@mcp-abap-adt/auth-providers 1.2.0 → 2.0.0

package/dist/strategies/BrowserCallbackStrategy.js

@@ -0,0 +1,210 @@
+"use strict";
+/**
+ * Reaching the authorization URL with a browser, receiving the redirect on a
+ * local socket.
+ *
+ * The transport is injected rather than assumed: a consumer that already runs
+ * an HTTP server can pass its own `CallbackServerFactory` and keep everything
+ * else here.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BrowserCallbackStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = void 0;
+exports.browserCallbackStrategy = browserCallbackStrategy;
+exports.oidcCallbackStrategy = oidcCallbackStrategy;
+exports.samlCallbackStrategy = samlCallbackStrategy;
+const net = __importStar(require("node:net"));
+const announce_1 = require("../auth/announce");
+const browserAuth_1 = require("../auth/browserAuth");
+const callbackServer_1 = require("../auth/callbackServer");
+const oidcBrowserAuth_1 = require("../auth/oidcBrowserAuth");
+const saml2Auth_1 = require("../auth/saml2Auth");
+/**
+ * Above Linux's `ip_local_port_range` (32768–60999), so an outbound connection
+ * never squats on it, and far from the 3001/3333 range application servers use.
+ */
+exports.DEFAULT_CALLBACK_PORT = 61001;
+/** How long an interactive login may wait for its callback. */
+exports.DEFAULT_LOGIN_TIMEOUT_MS = 30_000;
+/**
+ * Kept for its wording, not its certainty.
+ *
+ * `AuthBroker` matches /already in use/i to tell a busy port from every other
+ * failure, and the bind error Node raises says `EADDRINUSE` instead. Skipped
+ * entirely for an ephemeral port: there is nothing to check, and the answer
+ * would be about a port we are not going to get.
+ */
+async function assertPortAvailable(port) {
+    if (port === 0)
+        return;
+    const free = await new Promise((resolve) => {
+        const probe = net.createServer();
+        probe.once('error', () => resolve(false));
+        probe.listen(port, () => probe.close(() => resolve(true)));
+    });
+    if (!free) {
+        throw new Error(`Port ${port} is already in use. Please specify a different port or free the port.`);
+    }
+}
+class BrowserCallbackStrategy {
+    options;
+    inFlight = null;
+    controller = null;
+    disposed = false;
+    constructor(options) {
+        this.options = options;
+    }
+    async authorize(request) {
+        if (this.disposed) {
+            throw new Error('BrowserCallbackStrategy has been disposed');
+        }
+        if (this.inFlight) {
+            throw new Error('BrowserCallbackStrategy is already authorizing; it holds a single port');
+        }
+        const port = this.options.port ?? exports.DEFAULT_CALLBACK_PORT;
+        const controller = new AbortController();
+        this.controller = controller;
+        const relay = () => controller.abort();
+        this.options.signal?.addEventListener('abort', relay, { once: true });
+        // A signal that was already aborted fires no event, so registering a
+        // listener for it is not enough — the login would proceed as if nobody had
+        // cancelled it.
+        if (this.options.signal?.aborted)
+            controller.abort();
+        const announce = (0, announce_1.announcer)(request.logger);
+        const browser = this.options.browser ?? 'none';
+        // Wrapped in an immediately-invoked async function, and assigned to
+        // `inFlight` in the same synchronous turn as the controller. The port probe
+        // awaits, and a `dispose` landing in that window used to find both fields
+        // still null: it resolved, reporting everything released, and the login
+        // then went on to bind a socket behind it.
+        const run = (async () => {
+            await assertPortAvailable(port);
+            if (controller.signal.aborted) {
+                throw new Error('Authorization aborted before the callback server bound');
+            }
+            return await this.options.callbackServer({
+                port,
+                timeoutMs: this.options.timeoutMs ?? exports.DEFAULT_LOGIN_TIMEOUT_MS,
+                signal: controller.signal,
+                logger: request.logger,
+            }, async (server) => {
+                // Thrown before anything is opened: a redirect the provider cannot
+                // honour must fail here, not as a callback that never arrives.
+                const url = await request.buildAuthorizationUrl(server.redirectUri);
+                const waiting = server.waitForResult();
+                // Built here, not earlier: the launcher's messages name the URI that is
+                // actually bound, which with `port: 0` nothing knew until now.
+                const open = this.options.openUrl ??
+                    ((u, which, redirectUri) => (0, browserAuth_1.launchBrowser)(u, which, redirectUri, announce, request.logger ?? null, this.options.remoteHint?.(redirectUri)));
+                // Not awaited: a launcher that hangs must not delay the timeout or the
+                // release, and one that fails ends the scope through `fail`.
+                void open(url, browser, server.redirectUri).catch((error) => {
+                    const message = error instanceof Error ? error.message : String(error);
+                    request.logger?.error(`Failed to open browser: ${message}. Open manually: ${url}`, { error: message, url });
+                    server.fail(new Error(`Browser opening failed. Open manually: ${url}`));
+                });
+                return {
+                    payload: await waiting,
+                    redirectUri: server.redirectUri,
+                };
+            });
+        })();
+        this.inFlight = run;
+        try {
+            return await run;
+        }
+        finally {
+            this.options.signal?.removeEventListener('abort', relay);
+            this.controller = null;
+            this.inFlight = null;
+        }
+    }
+    /**
+     * Idempotent; ends an authorization in flight and resolves only once the
+     * factory has settled — which it does after the socket is free.
+     */
+    async dispose() {
+        this.disposed = true;
+        const pending = this.inFlight;
+        this.controller?.abort();
+        if (pending)
+            await pending.catch(() => undefined);
+    }
+}
+exports.BrowserCallbackStrategy = BrowserCallbackStrategy;
+// Each ready constructor defaults the transport rather than dictating it: a
+// supplied `callbackServer` wins, which is what makes substitution reachable
+// without dropping to the class.
+/**
+ * The paste form `withBrowserCallbackServer` serves on `/` — and nothing else
+ * does. Since the terminal-paste channel left with `startBrowserAuth`, this
+ * form is the only remaining way in for a browser on another machine, so the
+ * address it names has to be one that machine can actually reach.
+ *
+ * Which is why the host is left as a placeholder rather than taken from
+ * `redirectUri`. That URI is bound for *this* process, so its origin is
+ * `http://localhost:<port>` — precisely the address that does not work from
+ * anywhere else, addressed to the one reader who is not here. The port is real
+ * and is kept; the host is the reader's to fill in.
+ */
+const uaaPasteHint = (redirectUri) => {
+    const { protocol, port } = new URL(redirectUri);
+    return ('   If your browser is on another machine, copy the `code` from the ' +
+        `address bar after login and paste it at ${protocol}//<this-host>:${port}/`);
+};
+function browserCallbackStrategy(options = {}) {
+    return new BrowserCallbackStrategy({
+        ...options,
+        callbackServer: options.callbackServer ?? callbackServer_1.withBrowserCallbackServer,
+        // An explicit hint always wins. Otherwise the default applies only when we
+        // supplied the transport: an injected receiver may have no `/` route, and
+        // the replaceable receiver is the whole point of this design, so assuming
+        // one would advertise a 404 to exactly the consumers the design is for.
+        remoteHint: options.remoteHint ?? (options.callbackServer ? undefined : uaaPasteHint),
+    });
+}
+function oidcCallbackStrategy(options = {}) {
+    return new BrowserCallbackStrategy({
+        ...options,
+        callbackServer: options.callbackServer ?? oidcBrowserAuth_1.withOidcCallbackServer,
+    });
+}
+function samlCallbackStrategy(options = {}) {
+    return new BrowserCallbackStrategy({
+        ...options,
+        callbackServer: options.callbackServer ?? saml2Auth_1.withSamlCallbackServer,
+    });
+}

package/dist/strategies/asOidcResult.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Adapts a code-producing strategy to the OIDC provider's payload type.
+ *
+ * Everything a human or a consumer hands back is a string; only a real callback
+ * carries `state` beside the code. Rather than an OIDC twin of every strategy,
+ * the mismatch is bridged in one place.
+ */
+import type { IAuthorizationStrategy } from '@mcp-abap-adt/interfaces';
+import type { OidcCallbackResult } from '../auth/oidcBrowserAuth';
+export declare function asOidcResult(inner: IAuthorizationStrategy<string>): IAuthorizationStrategy<OidcCallbackResult>;
+//# sourceMappingURL=asOidcResult.d.ts.map

package/dist/strategies/asOidcResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"asOidcResult.d.ts","sourceRoot":"","sources":["../../src/strategies/asOidcResult.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACvB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,wBAAgB,YAAY,CAC1B,KAAK,EAAE,sBAAsB,CAAC,MAAM,CAAC,GACpC,sBAAsB,CAAC,kBAAkB,CAAC,CAqB5C"}

package/dist/strategies/asOidcResult.js

@@ -0,0 +1,30 @@
+"use strict";
+/**
+ * Adapts a code-producing strategy to the OIDC provider's payload type.
+ *
+ * Everything a human or a consumer hands back is a string; only a real callback
+ * carries `state` beside the code. Rather than an OIDC twin of every strategy,
+ * the mismatch is bridged in one place.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.asOidcResult = asOidcResult;
+function asOidcResult(inner) {
+    const adapted = {
+        async authorize(request) {
+            const outcome = await inner.authorize(request);
+            // No `state`: a value that never travelled through a redirect has none
+            // to check.
+            return {
+                payload: { code: outcome.payload },
+                redirectUri: outcome.redirectUri,
+            };
+        },
+    };
+    // Delegated, not reimplemented: the consumer holds only the adapter, so an
+    // undelegated dispose would strand whatever the wrapped strategy owns. Absent
+    // when the wrapped strategy has none, so optionality survives the wrapping.
+    if (inner.dispose) {
+        adapted.dispose = () => inner.dispose?.() ?? Promise.resolve();
+    }
+    return adapted;
+}

package/dist/strategies/codeStrategies.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Strategies where the consumer supplies the payload.
+ *
+ * The two are separate because one needs the authorization URL and the other
+ * does not — and asking for a URL that is not needed would drag in OIDC
+ * discovery that a static payload never required.
+ */
+import type { IAuthorizationStrategy } from '@mcp-abap-adt/interfaces';
+export interface ExternalCodeStrategyOptions {
+    redirectUri?: string;
+    /** Receives the assembled URL — so the code returned matches its PKCE challenge. */
+    provide: (authorizationUrl: string) => Promise<string>;
+}
+export interface StaticCodeStrategyOptions {
+    redirectUri?: string;
+    payload: string;
+}
+/** The consumer drives its own interactive flow and needs the URL to do it. */
+export declare function externalCodeStrategy(options: ExternalCodeStrategyOptions): IAuthorizationStrategy<string>;
+/** The consumer already holds the payload; the builder is never called. */
+export declare function staticCodeStrategy(options: StaticCodeStrategyOptions): IAuthorizationStrategy<string>;
+//# sourceMappingURL=codeStrategies.d.ts.map

package/dist/strategies/codeStrategies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"codeStrategies.d.ts","sourceRoot":"","sources":["../../src/strategies/codeStrategies.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAGV,sBAAsB,EACvB,MAAM,0BAA0B,CAAC;AAMlC,MAAM,WAAW,2BAA2B;IAC1C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oFAAoF;IACpF,OAAO,EAAE,CAAC,gBAAgB,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CACxD;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,2BAA2B,GACnC,sBAAsB,CAAC,MAAM,CAAC,CAchC;AAED,2EAA2E;AAC3E,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,yBAAyB,GACjC,sBAAsB,CAAC,MAAM,CAAC,CAUhC"}

package/dist/strategies/codeStrategies.js

@@ -0,0 +1,39 @@
+"use strict";
+/**
+ * Strategies where the consumer supplies the payload.
+ *
+ * The two are separate because one needs the authorization URL and the other
+ * does not — and asking for a URL that is not needed would drag in OIDC
+ * discovery that a static payload never required.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.externalCodeStrategy = externalCodeStrategy;
+exports.staticCodeStrategy = staticCodeStrategy;
+const BrowserCallbackStrategy_1 = require("./BrowserCallbackStrategy");
+const defaultRedirectUri = () => `http://localhost:${BrowserCallbackStrategy_1.DEFAULT_CALLBACK_PORT}/callback`;
+/** The consumer drives its own interactive flow and needs the URL to do it. */
+function externalCodeStrategy(options) {
+    const redirectUri = options.redirectUri ?? defaultRedirectUri();
+    return {
+        async authorize(request) {
+            const url = await request.buildAuthorizationUrl(redirectUri);
+            const payload = await options.provide(url);
+            if (!payload) {
+                throw new Error('Authorization code provider returned an empty value');
+            }
+            return { payload, redirectUri };
+        },
+    };
+}
+/** The consumer already holds the payload; the builder is never called. */
+function staticCodeStrategy(options) {
+    const redirectUri = options.redirectUri ?? defaultRedirectUri();
+    if (!options.payload) {
+        throw new Error('staticCodeStrategy requires a payload');
+    }
+    return {
+        async authorize() {
+            return { payload: options.payload, redirectUri };
+        },
+    };
+}

package/dist/strategies/index.d.ts

@@ -0,0 +1,8 @@
+export { asOidcResult } from './asOidcResult';
+export type { BrowserCallbackStrategyOptions, CallbackStrategyOptions, } from './BrowserCallbackStrategy';
+export { BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, oidcCallbackStrategy, samlCallbackStrategy, } from './BrowserCallbackStrategy';
+export type { ExternalCodeStrategyOptions, StaticCodeStrategyOptions, } from './codeStrategies';
+export { externalCodeStrategy, staticCodeStrategy, } from './codeStrategies';
+export type { ManualStrategyOptions } from './manualStrategies';
+export { manualPasteStrategy, manualSamlResponseStrategy, } from './manualStrategies';
+//# sourceMappingURL=index.d.ts.map

package/dist/strategies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/strategies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC"}

package/dist/strategies/index.js

@@ -0,0 +1,18 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.staticCodeStrategy = exports.externalCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = void 0;
+var asOidcResult_1 = require("./asOidcResult");
+Object.defineProperty(exports, "asOidcResult", { enumerable: true, get: function () { return asOidcResult_1.asOidcResult; } });
+var BrowserCallbackStrategy_1 = require("./BrowserCallbackStrategy");
+Object.defineProperty(exports, "BrowserCallbackStrategy", { enumerable: true, get: function () { return BrowserCallbackStrategy_1.BrowserCallbackStrategy; } });
+Object.defineProperty(exports, "browserCallbackStrategy", { enumerable: true, get: function () { return BrowserCallbackStrategy_1.browserCallbackStrategy; } });
+Object.defineProperty(exports, "DEFAULT_CALLBACK_PORT", { enumerable: true, get: function () { return BrowserCallbackStrategy_1.DEFAULT_CALLBACK_PORT; } });
+Object.defineProperty(exports, "DEFAULT_LOGIN_TIMEOUT_MS", { enumerable: true, get: function () { return BrowserCallbackStrategy_1.DEFAULT_LOGIN_TIMEOUT_MS; } });
+Object.defineProperty(exports, "oidcCallbackStrategy", { enumerable: true, get: function () { return BrowserCallbackStrategy_1.oidcCallbackStrategy; } });
+Object.defineProperty(exports, "samlCallbackStrategy", { enumerable: true, get: function () { return BrowserCallbackStrategy_1.samlCallbackStrategy; } });
+var codeStrategies_1 = require("./codeStrategies");
+Object.defineProperty(exports, "externalCodeStrategy", { enumerable: true, get: function () { return codeStrategies_1.externalCodeStrategy; } });
+Object.defineProperty(exports, "staticCodeStrategy", { enumerable: true, get: function () { return codeStrategies_1.staticCodeStrategy; } });
+var manualStrategies_1 = require("./manualStrategies");
+Object.defineProperty(exports, "manualPasteStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualPasteStrategy; } });
+Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualSamlResponseStrategy; } });

package/dist/strategies/manualStrategies.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Strategies where a human moves the payload.
+ *
+ * There are two because the payload is not acquired the same way. An
+ * authorization code lands in the browser's address bar; a `SAMLResponse` does
+ * not — our `AuthnRequest` declares the HTTP-POST binding, so the IdP posts it
+ * in a form body and the user must lift it from there.
+ */
+import type { IAuthorizationStrategy } from '@mcp-abap-adt/interfaces';
+export interface ManualStrategyOptions {
+    /** Must match what the authorization request advertises and the exchange sends. */
+    redirectUri?: string;
+    /** Where the pasted value comes from. Defaults to an interactive stdin read. */
+    read?: (prompt: string) => Promise<string>;
+}
+/** The user copies the `code` out of the address bar after the redirect. */
+export declare function manualPasteStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
+/** The user lifts `SAMLResponse` from the POST body — it never reaches the URL. */
+export declare function manualSamlResponseStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
+//# sourceMappingURL=manualStrategies.d.ts.map

package/dist/strategies/manualStrategies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manualStrategies.d.ts","sourceRoot":"","sources":["../../src/strategies/manualStrategies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAGV,sBAAsB,EACvB,MAAM,0BAA0B,CAAC;AAIlC,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAiCD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAmBhC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAiBhC"}

package/dist/strategies/manualStrategies.js

@@ -0,0 +1,77 @@
+"use strict";
+/**
+ * Strategies where a human moves the payload.
+ *
+ * There are two because the payload is not acquired the same way. An
+ * authorization code lands in the browser's address bar; a `SAMLResponse` does
+ * not — our `AuthnRequest` declares the HTTP-POST binding, so the IdP posts it
+ * in a form body and the user must lift it from there.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.manualPasteStrategy = manualPasteStrategy;
+exports.manualSamlResponseStrategy = manualSamlResponseStrategy;
+const node_readline_1 = require("node:readline");
+const browserAuth_1 = require("../auth/browserAuth");
+const BrowserCallbackStrategy_1 = require("./BrowserCallbackStrategy");
+const defaultRedirectUri = () => `http://localhost:${BrowserCallbackStrategy_1.DEFAULT_CALLBACK_PORT}/callback`;
+/**
+ * Reads one line from stdin.
+ *
+ * The prompt goes to stderr, never stdout, and stdin is touched only when it is
+ * a terminal: under a stdio RPC transport those streams carry the protocol.
+ */
+async function readFromTerminal(prompt) {
+    if (!process.stdin.isTTY) {
+        throw new Error('Manual input needs an interactive terminal. Supply `read` to source the value elsewhere.');
+    }
+    process.stderr.write(prompt);
+    const rl = (0, node_readline_1.createInterface)({ input: process.stdin });
+    try {
+        for await (const line of rl)
+            return line.trim();
+    }
+    finally {
+        rl.close();
+    }
+    throw new Error('No input received');
+}
+function announce(request, url) {
+    const message = `Open this URL to authenticate:\n${url}`;
+    if (request.logger)
+        request.logger.info(message);
+    else
+        process.stderr.write(`${message}\n`);
+}
+/** The user copies the `code` out of the address bar after the redirect. */
+function manualPasteStrategy(options = {}) {
+    const redirectUri = options.redirectUri ?? defaultRedirectUri();
+    const read = options.read ?? readFromTerminal;
+    return {
+        async authorize(request) {
+            const url = await request.buildAuthorizationUrl(redirectUri);
+            announce(request, url);
+            const raw = await read('Paste the authorization code (or the whole redirected URL): ');
+            const code = (0, browserAuth_1.extractCode)(raw);
+            if (!code) {
+                throw new Error('Could not read an authorization code from that input');
+            }
+            return { payload: code, redirectUri };
+        },
+    };
+}
+/** The user lifts `SAMLResponse` from the POST body — it never reaches the URL. */
+function manualSamlResponseStrategy(options = {}) {
+    const redirectUri = options.redirectUri ?? defaultRedirectUri();
+    const read = options.read ?? readFromTerminal;
+    return {
+        async authorize(request) {
+            const url = await request.buildAuthorizationUrl(redirectUri);
+            announce(request, url);
+            const raw = await read('Paste the SAMLResponse (from the POST body — it is not in the address bar): ');
+            const assertion = raw.trim();
+            if (!assertion)
+                throw new Error('No SAMLResponse was provided');
+            return { payload: assertion, redirectUri };
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "1.2.0",
+  "version": "2.0.0",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -58,7 +58,7 @@
     "node": ">=18.2.0"
   },
   "dependencies": {
-    "@mcp-abap-adt/interfaces": "^11.4.0",
+    "@mcp-abap-adt/interfaces": "^11.6.0",
     "axios": "^1.13.5",
     "express": "^5.1.0",
     "open": "^11.0.0"

package/dist/auth/manualInput.d.ts

@@ -1,5 +0,0 @@
-/**
- * Manual input helper (stdin)
- */
-export declare function readManualInput(prompt: string): Promise<string>;
-//# sourceMappingURL=manualInput.d.ts.map

package/dist/auth/manualInput.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"manualInput.d.ts","sourceRoot":"","sources":["../../src/auth/manualInput.ts"],"names":[],"mappings":"AAAA;;GAEG;AAIH,wBAAsB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAYrE"}

package/dist/auth/manualInput.js

@@ -1,19 +0,0 @@
-"use strict";
-/**
- * Manual input helper (stdin)
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.readManualInput = readManualInput;
-const node_readline_1 = require("node:readline");
-async function readManualInput(prompt) {
-    const rl = (0, node_readline_1.createInterface)({
-        input: process.stdin,
-        output: process.stdout,
-    });
-    return new Promise((resolve) => {
-        rl.question(prompt, (answer) => {
-            rl.close();
-            resolve(answer.trim());
-        });
-    });
-}