@mcp-abap-adt/auth-providers 2.2.2 → 3.0.0

package/dist/auth/callbackServer.js

@@ -163,8 +163,8 @@ async function runCallbackScope(options, routes, use) {
             setTimeout(() => {
                 if (finished)
                     return;
-                // Grace expired — on Node 18.x `close()` does not end idle connections,
-                // and an active one may simply be stuck. Force it, bounded.
+                // Grace expired — an active connection may simply be stuck. Force it,
+                // bounded.
                 server.closeIdleConnections?.();
                 server.closeAllConnections?.();
                 for (const socket of sockets)

package/dist/auth/passcodeAuth.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The UAA one-time passcode exchange — what `cf login --sso` does.
+ *
+ * The user opens `<uaa>/passcode` in any browser, logs in however the
+ * identity zone lets them (SSO, a corporate IdP, MFA), and copies the
+ * "Temporary Authentication Code" shown there. That code is exchanged here
+ * through the password grant, with `passcode` in place of a username and
+ * password. It is a UAA extension, not an RFC; XSUAA inherits it.
+ *
+ * UAA hands the request to its passcode filter chain only when its Accept
+ * header names JSON (`passcodeTokenMatcher` accepts `application/json` or
+ * `application/x-www-form-urlencoded`). Otherwise it falls through to the
+ * ordinary password grant, which answers `invalid_client: No password
+ * supplied` — what a bare `fetch`, which sends `*\/*`, gets. axios's default
+ * Accept happens to include `application/json`; the header is set explicitly
+ * so the exchange does not depend on an HTTP client's defaults.
+ */
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+export interface PasscodeTokens {
+    accessToken: string;
+    refreshToken?: string;
+    expiresIn?: number;
+}
+export declare function exchangePasscode(uaaUrl: string, clientId: string, clientSecret: string | undefined, passcode: string, logger?: ILogger): Promise<PasscodeTokens>;
+//# sourceMappingURL=passcodeAuth.d.ts.map

package/dist/auth/passcodeAuth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"passcodeAuth.d.ts","sourceRoot":"","sources":["../../src/auth/passcodeAuth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,QAAQ,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,cAAc,CAAC,CAiDzB"}

package/dist/auth/passcodeAuth.js

@@ -0,0 +1,62 @@
+"use strict";
+/**
+ * The UAA one-time passcode exchange — what `cf login --sso` does.
+ *
+ * The user opens `<uaa>/passcode` in any browser, logs in however the
+ * identity zone lets them (SSO, a corporate IdP, MFA), and copies the
+ * "Temporary Authentication Code" shown there. That code is exchanged here
+ * through the password grant, with `passcode` in place of a username and
+ * password. It is a UAA extension, not an RFC; XSUAA inherits it.
+ *
+ * UAA hands the request to its passcode filter chain only when its Accept
+ * header names JSON (`passcodeTokenMatcher` accepts `application/json` or
+ * `application/x-www-form-urlencoded`). Otherwise it falls through to the
+ * ordinary password grant, which answers `invalid_client: No password
+ * supplied` — what a bare `fetch`, which sends `*\/*`, gets. axios's default
+ * Accept happens to include `application/json`; the header is set explicitly
+ * so the exchange does not depend on an HTTP client's defaults.
+ */
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.exchangePasscode = exchangePasscode;
+const axios_1 = __importDefault(require("axios"));
+async function exchangePasscode(uaaUrl, clientId, clientSecret, passcode, logger) {
+    const tokenUrl = `${uaaUrl.replace(/\/+$/, '')}/oauth/token`;
+    const params = new URLSearchParams();
+    params.append('grant_type', 'password');
+    params.append('passcode', passcode);
+    logger?.info('[UAA] Exchanging passcode for token', { tokenUrl });
+    // A public client — `cf` is one — authenticates with an empty secret.
+    const basic = Buffer.from(`${clientId}:${clientSecret ?? ''}`).toString('base64');
+    let response;
+    try {
+        response = await axios_1.default.post(tokenUrl, params.toString(), {
+            headers: {
+                'Content-Type': 'application/x-www-form-urlencoded',
+                Accept: 'application/json',
+                Authorization: `Basic ${basic}`,
+            },
+        });
+    }
+    catch (error) {
+        // UAA says why in the body — "Invalid passcode" for a mistyped or
+        // already spent code — which is what the user needs to read.
+        if (axios_1.default.isAxiosError(error) && error.response) {
+            const body = error.response.data;
+            const reason = body?.error_description ?? body?.error ?? 'no reason given';
+            throw new Error(`Passcode exchange failed (${error.response.status}): ${reason}`);
+        }
+        throw error;
+    }
+    const data = response.data;
+    if (!data?.access_token) {
+        throw new Error('Passcode exchange returned no access_token');
+    }
+    return {
+        accessToken: data.access_token,
+        refreshToken: data.refresh_token,
+        expiresIn: data.expires_in,
+    };
+}

package/dist/auth/samlBearerAssertion.d.ts

@@ -0,0 +1,24 @@
+/**
+ * What the SAML 2.0 bearer grant accepts, from what a SAML login delivers.
+ *
+ * RFC 7522 §2.1: the `assertion` parameter is a single SAML 2.0 Assertion,
+ * base64url-encoded. An interactive login delivers something else — the
+ * identity provider's whole `samlp:Response`, in standard base64 — and a
+ * token endpoint that follows the RFC refuses it: Cloud Foundry UAA answers
+ * 401 to a Response in either encoding. So the Assertion is taken out of the
+ * Response here and re-encoded.
+ *
+ * The Assertion is serialised as an element of its own, and every namespace
+ * declaration it inherited from the Response is copied onto it first. A
+ * serializer would add back only the prefixes used in element and attribute
+ * names; a prefix used only inside a value — `xsi:type="xs:string"` — would be
+ * lost, leaving a QName that no longer resolves. Copying all of them keeps the
+ * Assertion's in-scope namespaces exactly what they were. Its signature, over
+ * exclusive canonical XML, still verifies: canonicalisation renders a
+ * namespace where it is used, or where the signature's InclusiveNamespaces
+ * names it, not where it was declared. A signature over the Response alone does not
+ * survive the cut; the token endpoint then refuses the Assertion, as it
+ * would any unsigned one.
+ */
+export declare function toBearerAssertion(payload: string): string;
+//# sourceMappingURL=samlBearerAssertion.d.ts.map

package/dist/auth/samlBearerAssertion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"samlBearerAssertion.d.ts","sourceRoot":"","sources":["../../src/auth/samlBearerAssertion.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAOH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAmDzD"}

package/dist/auth/samlBearerAssertion.js

@@ -0,0 +1,101 @@
+"use strict";
+/**
+ * What the SAML 2.0 bearer grant accepts, from what a SAML login delivers.
+ *
+ * RFC 7522 §2.1: the `assertion` parameter is a single SAML 2.0 Assertion,
+ * base64url-encoded. An interactive login delivers something else — the
+ * identity provider's whole `samlp:Response`, in standard base64 — and a
+ * token endpoint that follows the RFC refuses it: Cloud Foundry UAA answers
+ * 401 to a Response in either encoding. So the Assertion is taken out of the
+ * Response here and re-encoded.
+ *
+ * The Assertion is serialised as an element of its own, and every namespace
+ * declaration it inherited from the Response is copied onto it first. A
+ * serializer would add back only the prefixes used in element and attribute
+ * names; a prefix used only inside a value — `xsi:type="xs:string"` — would be
+ * lost, leaving a QName that no longer resolves. Copying all of them keeps the
+ * Assertion's in-scope namespaces exactly what they were. Its signature, over
+ * exclusive canonical XML, still verifies: canonicalisation renders a
+ * namespace where it is used, or where the signature's InclusiveNamespaces
+ * names it, not where it was declared. A signature over the Response alone does not
+ * survive the cut; the token endpoint then refuses the Assertion, as it
+ * would any unsigned one.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toBearerAssertion = toBearerAssertion;
+const xmldom_1 = require("@xmldom/xmldom");
+const SAML_ASSERTION_NS = 'urn:oasis:names:tc:SAML:2.0:assertion';
+const SAML_PROTOCOL_NS = 'urn:oasis:names:tc:SAML:2.0:protocol';
+function toBearerAssertion(payload) {
+    // Node's base64 decoder accepts both alphabets, so this reads either.
+    const xml = Buffer.from(payload.trim(), 'base64').toString('utf8');
+    if (!xml.trimStart().startsWith('<')) {
+        throw new Error('SAML bearer payload is not base64-encoded XML');
+    }
+    let root;
+    try {
+        root = new xmldom_1.DOMParser().parseFromString(xml, 'text/xml').documentElement;
+    }
+    catch (error) {
+        throw new Error(`SAML bearer payload is not well-formed XML: ${error instanceof Error ? error.message : String(error)}`);
+    }
+    if (isElement(root, SAML_ASSERTION_NS, 'Assertion')) {
+        return Buffer.from(xml, 'utf8').toString('base64url');
+    }
+    if (!isElement(root, SAML_PROTOCOL_NS, 'Response')) {
+        throw new Error('SAML bearer payload is neither a SAML Response nor an Assertion');
+    }
+    const children = childElements(root);
+    const assertions = children.filter((e) => isElement(e, SAML_ASSERTION_NS, 'Assertion'));
+    if (assertions.length === 0) {
+        if (children.some((e) => isElement(e, SAML_ASSERTION_NS, 'EncryptedAssertion'))) {
+            throw new Error('SAML Response carries only an EncryptedAssertion; encrypted Assertions are not supported');
+        }
+        throw new Error('SAML Response carries no Assertion');
+    }
+    if (assertions.length > 1) {
+        throw new Error(`SAML Response carries ${assertions.length} Assertions; a bearer grant takes one`);
+    }
+    const assertion = assertions[0];
+    declareInheritedNamespaces(assertion);
+    const serialized = new xmldom_1.XMLSerializer().serializeToString(assertion);
+    return Buffer.from(serialized, 'utf8').toString('base64url');
+}
+function isElement(node, namespace, localName) {
+    return (!!node && node.namespaceURI === namespace && node.localName === localName);
+}
+const XMLNS_NS = 'http://www.w3.org/2000/xmlns/';
+const isNamespaceDeclaration = (name) => name === 'xmlns' || name.startsWith('xmlns:');
+/**
+ * Copies onto `element` every namespace declaration in scope from its
+ * ancestors that it does not make itself. Ancestors are walked innermost
+ * first, so the nearest declaration of a prefix wins, as it did in place.
+ */
+function declareInheritedNamespaces(element) {
+    const declared = new Set();
+    for (let i = 0; i < element.attributes.length; i++) {
+        const name = element.attributes.item(i)?.name;
+        if (name && isNamespaceDeclaration(name))
+            declared.add(name);
+    }
+    for (let ancestor = element.parentNode; ancestor && ancestor.nodeType === 1; ancestor = ancestor.parentNode) {
+        const attributes = ancestor.attributes;
+        for (let i = 0; i < attributes.length; i++) {
+            const attribute = attributes.item(i);
+            if (attribute &&
+                isNamespaceDeclaration(attribute.name) &&
+                !declared.has(attribute.name)) {
+                element.setAttributeNS(XMLNS_NS, attribute.name, attribute.value);
+                declared.add(attribute.name);
+            }
+        }
+    }
+}
+function childElements(parent) {
+    const out = [];
+    for (let n = parent.firstChild; n; n = n.nextSibling) {
+        if (n.nodeType === 1)
+            out.push(n);
+    }
+    return out;
+}

package/dist/index.d.ts

@@ -9,10 +9,10 @@ export type { OidcCallbackResult } from './auth/oidcBrowserAuth';
 export { withOidcCallbackServer } from './auth/oidcBrowserAuth';
 export { withSamlCallbackServer } from './auth/saml2Auth';
 export { BrowserAuthError, RefreshError, ServiceKeyError, SessionDataError, TokenProviderError, ValidationError, } from './errors/TokenProviderErrors';
-export type { AuthorizationCodeProviderConfig, ClientCredentialsProviderConfig, DeviceFlowProviderConfig, OidcBrowserProviderConfig, OidcDeviceFlowProviderConfig, OidcPasswordProviderConfig, OidcTokenExchangeProviderConfig, Saml2BearerProviderConfig, Saml2PureProviderConfig, } from './providers';
-export { AuthorizationCodeProvider, BaseTokenProvider, ClientCredentialsProvider, DeviceFlowProvider, OidcBrowserProvider, OidcDeviceFlowProvider, OidcPasswordProvider, OidcTokenExchangeProvider, Saml2BearerProvider, Saml2PureProvider, } from './providers';
+export type { AuthorizationCodeProviderConfig, ClientCredentialsProviderConfig, OidcBrowserProviderConfig, OidcDeviceFlowProviderConfig, OidcPasswordProviderConfig, OidcTokenExchangeProviderConfig, Saml2BearerProviderConfig, Saml2PureProviderConfig, UaaPasscodeProviderConfig, } from './providers';
+export { AuthorizationCodeProvider, BaseTokenProvider, ClientCredentialsProvider, OidcBrowserProvider, OidcDeviceFlowProvider, OidcPasswordProvider, OidcTokenExchangeProvider, Saml2BearerProvider, Saml2PureProvider, UaaPasscodeProvider, } from './providers';
 export { SsoProviderFactory } from './sso/SsoProviderFactory';
 export type { SsoProviderConfig, SsoProviderInstance } from './sso/types';
 export type { BrowserCallbackStrategyOptions, CallbackStrategyOptions, ExternalCodeStrategyOptions, ManualStrategyOptions, StaticCodeStrategyOptions, } from './strategies';
-export { asOidcResult, BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, externalCodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, oidcCallbackStrategy, samlCallbackStrategy, staticCodeStrategy, } from './strategies';
+export { asOidcResult, BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, externalCodeStrategy, manualPasscodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, oidcCallbackStrategy, samlCallbackStrategy, staticCodeStrategy, } from './strategies';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}

package/dist/index.js

@@ -6,7 +6,7 @@
  * Provides token providers
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
+exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.manualPasscodeStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.UaaPasscodeProvider = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
 // Callback server factories — "take the transport this package gives".
 var callbackServer_1 = require("./auth/callbackServer");
 Object.defineProperty(exports, "withBrowserCallbackServer", { enumerable: true, get: function () { return callbackServer_1.withBrowserCallbackServer; } });
@@ -27,13 +27,13 @@ var providers_1 = require("./providers");
 Object.defineProperty(exports, "AuthorizationCodeProvider", { enumerable: true, get: function () { return providers_1.AuthorizationCodeProvider; } });
 Object.defineProperty(exports, "BaseTokenProvider", { enumerable: true, get: function () { return providers_1.BaseTokenProvider; } });
 Object.defineProperty(exports, "ClientCredentialsProvider", { enumerable: true, get: function () { return providers_1.ClientCredentialsProvider; } });
-Object.defineProperty(exports, "DeviceFlowProvider", { enumerable: true, get: function () { return providers_1.DeviceFlowProvider; } });
 Object.defineProperty(exports, "OidcBrowserProvider", { enumerable: true, get: function () { return providers_1.OidcBrowserProvider; } });
 Object.defineProperty(exports, "OidcDeviceFlowProvider", { enumerable: true, get: function () { return providers_1.OidcDeviceFlowProvider; } });
 Object.defineProperty(exports, "OidcPasswordProvider", { enumerable: true, get: function () { return providers_1.OidcPasswordProvider; } });
 Object.defineProperty(exports, "OidcTokenExchangeProvider", { enumerable: true, get: function () { return providers_1.OidcTokenExchangeProvider; } });
 Object.defineProperty(exports, "Saml2BearerProvider", { enumerable: true, get: function () { return providers_1.Saml2BearerProvider; } });
 Object.defineProperty(exports, "Saml2PureProvider", { enumerable: true, get: function () { return providers_1.Saml2PureProvider; } });
+Object.defineProperty(exports, "UaaPasscodeProvider", { enumerable: true, get: function () { return providers_1.UaaPasscodeProvider; } });
 // SSO factory
 var SsoProviderFactory_1 = require("./sso/SsoProviderFactory");
 Object.defineProperty(exports, "SsoProviderFactory", { enumerable: true, get: function () { return SsoProviderFactory_1.SsoProviderFactory; } });
@@ -45,6 +45,7 @@ Object.defineProperty(exports, "browserCallbackStrategy", { enumerable: true, ge
 Object.defineProperty(exports, "DEFAULT_CALLBACK_PORT", { enumerable: true, get: function () { return strategies_1.DEFAULT_CALLBACK_PORT; } });
 Object.defineProperty(exports, "DEFAULT_LOGIN_TIMEOUT_MS", { enumerable: true, get: function () { return strategies_1.DEFAULT_LOGIN_TIMEOUT_MS; } });
 Object.defineProperty(exports, "externalCodeStrategy", { enumerable: true, get: function () { return strategies_1.externalCodeStrategy; } });
+Object.defineProperty(exports, "manualPasscodeStrategy", { enumerable: true, get: function () { return strategies_1.manualPasscodeStrategy; } });
 Object.defineProperty(exports, "manualPasteStrategy", { enumerable: true, get: function () { return strategies_1.manualPasteStrategy; } });
 Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true, get: function () { return strategies_1.manualSamlResponseStrategy; } });
 Object.defineProperty(exports, "oidcCallbackStrategy", { enumerable: true, get: function () { return strategies_1.oidcCallbackStrategy; } });

package/dist/providers/Saml2BearerProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAK9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAiB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAoBrD;;;;OAIG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqBxD"}
+{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAM9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAiB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAsBrD;;;;OAIG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqBxD"}

package/dist/providers/Saml2BearerProvider.js

@@ -8,6 +8,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Saml2BearerProvider = void 0;
 const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const saml2TokenExchange_1 = require("../auth/saml2TokenExchange");
+const samlBearerAssertion_1 = require("../auth/samlBearerAssertion");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 const saml2Utils_1 = require("./saml2Utils");
 class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
@@ -33,7 +34,9 @@ class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
     async performLogin() {
         const samlResponse = await (0, saml2Utils_1.getSamlAssertion)(this.config);
         const tokenUrl = (0, saml2Utils_1.resolveTokenUrl)(this.config);
-        const tokens = await (0, saml2TokenExchange_1.exchangeSamlAssertion)(samlResponse, tokenUrl, this.config.clientId, this.config.clientSecret, this.logger);
+        // RFC 7522 takes one base64url Assertion; a login delivers the whole
+        // Response in standard base64, which a conforming endpoint refuses.
+        const tokens = await (0, saml2TokenExchange_1.exchangeSamlAssertion)((0, samlBearerAssertion_1.toBearerAssertion)(samlResponse), tokenUrl, this.config.clientId, this.config.clientSecret, this.logger);
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,

package/dist/providers/UaaPasscodeProvider.d.ts

@@ -0,0 +1,43 @@
+/**
+ * UAA / XSUAA one-time passcode provider — the login `cf login --sso` uses.
+ *
+ * Nothing is opened and nothing listens on this machine: the user fetches a
+ * code from `<uaaUrl>/passcode` in any browser, anywhere, logging in however
+ * the identity zone asks (SSO through a corporate IdP, MFA), and hands it to
+ * the strategy. The provider exchanges it for tokens and refreshes them
+ * afterwards, so the user is asked again only when the refresh token is gone.
+ */
+import type { IAuthorizationStrategy, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+import { BaseTokenProvider } from './BaseTokenProvider';
+export interface UaaPasscodeProviderConfig {
+    /** UAA / XSUAA base URL, e.g. `https://<subdomain>.authentication.<region>.hana.ondemand.com`. */
+    uaaUrl: string;
+    /** A client allowed the `password` grant; add `refresh_token` to keep the session. */
+    clientId: string;
+    /** Omitted for a public client, which authenticates with an empty secret. */
+    clientSecret?: string;
+    /**
+     * How the user's code reaches the provider. The strategy is handed
+     * `<uaaUrl>/passcode` as the URL to send the user to, and returns the code.
+     * Defaults to `manualPasscodeStrategy()`: announce the URL, read the code
+     * from the terminal.
+     */
+    authorization?: IAuthorizationStrategy<string>;
+    accessToken?: string;
+    refreshToken?: string;
+    logger?: ILogger;
+}
+export declare class UaaPasscodeProvider extends BaseTokenProvider {
+    private readonly config;
+    constructor(config: UaaPasscodeProviderConfig);
+    protected getAuthType(): OAuth2GrantType;
+    private get baseUrl();
+    protected performLogin(): Promise<ITokenResult>;
+    /**
+     * A failure is thrown, not handled: BaseTokenProvider drops the refresh
+     * token and asks for a new passcode through performLogin().
+     */
+    protected performRefresh(): Promise<ITokenResult>;
+}
+//# sourceMappingURL=UaaPasscodeProvider.d.ts.map

package/dist/providers/UaaPasscodeProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UaaPasscodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/UaaPasscodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAI9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;gBAEvC,MAAM,EAAE,yBAAyB;IAa7C,SAAS,CAAC,WAAW,IAAI,eAAe;IAIxC,OAAO,KAAK,OAAO,GAElB;cAEe,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAqCrD;;;OAGG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAkBxD"}

package/dist/providers/UaaPasscodeProvider.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * UAA / XSUAA one-time passcode provider — the login `cf login --sso` uses.
+ *
+ * Nothing is opened and nothing listens on this machine: the user fetches a
+ * code from `<uaaUrl>/passcode` in any browser, anywhere, logging in however
+ * the identity zone asks (SSO through a corporate IdP, MFA), and hands it to
+ * the strategy. The provider exchanges it for tokens and refreshes them
+ * afterwards, so the user is asked again only when the refresh token is gone.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UaaPasscodeProvider = void 0;
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
+const passcodeAuth_1 = require("../auth/passcodeAuth");
+const tokenRefresher_1 = require("../auth/tokenRefresher");
+const manualStrategies_1 = require("../strategies/manualStrategies");
+const BaseTokenProvider_1 = require("./BaseTokenProvider");
+class UaaPasscodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
+    config;
+    constructor(config) {
+        super();
+        this.config = config;
+        this.logger = config.logger;
+        if (config.accessToken) {
+            this.authorizationToken = config.accessToken;
+            this.expiresAt = this.parseExpirationFromJWT(config.accessToken);
+        }
+        if (config.refreshToken) {
+            this.refreshToken = config.refreshToken;
+        }
+    }
+    getAuthType() {
+        return interfaces_auth_1.AUTH_TYPE_PASSWORD;
+    }
+    get baseUrl() {
+        return this.config.uaaUrl.replace(/\/+$/, '');
+    }
+    async performLogin() {
+        const supplied = this.config.authorization;
+        const strategy = supplied ?? (0, manualStrategies_1.manualPasscodeStrategy)();
+        let passcode;
+        try {
+            // The passcode page takes no redirect: the code travels by hand.
+            const outcome = await strategy.authorize({
+                logger: this.logger,
+                buildAuthorizationUrl: async () => `${this.baseUrl}/passcode`,
+            });
+            passcode = outcome.payload;
+        }
+        finally {
+            if (!supplied) {
+                await strategy.dispose?.().catch((error) => {
+                    this.logger?.warn('[UaaPasscodeProvider] dispose failed', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                });
+            }
+        }
+        const tokens = await (0, passcodeAuth_1.exchangePasscode)(this.baseUrl, this.config.clientId, this.config.clientSecret, passcode, this.logger);
+        return {
+            authorizationToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            authType: interfaces_auth_1.AUTH_TYPE_PASSWORD,
+            expiresIn: tokens.expiresIn,
+            tokenType: 'jwt',
+        };
+    }
+    /**
+     * A failure is thrown, not handled: BaseTokenProvider drops the refresh
+     * token and asks for a new passcode through performLogin().
+     */
+    async performRefresh() {
+        if (!this.refreshToken) {
+            throw new Error('Refresh token is required for refresh');
+        }
+        const result = await (0, tokenRefresher_1.refreshJwtToken)(this.refreshToken, this.baseUrl, this.config.clientId, this.config.clientSecret ?? '');
+        return {
+            authorizationToken: result.accessToken,
+            refreshToken: result.refreshToken || this.refreshToken,
+            authType: interfaces_auth_1.AUTH_TYPE_PASSWORD,
+            expiresIn: result.expiresIn,
+            tokenType: 'jwt',
+        };
+    }
+}
+exports.UaaPasscodeProvider = UaaPasscodeProvider;

package/dist/providers/index.d.ts

@@ -9,8 +9,6 @@ export { AuthorizationCodeProvider } from './AuthorizationCodeProvider';
 export { BaseTokenProvider } from './BaseTokenProvider';
 export type { ClientCredentialsProviderConfig } from './ClientCredentialsProvider';
 export { ClientCredentialsProvider } from './ClientCredentialsProvider';
-export type { DeviceFlowProviderConfig } from './DeviceFlowProvider';
-export { DeviceFlowProvider } from './DeviceFlowProvider';
 export type { OidcBrowserProviderConfig } from './OidcBrowserProvider';
 export { OidcBrowserProvider } from './OidcBrowserProvider';
 export type { OidcDeviceFlowProviderConfig } from './OidcDeviceFlowProvider';
@@ -23,4 +21,6 @@ export type { Saml2BearerProviderConfig } from './Saml2BearerProvider';
 export { Saml2BearerProvider } from './Saml2BearerProvider';
 export type { Saml2PureProviderConfig } from './Saml2PureProvider';
 export { Saml2PureProvider } from './Saml2PureProvider';
+export type { UaaPasscodeProviderConfig } from './UaaPasscodeProvider';
+export { UaaPasscodeProvider } from './UaaPasscodeProvider';
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/providers/index.js

@@ -6,15 +6,13 @@
  * All providers extend BaseTokenProvider and implement ITokenProvider.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = void 0;
+exports.UaaPasscodeProvider = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = void 0;
 var AuthorizationCodeProvider_1 = require("./AuthorizationCodeProvider");
 Object.defineProperty(exports, "AuthorizationCodeProvider", { enumerable: true, get: function () { return AuthorizationCodeProvider_1.AuthorizationCodeProvider; } });
 var BaseTokenProvider_1 = require("./BaseTokenProvider");
 Object.defineProperty(exports, "BaseTokenProvider", { enumerable: true, get: function () { return BaseTokenProvider_1.BaseTokenProvider; } });
 var ClientCredentialsProvider_1 = require("./ClientCredentialsProvider");
 Object.defineProperty(exports, "ClientCredentialsProvider", { enumerable: true, get: function () { return ClientCredentialsProvider_1.ClientCredentialsProvider; } });
-var DeviceFlowProvider_1 = require("./DeviceFlowProvider");
-Object.defineProperty(exports, "DeviceFlowProvider", { enumerable: true, get: function () { return DeviceFlowProvider_1.DeviceFlowProvider; } });
 var OidcBrowserProvider_1 = require("./OidcBrowserProvider");
 Object.defineProperty(exports, "OidcBrowserProvider", { enumerable: true, get: function () { return OidcBrowserProvider_1.OidcBrowserProvider; } });
 var OidcDeviceFlowProvider_1 = require("./OidcDeviceFlowProvider");
@@ -27,3 +25,5 @@ var Saml2BearerProvider_1 = require("./Saml2BearerProvider");
 Object.defineProperty(exports, "Saml2BearerProvider", { enumerable: true, get: function () { return Saml2BearerProvider_1.Saml2BearerProvider; } });
 var Saml2PureProvider_1 = require("./Saml2PureProvider");
 Object.defineProperty(exports, "Saml2PureProvider", { enumerable: true, get: function () { return Saml2PureProvider_1.Saml2PureProvider; } });
+var UaaPasscodeProvider_1 = require("./UaaPasscodeProvider");
+Object.defineProperty(exports, "UaaPasscodeProvider", { enumerable: true, get: function () { return UaaPasscodeProvider_1.UaaPasscodeProvider; } });

package/dist/strategies/index.d.ts

@@ -4,5 +4,5 @@ export { BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT
 export type { ExternalCodeStrategyOptions, StaticCodeStrategyOptions, } from './codeStrategies';
 export { externalCodeStrategy, staticCodeStrategy, } from './codeStrategies';
 export type { ManualStrategyOptions } from './manualStrategies';
-export { manualPasteStrategy, manualSamlResponseStrategy, } from './manualStrategies';
+export { manualPasscodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, } from './manualStrategies';
 //# sourceMappingURL=index.d.ts.map

package/dist/strategies/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/strategies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/strategies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,GACxB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AACnC,YAAY,EACV,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,oBAAoB,CAAC"}

package/dist/strategies/index.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.staticCodeStrategy = exports.externalCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = void 0;
+exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.manualPasscodeStrategy = exports.staticCodeStrategy = exports.externalCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = void 0;
 var asOidcResult_1 = require("./asOidcResult");
 Object.defineProperty(exports, "asOidcResult", { enumerable: true, get: function () { return asOidcResult_1.asOidcResult; } });
 var BrowserCallbackStrategy_1 = require("./BrowserCallbackStrategy");
@@ -14,5 +14,6 @@ var codeStrategies_1 = require("./codeStrategies");
 Object.defineProperty(exports, "externalCodeStrategy", { enumerable: true, get: function () { return codeStrategies_1.externalCodeStrategy; } });
 Object.defineProperty(exports, "staticCodeStrategy", { enumerable: true, get: function () { return codeStrategies_1.staticCodeStrategy; } });
 var manualStrategies_1 = require("./manualStrategies");
+Object.defineProperty(exports, "manualPasscodeStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualPasscodeStrategy; } });
 Object.defineProperty(exports, "manualPasteStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualPasteStrategy; } });
 Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true, get: function () { return manualStrategies_1.manualSamlResponseStrategy; } });

package/dist/strategies/manualStrategies.d.ts

@@ -17,4 +17,11 @@ export interface ManualStrategyOptions {
 export declare function manualPasteStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
 /** The user lifts `SAMLResponse` from the POST body — it never reaches the URL. */
 export declare function manualSamlResponseStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
+/**
+ * The UAA passcode, typed in by the user: shows where to fetch it —
+ * `<uaa>/passcode`, opened in any browser, on any machine — and reads the
+ * code they copy from that page. The default for `UaaPasscodeProvider`, so a
+ * login works on a machine with no browser at all, as `cf login --sso` does.
+ */
+export declare function manualPasscodeStrategy(options?: ManualStrategyOptions): IAuthorizationStrategy<string>;
 //# sourceMappingURL=manualStrategies.d.ts.map

package/dist/strategies/manualStrategies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manualStrategies.d.ts","sourceRoot":"","sources":["../../src/strategies/manualStrategies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAGV,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAiCD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAmBhC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAiBhC"}
+{"version":3,"file":"manualStrategies.d.ts","sourceRoot":"","sources":["../../src/strategies/manualStrategies.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAGV,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC5C;AAiCD,4EAA4E;AAC5E,wBAAgB,mBAAmB,CACjC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAmBhC;AAED,mFAAmF;AACnF,wBAAgB,0BAA0B,CACxC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAiBhC;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,GAAE,qBAA0B,GAClC,sBAAsB,CAAC,MAAM,CAAC,CAgBhC"}

package/dist/strategies/manualStrategies.js

@@ -10,6 +10,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.manualPasteStrategy = manualPasteStrategy;
 exports.manualSamlResponseStrategy = manualSamlResponseStrategy;
+exports.manualPasscodeStrategy = manualPasscodeStrategy;
 const node_readline_1 = require("node:readline");
 const browserAuth_1 = require("../auth/browserAuth");
 const BrowserCallbackStrategy_1 = require("./BrowserCallbackStrategy");
@@ -75,3 +76,23 @@ function manualSamlResponseStrategy(options = {}) {
         },
     };
 }
+/**
+ * The UAA passcode, typed in by the user: shows where to fetch it —
+ * `<uaa>/passcode`, opened in any browser, on any machine — and reads the
+ * code they copy from that page. The default for `UaaPasscodeProvider`, so a
+ * login works on a machine with no browser at all, as `cf login --sso` does.
+ */
+function manualPasscodeStrategy(options = {}) {
+    const redirectUri = options.redirectUri ?? defaultRedirectUri();
+    const read = options.read ?? readFromTerminal;
+    return {
+        async authorize(request) {
+            const url = await request.buildAuthorizationUrl(redirectUri);
+            announce(request, url);
+            const code = (await read('Paste the Temporary Authentication Code (passcode): ')).trim();
+            if (!code)
+                throw new Error('No passcode was provided');
+            return { payload: code, redirectUri };
+        },
+    };
+}