = (samlResponse) => {
-            if (!samlResponse) {
-                cleanup();
-                reject(new Error('Missing SAMLResponse'));
-                return;
-            }
-            cleanup();
-            resolve(samlResponse);
-        };
-        app.post('/callback', (req, res) => {
-            const samlResponse = req.body?.SAMLResponse;
+const withSamlCallbackServer = (options, use) => (0, callbackServer_1.runCallbackScope)(options, (app, settle) => {
+    app.use(express_1.default.urlencoded({ extended: false, limit: '5mb' }));
+    const handle = (samlResponse, res) => {
+        // The response is decided after the payload is examined. Answering 200
+        // first told a request that carried nothing that it had authenticated.
+        if (typeof samlResponse === 'string' && samlResponse) {
             res
                 .status(200)
                 .send('SAML authentication complete. You can close this window.');
-            handleResponse(typeof samlResponse === 'string' ? samlResponse : undefined);
-        });
-        app.get('/callback', (req, res) => {
-            const samlResponse = req.query.SAMLResponse;
-            res
-                .status(200)
-                .send('SAML authentication complete. You can close this window.');
-            handleResponse(typeof samlResponse === 'string' ? samlResponse : undefined);
-        });
-        server.listen(PORT, async () => {
-            logger?.info('[SAML] Callback server listening', { port: PORT });
-            await openBrowserUrl(authorizationUrl, browser, logger);
-        });
+            settle.ok(samlResponse, res);
+            return;
+        }
+        res.status(400).send('Error: not a SAML assertion callback');
+        settle.ignore('no SAMLResponse in the request', res);
+    };
+    app.post('/callback', (req, res) => {
+        handle(req.body?.SAMLResponse, res);
     });
-}
+    app.get('/callback', (req, res) => {
+        handle(req.query.SAMLResponse, res);
+    });
+}, use);
+exports.withSamlCallbackServer = withSamlCallbackServer;
 function parseSamlNotOnOrAfter(samlResponse) {
     try {
         const decoded = Buffer.from(samlResponse, 'base64').toString('utf8');

package/dist/index.d.ts

@@ -4,9 +4,15 @@
  *
  * Provides token providers
  */
+export { withBrowserCallbackServer } from './auth/callbackServer';
+export type { OidcCallbackResult } from './auth/oidcBrowserAuth';
+export { withOidcCallbackServer } from './auth/oidcBrowserAuth';
+export { withSamlCallbackServer } from './auth/saml2Auth';
 export { BrowserAuthError, RefreshError, ServiceKeyError, SessionDataError, TokenProviderError, ValidationError, } from './errors/TokenProviderErrors';
 export type { AuthorizationCodeProviderConfig, ClientCredentialsProviderConfig, DeviceFlowProviderConfig, OidcBrowserProviderConfig, OidcDeviceFlowProviderConfig, OidcPasswordProviderConfig, OidcTokenExchangeProviderConfig, Saml2BearerProviderConfig, Saml2PureProviderConfig, } from './providers';
 export { AuthorizationCodeProvider, BaseTokenProvider, ClientCredentialsProvider, DeviceFlowProvider, OidcBrowserProvider, OidcDeviceFlowProvider, OidcPasswordProvider, OidcTokenExchangeProvider, Saml2BearerProvider, Saml2PureProvider, } from './providers';
 export { SsoProviderFactory } from './sso/SsoProviderFactory';
 export type { SsoProviderConfig, SsoProviderInstance } from './sso/types';
+export type { BrowserCallbackStrategyOptions, CallbackStrategyOptions, ExternalCodeStrategyOptions, ManualStrategyOptions, StaticCodeStrategyOptions, } from './strategies';
+export { asOidcResult, BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, externalCodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, oidcCallbackStrategy, samlCallbackStrategy, staticCodeStrategy, } from './strategies';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -6,7 +6,14 @@
  * Provides token providers
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SsoProviderFactory = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = void 0;
+exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
+// Callback server factories — "take the transport this package gives".
+var callbackServer_1 = require("./auth/callbackServer");
+Object.defineProperty(exports, "withBrowserCallbackServer", { enumerable: true, get: function () { return callbackServer_1.withBrowserCallbackServer; } });
+var oidcBrowserAuth_1 = require("./auth/oidcBrowserAuth");
+Object.defineProperty(exports, "withOidcCallbackServer", { enumerable: true, get: function () { return oidcBrowserAuth_1.withOidcCallbackServer; } });
+var saml2Auth_1 = require("./auth/saml2Auth");
+Object.defineProperty(exports, "withSamlCallbackServer", { enumerable: true, get: function () { return saml2Auth_1.withSamlCallbackServer; } });
 // Errors
 var TokenProviderErrors_1 = require("./errors/TokenProviderErrors");
 Object.defineProperty(exports, "BrowserAuthError", { enumerable: true, get: function () { return TokenProviderErrors_1.BrowserAuthError; } });
@@ -30,3 +37,16 @@ Object.defineProperty(exports, "Saml2PureProvider", { enumerable: true, get: fun
 // SSO factory
 var SsoProviderFactory_1 = require("./sso/SsoProviderFactory");
 Object.defineProperty(exports, "SsoProviderFactory", { enumerable: true, get: function () { return SsoProviderFactory_1.SsoProviderFactory; } });
+// Authorization strategies — or bring your own IAuthorizationStrategy.
+var strategies_1 = require("./strategies");
+Object.defineProperty(exports, "asOidcResult", { enumerable: true, get: function () { return strategies_1.asOidcResult; } });
+Object.defineProperty(exports, "BrowserCallbackStrategy", { enumerable: true, get: function () { return strategies_1.BrowserCallbackStrategy; } });
+Object.defineProperty(exports, "browserCallbackStrategy", { enumerable: true, get: function () { return strategies_1.browserCallbackStrategy; } });
+Object.defineProperty(exports, "DEFAULT_CALLBACK_PORT", { enumerable: true, get: function () { return strategies_1.DEFAULT_CALLBACK_PORT; } });
+Object.defineProperty(exports, "DEFAULT_LOGIN_TIMEOUT_MS", { enumerable: true, get: function () { return strategies_1.DEFAULT_LOGIN_TIMEOUT_MS; } });
+Object.defineProperty(exports, "externalCodeStrategy", { enumerable: true, get: function () { return strategies_1.externalCodeStrategy; } });
+Object.defineProperty(exports, "manualPasteStrategy", { enumerable: true, get: function () { return strategies_1.manualPasteStrategy; } });
+Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true, get: function () { return strategies_1.manualSamlResponseStrategy; } });
+Object.defineProperty(exports, "oidcCallbackStrategy", { enumerable: true, get: function () { return strategies_1.oidcCallbackStrategy; } });
+Object.defineProperty(exports, "samlCallbackStrategy", { enumerable: true, get: function () { return strategies_1.samlCallbackStrategy; } });
+Object.defineProperty(exports, "staticCodeStrategy", { enumerable: true, get: function () { return strategies_1.staticCodeStrategy; } });

package/dist/providers/AuthorizationCodeProvider.d.ts

@@ -4,15 +4,19 @@
  * Uses authorization_code grant type with browser-based OAuth2 flow.
  * Supports pre-built authorization URLs and automatic refresh.
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { IAuthorizationStrategy, ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface AuthorizationCodeProviderConfig {
     uaaUrl: string;
     clientId: string;
     clientSecret: string;
+    /** Pre-built authorization URL. Carries its own redirect; see the guard below. */
     authorizationUrl?: string;
-    browser?: string;
-    redirectPort?: number;
+    /**
+     * How the login is conducted. Omitted means a browser callback on the default
+     * port — the package's own transport, which a consumer may replace wholesale.
+     */
+    authorization?: IAuthorizationStrategy<string>;
     accessToken?: string;
     refreshToken?: string;
     logger?: ILogger;

package/dist/providers/AuthorizationCodeProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationCodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/AuthorizationCodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAEV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAE9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAGrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IA8D7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cA2ErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA0CxD"}
+{"version":3,"file":"AuthorizationCodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/AuthorizationCodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAEV,sBAAsB,EACtB,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAE9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAErB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAG/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IA4D7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cA+ErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA0CxD"}

package/dist/providers/AuthorizationCodeProvider.js

@@ -10,6 +10,7 @@ exports.AuthorizationCodeProvider = void 0;
 const interfaces_1 = require("@mcp-abap-adt/interfaces");
 const browserAuth_1 = require("../auth/browserAuth");
 const tokenRefresher_1 = require("../auth/tokenRefresher");
+const strategies_1 = require("../strategies");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 /**
  * Authorization Code token provider
@@ -30,8 +31,6 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
             hasRefreshToken: !!config.refreshToken,
             accessToken: this.formatToken(config.accessToken),
             refreshToken: this.formatToken(config.refreshToken),
-            browser: config.browser || 'none',
-            redirectPort: config.redirectPort || 3001,
         });
         const missingFields = [];
         if (!config.uaaUrl) {
@@ -76,56 +75,67 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE;
     }
     async performLogin() {
-        // Build authorization config
-        // If authorizationUrl is provided, use it; otherwise startBrowserAuth will build it from uaaUrl + clientId
         const authConfig = {
             uaaUrl: this.config.uaaUrl,
             uaaClientId: this.config.clientId,
             uaaClientSecret: this.config.clientSecret,
         };
-        // If pre-built URL provided, use it
-        if (this.config.authorizationUrl) {
-            authConfig.authorizationUrl = this.config.authorizationUrl;
+        const prebuilt = this.config.authorizationUrl;
+        const declaredRedirect = prebuilt
+            ? new URL(prebuilt).searchParams.get('redirect_uri')
+            : null;
+        const mismatch = (redirectUri) => `Pre-built authorizationUrl declares redirect_uri ${declaredRedirect}, ` +
+            `but the authorization strategy used ${redirectUri}, which does not match. ` +
+            'An ephemeral port cannot be used with a pre-built URL.';
+        // The provider owns the URL; the strategy owns where it is answered. The
+        // guard lives here rather than after the fact because a mismatched redirect
+        // produces no callback at all — checking the outcome would mean waiting for
+        // a timeout that explains nothing.
+        const request = {
+            logger: this.logger,
+            buildAuthorizationUrl: async (redirectUri) => {
+                if (prebuilt) {
+                    if (declaredRedirect && declaredRedirect !== redirectUri) {
+                        throw new Error(mismatch(redirectUri));
+                    }
+                    return prebuilt;
+                }
+                return (0, browserAuth_1.getJwtAuthorizationUrl)(authConfig, redirectUri);
+            },
+        };
+        // Constructed here means disposed here: whoever constructs, disposes.
+        const supplied = this.config.authorization;
+        const strategy = supplied ?? (0, strategies_1.browserCallbackStrategy)();
+        let outcome;
+        try {
+            outcome = await strategy.authorize(request);
         }
-        // Use provided browser or default to 'none' (prints URL to console)
-        const browser = this.config.browser || 'none';
-        const redirectPort = this.config.redirectPort || 3001;
-        // Build authorization URL for logging (same logic as in startBrowserAuth)
-        const authorizationUrl = authConfig.authorizationUrl ??
-            `${authConfig.uaaUrl}/oauth/authorize?client_id=${encodeURIComponent(authConfig.uaaClientId)}&redirect_uri=${encodeURIComponent(`http://localhost:${redirectPort}/callback`)}&response_type=code`;
-        this.logger?.info('[AuthorizationCodeProvider] Performing login via browser', {
-            browser,
-            redirectPort,
-            authorizationUrl,
-            uaaUrl: authConfig.uaaUrl,
-            clientId: authConfig.uaaClientId,
-        });
-        // Wrap startBrowserAuth with timeout
-        const timeoutMs = 30 * 1000; // 30 seconds
-        const timeoutPromise = new Promise((_, reject) => {
-            setTimeout(() => {
-                reject(new Error(`Authentication timeout after ${timeoutMs / 1000} seconds. Please try again.`));
-            }, timeoutMs);
-        });
-        const result = await Promise.race([
-            (0, browserAuth_1.startBrowserAuth)(authConfig, browser, this.logger || undefined, // Pass logger to browserAuth
-            redirectPort),
-            timeoutPromise,
-        ]);
-        this.logger?.info('[AuthorizationCodeProvider] Login completed', {
-            hasAccessToken: !!result.accessToken,
-            hasRefreshToken: !!result.refreshToken,
-            accessToken: this.formatToken(result.accessToken),
-            refreshToken: this.formatToken(result.refreshToken),
-            accessTokenLength: result.accessToken?.length || 0,
+        finally {
+            if (!supplied) {
+                // A cleanup failure must not replace the reason the login failed.
+                await strategy.dispose?.().catch((error) => {
+                    this.logger?.warn('[AuthorizationCodeProvider] dispose failed', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                });
+            }
+        }
+        // The second net. A strategy that never called the builder — `staticCodeStrategy`
+        // holds its payload already — passed the first check by not participating in
+        // it, and would otherwise reach the exchange with a redirect_uri the
+        // pre-built URL never advertised, earning an opaque `invalid_grant`.
+        if (declaredRedirect && declaredRedirect !== outcome.redirectUri) {
+            throw new Error(mismatch(outcome.redirectUri));
+        }
+        this.logger?.info('[AuthorizationCodeProvider] Code received', {
+            redirectUri: outcome.redirectUri,
         });
-        // Parse expiration from JWT
-        const expiresIn = this.calculateExpiresIn(result.accessToken);
+        const result = await (0, browserAuth_1.exchangeCodeForToken)(authConfig, outcome.payload, outcome.redirectUri, this.logger);
         return {
             authorizationToken: result.accessToken,
             refreshToken: result.refreshToken,
             authType: interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE,
-            expiresIn,
+            expiresIn: this.calculateExpiresIn(result.accessToken),
         };
     }
     async performRefresh() {

package/dist/providers/DeviceFlowProvider.d.ts

@@ -4,7 +4,7 @@
  * Uses OAuth2 Device Flow for devices without browser or input capabilities.
  * User authorizes on another device by entering a code.
  */
-import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface DeviceFlowProviderConfig {
     uaaUrl: string;
@@ -13,6 +13,7 @@ export interface DeviceFlowProviderConfig {
     scope?: string;
     accessToken?: string;
     refreshToken?: string;
+    logger?: ILogger;
 }
 /**
  * Device Flow token provider

package/dist/providers/DeviceFlowProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/DeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAO9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,MAAM,CAA2B;gBAE7B,MAAM,EAAE,wBAAwB;IAa5C,SAAS,CAAC,WAAW,IAAI,eAAe;cAOxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cA0CrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA2BxD"}
+{"version":3,"file":"DeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/DeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,MAAM,CAA2B;gBAE7B,MAAM,EAAE,wBAAwB;IAc5C,SAAS,CAAC,WAAW,IAAI,eAAe;cAOxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAyCrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA2BxD"}

package/dist/providers/DeviceFlowProvider.js

@@ -8,6 +8,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeviceFlowProvider = void 0;
 const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const announce_1 = require("../auth/announce");
 const deviceFlowAuth_1 = require("../auth/deviceFlowAuth");
 const tokenRefresher_1 = require("../auth/tokenRefresher");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
@@ -22,6 +23,7 @@ class DeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
     constructor(config) {
         super();
         this.config = config;
+        this.logger = config.logger;
         if (config.accessToken) {
             this.authorizationToken = config.accessToken;
             this.expiresAt = this.parseExpirationFromJWT(config.accessToken);
@@ -38,19 +40,20 @@ class DeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
     }
     async performLogin() {
         // Initiate device flow
-        const deviceFlow = await (0, deviceFlowAuth_1.initiateDeviceFlow)(this.config.uaaUrl, this.config.clientId, this.config.scope, undefined);
-        // Display user code and verification URI
-        console.log('\n🔐 Device Flow Authorization');
-        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-        console.log(`📱 Go to: ${deviceFlow.verificationUri}`);
+        const deviceFlow = await (0, deviceFlowAuth_1.initiateDeviceFlow)(this.config.uaaUrl, this.config.clientId, this.config.scope, this.logger);
+        // Display user code and verification URI. This is a prompt the user must
+        // see to complete the flow, not a log line — it goes to the logger when
+        // there is one and to stderr otherwise, never to stdout.
+        const announce = (0, announce_1.announcer)(this.logger);
+        announce('Device Flow Authorization');
+        announce(`Go to: ${deviceFlow.verificationUri}`);
         if (deviceFlow.verificationUriComplete) {
-            console.log(`   Or use complete URL: ${deviceFlow.verificationUriComplete}`);
+            announce(`Or use complete URL: ${deviceFlow.verificationUriComplete}`);
         }
-        console.log(`🔑 Enter code: ${deviceFlow.userCode}`);
-        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-        console.log('⏳ Waiting for authorization...\n');
+        announce(`Enter code: ${deviceFlow.userCode}`);
+        announce('Waiting for authorization...');
         // Poll for tokens
-        const result = await (0, deviceFlowAuth_1.pollForDeviceTokens)(this.config.uaaUrl, this.config.clientId, this.config.clientSecret, deviceFlow.deviceCode, deviceFlow.interval, undefined);
+        const result = await (0, deviceFlowAuth_1.pollForDeviceTokens)(this.config.uaaUrl, this.config.clientId, this.config.clientSecret, deviceFlow.deviceCode, deviceFlow.interval, this.logger);
         const expiresIn = this.calculateExpiresIn(result.accessToken);
         return {
             authorizationToken: result.accessToken,

package/dist/providers/OidcBrowserProvider.d.ts

@@ -1,20 +1,18 @@
 /**
  * OIDC Authorization Code Provider (with PKCE)
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { IAuthorizationStrategy, ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { OidcCallbackResult } from '../auth/oidcBrowserAuth';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface OidcBrowserProviderConfig {
     issuerUrl?: string;
     clientId: string;
     clientSecret?: string;
     scopes?: string[];
-    browser?: string;
-    redirectPort?: number;
-    redirectUri?: string;
-    authorizationCode?: string;
-    authorizationCodeProvider?: () => Promise<string>;
     authorizationEndpoint?: string;
     tokenEndpoint?: string;
+    /** How the login is conducted. Omitted means a browser callback on the default port. */
+    authorization?: IAuthorizationStrategy<OidcCallbackResult>;
     accessToken?: string;
     refreshToken?: string;
     logger?: ILogger;
@@ -25,6 +23,5 @@ export declare class OidcBrowserProvider extends BaseTokenProvider {
     protected getAuthType(): OAuth2GrantType;
     protected performLogin(): Promise<ITokenResult>;
     protected performRefresh(): Promise<ITokenResult>;
-    private resolveAuthorizationCode;
 }
 //# sourceMappingURL=OidcBrowserProvider.d.ts.map

package/dist/providers/OidcBrowserProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcBrowserProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcBrowserProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAMlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAc7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAsFrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;YAoCzC,wBAAwB;CA8BvC"}
+{"version":3,"file":"OidcBrowserProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcBrowserProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,aAAa,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAc7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAyFrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAsCxD"}