@mcp-abap-adt/auth-providers 1.2.0 → 2.0.0

package/dist/auth/oidcBrowserAuth.js

@@ -2,110 +2,28 @@
 /**
  * OIDC browser authorization code flow (capture code)
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.startOidcBrowserAuth = startOidcBrowserAuth;
-const net = __importStar(require("node:net"));
+exports.withOidcCallbackServer = void 0;
 const callbackServer_1 = require("./callbackServer");
-const BROWSER_MAP = {
-    chrome: 'chrome',
-    edge: 'msedge',
-    firefox: 'firefox',
-    system: undefined,
-    auto: undefined,
-    headless: null,
-    none: null,
-};
-function isPortAvailable(port) {
-    return new Promise((resolve) => {
-        const server = net.createServer();
-        server.listen(port, () => {
-            server.once('close', () => resolve(true));
-            server.close();
-        });
-        server.on('error', () => resolve(false));
-    });
-}
-async function openBrowserUrl(authorizationUrl, browser, logger) {
-    const browserApp = BROWSER_MAP[browser];
-    if (browserApp === null) {
-        logger?.info('[OIDC] Browser suppressed, open URL manually', {
-            authorizationUrl,
-        });
-        return;
-    }
-    if (browser === 'auto') {
-        try {
-            const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-            const open = openModule.default;
-            await open(authorizationUrl);
-            logger?.info('[OIDC] Browser opened');
-            return;
-        }
-        catch (error) {
-            logger?.warn('[OIDC] Failed to open browser automatically', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            logger?.info('[OIDC] Open URL manually', { authorizationUrl });
-            return;
-        }
-    }
-    try {
-        const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-        const open = openModule.default;
-        if (browserApp) {
-            await open(authorizationUrl, { app: { name: browserApp } });
-        }
-        else {
-            await open(authorizationUrl);
-        }
-    }
-    catch (error) {
-        logger?.warn('[OIDC] Failed to open browser', {
-            error: error instanceof Error ? error.message : String(error),
-        });
-        logger?.info('[OIDC] Open URL manually', { authorizationUrl });
-    }
-}
 const withOidcCallbackServer = (options, use) => (0, callbackServer_1.runCallbackScope)(options, (app, settle) => {
     app.get('/callback', (req, res) => {
+        // An IdP that declines says so explicitly. That is a finished login,
+        // not a stray request, and it must not wait for the timeout.
+        const { error, error_description, error_uri } = req.query;
+        if (error) {
+            const message = error_description
+                ? `${String(error)}: ${String(error_description)}`
+                : String(error);
+            res.status(400).send(`Authentication failed: ${message}`);
+            settle.err(new Error(`OIDC authentication failed: ${message}` +
+                (error_uri ? ` (${String(error_uri)})` : '')), res);
+            return;
+        }
         const code = req.query.code;
         const state = req.query.state;
         if (!code || typeof code !== 'string') {
-            res.status(400).send('Missing authorization code');
-            settle.err(new Error('Missing authorization code'), res);
+            res.status(400).send('Error: not an authorization callback');
+            settle.ignore('no code and no error in query', res);
             return;
         }
         res
@@ -114,31 +32,4 @@ const withOidcCallbackServer = (options, use) => (0, callbackServer_1.runCallbac
         settle.ok({ code, state: typeof state === 'string' ? state : undefined }, res);
     });
 }, use);
-/**
- * OIDC browser login.
- *
- * The callback socket belongs to the scope: it is released when the scope ends,
- * whatever ends it. Before this, the flow had no timeout at all — an abandoned
- * login never settled and the port was held for the life of the process.
- */
-async function startOidcBrowserAuth(authorizationUrl, browser, logger, port = 3001, timeoutMs = 30 * 1000) {
-    // Pre-check kept for its message: AuthBroker matches /already in use/i to
-    // distinguish a busy port from other failures.
-    const portAvailable = await isPortAvailable(port);
-    if (!portAvailable) {
-        throw new Error(`Port ${port} is already in use. Please specify a different port or free the port.`);
-    }
-    return await withOidcCallbackServer({ port, timeoutMs }, async (server) => {
-        logger?.info('[OIDC] Callback server listening', { port: server.port });
-        const waiting = server.waitForResult();
-        // Not awaited: a launcher that hangs must not delay the timeout or the
-        // release of the port.
-        void openBrowserUrl(authorizationUrl, browser, logger).catch((error) => {
-            logger?.warn('[OIDC] Failed to open browser', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            logger?.info('[OIDC] Open URL manually', { authorizationUrl });
-        });
-        return await waiting;
-    });
-}
+exports.withOidcCallbackServer = withOidcCallbackServer;

package/dist/auth/saml2Auth.d.ts

@@ -1,7 +1,7 @@
 /**
  * SAML 2.0 auth helpers
  */
-import type { ILogger } from '@mcp-abap-adt/interfaces';
+import type { CallbackServerFactory } from '@mcp-abap-adt/interfaces';
 export interface Saml2AuthConfig {
     idpSsoUrl: string;
     spEntityId: string;
@@ -10,13 +10,6 @@ export interface Saml2AuthConfig {
     authorizationUrl?: string;
 }
 export declare function buildSamlAuthorizationUrl(config: Saml2AuthConfig): string;
-/**
- * SAML browser login.
- *
- * The callback socket belongs to the scope: it is released when the scope ends,
- * whatever ends it. Before this, the flow had no timeout at all — an abandoned
- * login never settled and the port was held for the life of the process.
- */
-export declare function startSamlBrowserAuth(config: Saml2AuthConfig, browser: string, logger?: ILogger, port?: number, timeoutMs?: number): Promise<string>;
+export declare const withSamlCallbackServer: CallbackServerFactory<string>;
 export declare function parseSamlNotOnOrAfter(samlResponse: string): number | undefined;
 //# sourceMappingURL=saml2Auth.d.ts.map

package/dist/auth/saml2Auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2Auth.d.ts","sourceRoot":"","sources":["../../src/auth/saml2Auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAIV,OAAO,EACR,MAAM,0BAA0B,CAAC;AAIlC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AA8CD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAazE;AA8ED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,MAAM,EACf,MAAM,CAAC,EAAE,OAAO,EAChB,IAAI,GAAE,MAAa,EACnB,SAAS,GAAE,MAAkB,GAC5B,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAYpB"}
+{"version":3,"file":"saml2Auth.d.ts","sourceRoot":"","sources":["../../src/auth/saml2Auth.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,OAAO,KAAK,EACV,qBAAqB,EAGtB,MAAM,0BAA0B,CAAC;AAIlC,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAyBD,wBAAgB,yBAAyB,CAAC,MAAM,EAAE,eAAe,GAAG,MAAM,CAazE;AAED,eAAO,MAAM,sBAAsB,EAAE,qBAAqB,CAAC,MAAM,CAgC9D,CAAC;AAEJ,wBAAgB,qBAAqB,CACnC,YAAY,EAAE,MAAM,GACnB,MAAM,GAAG,SAAS,CAYpB"}

package/dist/auth/saml2Auth.js

@@ -2,70 +2,17 @@
 /**
  * SAML 2.0 auth helpers
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.withSamlCallbackServer = void 0;
 exports.buildSamlAuthorizationUrl = buildSamlAuthorizationUrl;
-exports.startSamlBrowserAuth = startSamlBrowserAuth;
 exports.parseSamlNotOnOrAfter = parseSamlNotOnOrAfter;
 const node_crypto_1 = require("node:crypto");
-const net = __importStar(require("node:net"));
 const node_zlib_1 = require("node:zlib");
 const express_1 = __importDefault(require("express"));
 const callbackServer_1 = require("./callbackServer");
-const BROWSER_MAP = {
-    chrome: 'chrome',
-    edge: 'msedge',
-    firefox: 'firefox',
-    system: undefined,
-    auto: undefined,
-    headless: null,
-    none: null,
-};
-function isPortAvailable(port) {
-    return new Promise((resolve) => {
-        const server = net.createServer();
-        server.listen(port, () => {
-            server.once('close', () => resolve(true));
-            server.close();
-        });
-        server.on('error', () => resolve(false));
-    });
-}
 function base64Encode(input) {
     return Buffer.isBuffer(input)
         ? input.toString('base64')
@@ -99,59 +46,20 @@ function buildSamlAuthorizationUrl(config) {
         : '';
     return `${config.idpSsoUrl}?SAMLRequest=${samlRequest}${relayState}`;
 }
-async function openBrowserUrl(authorizationUrl, browser, logger) {
-    const browserApp = BROWSER_MAP[browser];
-    if (browserApp === null) {
-        logger?.info('[SAML] Browser suppressed, open URL manually', {
-            authorizationUrl,
-        });
-        return;
-    }
-    if (browser === 'auto') {
-        try {
-            const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-            const open = openModule.default;
-            await open(authorizationUrl);
-            logger?.info('[SAML] Browser opened');
-            return;
-        }
-        catch (error) {
-            logger?.warn('[SAML] Failed to open browser automatically', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            logger?.info('[SAML] Open URL manually', { authorizationUrl });
-            return;
-        }
-    }
-    try {
-        const openModule = await Promise.resolve().then(() => __importStar(require('open')));
-        const open = openModule.default;
-        if (browserApp) {
-            await open(authorizationUrl, { app: { name: browserApp } });
-        }
-        else {
-            await open(authorizationUrl);
-        }
-    }
-    catch (error) {
-        logger?.warn('[SAML] Failed to open browser', {
-            error: error instanceof Error ? error.message : String(error),
-        });
-        logger?.info('[SAML] Open URL manually', { authorizationUrl });
-    }
-}
 const withSamlCallbackServer = (options, use) => (0, callbackServer_1.runCallbackScope)(options, (app, settle) => {
     app.use(express_1.default.urlencoded({ extended: false, limit: '5mb' }));
     const handle = (samlResponse, res) => {
-        res
-            .status(200)
-            .send('SAML authentication complete. You can close this window.');
+        // The response is decided after the payload is examined. Answering 200
+        // first told a request that carried nothing that it had authenticated.
         if (typeof samlResponse === 'string' && samlResponse) {
+            res
+                .status(200)
+                .send('SAML authentication complete. You can close this window.');
             settle.ok(samlResponse, res);
+            return;
         }
-        else {
-            settle.err(new Error('Missing SAMLResponse'), res);
-        }
+        res.status(400).send('Error: not a SAML assertion callback');
+        settle.ignore('no SAMLResponse in the request', res);
     };
     app.post('/callback', (req, res) => {
         handle(req.body?.SAMLResponse, res);
@@ -160,35 +68,7 @@ const withSamlCallbackServer = (options, use) => (0, callbackServer_1.runCallbac
         handle(req.query.SAMLResponse, res);
     });
 }, use);
-/**
- * SAML browser login.
- *
- * The callback socket belongs to the scope: it is released when the scope ends,
- * whatever ends it. Before this, the flow had no timeout at all — an abandoned
- * login never settled and the port was held for the life of the process.
- */
-async function startSamlBrowserAuth(config, browser, logger, port = 3001, timeoutMs = 30 * 1000) {
-    // Pre-check kept for its message: AuthBroker matches /already in use/i to
-    // distinguish a busy port from other failures.
-    const portAvailable = await isPortAvailable(port);
-    if (!portAvailable) {
-        throw new Error(`Port ${port} is already in use. Please specify a different port or free the port.`);
-    }
-    const authorizationUrl = buildSamlAuthorizationUrl(config);
-    return await withSamlCallbackServer({ port, timeoutMs }, async (server) => {
-        logger?.info('[SAML] Callback server listening', { port: server.port });
-        const waiting = server.waitForResult();
-        // Not awaited: a launcher that hangs must not delay the timeout or the
-        // release of the port.
-        void openBrowserUrl(authorizationUrl, browser, logger).catch((error) => {
-            logger?.warn('[SAML] Failed to open browser', {
-                error: error instanceof Error ? error.message : String(error),
-            });
-            logger?.info('[SAML] Open URL manually', { authorizationUrl });
-        });
-        return await waiting;
-    });
-}
+exports.withSamlCallbackServer = withSamlCallbackServer;
 function parseSamlNotOnOrAfter(samlResponse) {
     try {
         const decoded = Buffer.from(samlResponse, 'base64').toString('utf8');

package/dist/index.d.ts

@@ -4,9 +4,15 @@
  *
  * Provides token providers
  */
+export { withBrowserCallbackServer } from './auth/callbackServer';
+export type { OidcCallbackResult } from './auth/oidcBrowserAuth';
+export { withOidcCallbackServer } from './auth/oidcBrowserAuth';
+export { withSamlCallbackServer } from './auth/saml2Auth';
 export { BrowserAuthError, RefreshError, ServiceKeyError, SessionDataError, TokenProviderError, ValidationError, } from './errors/TokenProviderErrors';
 export type { AuthorizationCodeProviderConfig, ClientCredentialsProviderConfig, DeviceFlowProviderConfig, OidcBrowserProviderConfig, OidcDeviceFlowProviderConfig, OidcPasswordProviderConfig, OidcTokenExchangeProviderConfig, Saml2BearerProviderConfig, Saml2PureProviderConfig, } from './providers';
 export { AuthorizationCodeProvider, BaseTokenProvider, ClientCredentialsProvider, DeviceFlowProvider, OidcBrowserProvider, OidcDeviceFlowProvider, OidcPasswordProvider, OidcTokenExchangeProvider, Saml2BearerProvider, Saml2PureProvider, } from './providers';
 export { SsoProviderFactory } from './sso/SsoProviderFactory';
 export type { SsoProviderConfig, SsoProviderInstance } from './sso/types';
+export type { BrowserCallbackStrategyOptions, CallbackStrategyOptions, ExternalCodeStrategyOptions, ManualStrategyOptions, StaticCodeStrategyOptions, } from './strategies';
+export { asOidcResult, BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, externalCodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, oidcCallbackStrategy, samlCallbackStrategy, staticCodeStrategy, } from './strategies';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAGrB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -6,7 +6,14 @@
  * Provides token providers
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SsoProviderFactory = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = void 0;
+exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
+// Callback server factories — "take the transport this package gives".
+var callbackServer_1 = require("./auth/callbackServer");
+Object.defineProperty(exports, "withBrowserCallbackServer", { enumerable: true, get: function () { return callbackServer_1.withBrowserCallbackServer; } });
+var oidcBrowserAuth_1 = require("./auth/oidcBrowserAuth");
+Object.defineProperty(exports, "withOidcCallbackServer", { enumerable: true, get: function () { return oidcBrowserAuth_1.withOidcCallbackServer; } });
+var saml2Auth_1 = require("./auth/saml2Auth");
+Object.defineProperty(exports, "withSamlCallbackServer", { enumerable: true, get: function () { return saml2Auth_1.withSamlCallbackServer; } });
 // Errors
 var TokenProviderErrors_1 = require("./errors/TokenProviderErrors");
 Object.defineProperty(exports, "BrowserAuthError", { enumerable: true, get: function () { return TokenProviderErrors_1.BrowserAuthError; } });
@@ -30,3 +37,16 @@ Object.defineProperty(exports, "Saml2PureProvider", { enumerable: true, get: fun
 // SSO factory
 var SsoProviderFactory_1 = require("./sso/SsoProviderFactory");
 Object.defineProperty(exports, "SsoProviderFactory", { enumerable: true, get: function () { return SsoProviderFactory_1.SsoProviderFactory; } });
+// Authorization strategies — or bring your own IAuthorizationStrategy.
+var strategies_1 = require("./strategies");
+Object.defineProperty(exports, "asOidcResult", { enumerable: true, get: function () { return strategies_1.asOidcResult; } });
+Object.defineProperty(exports, "BrowserCallbackStrategy", { enumerable: true, get: function () { return strategies_1.BrowserCallbackStrategy; } });
+Object.defineProperty(exports, "browserCallbackStrategy", { enumerable: true, get: function () { return strategies_1.browserCallbackStrategy; } });
+Object.defineProperty(exports, "DEFAULT_CALLBACK_PORT", { enumerable: true, get: function () { return strategies_1.DEFAULT_CALLBACK_PORT; } });
+Object.defineProperty(exports, "DEFAULT_LOGIN_TIMEOUT_MS", { enumerable: true, get: function () { return strategies_1.DEFAULT_LOGIN_TIMEOUT_MS; } });
+Object.defineProperty(exports, "externalCodeStrategy", { enumerable: true, get: function () { return strategies_1.externalCodeStrategy; } });
+Object.defineProperty(exports, "manualPasteStrategy", { enumerable: true, get: function () { return strategies_1.manualPasteStrategy; } });
+Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true, get: function () { return strategies_1.manualSamlResponseStrategy; } });
+Object.defineProperty(exports, "oidcCallbackStrategy", { enumerable: true, get: function () { return strategies_1.oidcCallbackStrategy; } });
+Object.defineProperty(exports, "samlCallbackStrategy", { enumerable: true, get: function () { return strategies_1.samlCallbackStrategy; } });
+Object.defineProperty(exports, "staticCodeStrategy", { enumerable: true, get: function () { return strategies_1.staticCodeStrategy; } });

package/dist/providers/AuthorizationCodeProvider.d.ts

@@ -4,15 +4,19 @@
  * Uses authorization_code grant type with browser-based OAuth2 flow.
  * Supports pre-built authorization URLs and automatic refresh.
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { IAuthorizationStrategy, ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface AuthorizationCodeProviderConfig {
     uaaUrl: string;
     clientId: string;
     clientSecret: string;
+    /** Pre-built authorization URL. Carries its own redirect; see the guard below. */
     authorizationUrl?: string;
-    browser?: string;
-    redirectPort?: number;
+    /**
+     * How the login is conducted. Omitted means a browser callback on the default
+     * port — the package's own transport, which a consumer may replace wholesale.
+     */
+    authorization?: IAuthorizationStrategy<string>;
     accessToken?: string;
     refreshToken?: string;
     logger?: ILogger;

package/dist/providers/AuthorizationCodeProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthorizationCodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/AuthorizationCodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAEV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAKxD,MAAM,WAAW,+BAA+B;IAE9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAGrB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAG1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAGtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IA8D7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAoErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA0CxD"}
+{"version":3,"file":"AuthorizationCodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/AuthorizationCodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAEV,sBAAsB,EACtB,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAE9C,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IAErB,kFAAkF;IAClF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;OAGG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAG/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IA4D7C,SAAS,IAAI,OAAO,CAAC,YAAY,CAAC;IAIxC,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cA+ErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA0CxD"}

package/dist/providers/AuthorizationCodeProvider.js

@@ -10,9 +10,8 @@ exports.AuthorizationCodeProvider = void 0;
 const interfaces_1 = require("@mcp-abap-adt/interfaces");
 const browserAuth_1 = require("../auth/browserAuth");
 const tokenRefresher_1 = require("../auth/tokenRefresher");
+const strategies_1 = require("../strategies");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
-/** How long an interactive login may wait for its callback. */
-const LOGIN_TIMEOUT_MS = 30 * 1000;
 /**
  * Authorization Code token provider
  *
@@ -32,8 +31,6 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
             hasRefreshToken: !!config.refreshToken,
             accessToken: this.formatToken(config.accessToken),
             refreshToken: this.formatToken(config.refreshToken),
-            browser: config.browser || 'none',
-            redirectPort: config.redirectPort || 3001,
         });
         const missingFields = [];
         if (!config.uaaUrl) {
@@ -78,53 +75,67 @@ class AuthorizationCodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE;
     }
     async performLogin() {
-        // Build authorization config
-        // If authorizationUrl is provided, use it; otherwise startBrowserAuth will build it from uaaUrl + clientId
         const authConfig = {
             uaaUrl: this.config.uaaUrl,
             uaaClientId: this.config.clientId,
             uaaClientSecret: this.config.clientSecret,
         };
-        // If pre-built URL provided, use it
-        if (this.config.authorizationUrl) {
-            authConfig.authorizationUrl = this.config.authorizationUrl;
+        const prebuilt = this.config.authorizationUrl;
+        const declaredRedirect = prebuilt
+            ? new URL(prebuilt).searchParams.get('redirect_uri')
+            : null;
+        const mismatch = (redirectUri) => `Pre-built authorizationUrl declares redirect_uri ${declaredRedirect}, ` +
+            `but the authorization strategy used ${redirectUri}, which does not match. ` +
+            'An ephemeral port cannot be used with a pre-built URL.';
+        // The provider owns the URL; the strategy owns where it is answered. The
+        // guard lives here rather than after the fact because a mismatched redirect
+        // produces no callback at all — checking the outcome would mean waiting for
+        // a timeout that explains nothing.
+        const request = {
+            logger: this.logger,
+            buildAuthorizationUrl: async (redirectUri) => {
+                if (prebuilt) {
+                    if (declaredRedirect && declaredRedirect !== redirectUri) {
+                        throw new Error(mismatch(redirectUri));
+                    }
+                    return prebuilt;
+                }
+                return (0, browserAuth_1.getJwtAuthorizationUrl)(authConfig, redirectUri);
+            },
+        };
+        // Constructed here means disposed here: whoever constructs, disposes.
+        const supplied = this.config.authorization;
+        const strategy = supplied ?? (0, strategies_1.browserCallbackStrategy)();
+        let outcome;
+        try {
+            outcome = await strategy.authorize(request);
         }
-        // Use provided browser or default to 'none' (prints URL to console)
-        const browser = this.config.browser || 'none';
-        const redirectPort = this.config.redirectPort || 3001;
-        // Build authorization URL for logging (same logic as in startBrowserAuth)
-        const authorizationUrl = authConfig.authorizationUrl ??
-            `${authConfig.uaaUrl}/oauth/authorize?client_id=${encodeURIComponent(authConfig.uaaClientId)}&redirect_uri=${encodeURIComponent(`http://localhost:${redirectPort}/callback`)}&response_type=code`;
-        this.logger?.info('[AuthorizationCodeProvider] Performing login via browser', {
-            browser,
-            redirectPort,
-            authorizationUrl,
-            uaaUrl: authConfig.uaaUrl,
-            clientId: authConfig.uaaClientId,
-        });
-        // One timeout, owned by whoever owns the socket.
-        //
-        // This used to race startBrowserAuth against a second timer of the same
-        // 30 seconds, so which fired was down to scheduling — and when the outer
-        // one won, the provider rejected while the callback port was still bound.
-        // That timer was never cleared either, keeping the event loop alive for the
-        // rest of the window after a login that succeeded in a second.
-        const result = await (0, browserAuth_1.startBrowserAuth)(authConfig, browser, this.logger || undefined, // Pass logger to browserAuth
-        redirectPort, LOGIN_TIMEOUT_MS);
-        this.logger?.info('[AuthorizationCodeProvider] Login completed', {
-            hasAccessToken: !!result.accessToken,
-            hasRefreshToken: !!result.refreshToken,
-            accessToken: this.formatToken(result.accessToken),
-            refreshToken: this.formatToken(result.refreshToken),
-            accessTokenLength: result.accessToken?.length || 0,
+        finally {
+            if (!supplied) {
+                // A cleanup failure must not replace the reason the login failed.
+                await strategy.dispose?.().catch((error) => {
+                    this.logger?.warn('[AuthorizationCodeProvider] dispose failed', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                });
+            }
+        }
+        // The second net. A strategy that never called the builder — `staticCodeStrategy`
+        // holds its payload already — passed the first check by not participating in
+        // it, and would otherwise reach the exchange with a redirect_uri the
+        // pre-built URL never advertised, earning an opaque `invalid_grant`.
+        if (declaredRedirect && declaredRedirect !== outcome.redirectUri) {
+            throw new Error(mismatch(outcome.redirectUri));
+        }
+        this.logger?.info('[AuthorizationCodeProvider] Code received', {
+            redirectUri: outcome.redirectUri,
         });
-        // Parse expiration from JWT
-        const expiresIn = this.calculateExpiresIn(result.accessToken);
+        const result = await (0, browserAuth_1.exchangeCodeForToken)(authConfig, outcome.payload, outcome.redirectUri, this.logger);
         return {
             authorizationToken: result.accessToken,
             refreshToken: result.refreshToken,
             authType: interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE,
-            expiresIn,
+            expiresIn: this.calculateExpiresIn(result.accessToken),
         };
     }
     async performRefresh() {

package/dist/providers/DeviceFlowProvider.d.ts

@@ -4,7 +4,7 @@
  * Uses OAuth2 Device Flow for devices without browser or input capabilities.
  * User authorizes on another device by entering a code.
  */
-import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface DeviceFlowProviderConfig {
     uaaUrl: string;
@@ -13,6 +13,7 @@ export interface DeviceFlowProviderConfig {
     scope?: string;
     accessToken?: string;
     refreshToken?: string;
+    logger?: ILogger;
 }
 /**
  * Device Flow token provider

package/dist/providers/DeviceFlowProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"DeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/DeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAO9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,MAAM,CAA2B;gBAE7B,MAAM,EAAE,wBAAwB;IAa5C,SAAS,CAAC,WAAW,IAAI,eAAe;cAOxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cA0CrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA2BxD"}
+{"version":3,"file":"DeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/DeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,MAAM,CAA2B;gBAE7B,MAAM,EAAE,wBAAwB;IAc5C,SAAS,CAAC,WAAW,IAAI,eAAe;cAOxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAyCrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA2BxD"}