@mcp-abap-adt/auth-providers 2.2.1 → 3.0.0

package/dist/__tests__/integration/stand/formLogin.js

@@ -0,0 +1,194 @@
+"use strict";
+/**
+ * Plays the user in an interactive login against a stand server's own login
+ * page: follows redirects, keeps cookies, finds the form with a password
+ * field, fills it in with every hidden field it carries (UAA's CSRF token,
+ * Keycloak's session code), and submits it.
+ *
+ * Deliberately small: enough for UAA's and Keycloak's stock login pages, which
+ * the pinned image versions keep stable. It is a test helper, not a browser.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FormBrowser = void 0;
+exports.authorizeByForm = authorizeByForm;
+exports.approveDevice = approveDevice;
+exports.samlResponseByForm = samlResponseByForm;
+const MAX_HOPS = 20;
+class FormBrowser {
+    cookies = new Map();
+    /** GET `url` and follow redirects until `stop(url)` or a page is served. */
+    async open(url, stop = () => false) {
+        return this.follow(url, { method: 'GET' }, stop);
+    }
+    /**
+     * Submit the login form on `page`, then follow redirects until `stop` says
+     * the next location is the one the caller wants — typically the client's
+     * redirect URI carrying the code — without requesting it.
+     */
+    async submitLogin(page, credentials, stop = () => false) {
+        const form = findPasswordForm(page.html ?? '');
+        if (!form) {
+            throw new Error(`no login form on ${page.url}`);
+        }
+        const body = new URLSearchParams(form.hidden);
+        body.set(form.userField, credentials.username);
+        body.set(form.passwordField, credentials.password);
+        return this.follow(new URL(form.action, page.url).toString(), {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            body: body.toString(),
+        }, stop);
+    }
+    /**
+     * Accept a consent page ("Do you grant these access privileges?"): submit
+     * the form that carries an `accept` button, with its hidden fields.
+     */
+    async acceptConsent(page) {
+        for (const match of (page.html ?? '').matchAll(/<form\b[^>]*>[\s\S]*?<\/form>/gi)) {
+            const formHtml = match[0];
+            const inputs = [...formHtml.matchAll(/<(?:input|button)\b[^>]*>/gi)].map((m) => m[0]);
+            const accept = inputs.find((i) => attribute(i, 'name') === 'accept');
+            if (!accept)
+                continue;
+            const body = new URLSearchParams();
+            for (const input of inputs) {
+                const name = attribute(input, 'name');
+                if (name && attribute(input, 'type') === 'hidden') {
+                    body.set(name, attribute(input, 'value') ?? '');
+                }
+            }
+            body.set('accept', attribute(accept, 'value') ?? 'Yes');
+            const formTag = /<form\b[^>]*>/i.exec(formHtml)?.[0] ?? '';
+            return this.follow(new URL(attribute(formTag, 'action') ?? '', page.url).toString(), {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                body: body.toString(),
+            }, () => false);
+        }
+        throw new Error(`no consent form on ${page.url}`);
+    }
+    async follow(url, init, stop) {
+        let current = url;
+        let request = init;
+        for (let hop = 0; hop < MAX_HOPS; hop++) {
+            const response = await fetch(current, {
+                ...request,
+                redirect: 'manual',
+                headers: { ...(request.headers ?? {}), Cookie: this.cookieHeader() },
+                signal: AbortSignal.timeout(15_000),
+            });
+            this.remember(response);
+            const location = response.headers.get('location');
+            if (response.status >= 300 && response.status < 400 && location) {
+                const next = new URL(location, current).toString();
+                if (stop(next))
+                    return { url: next };
+                current = next;
+                request = { method: 'GET' };
+                continue;
+            }
+            return { url: current, html: await response.text() };
+        }
+        throw new Error(`more than ${MAX_HOPS} redirects from ${url}`);
+    }
+    remember(response) {
+        for (const line of response.headers.getSetCookie()) {
+            const [pair] = line.split(';');
+            const eq = pair.indexOf('=');
+            if (eq > 0) {
+                this.cookies.set(pair.slice(0, eq).trim(), pair.slice(eq + 1).trim());
+            }
+        }
+    }
+    cookieHeader() {
+        return [...this.cookies].map(([k, v]) => `${k}=${v}`).join('; ');
+    }
+}
+exports.FormBrowser = FormBrowser;
+/**
+ * Log in through the authorization URL and return the redirect URI the server
+ * sends the browser back to, with its `code` — not requested, since nothing
+ * listens there.
+ */
+async function authorizeByForm(authorizationUrl, redirectUri, credentials) {
+    const reached = (next) => next.startsWith(redirectUri);
+    const browser = new FormBrowser();
+    const page = await browser.open(authorizationUrl, reached);
+    const done = page.html === undefined
+        ? page
+        : await browser.submitLogin(page, credentials, reached);
+    if (!reached(done.url)) {
+        throw new Error(`login did not return to ${redirectUri}; ended at ${done.url}`);
+    }
+    return new URL(done.url);
+}
+/**
+ * Approve a device authorization the way a user would: open the verification
+ * URI (with the user code already in it), log in, and grant access.
+ */
+async function approveDevice(verificationUriComplete, credentials) {
+    const browser = new FormBrowser();
+    const page = await browser.open(verificationUriComplete);
+    const consent = await browser.submitLogin(page, credentials);
+    await browser.acceptConsent(consent);
+}
+/**
+ * A SAML login at an identity provider: open the AuthnRequest URL, log in,
+ * and take the SAMLResponse from the auto-posting form the IdP answers with —
+ * what a browser would post to the assertion consumer service.
+ */
+async function samlResponseByForm(authnRequestUrl, credentials) {
+    const browser = new FormBrowser();
+    const page = await browser.submitLogin(await browser.open(authnRequestUrl), credentials);
+    const html = page.html ?? '';
+    const input = [...html.matchAll(/<input\b[^>]*>/gi)]
+        .map((m) => m[0])
+        .find((i) => attribute(i, 'name') === 'SAMLResponse');
+    const samlResponse = input ? attribute(input, 'value') : undefined;
+    const formTag = /<form\b[^>]*>/i.exec(html)?.[0] ?? '';
+    if (!samlResponse) {
+        throw new Error(`no SAMLResponse form on ${page.url}`);
+    }
+    return { samlResponse, acsUrl: attribute(formTag, 'action') ?? '' };
+}
+const decode = (value) => value
+    .replace(/&amp;/g, '&')
+    .replace(/&quot;/g, '"')
+    .replace(/&#39;/g, "'")
+    .replace(/&lt;/g, '<')
+    .replace(/&gt;/g, '>');
+const attribute = (tag, name) => {
+    const match = new RegExp(`\\s${name}\\s*=\\s*("([^"]*)"|'([^']*)')`, 'i').exec(tag);
+    return match ? decode(match[2] ?? match[3] ?? '') : undefined;
+};
+function findPasswordForm(html) {
+    for (const match of html.matchAll(/<form\b[^>]*>[\s\S]*?<\/form>/gi)) {
+        const formHtml = match[0];
+        const inputs = [...formHtml.matchAll(/<input\b[^>]*>/gi)].map((m) => m[0]);
+        const password = inputs.find((i) => attribute(i, 'type') === 'password');
+        if (!password)
+            continue;
+        const hidden = {};
+        let userField = 'username';
+        for (const input of inputs) {
+            const type = (attribute(input, 'type') ?? 'text').toLowerCase();
+            const name = attribute(input, 'name');
+            if (!name)
+                continue;
+            if (type === 'hidden')
+                hidden[name] = attribute(input, 'value') ?? '';
+            if ((type === 'text' || type === 'email') &&
+                /user|email|login/i.test(name)) {
+                userField = name;
+            }
+        }
+        const formTag = /<form\b[^>]*>/i.exec(formHtml)?.[0] ?? '';
+        return {
+            action: attribute(formTag, 'action') ?? '',
+            userField,
+            passwordField: attribute(password, 'name') ?? 'password',
+            hidden,
+        };
+    }
+    return undefined;
+}

package/dist/auth/callbackServer.js

@@ -163,8 +163,8 @@ async function runCallbackScope(options, routes, use) {
             setTimeout(() => {
                 if (finished)
                     return;
-                // Grace expired — on Node 18.x `close()` does not end idle connections,
-                // and an active one may simply be stuck. Force it, bounded.
+                // Grace expired — an active connection may simply be stuck. Force it,
+                // bounded.
                 server.closeIdleConnections?.();
                 server.closeAllConnections?.();
                 for (const socket of sockets)

package/dist/auth/passcodeAuth.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The UAA one-time passcode exchange — what `cf login --sso` does.
+ *
+ * The user opens `<uaa>/passcode` in any browser, logs in however the
+ * identity zone lets them (SSO, a corporate IdP, MFA), and copies the
+ * "Temporary Authentication Code" shown there. That code is exchanged here
+ * through the password grant, with `passcode` in place of a username and
+ * password. It is a UAA extension, not an RFC; XSUAA inherits it.
+ *
+ * UAA hands the request to its passcode filter chain only when its Accept
+ * header names JSON (`passcodeTokenMatcher` accepts `application/json` or
+ * `application/x-www-form-urlencoded`). Otherwise it falls through to the
+ * ordinary password grant, which answers `invalid_client: No password
+ * supplied` — what a bare `fetch`, which sends `*\/*`, gets. axios's default
+ * Accept happens to include `application/json`; the header is set explicitly
+ * so the exchange does not depend on an HTTP client's defaults.
+ */
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+export interface PasscodeTokens {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+}
+export declare function exchangePasscode(uaaUrl: string, clientId: string, clientSecret: string | undefined, passcode: string, logger?: ILogger): Promise<PasscodeTokens>;
+//# sourceMappingURL=passcodeAuth.d.ts.map

package/dist/auth/passcodeAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passcodeAuth.d.ts","sourceRoot":"","sources":["../../src/auth/passcodeAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,cAAc,CAAC,CAiDzB"}

package/dist/auth/passcodeAuth.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * The UAA one-time passcode exchange — what `cf login --sso` does.
+ *
+ * The user opens `<uaa>/passcode` in any browser, logs in however the
+ * identity zone lets them (SSO, a corporate IdP, MFA), and copies the
+ * "Temporary Authentication Code" shown there. That code is exchanged here
+ * through the password grant, with `passcode` in place of a username and
+ * password. It is a UAA extension, not an RFC; XSUAA inherits it.
+ *
+ * UAA hands the request to its passcode filter chain only when its Accept
+ * header names JSON (`passcodeTokenMatcher` accepts `application/json` or
+ * `application/x-www-form-urlencoded`). Otherwise it falls through to the
+ * ordinary password grant, which answers `invalid_client: No password
+ * supplied` — what a bare `fetch`, which sends `*\/*`, gets. axios's default
+ * Accept happens to include `application/json`; the header is set explicitly
+ * so the exchange does not depend on an HTTP client's defaults.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangePasscode = exchangePasscode;
+const axios_1 = __importDefault(require("axios"));
+async function exchangePasscode(uaaUrl, clientId, clientSecret, passcode, logger) {
+    const tokenUrl = `${uaaUrl.replace(/\/+$/, '')}/oauth/token`;
+    const params = new URLSearchParams();
+    params.append('grant_type', 'password');
+    params.append('passcode', passcode);
+    logger?.info('[UAA] Exchanging passcode for token', { tokenUrl });
+    // A public client — `cf` is one — authenticates with an empty secret.
+    const basic = Buffer.from(`${clientId}:${clientSecret ?? ''}`).toString('base64');
+    let response;
+    try {
+        response = await axios_1.default.post(tokenUrl, params.toString(), {
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+                Authorization: `Basic ${basic}`,
+            },
+        });
+    }
+    catch (error) {
+        // UAA says why in the body — "Invalid passcode" for a mistyped or
+        // already spent code — which is what the user needs to read.
+        if (axios_1.default.isAxiosError(error) && error.response) {
+            const body = error.response.data;
+            const reason = body?.error_description ?? body?.error ?? 'no reason given';
+            throw new Error(`Passcode exchange failed (${error.response.status}): ${reason}`);
+        }
+        throw error;
+    }
+    const data = response.data;
+    if (!data?.access_token) {
+        throw new Error('Passcode exchange returned no access_token');
+    }
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresIn: data.expires_in,
+    };
+}

package/dist/auth/samlBearerAssertion.d.ts

@@ -0,0 +1,24 @@
+/**
+ * What the SAML 2.0 bearer grant accepts, from what a SAML login delivers.
+ *
+ * RFC 7522 §2.1: the `assertion` parameter is a single SAML 2.0 Assertion,
+ * base64url-encoded. An interactive login delivers something else — the
+ * identity provider's whole `samlp:Response`, in standard base64 — and a
+ * token endpoint that follows the RFC refuses it: Cloud Foundry UAA answers
+ * 401 to a Response in either encoding. So the Assertion is taken out of the
+ * Response here and re-encoded.
+ *
+ * The Assertion is serialised as an element of its own, and every namespace
+ * declaration it inherited from the Response is copied onto it first. A
+ * serializer would add back only the prefixes used in element and attribute
+ * names; a prefix used only inside a value — `xsi:type="xs:string"` — would be
+ * lost, leaving a QName that no longer resolves. Copying all of them keeps the
+ * Assertion's in-scope namespaces exactly what they were. Its signature, over
+ * exclusive canonical XML, still verifies: canonicalisation renders a
+ * namespace where it is used, or where the signature's InclusiveNamespaces
+ * names it, not where it was declared. A signature over the Response alone does not
+ * survive the cut; the token endpoint then refuses the Assertion, as it
+ * would any unsigned one.
+ */
+export declare function toBearerAssertion(payload: string): string;
+//# sourceMappingURL=samlBearerAssertion.d.ts.map

package/dist/auth/samlBearerAssertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"samlBearerAssertion.d.ts","sourceRoot":"","sources":["../../src/auth/samlBearerAssertion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmDzD"}

package/dist/auth/samlBearerAssertion.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * What the SAML 2.0 bearer grant accepts, from what a SAML login delivers.
+ *
+ * RFC 7522 §2.1: the `assertion` parameter is a single SAML 2.0 Assertion,
+ * base64url-encoded. An interactive login delivers something else — the
+ * identity provider's whole `samlp:Response`, in standard base64 — and a
+ * token endpoint that follows the RFC refuses it: Cloud Foundry UAA answers
+ * 401 to a Response in either encoding. So the Assertion is taken out of the
+ * Response here and re-encoded.
+ *
+ * The Assertion is serialised as an element of its own, and every namespace
+ * declaration it inherited from the Response is copied onto it first. A
+ * serializer would add back only the prefixes used in element and attribute
+ * names; a prefix used only inside a value — `xsi:type="xs:string"` — would be
+ * lost, leaving a QName that no longer resolves. Copying all of them keeps the
+ * Assertion's in-scope namespaces exactly what they were. Its signature, over
+ * exclusive canonical XML, still verifies: canonicalisation renders a
+ * namespace where it is used, or where the signature's InclusiveNamespaces
+ * names it, not where it was declared. A signature over the Response alone does not
+ * survive the cut; the token endpoint then refuses the Assertion, as it
+ * would any unsigned one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toBearerAssertion = toBearerAssertion;
+const xmldom_1 = require("@xmldom/xmldom");
+const SAML_ASSERTION_NS = 'urn:oasis:names:tc:SAML:2.0:assertion';
+const SAML_PROTOCOL_NS = 'urn:oasis:names:tc:SAML:2.0:protocol';
+function toBearerAssertion(payload) {
+    // Node's base64 decoder accepts both alphabets, so this reads either.
+    const xml = Buffer.from(payload.trim(), 'base64').toString('utf8');
+    if (!xml.trimStart().startsWith('<')) {
+        throw new Error('SAML bearer payload is not base64-encoded XML');
+    }
+    let root;
+    try {
+        root = new xmldom_1.DOMParser().parseFromString(xml, 'text/xml').documentElement;
+    }
+    catch (error) {
+        throw new Error(`SAML bearer payload is not well-formed XML: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (isElement(root, SAML_ASSERTION_NS, 'Assertion')) {
+        return Buffer.from(xml, 'utf8').toString('base64url');
+    }
+    if (!isElement(root, SAML_PROTOCOL_NS, 'Response')) {
+        throw new Error('SAML bearer payload is neither a SAML Response nor an Assertion');
+    }
+    const children = childElements(root);
+    const assertions = children.filter((e) => isElement(e, SAML_ASSERTION_NS, 'Assertion'));
+    if (assertions.length === 0) {
+        if (children.some((e) => isElement(e, SAML_ASSERTION_NS, 'EncryptedAssertion'))) {
+            throw new Error('SAML Response carries only an EncryptedAssertion; encrypted Assertions are not supported');
+        }
+        throw new Error('SAML Response carries no Assertion');
+    }
+    if (assertions.length > 1) {
+        throw new Error(`SAML Response carries ${assertions.length} Assertions; a bearer grant takes one`);
+    }
+    const assertion = assertions[0];
+    declareInheritedNamespaces(assertion);
+    const serialized = new xmldom_1.XMLSerializer().serializeToString(assertion);
+    return Buffer.from(serialized, 'utf8').toString('base64url');
+}
+function isElement(node, namespace, localName) {
+    return (!!node && node.namespaceURI === namespace && node.localName === localName);
+}
+const XMLNS_NS = 'http://www.w3.org/2000/xmlns/';
+const isNamespaceDeclaration = (name) => name === 'xmlns' || name.startsWith('xmlns:');
+/**
+ * Copies onto `element` every namespace declaration in scope from its
+ * ancestors that it does not make itself. Ancestors are walked innermost
+ * first, so the nearest declaration of a prefix wins, as it did in place.
+ */
+function declareInheritedNamespaces(element) {
+    const declared = new Set();
+    for (let i = 0; i < element.attributes.length; i++) {
+        const name = element.attributes.item(i)?.name;
+        if (name && isNamespaceDeclaration(name))
+            declared.add(name);
+    }
+    for (let ancestor = element.parentNode; ancestor && ancestor.nodeType === 1; ancestor = ancestor.parentNode) {
+        const attributes = ancestor.attributes;
+        for (let i = 0; i < attributes.length; i++) {
+            const attribute = attributes.item(i);
+            if (attribute &&
+                isNamespaceDeclaration(attribute.name) &&
+                !declared.has(attribute.name)) {
+                element.setAttributeNS(XMLNS_NS, attribute.name, attribute.value);
+                declared.add(attribute.name);
+            }
+        }
+    }
+}
+function childElements(parent) {
+    const out = [];
+    for (let n = parent.firstChild; n; n = n.nextSibling) {
+        if (n.nodeType === 1)
+            out.push(n);
+    }
+    return out;
+}

package/dist/index.d.ts

@@ -9,10 +9,10 @@ export type { OidcCallbackResult } from './auth/oidcBrowserAuth';
 export { withOidcCallbackServer } from './auth/oidcBrowserAuth';
 export { withSamlCallbackServer } from './auth/saml2Auth';
 export { BrowserAuthError, RefreshError, ServiceKeyError, SessionDataError, TokenProviderError, ValidationError, } from './errors/TokenProviderErrors';
-export type { AuthorizationCodeProviderConfig, ClientCredentialsProviderConfig, DeviceFlowProviderConfig, OidcBrowserProviderConfig, OidcDeviceFlowProviderConfig, OidcPasswordProviderConfig, OidcTokenExchangeProviderConfig, Saml2BearerProviderConfig, Saml2PureProviderConfig, } from './providers';
-export { AuthorizationCodeProvider, BaseTokenProvider, ClientCredentialsProvider, DeviceFlowProvider, OidcBrowserProvider, OidcDeviceFlowProvider, OidcPasswordProvider, OidcTokenExchangeProvider, Saml2BearerProvider, Saml2PureProvider, } from './providers';
+export type { AuthorizationCodeProviderConfig, ClientCredentialsProviderConfig, OidcBrowserProviderConfig, OidcDeviceFlowProviderConfig, OidcPasswordProviderConfig, OidcTokenExchangeProviderConfig, Saml2BearerProviderConfig, Saml2PureProviderConfig, UaaPasscodeProviderConfig, } from './providers';
+export { AuthorizationCodeProvider, BaseTokenProvider, ClientCredentialsProvider, OidcBrowserProvider, OidcDeviceFlowProvider, OidcPasswordProvider, OidcTokenExchangeProvider, Saml2BearerProvider, Saml2PureProvider, UaaPasscodeProvider, } from './providers';
 export { SsoProviderFactory } from './sso/SsoProviderFactory';
 export type { SsoProviderConfig, SsoProviderInstance } from './sso/types';
 export type { BrowserCallbackStrategyOptions, CallbackStrategyOptions, ExternalCodeStrategyOptions, ManualStrategyOptions, StaticCodeStrategyOptions, } from './strategies';
-export { asOidcResult, BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, externalCodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, oidcCallbackStrategy, samlCallbackStrategy, staticCodeStrategy, } from './strategies';
+export { asOidcResult, BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, externalCodeStrategy, manualPasscodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, oidcCallbackStrategy, samlCallbackStrategy, staticCodeStrategy, } from './strategies';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -6,7 +6,7 @@
  * Provides token providers
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
+exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.manualPasscodeStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.UaaPasscodeProvider = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
 // Callback server factories — "take the transport this package gives".
 var callbackServer_1 = require("./auth/callbackServer");
 Object.defineProperty(exports, "withBrowserCallbackServer", { enumerable: true, get: function () { return callbackServer_1.withBrowserCallbackServer; } });
@@ -27,13 +27,13 @@ var providers_1 = require("./providers");
 Object.defineProperty(exports, "AuthorizationCodeProvider", { enumerable: true, get: function () { return providers_1.AuthorizationCodeProvider; } });
 Object.defineProperty(exports, "BaseTokenProvider", { enumerable: true, get: function () { return providers_1.BaseTokenProvider; } });
 Object.defineProperty(exports, "ClientCredentialsProvider", { enumerable: true, get: function () { return providers_1.ClientCredentialsProvider; } });
-Object.defineProperty(exports, "DeviceFlowProvider", { enumerable: true, get: function () { return providers_1.DeviceFlowProvider; } });
 Object.defineProperty(exports, "OidcBrowserProvider", { enumerable: true, get: function () { return providers_1.OidcBrowserProvider; } });
 Object.defineProperty(exports, "OidcDeviceFlowProvider", { enumerable: true, get: function () { return providers_1.OidcDeviceFlowProvider; } });
 Object.defineProperty(exports, "OidcPasswordProvider", { enumerable: true, get: function () { return providers_1.OidcPasswordProvider; } });
 Object.defineProperty(exports, "OidcTokenExchangeProvider", { enumerable: true, get: function () { return providers_1.OidcTokenExchangeProvider; } });
 Object.defineProperty(exports, "Saml2BearerProvider", { enumerable: true, get: function () { return providers_1.Saml2BearerProvider; } });
 Object.defineProperty(exports, "Saml2PureProvider", { enumerable: true, get: function () { return providers_1.Saml2PureProvider; } });
+Object.defineProperty(exports, "UaaPasscodeProvider", { enumerable: true, get: function () { return providers_1.UaaPasscodeProvider; } });
 // SSO factory
 var SsoProviderFactory_1 = require("./sso/SsoProviderFactory");
 Object.defineProperty(exports, "SsoProviderFactory", { enumerable: true, get: function () { return SsoProviderFactory_1.SsoProviderFactory; } });
@@ -45,6 +45,7 @@ Object.defineProperty(exports, "browserCallbackStrategy", { enumerable: true, ge
 Object.defineProperty(exports, "DEFAULT_CALLBACK_PORT", { enumerable: true, get: function () { return strategies_1.DEFAULT_CALLBACK_PORT; } });
 Object.defineProperty(exports, "DEFAULT_LOGIN_TIMEOUT_MS", { enumerable: true, get: function () { return strategies_1.DEFAULT_LOGIN_TIMEOUT_MS; } });
 Object.defineProperty(exports, "externalCodeStrategy", { enumerable: true, get: function () { return strategies_1.externalCodeStrategy; } });
+Object.defineProperty(exports, "manualPasscodeStrategy", { enumerable: true, get: function () { return strategies_1.manualPasscodeStrategy; } });
 Object.defineProperty(exports, "manualPasteStrategy", { enumerable: true, get: function () { return strategies_1.manualPasteStrategy; } });
 Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true, get: function () { return strategies_1.manualSamlResponseStrategy; } });
 Object.defineProperty(exports, "oidcCallbackStrategy", { enumerable: true, get: function () { return strategies_1.oidcCallbackStrategy; } });

package/dist/providers/Saml2BearerProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAK9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAiB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAoBrD;;;;OAIG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqBxD"}
+{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAM9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAiB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAsBrD;;;;OAIG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqBxD"}

package/dist/providers/Saml2BearerProvider.js

@@ -8,6 +8,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Saml2BearerProvider = void 0;
 const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const saml2TokenExchange_1 = require("../auth/saml2TokenExchange");
+const samlBearerAssertion_1 = require("../auth/samlBearerAssertion");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 const saml2Utils_1 = require("./saml2Utils");
 class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
@@ -33,7 +34,9 @@ class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
     async performLogin() {
         const samlResponse = await (0, saml2Utils_1.getSamlAssertion)(this.config);
         const tokenUrl = (0, saml2Utils_1.resolveTokenUrl)(this.config);
-        const tokens = await (0, saml2TokenExchange_1.exchangeSamlAssertion)(samlResponse, tokenUrl, this.config.clientId, this.config.clientSecret, this.logger);
+        // RFC 7522 takes one base64url Assertion; a login delivers the whole
+        // Response in standard base64, which a conforming endpoint refuses.
+        const tokens = await (0, saml2TokenExchange_1.exchangeSamlAssertion)((0, samlBearerAssertion_1.toBearerAssertion)(samlResponse), tokenUrl, this.config.clientId, this.config.clientSecret, this.logger);
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,

package/dist/providers/UaaPasscodeProvider.d.ts

@@ -0,0 +1,43 @@
+/**
+ * UAA / XSUAA one-time passcode provider — the login `cf login --sso` uses.
+ *
+ * Nothing is opened and nothing listens on this machine: the user fetches a
+ * code from `<uaaUrl>/passcode` in any browser, anywhere, logging in however
+ * the identity zone asks (SSO through a corporate IdP, MFA), and hands it to
+ * the strategy. The provider exchanges it for tokens and refreshes them
+ * afterwards, so the user is asked again only when the refresh token is gone.
+ */
+import type { IAuthorizationStrategy, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+import { BaseTokenProvider } from './BaseTokenProvider';
+export interface UaaPasscodeProviderConfig {
+    /** UAA / XSUAA base URL, e.g. `https://<subdomain>.authentication.<region>.hana.ondemand.com`. */
+    uaaUrl: string;
+    /** A client allowed the `password` grant; add `refresh_token` to keep the session. */
+    clientId: string;
+    /** Omitted for a public client, which authenticates with an empty secret. */
+    clientSecret?: string;
+    /**
+     * How the user's code reaches the provider. The strategy is handed
+     * `<uaaUrl>/passcode` as the URL to send the user to, and returns the code.
+     * Defaults to `manualPasscodeStrategy()`: announce the URL, read the code
+     * from the terminal.
+     */
+    authorization?: IAuthorizationStrategy<string>;
+    accessToken?: string;
+    refreshToken?: string;
+    logger?: ILogger;
+}
+export declare class UaaPasscodeProvider extends BaseTokenProvider {
+    private readonly config;
+    constructor(config: UaaPasscodeProviderConfig);
+    protected getAuthType(): OAuth2GrantType;
+    private get baseUrl();
+    protected performLogin(): Promise<ITokenResult>;
+    /**
+     * A failure is thrown, not handled: BaseTokenProvider drops the refresh
+     * token and asks for a new passcode through performLogin().
+     */
+    protected performRefresh(): Promise<ITokenResult>;
+}
+//# sourceMappingURL=UaaPasscodeProvider.d.ts.map

package/dist/providers/UaaPasscodeProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UaaPasscodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/UaaPasscodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAI9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;gBAEvC,MAAM,EAAE,yBAAyB;IAa7C,SAAS,CAAC,WAAW,IAAI,eAAe;IAIxC,OAAO,KAAK,OAAO,GAElB;cAEe,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAqCrD;;;OAGG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAkBxD"}