@mcp-abap-adt/auth-providers 1.2.0 → 2.2.0

package/dist/providers/OidcPasswordProvider.js

@@ -4,7 +4,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OidcPasswordProvider = void 0;
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const oidcDiscovery_1 = require("../auth/oidcDiscovery");
 const oidcToken_1 = require("../auth/oidcToken");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
@@ -23,7 +23,7 @@ class OidcPasswordProvider extends BaseTokenProvider_1.BaseTokenProvider {
         }
     }
     getAuthType() {
-        return interfaces_1.AUTH_TYPE_PASSWORD;
+        return interfaces_auth_1.AUTH_TYPE_PASSWORD;
     }
     async performLogin() {
         if (!this.config.tokenEndpoint && !this.config.issuerUrl) {
@@ -45,7 +45,7 @@ class OidcPasswordProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,
-            authType: interfaces_1.AUTH_TYPE_PASSWORD,
+            authType: interfaces_auth_1.AUTH_TYPE_PASSWORD,
             expiresIn: tokens.expiresIn,
             tokenType: 'jwt',
         };
@@ -72,7 +72,7 @@ class OidcPasswordProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken || this.refreshToken,
-            authType: interfaces_1.AUTH_TYPE_PASSWORD,
+            authType: interfaces_auth_1.AUTH_TYPE_PASSWORD,
             expiresIn: tokens.expiresIn,
             tokenType: 'jwt',
         };

package/dist/providers/OidcTokenExchangeProvider.d.ts

@@ -1,7 +1,8 @@
 /**
  * OIDC Token Exchange Provider
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 import { BaseTokenProvider } from './BaseTokenProvider';
 export interface OidcTokenExchangeProviderConfig {
     issuerUrl?: string;

package/dist/providers/OidcTokenExchangeProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"OidcTokenExchangeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcTokenExchangeProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAIlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IAcnD,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAwCrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxD"}
+{"version":3,"file":"OidcTokenExchangeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/OidcTokenExchangeProvider.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,+BAA+B;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,yBAA0B,SAAQ,iBAAiB;IAC9D,OAAO,CAAC,MAAM,CAAkC;gBAEpC,MAAM,EAAE,+BAA+B;IAcnD,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAwCrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxD"}

package/dist/providers/OidcTokenExchangeProvider.js

@@ -4,7 +4,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.OidcTokenExchangeProvider = void 0;
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const oidcDiscovery_1 = require("../auth/oidcDiscovery");
 const oidcToken_1 = require("../auth/oidcToken");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
@@ -23,7 +23,7 @@ class OidcTokenExchangeProvider extends BaseTokenProvider_1.BaseTokenProvider {
         }
     }
     getAuthType() {
-        return interfaces_1.AUTH_TYPE_USER_TOKEN;
+        return interfaces_auth_1.AUTH_TYPE_USER_TOKEN;
     }
     async performLogin() {
         if (!this.config.tokenEndpoint && !this.config.issuerUrl) {
@@ -44,7 +44,7 @@ class OidcTokenExchangeProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,
-            authType: interfaces_1.AUTH_TYPE_USER_TOKEN,
+            authType: interfaces_auth_1.AUTH_TYPE_USER_TOKEN,
             expiresIn: tokens.expiresIn,
             tokenType: 'jwt',
         };

package/dist/providers/Saml2BearerProvider.d.ts

@@ -3,10 +3,11 @@
  *
  * Exchanges SAMLResponse for OAuth2 access token.
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 import { BaseTokenProvider } from './BaseTokenProvider';
-import type { Saml2AssertionConfig, Saml2BearerExchangeConfig } from './saml2Utils';
-export interface Saml2BearerProviderConfig extends Saml2AssertionConfig, Saml2BearerExchangeConfig {
+import type { Saml2BearerExchangeConfig, Saml2CommonConfig } from './saml2Utils';
+export interface Saml2BearerProviderConfig extends Saml2CommonConfig, Saml2BearerExchangeConfig {
     logger?: ILogger;
     accessToken?: string;
     refreshToken?: string;

package/dist/providers/Saml2BearerProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,cAAc,CAAC;AAGtB,MAAM,WAAW,yBACf,SAAQ,oBAAoB,EAC1B,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAc7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAoBrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAMxD"}
+{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAiB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAoBrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAMxD"}

package/dist/providers/Saml2BearerProvider.js

@@ -6,7 +6,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Saml2BearerProvider = void 0;
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const saml2TokenExchange_1 = require("../auth/saml2TokenExchange");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 const saml2Utils_1 = require("./saml2Utils");
@@ -14,6 +14,9 @@ class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
     config;
     constructor(config) {
         super();
+        // A pre-built URL with no declared ACS cannot be verified against whatever
+        // the strategy binds, so it is refused here rather than at login time.
+        (0, saml2Utils_1.validateSamlConfig)(config);
         this.config = config;
         this.logger = config.logger;
         if (config.accessToken) {
@@ -25,7 +28,7 @@ class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
         }
     }
     getAuthType() {
-        return interfaces_1.AUTH_TYPE_SAML2_BEARER;
+        return interfaces_auth_1.AUTH_TYPE_SAML2_BEARER;
     }
     async performLogin() {
         const samlResponse = await (0, saml2Utils_1.getSamlAssertion)(this.config);
@@ -34,7 +37,7 @@ class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,
-            authType: interfaces_1.AUTH_TYPE_SAML2_BEARER,
+            authType: interfaces_auth_1.AUTH_TYPE_SAML2_BEARER,
             expiresIn: tokens.expiresIn,
             tokenType: 'jwt',
         };

package/dist/providers/Saml2PureProvider.d.ts

@@ -3,10 +3,11 @@
  *
  * Returns SAMLResponse as authorizationToken (non-JWT).
  */
-import type { ILogger, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces';
+import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 import { BaseTokenProvider } from './BaseTokenProvider';
-import type { Saml2AssertionConfig } from './saml2Utils';
-export interface Saml2PureProviderConfig extends Saml2AssertionConfig {
+import type { Saml2CommonConfig } from './saml2Utils';
+export interface Saml2PureProviderConfig extends Saml2CommonConfig {
     logger?: ILogger;
     cookieProvider: (samlResponse: string) => Promise<string>;
 }

package/dist/providers/Saml2PureProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2PureProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2PureProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,YAAY,EACZ,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAGzD,MAAM,WAAW,uBAAwB,SAAQ,oBAAoB;IACnE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;IACtD,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,uBAAuB;IAO3C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAarC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxD"}
+{"version":3,"file":"Saml2PureProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2PureProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;IACtD,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,uBAAuB;IAU3C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAarC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxD"}

package/dist/providers/Saml2PureProvider.js

@@ -6,7 +6,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Saml2PureProvider = void 0;
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const saml2Auth_1 = require("../auth/saml2Auth");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 const saml2Utils_1 = require("./saml2Utils");
@@ -14,12 +14,15 @@ class Saml2PureProvider extends BaseTokenProvider_1.BaseTokenProvider {
     config;
     constructor(config) {
         super();
+        // A pre-built URL with no declared ACS cannot be verified against whatever
+        // the strategy binds, so it is refused here rather than at login time.
+        (0, saml2Utils_1.validateSamlConfig)(config);
         this.config = config;
         this.logger = config.logger;
         this.tokenType = 'saml';
     }
     getAuthType() {
-        return interfaces_1.AUTH_TYPE_USER_TOKEN;
+        return interfaces_auth_1.AUTH_TYPE_USER_TOKEN;
     }
     async performLogin() {
         const samlResponse = await (0, saml2Utils_1.getSamlAssertion)(this.config);
@@ -27,7 +30,7 @@ class Saml2PureProvider extends BaseTokenProvider_1.BaseTokenProvider {
         const sessionCookies = await this.config.cookieProvider(samlResponse);
         return {
             authorizationToken: sessionCookies,
-            authType: interfaces_1.AUTH_TYPE_USER_TOKEN,
+            authType: interfaces_auth_1.AUTH_TYPE_USER_TOKEN,
             tokenType: 'saml',
             expiresAt,
         };

package/dist/providers/saml2Utils.d.ts

@@ -1,30 +1,31 @@
 /**
- * SAML2 provider shared helpers
+ * SAML2 provider shared helpers.
  */
-import type { ILogger } from '@mcp-abap-adt/interfaces';
-export type Saml2AssertionFlow = 'browser' | 'manual' | 'assertion';
+import type { IAuthorizationStrategy } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 export interface Saml2CommonConfig {
     idpSsoUrl: string;
     spEntityId: string;
+    /**
+     * Where the assertion is delivered. Required when `authorizationUrl` is set:
+     * the ACS is then buried in a deflated `SAMLRequest` this package did not
+     * build and cannot read, so it must be declared rather than inferred.
+     */
     acsUrl?: string;
     relayState?: string;
     authorizationUrl?: string;
-    browser?: string;
-    redirectPort?: number;
+    /** How the login is conducted. Omitted means a browser callback. */
+    authorization?: IAuthorizationStrategy<string>;
     logger?: ILogger;
 }
-export interface Saml2AssertionConfig extends Saml2CommonConfig {
-    assertionFlow: Saml2AssertionFlow;
-    assertionProvider?: () => Promise<string>;
-    manualInput?: () => Promise<string>;
-}
 export interface Saml2BearerExchangeConfig {
     tokenUrl?: string;
     uaaUrl?: string;
     clientId?: string;
     clientSecret?: string;
 }
-export declare function resolveAcsUrl(config: Saml2CommonConfig): string;
+/** Throw at construction rather than half-verify at runtime. */
+export declare function validateSamlConfig(config: Saml2CommonConfig): void;
 export declare function resolveTokenUrl(config: Saml2BearerExchangeConfig): string;
-export declare function getSamlAssertion(config: Saml2AssertionConfig): Promise<string>;
+export declare function getSamlAssertion(config: Saml2CommonConfig): Promise<string>;
 //# sourceMappingURL=saml2Utils.d.ts.map

package/dist/providers/saml2Utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2Utils.d.ts","sourceRoot":"","sources":["../../src/providers/saml2Utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAOxD,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAC;AAEpE,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,oBAAqB,SAAQ,iBAAiB;IAC7D,aAAa,EAAE,kBAAkB,CAAC;IAClC,iBAAiB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAG/D;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAQzE;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAAC,MAAM,CAAC,CAiCjB"}
+{"version":3,"file":"saml2Utils.d.ts","sourceRoot":"","sources":["../../src/providers/saml2Utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAI9D,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAOlE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAQzE;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,MAAM,CAAC,CA+CjB"}

package/dist/providers/saml2Utils.js

@@ -1,16 +1,19 @@
 "use strict";
 /**
- * SAML2 provider shared helpers
+ * SAML2 provider shared helpers.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.resolveAcsUrl = resolveAcsUrl;
+exports.validateSamlConfig = validateSamlConfig;
 exports.resolveTokenUrl = resolveTokenUrl;
 exports.getSamlAssertion = getSamlAssertion;
-const manualInput_1 = require("../auth/manualInput");
 const saml2Auth_1 = require("../auth/saml2Auth");
-function resolveAcsUrl(config) {
-    const port = config.redirectPort || 3001;
-    return config.acsUrl || `http://localhost:${port}/callback`;
+const strategies_1 = require("../strategies");
+/** Throw at construction rather than half-verify at runtime. */
+function validateSamlConfig(config) {
+    if (config.authorizationUrl && !config.acsUrl) {
+        throw new Error('acsUrl is required when authorizationUrl is set: the ACS inside a ' +
+            'pre-built SAML request cannot be read, so it must be declared.');
+    }
 }
 function resolveTokenUrl(config) {
     if (config.tokenUrl) {
@@ -22,28 +25,45 @@ function resolveTokenUrl(config) {
     throw new Error('Missing tokenUrl or uaaUrl for SAML bearer exchange');
 }
 async function getSamlAssertion(config) {
-    const acsUrl = resolveAcsUrl(config);
-    const authConfig = {
-        idpSsoUrl: config.idpSsoUrl,
-        spEntityId: config.spEntityId,
-        acsUrl,
-        relayState: config.relayState,
-        authorizationUrl: config.authorizationUrl,
+    const declaredAcs = config.acsUrl;
+    const request = {
+        logger: config.logger,
+        buildAuthorizationUrl: async (redirectUri) => {
+            // A declared ACS is registered with the IdP; the strategy must be
+            // listening exactly there, and an ephemeral port cannot be.
+            const acsUrl = declaredAcs ?? redirectUri;
+            if (declaredAcs && declaredAcs !== redirectUri) {
+                throw new Error(`SAML acsUrl is ${declaredAcs}, but the authorization strategy is ` +
+                    `listening on ${redirectUri}. They must match.`);
+            }
+            return (0, saml2Auth_1.buildSamlAuthorizationUrl)({
+                idpSsoUrl: config.idpSsoUrl,
+                spEntityId: config.spEntityId,
+                acsUrl,
+                relayState: config.relayState,
+                authorizationUrl: config.authorizationUrl,
+            });
+        },
     };
-    if (config.assertionFlow === 'assertion') {
-        if (!config.assertionProvider) {
-            throw new Error('assertionProvider is required for assertion flow');
+    const supplied = config.authorization;
+    const strategy = supplied ?? (0, strategies_1.samlCallbackStrategy)();
+    try {
+        const outcome = await strategy.authorize(request);
+        // The second net, for a strategy that never called the builder and so
+        // never met the check inside it.
+        if (declaredAcs && declaredAcs !== outcome.redirectUri) {
+            throw new Error(`SAML acsUrl is ${declaredAcs}, but the authorization strategy used ` +
+                `${outcome.redirectUri}. They must match.`);
         }
-        return await config.assertionProvider();
+        return outcome.payload;
     }
-    if (config.assertionFlow === 'manual') {
-        const authorizationUrl = (0, saml2Auth_1.buildSamlAuthorizationUrl)(authConfig);
-        config.logger?.info('[SAML] Open URL to authenticate', {
-            authorizationUrl,
-        });
-        const input = config.manualInput || manualInput_1.readManualInput;
-        return await input('Paste SAMLResponse: ');
+    finally {
+        if (!supplied) {
+            await strategy.dispose?.().catch((error) => {
+                config.logger?.warn('[SAML] dispose failed', {
+                    error: error instanceof Error ? error.message : String(error),
+                });
+            });
+        }
     }
-    const browser = config.browser || 'auto';
-    return await (0, saml2Auth_1.startSamlBrowserAuth)(authConfig, browser, config.logger, config.redirectPort || 3001);
 }

package/dist/sso/SsoProviderFactory.d.ts

@@ -1,4 +1,4 @@
-import type { ITokenProvider } from '@mcp-abap-adt/interfaces';
+import type { ITokenProvider } from '@mcp-abap-adt/interfaces-auth';
 import type { SsoProviderConfig } from './types';
 export declare class SsoProviderFactory {
     static create(config: SsoProviderConfig): ITokenProvider;

package/dist/sso/SsoProviderFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"SsoProviderFactory.d.ts","sourceRoot":"","sources":["../../src/sso/SsoProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAO/D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,cAAc;CA6BzD"}
+{"version":3,"file":"SsoProviderFactory.d.ts","sourceRoot":"","sources":["../../src/sso/SsoProviderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAOpE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAC;AAEjD,qBAAa,kBAAkB;IAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,cAAc;CA6BzD"}

package/dist/sso/types.d.ts

@@ -1,4 +1,4 @@
-import type { ITokenProvider } from '@mcp-abap-adt/interfaces';
+import type { ITokenProvider } from '@mcp-abap-adt/interfaces-auth';
 import type { OidcBrowserProviderConfig } from '../providers/OidcBrowserProvider';
 import type { OidcDeviceFlowProviderConfig } from '../providers/OidcDeviceFlowProvider';
 import type { OidcPasswordProviderConfig } from '../providers/OidcPasswordProvider';

package/dist/sso/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sso/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AAC9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,4BAA4B,CAAC;CACtC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,0BAA0B,CAAC;CACpC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,+BAA+B,CAAC;CACzC,GACD;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sso/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,4BAA4B,EAAE,MAAM,qCAAqC,CAAC;AACxF,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AACpF,OAAO,KAAK,EAAE,+BAA+B,EAAE,MAAM,wCAAwC,CAAC;AAC9F,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,kCAAkC,CAAC;AAClF,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gCAAgC,CAAC;AAE9E,MAAM,MAAM,mBAAmB,GAAG,cAAc,CAAC;AAEjD,MAAM,MAAM,iBAAiB,GACzB;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,SAAS,CAAC;IAChB,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,4BAA4B,CAAC;CACtC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,0BAA0B,CAAC;CACpC,GACD;IACE,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,+BAA+B,CAAC;CACzC,GACD;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,QAAQ,CAAC;IACf,MAAM,EAAE,yBAAyB,CAAC;CACnC,GACD;IACE,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,uBAAuB,CAAC;CACjC,CAAC"}

package/dist/strategies/BrowserCallbackStrategy.d.ts

@@ -0,0 +1,64 @@
+/**
+ * Reaching the authorization URL with a browser, receiving the redirect on a
+ * local socket.
+ *
+ * The transport is injected rather than assumed: a consumer that already runs
+ * an HTTP server can pass its own `CallbackServerFactory` and keep everything
+ * else here.
+ */
+import type { AuthorizationOutcome, AuthorizationRequest, CallbackServerFactory, IAuthorizationStrategy } from '@mcp-abap-adt/interfaces-auth';
+import type { OidcCallbackResult } from '../auth/oidcBrowserAuth';
+/**
+ * Above Linux's `ip_local_port_range` (32768–60999), so an outbound connection
+ * never squats on it, and far from the 3001/3333 range application servers use.
+ */
+export declare const DEFAULT_CALLBACK_PORT = 61001;
+/** How long an interactive login may wait for its callback. */
+export declare const DEFAULT_LOGIN_TIMEOUT_MS = 30000;
+export interface CallbackStrategyOptions<TResult = string> {
+    /** `0` binds an ephemeral port. Unusable where the IdP has a registered URI. */
+    port?: number;
+    timeoutMs?: number;
+    /** 'none' | 'headless' print the URL; 'auto' | 'system' | 'chrome' | … open it. */
+    browser?: string;
+    /**
+     * The transport. Omitted means the one this package ships for the flow; a
+     * consumer that already runs an HTTP server passes its own here and keeps
+     * everything else — which is the point of the ready constructors existing at
+     * all rather than forcing everyone through the class.
+     */
+    callbackServer?: CallbackServerFactory<TResult>;
+    /** Receives the bound redirect URI too, since with `port: 0` nobody knew it earlier. */
+    openUrl?: (url: string, browser: string, redirectUri: string) => Promise<void>;
+    /**
+     * Extra guidance for 'none'/'headless', built from the URI actually bound —
+     * "if your browser is elsewhere, do this instead".
+     *
+     * It describes a *route*, so it belongs to whoever supplied the transport. A
+     * consumer injecting its own `callbackServer` states its own hint here; the
+     * package supplies one only for the transport it ships, and never guesses on
+     * behalf of an injected one.
+     */
+    remoteHint?: (redirectUri: string) => string;
+    signal?: AbortSignal;
+}
+export interface BrowserCallbackStrategyOptions<TResult> extends CallbackStrategyOptions<TResult> {
+    callbackServer: CallbackServerFactory<TResult>;
+}
+export declare class BrowserCallbackStrategy<TResult> implements IAuthorizationStrategy<TResult> {
+    private readonly options;
+    private inFlight;
+    private controller;
+    private disposed;
+    constructor(options: BrowserCallbackStrategyOptions<TResult>);
+    authorize(request: AuthorizationRequest): Promise<AuthorizationOutcome<TResult>>;
+    /**
+     * Idempotent; ends an authorization in flight and resolves only once the
+     * factory has settled — which it does after the socket is free.
+     */
+    dispose(): Promise<void>;
+}
+export declare function browserCallbackStrategy(options?: CallbackStrategyOptions<string>): IAuthorizationStrategy<string>;
+export declare function oidcCallbackStrategy(options?: CallbackStrategyOptions<OidcCallbackResult>): IAuthorizationStrategy<OidcCallbackResult>;
+export declare function samlCallbackStrategy(options?: CallbackStrategyOptions<string>): IAuthorizationStrategy<string>;
+//# sourceMappingURL=BrowserCallbackStrategy.d.ts.map

package/dist/strategies/BrowserCallbackStrategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BrowserCallbackStrategy.d.ts","sourceRoot":"","sources":["../../src/strategies/BrowserCallbackStrategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EACV,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAIvC,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAIlE;;;GAGG;AACH,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAE3C,+DAA+D;AAC/D,eAAO,MAAM,wBAAwB,QAAS,CAAC;AAE/C,MAAM,WAAW,uBAAuB,CAAC,OAAO,GAAG,MAAM;IACvD,gFAAgF;IAChF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAChD,wFAAwF;IACxF,OAAO,CAAC,EAAE,CACR,GAAG,EAAE,MAAM,EACX,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,KAChB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB;;;;;;;;OAQG;IACH,UAAU,CAAC,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC;IAC7C,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB;AAED,MAAM,WAAW,8BAA8B,CAAC,OAAO,CACrD,SAAQ,uBAAuB,CAAC,OAAO,CAAC;IACxC,cAAc,EAAE,qBAAqB,CAAC,OAAO,CAAC,CAAC;CAChD;AAwBD,qBAAa,uBAAuB,CAAC,OAAO,CAC1C,YAAW,sBAAsB,CAAC,OAAO,CAAC;IAOxC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAL1B,OAAO,CAAC,QAAQ,CAAuD;IACvE,OAAO,CAAC,UAAU,CAAgC;IAClD,OAAO,CAAC,QAAQ,CAAS;gBAGN,OAAO,EAAE,8BAA8B,CAAC,OAAO,CAAC;IAG7D,SAAS,CACb,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;IA8FzC;;;OAGG;IACG,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;CAM/B;AAyBD,wBAAgB,uBAAuB,CACrC,OAAO,GAAE,uBAAuB,CAAC,MAAM,CAAM,GAC5C,sBAAsB,CAAC,MAAM,CAAC,CAWhC;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,uBAAuB,CAAC,kBAAkB,CAAM,GACxD,sBAAsB,CAAC,kBAAkB,CAAC,CAK5C;AAED,wBAAgB,oBAAoB,CAClC,OAAO,GAAE,uBAAuB,CAAC,MAAM,CAAM,GAC5C,sBAAsB,CAAC,MAAM,CAAC,CAKhC"}