@mcp-abap-adt/auth-providers 1.2.0 → 2.0.0

package/dist/providers/DeviceFlowProvider.js

@@ -8,6 +8,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DeviceFlowProvider = void 0;
 const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const announce_1 = require("../auth/announce");
 const deviceFlowAuth_1 = require("../auth/deviceFlowAuth");
 const tokenRefresher_1 = require("../auth/tokenRefresher");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
@@ -22,6 +23,7 @@ class DeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
     constructor(config) {
         super();
         this.config = config;
+        this.logger = config.logger;
         if (config.accessToken) {
             this.authorizationToken = config.accessToken;
             this.expiresAt = this.parseExpirationFromJWT(config.accessToken);
@@ -38,19 +40,20 @@ class DeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
     }
     async performLogin() {
         // Initiate device flow
-        const deviceFlow = await (0, deviceFlowAuth_1.initiateDeviceFlow)(this.config.uaaUrl, this.config.clientId, this.config.scope, undefined);
-        // Display user code and verification URI
-        console.log('\n🔐 Device Flow Authorization');
-        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-        console.log(`📱 Go to: ${deviceFlow.verificationUri}`);
+        const deviceFlow = await (0, deviceFlowAuth_1.initiateDeviceFlow)(this.config.uaaUrl, this.config.clientId, this.config.scope, this.logger);
+        // Display user code and verification URI. This is a prompt the user must
+        // see to complete the flow, not a log line — it goes to the logger when
+        // there is one and to stderr otherwise, never to stdout.
+        const announce = (0, announce_1.announcer)(this.logger);
+        announce('Device Flow Authorization');
+        announce(`Go to: ${deviceFlow.verificationUri}`);
         if (deviceFlow.verificationUriComplete) {
-            console.log(`   Or use complete URL: ${deviceFlow.verificationUriComplete}`);
+            announce(`Or use complete URL: ${deviceFlow.verificationUriComplete}`);
         }
-        console.log(`🔑 Enter code: ${deviceFlow.userCode}`);
-        console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-        console.log('⏳ Waiting for authorization...\n');
+        announce(`Enter code: ${deviceFlow.userCode}`);
+        announce('Waiting for authorization...');
         // Poll for tokens
-        const result = await (0, deviceFlowAuth_1.pollForDeviceTokens)(this.config.uaaUrl, this.config.clientId, this.config.clientSecret, deviceFlow.deviceCode, deviceFlow.interval, undefined);
+        const result = await (0, deviceFlowAuth_1.pollForDeviceTokens)(this.config.uaaUrl, this.config.clientId, this.config.clientSecret, deviceFlow.deviceCode, deviceFlow.interval, this.logger);
         const expiresIn = this.calculateExpiresIn(result.accessToken);
         return {
             authorizationToken: result.accessToken,

package/dist/providers/OidcBrowserProvider.d.ts

@@ -1,20 +1,18 @@
 /**
  * OIDC Authorization Code Provider (with PKCE)
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { IAuthorizationStrategy, ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { OidcCallbackResult } from '../auth/oidcBrowserAuth';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface OidcBrowserProviderConfig {
     issuerUrl?: string;
     clientId: string;
     clientSecret?: string;
     scopes?: string[];
-    browser?: string;
-    redirectPort?: number;
-    redirectUri?: string;
-    authorizationCode?: string;
-    authorizationCodeProvider?: () => Promise<string>;
     authorizationEndpoint?: string;
     tokenEndpoint?: string;
+    /** How the login is conducted. Omitted means a browser callback on the default port. */
+    authorization?: IAuthorizationStrategy<OidcCallbackResult>;
     accessToken?: string;
     refreshToken?: string;
     logger?: ILogger;
@@ -25,6 +23,5 @@ export declare class OidcBrowserProvider extends BaseTokenProvider {
     protected getAuthType(): OAuth2GrantType;
     protected performLogin(): Promise<ITokenResult>;
     protected performRefresh(): Promise<ITokenResult>;
-    private resolveAuthorizationCode;
 }
 //# sourceMappingURL=OidcBrowserProvider.d.ts.map

package/dist/providers/OidcBrowserProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcBrowserProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcBrowserProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAMlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,yBAAyB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAc7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAsFrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;YAoCzC,wBAAwB;CA8BvC"}
+{"version":3,"file":"OidcBrowserProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcBrowserProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAKlE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wFAAwF;IACxF,aAAa,CAAC,EAAE,sBAAsB,CAAC,kBAAkB,CAAC,CAAC;IAC3D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAc7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAyFrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAsCxD"}

package/dist/providers/OidcBrowserProvider.js

@@ -5,10 +5,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OidcBrowserProvider = void 0;
 const interfaces_1 = require("@mcp-abap-adt/interfaces");
-const oidcBrowserAuth_1 = require("../auth/oidcBrowserAuth");
 const oidcDiscovery_1 = require("../auth/oidcDiscovery");
 const oidcPkce_1 = require("../auth/oidcPkce");
 const oidcToken_1 = require("../auth/oidcToken");
+const strategies_1 = require("../strategies");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 class OidcBrowserProvider extends BaseTokenProvider_1.BaseTokenProvider {
     config;
@@ -28,50 +28,62 @@ class OidcBrowserProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return interfaces_1.AUTH_TYPE_AUTHORIZATION_CODE_PKCE;
     }
     async performLogin() {
-        const needsAuthorizationEndpoint = !this.config.authorizationCode && !this.config.authorizationCodeProvider;
-        const requiresDiscovery = (needsAuthorizationEndpoint && !this.config.authorizationEndpoint) ||
-            !this.config.tokenEndpoint;
+        // One memoised discovery per login, started on first use rather than up
+        // front: a strategy that already holds a code must not drag in a request —
+        // nor the `issuerUrl` requirement that comes with it.
         let discovery = null;
-        if (requiresDiscovery) {
-            if (!this.config.issuerUrl) {
-                throw new Error('OIDC issuerUrl is required when discovery is used');
+        const discover = () => {
+            if (!discovery) {
+                if (!this.config.issuerUrl) {
+                    throw new Error('OIDC issuerUrl is required when discovery is used');
+                }
+                discovery = (0, oidcDiscovery_1.discoverOidc)(this.config.issuerUrl, this.logger);
             }
-            discovery = await (0, oidcDiscovery_1.discoverOidc)(this.config.issuerUrl, this.logger);
+            return discovery;
+        };
+        const verifier = (0, oidcPkce_1.generatePkceVerifier)();
+        const challenge = (0, oidcPkce_1.generatePkceChallenge)(verifier);
+        const scope = (this.config.scopes && this.config.scopes.length > 0
+            ? this.config.scopes
+            : ['openid', 'profile', 'email']).join(' ');
+        const request = {
+            logger: this.logger,
+            buildAuthorizationUrl: async (redirectUri) => {
+                const endpoint = this.config.authorizationEndpoint ??
+                    (await discover()).authorization_endpoint;
+                if (!endpoint) {
+                    throw new Error('OIDC authorization endpoint is required (authorizationEndpoint or discovery)');
+                }
+                const params = new URLSearchParams();
+                params.append('response_type', 'code');
+                params.append('client_id', this.config.clientId);
+                params.append('redirect_uri', redirectUri);
+                params.append('scope', scope);
+                params.append('code_challenge', challenge);
+                params.append('code_challenge_method', 'S256');
+                return `${endpoint}?${params.toString()}`;
+            },
+        };
+        const supplied = this.config.authorization;
+        const strategy = supplied ?? (0, strategies_1.oidcCallbackStrategy)();
+        let outcome;
+        try {
+            outcome = await strategy.authorize(request);
         }
-        const authorizationEndpoint = needsAuthorizationEndpoint
-            ? this.config.authorizationEndpoint || discovery?.authorization_endpoint
-            : undefined;
-        const tokenEndpoint = this.config.tokenEndpoint || discovery?.token_endpoint;
-        if (needsAuthorizationEndpoint && !authorizationEndpoint) {
-            throw new Error('OIDC authorization endpoint is required (authorizationEndpoint or discovery)');
+        finally {
+            if (!supplied) {
+                await strategy.dispose?.().catch((error) => {
+                    this.logger?.warn('[OidcBrowserProvider] dispose failed', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                });
+            }
         }
+        const tokenEndpoint = this.config.tokenEndpoint ?? (await discover()).token_endpoint;
         if (!tokenEndpoint) {
             throw new Error('OIDC token endpoint is required (tokenEndpoint or discovery)');
         }
-        const redirectPort = this.config.redirectPort || 3001;
-        const redirectUri = this.config.redirectUri || `http://localhost:${redirectPort}/callback`;
-        if (needsAuthorizationEndpoint && this.config.redirectUri) {
-            if (!redirectUri.startsWith('http://localhost:')) {
-                throw new Error('OIDC redirectUri must be localhost for browser callback flow');
-            }
-        }
-        const scope = (this.config.scopes && this.config.scopes.length > 0
-            ? this.config.scopes
-            : ['openid', 'profile', 'email']).join(' ');
-        const verifier = (0, oidcPkce_1.generatePkceVerifier)();
-        const challenge = (0, oidcPkce_1.generatePkceChallenge)(verifier);
-        const params = new URLSearchParams();
-        params.append('response_type', 'code');
-        params.append('client_id', this.config.clientId);
-        params.append('redirect_uri', redirectUri);
-        params.append('scope', scope);
-        params.append('code_challenge', challenge);
-        params.append('code_challenge_method', 'S256');
-        const authorizationUrl = needsAuthorizationEndpoint
-            ? `${authorizationEndpoint}?${params.toString()}`
-            : undefined;
-        const code = await this.resolveAuthorizationCode(authorizationUrl, redirectPort);
-        const tokens = await (0, oidcToken_1.exchangeAuthorizationCode)(tokenEndpoint, this.config.clientId, this.config.clientSecret, code, redirectUri, verifier, this.logger);
+        const tokens = await (0, oidcToken_1.exchangeAuthorizationCode)(tokenEndpoint, this.config.clientId, this.config.clientSecret, outcome.payload.code, outcome.redirectUri, verifier, this.logger);
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,
@@ -91,7 +103,10 @@ class OidcBrowserProvider extends BaseTokenProvider_1.BaseTokenProvider {
             }
             discovery = await (0, oidcDiscovery_1.discoverOidc)(this.config.issuerUrl, this.logger);
         }
-        const tokenEndpoint = this.config.tokenEndpoint || discovery?.token_endpoint;
+        // `??`, matching the `=== undefined` gate above and the login path: `||`
+        // treated a configured-but-empty endpoint as absent while the gate had
+        // already decided it was present, so the two disagreed about the same value.
+        const tokenEndpoint = this.config.tokenEndpoint ?? discovery?.token_endpoint;
         if (!tokenEndpoint) {
             throw new Error('OIDC token endpoint is required (tokenEndpoint or discovery)');
         }
@@ -104,23 +119,5 @@ class OidcBrowserProvider extends BaseTokenProvider_1.BaseTokenProvider {
             tokenType: 'jwt',
         };
     }
-    async resolveAuthorizationCode(authorizationUrl, redirectPort) {
-        if (this.config.authorizationCode) {
-            return this.config.authorizationCode;
-        }
-        if (this.config.authorizationCodeProvider) {
-            const code = await this.config.authorizationCodeProvider();
-            if (!code) {
-                throw new Error('Authorization code provider returned empty value');
-            }
-            return code;
-        }
-        if (!authorizationUrl) {
-            throw new Error('OIDC authorization URL is required when using browser flow');
-        }
-        const browser = this.config.browser || 'auto';
-        const { code } = await (0, oidcBrowserAuth_1.startOidcBrowserAuth)(authorizationUrl, browser, this.logger, redirectPort);
-        return code;
-    }
 }
 exports.OidcBrowserProvider = OidcBrowserProvider;

package/dist/providers/OidcDeviceFlowProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcDeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcDeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAQlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D,OAAO,CAAC,MAAM,CAA+B;gBAEjC,MAAM,EAAE,4BAA4B;IAchD,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAuErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqCxD"}
+{"version":3,"file":"OidcDeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcDeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AASlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,4BAA4B;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,2BAA2B,CAAC,EAAE,MAAM,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,sBAAuB,SAAQ,iBAAiB;IAC3D,OAAO,CAAC,MAAM,CAA+B;gBAEjC,MAAM,EAAE,4BAA4B;IAchD,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAwErC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqCxD"}

package/dist/providers/OidcDeviceFlowProvider.js

@@ -5,6 +5,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OidcDeviceFlowProvider = void 0;
 const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const announce_1 = require("../auth/announce");
 const oidcDiscovery_1 = require("../auth/oidcDiscovery");
 const oidcToken_1 = require("../auth/oidcToken");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
@@ -50,15 +51,16 @@ class OidcDeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
         }
         const scope = this.config.scopes?.join(' ');
         const deviceFlow = await (0, oidcToken_1.initiateDeviceAuthorization)(deviceAuthorizationEndpoint, this.config.clientId, scope, this.logger);
-        // Manual user guidance
-        console.log('');
-        console.log('OIDC device authorization');
-        console.log('Go to:', deviceFlow.verificationUri);
+        // Manual user guidance. This is a prompt the user must see to complete
+        // the flow, not a log line — it goes to the logger when there is one and
+        // to stderr otherwise, never to stdout.
+        const announce = (0, announce_1.announcer)(this.logger);
+        announce('OIDC device authorization');
+        announce(`Go to: ${deviceFlow.verificationUri}`);
         if (deviceFlow.verificationUriComplete) {
-            console.log('Or use:', deviceFlow.verificationUriComplete);
+            announce(`Or use: ${deviceFlow.verificationUriComplete}`);
         }
-        console.log('Enter code:', deviceFlow.userCode);
-        console.log('');
+        announce(`Enter code: ${deviceFlow.userCode}`);
         const tokens = await (0, oidcToken_1.pollDeviceTokens)(tokenEndpoint, this.config.clientId, this.config.clientSecret, deviceFlow.deviceCode, deviceFlow.interval || 5, this.logger);
         return {
             authorizationToken: tokens.accessToken,

package/dist/providers/Saml2BearerProvider.d.ts

@@ -5,8 +5,8 @@
  */
 import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
 import { BaseTokenProvider } from './BaseTokenProvider';
-import type { Saml2AssertionConfig, Saml2BearerExchangeConfig } from './saml2Utils';
-export interface Saml2BearerProviderConfig extends Saml2AssertionConfig, Saml2BearerExchangeConfig {
+import type { Saml2BearerExchangeConfig, Saml2CommonConfig } from './saml2Utils';
+export interface Saml2BearerProviderConfig extends Saml2CommonConfig, Saml2BearerExchangeConfig {
     logger?: ILogger;
     accessToken?: string;
     refreshToken?: string;

package/dist/providers/Saml2BearerProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,cAAc,CAAC;AAGtB,MAAM,WAAW,yBACf,SAAQ,oBAAoB,EAC1B,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAc7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAoBrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAMxD"}
+{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAiB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAoBrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAMxD"}

package/dist/providers/Saml2BearerProvider.js

@@ -14,6 +14,9 @@ class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
     config;
     constructor(config) {
         super();
+        // A pre-built URL with no declared ACS cannot be verified against whatever
+        // the strategy binds, so it is refused here rather than at login time.
+        (0, saml2Utils_1.validateSamlConfig)(config);
         this.config = config;
         this.logger = config.logger;
         if (config.accessToken) {

package/dist/providers/Saml2PureProvider.d.ts

@@ -5,8 +5,8 @@
  */
 import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
 import { BaseTokenProvider } from './BaseTokenProvider';
-import type { Saml2AssertionConfig } from './saml2Utils';
-export interface Saml2PureProviderConfig extends Saml2AssertionConfig {
+import type { Saml2CommonConfig } from './saml2Utils';
+export interface Saml2PureProviderConfig extends Saml2CommonConfig {
     logger?: ILogger;
     cookieProvider: (samlResponse: string) => Promise<string>;
 }

package/dist/providers/Saml2PureProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2PureProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2PureProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACnE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;IACtD,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,uBAAuB;IAO3C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAarC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxD"}
+{"version":3,"file":"Saml2PureProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2PureProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;IACtD,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,uBAAuB;IAU3C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAarC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxD"}

package/dist/providers/Saml2PureProvider.js

@@ -14,6 +14,9 @@ class Saml2PureProvider extends BaseTokenProvider_1.BaseTokenProvider {
     config;
     constructor(config) {
         super();
+        // A pre-built URL with no declared ACS cannot be verified against whatever
+        // the strategy binds, so it is refused here rather than at login time.
+        (0, saml2Utils_1.validateSamlConfig)(config);
         this.config = config;
         this.logger = config.logger;
         this.tokenType = 'saml';

package/dist/providers/saml2Utils.d.ts

@@ -1,30 +1,30 @@
 /**
- * SAML2 provider shared helpers
+ * SAML2 provider shared helpers.
  */
-import type { ILogger } from '@mcp-abap-adt/interfaces';
-export type Saml2AssertionFlow = 'browser' | 'manual' | 'assertion';
+import type { IAuthorizationStrategy, ILogger } from '@mcp-abap-adt/interfaces';
 export interface Saml2CommonConfig {
     idpSsoUrl: string;
     spEntityId: string;
+    /**
+     * Where the assertion is delivered. Required when `authorizationUrl` is set:
+     * the ACS is then buried in a deflated `SAMLRequest` this package did not
+     * build and cannot read, so it must be declared rather than inferred.
+     */
     acsUrl?: string;
     relayState?: string;
     authorizationUrl?: string;
-    browser?: string;
-    redirectPort?: number;
+    /** How the login is conducted. Omitted means a browser callback. */
+    authorization?: IAuthorizationStrategy<string>;
     logger?: ILogger;
 }
-export interface Saml2AssertionConfig extends Saml2CommonConfig {
-    assertionFlow: Saml2AssertionFlow;
-    assertionProvider?: () => Promise<string>;
-    manualInput?: () => Promise<string>;
-}
 export interface Saml2BearerExchangeConfig {
     tokenUrl?: string;
     uaaUrl?: string;
     clientId?: string;
     clientSecret?: string;
 }
-export declare function resolveAcsUrl(config: Saml2CommonConfig): string;
+/** Throw at construction rather than half-verify at runtime. */
+export declare function validateSamlConfig(config: Saml2CommonConfig): void;
 export declare function resolveTokenUrl(config: Saml2BearerExchangeConfig): string;
-export declare function getSamlAssertion(config: Saml2AssertionConfig): Promise<string>;
+export declare function getSamlAssertion(config: Saml2CommonConfig): Promise<string>;
 //# sourceMappingURL=saml2Utils.d.ts.map

package/dist/providers/saml2Utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2Utils.d.ts","sourceRoot":"","sources":["../../src/providers/saml2Utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAOxD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpE,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,aAAa,EAAE,kBAAkB,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAG/D;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAQzE;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAiCjB"}
+{"version":3,"file":"saml2Utils.d.ts","sourceRoot":"","sources":["../../src/providers/saml2Utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAIhF,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAOlE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAQzE;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,MAAM,CAAC,CA+CjB"}

package/dist/providers/saml2Utils.js

@@ -1,16 +1,19 @@
 "use strict";
 /**
- * SAML2 provider shared helpers
+ * SAML2 provider shared helpers.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveAcsUrl = resolveAcsUrl;
+exports.validateSamlConfig = validateSamlConfig;
 exports.resolveTokenUrl = resolveTokenUrl;
 exports.getSamlAssertion = getSamlAssertion;
-const manualInput_1 = require("../auth/manualInput");
 const saml2Auth_1 = require("../auth/saml2Auth");
-function resolveAcsUrl(config) {
-    const port = config.redirectPort || 3001;
-    return config.acsUrl || `http://localhost:${port}/callback`;
+const strategies_1 = require("../strategies");
+/** Throw at construction rather than half-verify at runtime. */
+function validateSamlConfig(config) {
+    if (config.authorizationUrl && !config.acsUrl) {
+        throw new Error('acsUrl is required when authorizationUrl is set: the ACS inside a ' +
+            'pre-built SAML request cannot be read, so it must be declared.');
+    }
 }
 function resolveTokenUrl(config) {
     if (config.tokenUrl) {
@@ -22,28 +25,45 @@ function resolveTokenUrl(config) {
     throw new Error('Missing tokenUrl or uaaUrl for SAML bearer exchange');
 }
 async function getSamlAssertion(config) {
-    const acsUrl = resolveAcsUrl(config);
-    const authConfig = {
-        idpSsoUrl: config.idpSsoUrl,
-        spEntityId: config.spEntityId,
-        acsUrl,
-        relayState: config.relayState,
-        authorizationUrl: config.authorizationUrl,
+    const declaredAcs = config.acsUrl;
+    const request = {
+        logger: config.logger,
+        buildAuthorizationUrl: async (redirectUri) => {
+            // A declared ACS is registered with the IdP; the strategy must be
+            // listening exactly there, and an ephemeral port cannot be.
+            const acsUrl = declaredAcs ?? redirectUri;
+            if (declaredAcs && declaredAcs !== redirectUri) {
+                throw new Error(`SAML acsUrl is ${declaredAcs}, but the authorization strategy is ` +
+                    `listening on ${redirectUri}. They must match.`);
+            }
+            return (0, saml2Auth_1.buildSamlAuthorizationUrl)({
+                idpSsoUrl: config.idpSsoUrl,
+                spEntityId: config.spEntityId,
+                acsUrl,
+                relayState: config.relayState,
+                authorizationUrl: config.authorizationUrl,
+            });
+        },
     };
-    if (config.assertionFlow === 'assertion') {
-        if (!config.assertionProvider) {
-            throw new Error('assertionProvider is required for assertion flow');
+    const supplied = config.authorization;
+    const strategy = supplied ?? (0, strategies_1.samlCallbackStrategy)();
+    try {
+        const outcome = await strategy.authorize(request);
+        // The second net, for a strategy that never called the builder and so
+        // never met the check inside it.
+        if (declaredAcs && declaredAcs !== outcome.redirectUri) {
+            throw new Error(`SAML acsUrl is ${declaredAcs}, but the authorization strategy used ` +
+                `${outcome.redirectUri}. They must match.`);
         }
-        return await config.assertionProvider();
+        return outcome.payload;
     }
-    if (config.assertionFlow === 'manual') {
-        const authorizationUrl = (0, saml2Auth_1.buildSamlAuthorizationUrl)(authConfig);
-        config.logger?.info('[SAML] Open URL to authenticate', {
-            authorizationUrl,
-        });
-        const input = config.manualInput || manualInput_1.readManualInput;
-        return await input('Paste SAMLResponse: ');
+    finally {
+        if (!supplied) {
+            await strategy.dispose?.().catch((error) => {
+                config.logger?.warn('[SAML] dispose failed', {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            });
+        }
     }
-    const browser = config.browser || 'auto';
-    return await (0, saml2Auth_1.startSamlBrowserAuth)(authConfig, browser, config.logger, config.redirectPort || 3001);
 }

package/dist/strategies/BrowserCallbackStrategy.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Reaching the authorization URL with a browser, receiving the redirect on a
+ * local socket.
+ *
+ * The transport is injected rather than assumed: a consumer that already runs
+ * an HTTP server can pass its own `CallbackServerFactory` and keep everything
+ * else here.
+ */
+import type { AuthorizationOutcome, AuthorizationRequest, CallbackServerFactory, IAuthorizationStrategy } from '@mcp-abap-adt/interfaces';
+import type { OidcCallbackResult } from '../auth/oidcBrowserAuth';
+/**
+ * Above Linux's `ip_local_port_range` (32768–60999), so an outbound connection
+ * never squats on it, and far from the 3001/3333 range application servers use.
+ */
+export declare const DEFAULT_CALLBACK_PORT = 61001;
+/** How long an interactive login may wait for its callback. */
+export declare const DEFAULT_LOGIN_TIMEOUT_MS = 30000;
+export interface CallbackStrategyOptions<TResult = string> {
+    /** `0` binds an ephemeral port. Unusable where the IdP has a registered URI. */
+    port?: number;
+    timeoutMs?: number;
+    /** 'none' | 'headless' print the URL; 'auto' | 'system' | 'chrome' | … open it. */
+    browser?: string;
+    /**
+     * The transport. Omitted means the one this package ships for the flow; a
+     * consumer that already runs an HTTP server passes its own here and keeps
+     * everything else — which is the point of the ready constructors existing at
+     * all rather than forcing everyone through the class.
+     */
+    callbackServer?: CallbackServerFactory<TResult>;
+    /** Receives the bound redirect URI too, since with `port: 0` nobody knew it earlier. */
+    openUrl?: (url: string, browser: string, redirectUri: string) => Promise<void>;
+    /**
+     * Extra guidance for 'none'/'headless', built from the URI actually bound —
+     * "if your browser is elsewhere, do this instead".
+     *
+     * It describes a *route*, so it belongs to whoever supplied the transport. A
+     * consumer injecting its own `callbackServer` states its own hint here; the
+     * package supplies one only for the transport it ships, and never guesses on
+     * behalf of an injected one.
+     */
+    remoteHint?: (redirectUri: string) => string;
+    signal?: AbortSignal;
+}
+export interface BrowserCallbackStrategyOptions<TResult> extends CallbackStrategyOptions<TResult> {
+    callbackServer: CallbackServerFactory<TResult>;
+}
+export declare class BrowserCallbackStrategy<TResult> implements IAuthorizationStrategy<TResult> {
+    private readonly options;
+    private inFlight;
+    private controller;
+    private disposed;
+    constructor(options: BrowserCallbackStrategyOptions<TResult>);
+    authorize(request: AuthorizationRequest): Promise<AuthorizationOutcome<TResult>>;
+    /**
+     * Idempotent; ends an authorization in flight and resolves only once the
+     * factory has settled — which it does after the socket is free.
+     */
+    dispose(): Promise<void>;
+}
+export declare function browserCallbackStrategy(options?: CallbackStrategyOptions<string>): IAuthorizationStrategy<string>;
+export declare function oidcCallbackStrategy(options?: CallbackStrategyOptions<OidcCallbackResult>): IAuthorizationStrategy<OidcCallbackResult>;
+export declare function samlCallbackStrategy(options?: CallbackStrategyOptions<string>): IAuthorizationStrategy<string>;
+//# sourceMappingURL=BrowserCallbackStrategy.d.ts.map

package/dist/strategies/BrowserCallbackStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserCallbackStrategy.d.ts","sourceRoot":"","sources":["../../src/strategies/BrowserCallbackStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,uBAAuB,CAAC,OAAO,GAAG,MAAM;IACvD,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,wFAAwF;IACxF,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,8BAA8B,CAAC,OAAO,CACrD,SAAQ,uBAAuB,CAAC,OAAO,CAAC;IACxC,cAAc,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;CAChD;AAwBD,qBAAa,uBAAuB,CAAC,OAAO,CAC1C,YAAW,sBAAsB,CAAC,OAAO,CAAC;IAOxC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAuD;IACvE,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,QAAQ,CAAS;gBAGN,OAAO,EAAE,8BAA8B,CAAC,OAAO,CAAC;IAG7D,SAAS,CACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IA8FzC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM/B;AAyBD,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,uBAAuB,CAAC,MAAM,CAAM,GAC5C,sBAAsB,CAAC,MAAM,CAAC,CAWhC;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,uBAAuB,CAAC,kBAAkB,CAAM,GACxD,sBAAsB,CAAC,kBAAkB,CAAC,CAK5C;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,uBAAuB,CAAC,MAAM,CAAM,GAC5C,sBAAsB,CAAC,MAAM,CAAC,CAKhC"}