@mcp-abap-adt/auth-providers 2.2.1 → 3.0.0

package/dist/providers/UaaPasscodeProvider.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * UAA / XSUAA one-time passcode provider — the login `cf login --sso` uses.
+ *
+ * Nothing is opened and nothing listens on this machine: the user fetches a
+ * code from `<uaaUrl>/passcode` in any browser, anywhere, logging in however
+ * the identity zone asks (SSO through a corporate IdP, MFA), and hands it to
+ * the strategy. The provider exchanges it for tokens and refreshes them
+ * afterwards, so the user is asked again only when the refresh token is gone.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UaaPasscodeProvider = void 0;
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
+const passcodeAuth_1 = require("../auth/passcodeAuth");
+const tokenRefresher_1 = require("../auth/tokenRefresher");
+const manualStrategies_1 = require("../strategies/manualStrategies");
+const BaseTokenProvider_1 = require("./BaseTokenProvider");
+class UaaPasscodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
+    config;
+    constructor(config) {
+        super();
+        this.config = config;
+        this.logger = config.logger;
+        if (config.accessToken) {
+            this.authorizationToken = config.accessToken;
+            this.expiresAt = this.parseExpirationFromJWT(config.accessToken);
+        }
+        if (config.refreshToken) {
+            this.refreshToken = config.refreshToken;
+        }
+    }
+    getAuthType() {
+        return interfaces_auth_1.AUTH_TYPE_PASSWORD;
+    }
+    get baseUrl() {
+        return this.config.uaaUrl.replace(/\/+$/, '');
+    }
+    async performLogin() {
+        const supplied = this.config.authorization;
+        const strategy = supplied ?? (0, manualStrategies_1.manualPasscodeStrategy)();
+        let passcode;
+        try {
+            // The passcode page takes no redirect: the code travels by hand.
+            const outcome = await strategy.authorize({
+                logger: this.logger,
+                buildAuthorizationUrl: async () => `${this.baseUrl}/passcode`,
+            });
+            passcode = outcome.payload;
+        }
+        finally {
+            if (!supplied) {
+                await strategy.dispose?.().catch((error) => {
+                    this.logger?.warn('[UaaPasscodeProvider] dispose failed', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                });
+            }
+        }
+        const tokens = await (0, passcodeAuth_1.exchangePasscode)(this.baseUrl, this.config.clientId, this.config.clientSecret, passcode, this.logger);
+        return {
+            authorizationToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            authType: interfaces_auth_1.AUTH_TYPE_PASSWORD,
+            expiresIn: tokens.expiresIn,
+            tokenType: 'jwt',
+        };
+    }
+    /**
+     * A failure is thrown, not handled: BaseTokenProvider drops the refresh
+     * token and asks for a new passcode through performLogin().
+     */
+    async performRefresh() {
+        if (!this.refreshToken) {
+            throw new Error('Refresh token is required for refresh');
+        }
+        const result = await (0, tokenRefresher_1.refreshJwtToken)(this.refreshToken, this.baseUrl, this.config.clientId, this.config.clientSecret ?? '');
+        return {
+            authorizationToken: result.accessToken,
+            refreshToken: result.refreshToken || this.refreshToken,
+            authType: interfaces_auth_1.AUTH_TYPE_PASSWORD,
+            expiresIn: result.expiresIn,
+            tokenType: 'jwt',
+        };
+    }
+}
+exports.UaaPasscodeProvider = UaaPasscodeProvider;

package/dist/providers/index.d.ts

@@ -9,8 +9,6 @@ export { AuthorizationCodeProvider } from './AuthorizationCodeProvider';
 export { BaseTokenProvider } from './BaseTokenProvider';
 export type { ClientCredentialsProviderConfig } from './ClientCredentialsProvider';
 export { ClientCredentialsProvider } from './ClientCredentialsProvider';
-export type { DeviceFlowProviderConfig } from './DeviceFlowProvider';
-export { DeviceFlowProvider } from './DeviceFlowProvider';
 export type { OidcBrowserProviderConfig } from './OidcBrowserProvider';
 export { OidcBrowserProvider } from './OidcBrowserProvider';
 export type { OidcDeviceFlowProviderConfig } from './OidcDeviceFlowProvider';
@@ -23,4 +21,6 @@ export type { Saml2BearerProviderConfig } from './Saml2BearerProvider';
 export { Saml2BearerProvider } from './Saml2BearerProvider';
 export type { Saml2PureProviderConfig } from './Saml2PureProvider';
 export { Saml2PureProvider } from './Saml2PureProvider';
+export type { UaaPasscodeProviderConfig } from './UaaPasscodeProvider';
+export { UaaPasscodeProvider } from './UaaPasscodeProvider';
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/providers/index.js

@@ -6,15 +6,13 @@
  * All providers extend BaseTokenProvider and implement ITokenProvider.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = void 0;
+exports.UaaPasscodeProvider = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = void 0;
 var AuthorizationCodeProvider_1 = require("./AuthorizationCodeProvider");
 Object.defineProperty(exports, "AuthorizationCodeProvider", { enumerable: true, get: function () { return AuthorizationCodeProvider_1.AuthorizationCodeProvider; } });
 var BaseTokenProvider_1 = require("./BaseTokenProvider");
 Object.defineProperty(exports, "BaseTokenProvider", { enumerable: true, get: function () { return BaseTokenProvider_1.BaseTokenProvider; } });
 var ClientCredentialsProvider_1 = require("./ClientCredentialsProvider");
 Object.defineProperty(exports, "ClientCredentialsProvider", { enumerable: true, get: function () { return ClientCredentialsProvider_1.ClientCredentialsProvider; } });
-var DeviceFlowProvider_1 = require("./DeviceFlowProvider");
-Object.defineProperty(exports, "DeviceFlowProvider", { enumerable: true, get: function () { return DeviceFlowProvider_1.DeviceFlowProvider; } });
 var OidcBrowserProvider_1 = require("./OidcBrowserProvider");
 Object.defineProperty(exports, "OidcBrowserProvider", { enumerable: true, get: function () { return OidcBrowserProvider_1.OidcBrowserProvider; } });
 var OidcDeviceFlowProvider_1 = require("./OidcDeviceFlowProvider");
@@ -27,3 +25,5 @@ var Saml2BearerProvider_1 = require("./Saml2BearerProvider");
 Object.defineProperty(exports, "Saml2BearerProvider", { enumerable: true, get: function () { return Saml2BearerProvider_1.Saml2BearerProvider; } });
 var Saml2PureProvider_1 = require("./Saml2PureProvider");
 Object.defineProperty(exports, "Saml2PureProvider", { enumerable: true, get: function () { return Saml2PureProvider_1.Saml2PureProvider; } });
+var UaaPasscodeProvider_1 = require("./UaaPasscodeProvider");
+Object.defineProperty(exports, "UaaPasscodeProvider", { enumerable: true, get: function () { return UaaPasscodeProvider_1.UaaPasscodeProvider; } });

package/dist/strategies/index.d.ts

@@ -4,5 +4,5 @@ export { BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT
 export type { ExternalCodeStrategyOptions, StaticCodeStrategyOptions, } from './codeStrategies';
 export { externalCodeStrategy, staticCodeStrategy, } from './codeStrategies';
 export type { ManualStrategyOptions } from './manualStrategies';
-export { manualPasteStrategy, manualSamlResponseStrategy, } from './manualStrategies';
+export { manualPasscodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, } from './manualStrategies';
 //# sourceMappingURL=index.d.ts.map

package/dist/strategies/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/strategies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/strategies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC"}

package/dist/strategies/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.staticCodeStrategy = exports.externalCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = void 0;
+exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.manualPasscodeStrategy = exports.staticCodeStrategy = exports.externalCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = void 0;
 var asOidcResult_1 = require("./asOidcResult");
 Object.defineProperty(exports, "asOidcResult", { enumerable: true, get: function () { return asOidcResult_1.asOidcResult; } });
 var BrowserCallbackStrategy_1 = require("./BrowserCallbackStrategy");
@@ -14,5 +14,6 @@ var codeStrategies_1 = require("./codeStrategies");
 Object.defineProperty(exports, "externalCodeStrategy", { enumerable: true, get: function () { return codeStrategies_1.externalCodeStrategy; } });
 Object.defineProperty(exports, "staticCodeStrategy", { enumerable: true, get: function () { return codeStrategies_1.staticCodeStrategy; } });
 var manualStrategies_1 = require("./manualStrategies");
+Object.defineProperty(exports, "manualPasscodeStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualPasscodeStrategy; } });
 Object.defineProperty(exports, "manualPasteStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualPasteStrategy; } });
 Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualSamlResponseStrategy; } });

package/dist/strategies/manualStrategies.d.ts

@@ -17,4 +17,11 @@ export interface ManualStrategyOptions {
 export declare function manualPasteStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
 /** The user lifts `SAMLResponse` from the POST body — it never reaches the URL. */
 export declare function manualSamlResponseStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
+/**
+ * The UAA passcode, typed in by the user: shows where to fetch it —
+ * `<uaa>/passcode`, opened in any browser, on any machine — and reads the
+ * code they copy from that page. The default for `UaaPasscodeProvider`, so a
+ * login works on a machine with no browser at all, as `cf login --sso` does.
+ */
+export declare function manualPasscodeStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
 //# sourceMappingURL=manualStrategies.d.ts.map

package/dist/strategies/manualStrategies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manualStrategies.d.ts","sourceRoot":"","sources":["../../src/strategies/manualStrategies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAGV,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAiCD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAmBhC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAiBhC"}
+{"version":3,"file":"manualStrategies.d.ts","sourceRoot":"","sources":["../../src/strategies/manualStrategies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAGV,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAiCD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAmBhC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAiBhC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAgBhC"}

package/dist/strategies/manualStrategies.js

@@ -10,6 +10,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.manualPasteStrategy = manualPasteStrategy;
 exports.manualSamlResponseStrategy = manualSamlResponseStrategy;
+exports.manualPasscodeStrategy = manualPasscodeStrategy;
 const node_readline_1 = require("node:readline");
 const browserAuth_1 = require("../auth/browserAuth");
 const BrowserCallbackStrategy_1 = require("./BrowserCallbackStrategy");
@@ -75,3 +76,23 @@ function manualSamlResponseStrategy(options = {}) {
         },
     };
 }
+/**
+ * The UAA passcode, typed in by the user: shows where to fetch it —
+ * `<uaa>/passcode`, opened in any browser, on any machine — and reads the
+ * code they copy from that page. The default for `UaaPasscodeProvider`, so a
+ * login works on a machine with no browser at all, as `cf login --sso` does.
+ */
+function manualPasscodeStrategy(options = {}) {
+    const redirectUri = options.redirectUri ?? defaultRedirectUri();
+    const read = options.read ?? readFromTerminal;
+    return {
+        async authorize(request) {
+            const url = await request.buildAuthorizationUrl(redirectUri);
+            announce(request, url);
+            const code = (await read('Paste the Temporary Authentication Code (passcode): ')).trim();
+            if (!code)
+                throw new Error('No passcode was provided');
+            return { payload: code, redirectUri };
+        },
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "2.2.1",
+  "version": "3.0.0",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -40,8 +40,7 @@
   },
   "bin": {
     "auth-authorization-code": "./bin/auth-authorization-code.ts",
-    "auth-client-credentials": "./bin/auth-client-credentials.ts",
-    "auth-device-flow": "./bin/auth-device-flow.ts"
+    "auth-client-credentials": "./bin/auth-client-credentials.ts"
   },
   "scripts": {
     "chrono": "./tools/version-stats.sh",
@@ -53,15 +52,20 @@
     "build:fast": "npx tsc -p tsconfig.json",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "test:check": "npx tsc --noEmit",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "stand:up": "tests/stand/up.sh",
+    "stand:down": "tests/stand/down.sh",
+    "test:stand": "tests/stand/run.sh",
+    "test:xsuaa": "tests/xsuaa/run.sh"
   },
   "engines": {
-    "node": ">=18.2.0"
+    "node": "^22 || ^24"
   },
   "dependencies": {
     "@mcp-abap-adt/interfaces-auth": "^1.2.0",
     "@mcp-abap-adt/interfaces-auth-sap": "^1.0.0",
     "@mcp-abap-adt/interfaces-utils": "^1.1.0",
+    "@xmldom/xmldom": "^0.9.12",
     "axios": "^1.13.5",
     "express": "^5.1.0",
     "open": "^11.0.0"
@@ -69,6 +73,7 @@
   "devDependencies": {
     "@biomejs/biome": "^2.3.14",
     "@jest/globals": "^30.2.0",
+    "@mcp-abap-adt/auth-mocks": "^0.3.0",
     "@mcp-abap-adt/auth-stores": "^1.0.1",
     "@mcp-abap-adt/logger": "^0.4.0",
     "@types/express": "^5.0.5",

package/bin/auth-device-flow.ts

@@ -1,114 +0,0 @@
-#!/usr/bin/env tsx
-/**
- * Device Flow Provider Test Command
- */
-
-import { DeviceFlowProvider } from '../src/providers/DeviceFlowProvider';
-import {
-  getUaaCredentials,
-  parseEnvFile,
-  parseServiceKey,
-  writeEnvFile,
-} from './utils/parseConfig';
-
-async function main() {
-  const args = process.argv.slice(2);
-  let serviceKeyPath: string | undefined;
-  let inputEnvPath: string | undefined;
-  let outputEnvPath: string | undefined;
-  let scope: string | undefined;
-
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === '--service-key' && args[i + 1]) {
-      serviceKeyPath = args[++i];
-    } else if (arg === '--input-env' && args[i + 1]) {
-      inputEnvPath = args[++i];
-    } else if (arg === '--output-env' && args[i + 1]) {
-      outputEnvPath = args[++i];
-    } else if (arg === '--scope' && args[i + 1]) {
-      scope = args[++i];
-    } else if (arg === '--help' || arg === '-h') {
-      console.log(`
-Usage: auth-device-flow [options]
-
-Options:
-  --service-key <path>    Path to service key JSON file
-  --input-env <path>      Path to .env file for reading existing tokens (for refresh)
-  --output-env <path>     Path to .env file for saving tokens
-  --scope <scope>         Optional scope (space-separated)
-  --help, -h              Show this help message
-      `);
-      process.exit(0);
-    }
-  }
-
-  if (!serviceKeyPath && !inputEnvPath) {
-    console.error('❌ Error: Either --service-key or --input-env must be provided');
-    process.exit(1);
-  }
-
-  if (!outputEnvPath) {
-    console.error('❌ Error: --output-env is required to save tokens');
-    process.exit(1);
-  }
-
-  try {
-    // Read config from service key or input env
-    const serviceKey = serviceKeyPath ? parseServiceKey(serviceKeyPath) : undefined;
-    const inputEnv = inputEnvPath ? parseEnvFile(inputEnvPath) : undefined;
-    const { uaaUrl, clientId, clientSecret } = getUaaCredentials(serviceKey, inputEnv);
-
-    // Read existing tokens from input env if provided
-    const existingAccessToken = inputEnv?.AUTHORIZATION_TOKEN;
-    const existingRefreshToken = inputEnv?.REFRESH_TOKEN;
-
-    const provider = new DeviceFlowProvider({
-      uaaUrl,
-      clientId,
-      clientSecret,
-      scope,
-      accessToken: existingAccessToken,
-      refreshToken: existingRefreshToken,
-    });
-
-    console.log('🔐 Getting tokens using Device Flow...');
-    if (serviceKeyPath) {
-      console.log(`📁 Service Key: ${serviceKeyPath}`);
-    }
-    if (inputEnvPath) {
-      console.log(`📁 Input Env: ${inputEnvPath}`);
-    }
-    console.log(`💾 Output Env: ${outputEnvPath}\n`);
-
-    const result = await provider.getTokens();
-
-    // Save tokens to output env file
-    writeEnvFile(outputEnvPath, {
-      authorizationToken: result.authorizationToken,
-      refreshToken: result.refreshToken,
-      uaaUrl,
-      clientId,
-      clientSecret,
-    });
-
-    console.log('✅ Tokens obtained and saved successfully!');
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-    console.log(`🔑 Authorization Token: ${result.authorizationToken.substring(0, 50)}...`);
-    if (result.refreshToken) {
-      console.log(`🔄 Refresh Token: ${result.refreshToken.substring(0, 50)}...`);
-    }
-    console.log(`📋 Auth Type: ${result.authType}`);
-    if (result.expiresIn) {
-      console.log(`⏰ Expires In: ${result.expiresIn} seconds`);
-    }
-    console.log(`💾 Saved to: ${outputEnvPath}`);
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-  } catch (error) {
-    console.error('❌ Error:', error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  }
-}
-
-main();
-

package/dist/auth/deviceFlowAuth.d.ts

@@ -1,43 +0,0 @@
-/**
- * Device Flow authentication
- *
- * OAuth2 Device Flow for devices without browser or input capabilities.
- * User authorizes on another device by entering a code.
- */
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-export interface DeviceFlowResult {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    verificationUriComplete?: string;
-    expiresIn: number;
-    interval?: number;
-}
-export interface DeviceFlowTokens {
-    accessToken: string;
-    refreshToken?: string;
-    expiresIn?: number;
-}
-/**
- * Initiate device flow - get device code and user code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param scope Optional scope (space-separated)
- * @param logger Optional logger
- * @returns Promise that resolves to device flow result
- * @internal - Internal function, not exported from package
- */
-export declare function initiateDeviceFlow(uaaUrl: string, clientId: string, scope?: string, logger?: ILogger): Promise<DeviceFlowResult>;
-/**
- * Poll for tokens using device code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param clientSecret Client secret (optional for public clients)
- * @param deviceCode Device code from initiateDeviceFlow
- * @param interval Polling interval in seconds
- * @param logger Optional logger
- * @returns Promise that resolves to tokens
- * @internal - Internal function, not exported from package
- */
-export declare function pollForDeviceTokens(uaaUrl: string, clientId: string, clientSecret: string | undefined, deviceCode: string, interval?: number, logger?: ILogger): Promise<DeviceFlowTokens>;
-//# sourceMappingURL=deviceFlowAuth.d.ts.map

package/dist/auth/deviceFlowAuth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deviceFlowAuth.d.ts","sourceRoot":"","sources":["../../src/auth/deviceFlowAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CA4D3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAU,EACpB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAoG3B"}

package/dist/auth/deviceFlowAuth.js

@@ -1,168 +0,0 @@
-"use strict";
-/**
- * Device Flow authentication
- *
- * OAuth2 Device Flow for devices without browser or input capabilities.
- * User authorizes on another device by entering a code.
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.initiateDeviceFlow = initiateDeviceFlow;
-exports.pollForDeviceTokens = pollForDeviceTokens;
-const axios_1 = __importDefault(require("axios"));
-/**
- * Initiate device flow - get device code and user code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param scope Optional scope (space-separated)
- * @param logger Optional logger
- * @returns Promise that resolves to device flow result
- * @internal - Internal function, not exported from package
- */
-async function initiateDeviceFlow(uaaUrl, clientId, scope, logger) {
-    try {
-        const deviceUrl = `${uaaUrl}/oauth/device_authorization`;
-        const params = new URLSearchParams();
-        params.append('client_id', clientId);
-        if (scope) {
-            params.append('scope', scope);
-        }
-        logger?.info(`Initiating device flow: ${deviceUrl}`);
-        const response = await (0, axios_1.default)({
-            method: 'post',
-            url: deviceUrl,
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            data: params.toString(),
-            timeout: 30000,
-        });
-        if (response.data?.device_code &&
-            response.data?.user_code &&
-            response.data?.verification_uri) {
-            return {
-                deviceCode: response.data.device_code,
-                userCode: response.data.user_code,
-                verificationUri: response.data.verification_uri,
-                verificationUriComplete: response.data.verification_uri_complete,
-                expiresIn: response.data.expires_in || 1800, // Default 30 minutes
-                interval: response.data.interval || 5, // Default 5 seconds
-            };
-        }
-        else {
-            throw new Error('Response does not contain required device flow fields');
-        }
-    }
-    catch (error) {
-        if (error &&
-            typeof error === 'object' &&
-            'response' in error &&
-            error.response &&
-            typeof error.response === 'object' &&
-            'status' in error.response &&
-            'data' in error.response) {
-            const axiosError = error;
-            throw new Error(`Device flow initiation failed (${axiosError.response.status}): ${JSON.stringify(axiosError.response.data)}`);
-        }
-        else {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            throw new Error(`Device flow initiation failed: ${errorMessage}`);
-        }
-    }
-}
-/**
- * Poll for tokens using device code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param clientSecret Client secret (optional for public clients)
- * @param deviceCode Device code from initiateDeviceFlow
- * @param interval Polling interval in seconds
- * @param logger Optional logger
- * @returns Promise that resolves to tokens
- * @internal - Internal function, not exported from package
- */
-async function pollForDeviceTokens(uaaUrl, clientId, clientSecret, deviceCode, interval = 5, logger) {
-    const tokenUrl = `${uaaUrl}/oauth/token`;
-    const params = new URLSearchParams();
-    params.append('grant_type', 'urn:ietf:params:oauth:grant-type:device_code');
-    params.append('device_code', deviceCode);
-    params.append('client_id', clientId);
-    const headers = {
-        'Content-Type': 'application/x-www-form-urlencoded',
-    };
-    // Add client secret if provided (for confidential clients)
-    if (clientSecret) {
-        const authString = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
-        headers.Authorization = `Basic ${authString}`;
-    }
-    // Poll until authorization is complete or expires
-    const maxAttempts = 120; // 10 minutes max (120 * 5 seconds)
-    let attempts = 0;
-    while (attempts < maxAttempts) {
-        try {
-            logger?.debug(`Polling for device tokens (attempt ${attempts + 1})`);
-            const response = await (0, axios_1.default)({
-                method: 'post',
-                url: tokenUrl,
-                headers,
-                data: params.toString(),
-                timeout: 30000,
-            });
-            if (response.data?.access_token) {
-                logger?.info('Device flow authorization successful');
-                return {
-                    accessToken: response.data.access_token,
-                    refreshToken: response.data.refresh_token,
-                    expiresIn: response.data.expires_in,
-                };
-            }
-            else {
-                throw new Error('Response does not contain access_token');
-            }
-        }
-        catch (error) {
-            // Check if it's an "authorization_pending" error (expected during polling)
-            if (error &&
-                typeof error === 'object' &&
-                'response' in error &&
-                error.response &&
-                typeof error.response === 'object' &&
-                'status' in error.response &&
-                'data' in error.response) {
-                const axiosError = error;
-                if (axiosError.response.data?.error === 'authorization_pending') {
-                    // Still waiting for user authorization - continue polling
-                    attempts++;
-                    if (attempts >= maxAttempts) {
-                        throw new Error('Device flow authorization timeout - user did not authorize in time');
-                    }
-                    // Wait for interval before next poll
-                    await new Promise((resolve) => setTimeout(resolve, interval * 1000));
-                    continue;
-                }
-                else if (axiosError.response.data?.error === 'slow_down') {
-                    // Server requests slower polling - increase interval by 5 seconds
-                    interval += 5;
-                    attempts++;
-                    if (attempts >= maxAttempts) {
-                        throw new Error('Device flow authorization timeout - user did not authorize in time');
-                    }
-                    await new Promise((resolve) => setTimeout(resolve, interval * 1000));
-                    continue;
-                }
-                else if (axiosError.response.data?.error === 'expired_token') {
-                    throw new Error('Device code expired - please restart device flow');
-                }
-                else if (axiosError.response.data?.error === 'access_denied') {
-                    throw new Error('User denied device authorization');
-                }
-            }
-            // Other error - rethrow
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            throw new Error(`Device flow polling failed: ${errorMessage}`);
-        }
-    }
-    throw new Error('Device flow authorization timeout - maximum polling attempts reached');
-}

package/dist/providers/DeviceFlowProvider.d.ts

@@ -1,32 +0,0 @@
-/**
- * Device Flow Token Provider
- *
- * Uses OAuth2 Device Flow for devices without browser or input capabilities.
- * User authorizes on another device by entering a code.
- */
-import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-import { BaseTokenProvider } from './BaseTokenProvider';
-export interface DeviceFlowProviderConfig {
-    uaaUrl: string;
-    clientId: string;
-    clientSecret?: string;
-    scope?: string;
-    accessToken?: string;
-    refreshToken?: string;
-    logger?: ILogger;
-}
-/**
- * Device Flow token provider
- *
- * Uses OAuth2 Device Flow - user authorizes on another device.
- * Supports refresh token if provided by server.
- */
-export declare class DeviceFlowProvider extends BaseTokenProvider {
-    private config;
-    constructor(config: DeviceFlowProviderConfig);
-    protected getAuthType(): OAuth2GrantType;
-    protected performLogin(): Promise<ITokenResult>;
-    protected performRefresh(): Promise<ITokenResult>;
-}
-//# sourceMappingURL=DeviceFlowProvider.d.ts.map

package/dist/providers/DeviceFlowProvider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"DeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/DeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAO9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,MAAM,CAA2B;gBAE7B,MAAM,EAAE,wBAAwB;IAc5C,SAAS,CAAC,WAAW,IAAI,eAAe;cAOxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAyCrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA2BxD"}