@mcp-abap-adt/auth-providers 2.2.0 → 2.2.1

package/CHANGELOG.md

@@ -7,6 +7,19 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.2.1] - 2026-09-24
+
+### Fixed
+
+- **`Saml2BearerProvider` spends its refresh token** (#23). `performRefresh()`
+  used to run a full interactive login on both of its branches, so a session
+  holding a valid refresh token still went through the IdP and a browser — and
+  a headless consumer got `BROWSER_AUTH_REQUIRED` from `auth-broker`. It now
+  sends a `refresh_token` grant to the same token endpoint and with the same
+  client credentials as the assertion exchange, keeps the refresh token it spent
+  when the response carries no new one, and falls back to a full login when the
+  grant is refused.
+
 ## [2.2.0] - 2026-09-24
 
 ### Dependencies

package/README.md

@@ -378,6 +378,14 @@ const provider = new Saml2BearerProvider({
 const broker = new AuthBroker({ tokenProvider: provider }, 'none');
 ```
 
+**Refresh.** When the token endpoint returns a `refresh_token` with the SAML
+bearer exchange, `Saml2BearerProvider` spends it once the access token expires:
+a `refresh_token` grant to the same endpoint (`tokenUrl`, or `uaaUrl` +
+`/oauth/token`) with the same client credentials, and no assertion, strategy or
+browser involved. Pass a stored one back as `refreshToken` in the config and the
+next `getTokens()` uses it. If the grant is refused, or no refresh token was
+ever issued, the provider falls back to a full login through `authorization`.
+
 Pure SAML example (cookie-based):
 
 ```typescript

package/dist/auth/saml2TokenExchange.d.ts

@@ -9,4 +9,12 @@ export interface Saml2TokenExchangeResponse {
     tokenType?: string;
 }
 export declare function exchangeSamlAssertion(samlResponse: string, tokenUrl: string, clientId: string | undefined, clientSecret: string | undefined, logger?: ILogger): Promise<Saml2TokenExchangeResponse>;
+/**
+ * Spends a refresh token obtained from a SAML bearer exchange.
+ *
+ * Sent to the same token endpoint, with the same client authentication, as the
+ * exchange that issued it — so an explicit `tokenUrl` is honoured rather than
+ * rebuilt from a UAA base URL.
+ */
+export declare function refreshSamlBearerToken(refreshToken: string, tokenUrl: string, clientId: string | undefined, clientSecret?: string, logger?: ILogger): Promise<Saml2TokenExchangeResponse>;
 //# sourceMappingURL=saml2TokenExchange.d.ts.map

package/dist/auth/saml2TokenExchange.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2TokenExchange.d.ts","sourceRoot":"","sources":["../../src/auth/saml2TokenExchange.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CAwCrC"}
+{"version":3,"file":"saml2TokenExchange.d.ts","sourceRoot":"","sources":["../../src/auth/saml2TokenExchange.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAMD,wBAAsB,qBAAqB,CACzC,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CAwCrC;AAED;;;;;;GAMG;AACH,wBAAsB,sBAAsB,CAC1C,YAAY,EAAE,MAAM,EACpB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,YAAY,CAAC,EAAE,MAAM,EACrB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,0BAA0B,CAAC,CAwCrC"}

package/dist/auth/saml2TokenExchange.js

@@ -7,6 +7,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.exchangeSamlAssertion = exchangeSamlAssertion;
+exports.refreshSamlBearerToken = refreshSamlBearerToken;
 const axios_1 = __importDefault(require("axios"));
 function toBasicAuth(clientId, clientSecret) {
     return Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
@@ -49,3 +50,48 @@ async function exchangeSamlAssertion(samlResponse, tokenUrl, clientId, clientSec
         tokenType: data.token_type,
     };
 }
+/**
+ * Spends a refresh token obtained from a SAML bearer exchange.
+ *
+ * Sent to the same token endpoint, with the same client authentication, as the
+ * exchange that issued it — so an explicit `tokenUrl` is honoured rather than
+ * rebuilt from a UAA base URL.
+ */
+async function refreshSamlBearerToken(refreshToken, tokenUrl, clientId, clientSecret, logger) {
+    const params = new URLSearchParams();
+    params.append('grant_type', 'refresh_token');
+    params.append('refresh_token', refreshToken);
+    if (clientId) {
+        params.append('client_id', clientId);
+    }
+    logger?.info('[SAML] Refreshing token', { tokenUrl });
+    const headers = {
+        'Content-Type': 'application/x-www-form-urlencoded',
+    };
+    if (clientId && clientSecret) {
+        headers.Authorization = `Basic ${toBasicAuth(clientId, clientSecret)}`;
+    }
+    let response;
+    try {
+        response = await axios_1.default.post(tokenUrl, params.toString(), { headers });
+    }
+    catch (error) {
+        if (axios_1.default.isAxiosError(error)) {
+            logger?.error('[SAML] Token refresh failed', {
+                status: error.response?.status,
+                data: error.response?.data,
+            });
+        }
+        throw error;
+    }
+    const data = response.data;
+    if (!data?.access_token) {
+        throw new Error('Refresh response missing access_token');
+    }
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresIn: data.expires_in,
+        tokenType: data.token_type,
+    };
+}

package/dist/providers/Saml2BearerProvider.d.ts

@@ -17,6 +17,11 @@ export declare class Saml2BearerProvider extends BaseTokenProvider {
     constructor(config: Saml2BearerProviderConfig);
     protected getAuthType(): OAuth2GrantType;
     protected performLogin(): Promise<ITokenResult>;
+    /**
+     * Spends the refresh token at the endpoint that issued it. A failure is
+     * thrown rather than handled: `BaseTokenProvider.getTokens()` drops the
+     * refresh token and falls back to `performLogin()`.
+     */
     protected performRefresh(): Promise<ITokenResult>;
 }
 //# sourceMappingURL=Saml2BearerProvider.d.ts.map

package/dist/providers/Saml2BearerProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAiB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAoBrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAMxD"}
+{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAK9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAiB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAoBrD;;;;OAIG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqBxD"}

package/dist/providers/Saml2BearerProvider.js

@@ -42,11 +42,23 @@ class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
             tokenType: 'jwt',
         };
     }
+    /**
+     * Spends the refresh token at the endpoint that issued it. A failure is
+     * thrown rather than handled: `BaseTokenProvider.getTokens()` drops the
+     * refresh token and falls back to `performLogin()`.
+     */
     async performRefresh() {
         if (!this.refreshToken) {
-            return this.performLogin();
+            throw new Error('Refresh token is required for refresh');
         }
-        return this.performLogin();
+        const tokens = await (0, saml2TokenExchange_1.refreshSamlBearerToken)(this.refreshToken, (0, saml2Utils_1.resolveTokenUrl)(this.config), this.config.clientId, this.config.clientSecret, this.logger);
+        return {
+            authorizationToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken || this.refreshToken,
+            authType: interfaces_auth_1.AUTH_TYPE_SAML2_BEARER,
+            expiresIn: tokens.expiresIn,
+            tokenType: 'jwt',
+        };
     }
 }
 exports.Saml2BearerProvider = Saml2BearerProvider;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "2.2.0",
+  "version": "2.2.1",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",