@mcp-abap-adt/auth-providers 2.2.2 → 3.0.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "2.2.2",
+  "version": "3.0.0",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -40,8 +40,7 @@
   },
   "bin": {
     "auth-authorization-code": "./bin/auth-authorization-code.ts",
-    "auth-client-credentials": "./bin/auth-client-credentials.ts",
-    "auth-device-flow": "./bin/auth-device-flow.ts"
+    "auth-client-credentials": "./bin/auth-client-credentials.ts"
   },
   "scripts": {
     "chrono": "./tools/version-stats.sh",
@@ -53,15 +52,20 @@
     "build:fast": "npx tsc -p tsconfig.json",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "test:check": "npx tsc --noEmit",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "stand:up": "tests/stand/up.sh",
+    "stand:down": "tests/stand/down.sh",
+    "test:stand": "tests/stand/run.sh",
+    "test:xsuaa": "tests/xsuaa/run.sh"
   },
   "engines": {
-    "node": ">=18.2.0"
+    "node": "^22 || ^24"
   },
   "dependencies": {
     "@mcp-abap-adt/interfaces-auth": "^1.2.0",
     "@mcp-abap-adt/interfaces-auth-sap": "^1.0.0",
     "@mcp-abap-adt/interfaces-utils": "^1.1.0",
+    "@xmldom/xmldom": "^0.9.12",
     "axios": "^1.13.5",
     "express": "^5.1.0",
     "open": "^11.0.0"
@@ -69,6 +73,7 @@
   "devDependencies": {
     "@biomejs/biome": "^2.3.14",
     "@jest/globals": "^30.2.0",
+    "@mcp-abap-adt/auth-mocks": "^0.3.0",
     "@mcp-abap-adt/auth-stores": "^1.0.1",
     "@mcp-abap-adt/logger": "^0.4.0",
     "@types/express": "^5.0.5",

package/bin/auth-device-flow.ts

@@ -1,114 +0,0 @@
-#!/usr/bin/env tsx
-/**
- * Device Flow Provider Test Command
- */
-
-import { DeviceFlowProvider } from '../src/providers/DeviceFlowProvider';
-import {
-  getUaaCredentials,
-  parseEnvFile,
-  parseServiceKey,
-  writeEnvFile,
-} from './utils/parseConfig';
-
-async function main() {
-  const args = process.argv.slice(2);
-  let serviceKeyPath: string | undefined;
-  let inputEnvPath: string | undefined;
-  let outputEnvPath: string | undefined;
-  let scope: string | undefined;
-
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === '--service-key' && args[i + 1]) {
-      serviceKeyPath = args[++i];
-    } else if (arg === '--input-env' && args[i + 1]) {
-      inputEnvPath = args[++i];
-    } else if (arg === '--output-env' && args[i + 1]) {
-      outputEnvPath = args[++i];
-    } else if (arg === '--scope' && args[i + 1]) {
-      scope = args[++i];
-    } else if (arg === '--help' || arg === '-h') {
-      console.log(`
-Usage: auth-device-flow [options]
-
-Options:
-  --service-key <path>    Path to service key JSON file
-  --input-env <path>      Path to .env file for reading existing tokens (for refresh)
-  --output-env <path>     Path to .env file for saving tokens
-  --scope <scope>         Optional scope (space-separated)
-  --help, -h              Show this help message
-      `);
-      process.exit(0);
-    }
-  }
-
-  if (!serviceKeyPath && !inputEnvPath) {
-    console.error('❌ Error: Either --service-key or --input-env must be provided');
-    process.exit(1);
-  }
-
-  if (!outputEnvPath) {
-    console.error('❌ Error: --output-env is required to save tokens');
-    process.exit(1);
-  }
-
-  try {
-    // Read config from service key or input env
-    const serviceKey = serviceKeyPath ? parseServiceKey(serviceKeyPath) : undefined;
-    const inputEnv = inputEnvPath ? parseEnvFile(inputEnvPath) : undefined;
-    const { uaaUrl, clientId, clientSecret } = getUaaCredentials(serviceKey, inputEnv);
-
-    // Read existing tokens from input env if provided
-    const existingAccessToken = inputEnv?.AUTHORIZATION_TOKEN;
-    const existingRefreshToken = inputEnv?.REFRESH_TOKEN;
-
-    const provider = new DeviceFlowProvider({
-      uaaUrl,
-      clientId,
-      clientSecret,
-      scope,
-      accessToken: existingAccessToken,
-      refreshToken: existingRefreshToken,
-    });
-
-    console.log('🔐 Getting tokens using Device Flow...');
-    if (serviceKeyPath) {
-      console.log(`📁 Service Key: ${serviceKeyPath}`);
-    }
-    if (inputEnvPath) {
-      console.log(`📁 Input Env: ${inputEnvPath}`);
-    }
-    console.log(`💾 Output Env: ${outputEnvPath}\n`);
-
-    const result = await provider.getTokens();
-
-    // Save tokens to output env file
-    writeEnvFile(outputEnvPath, {
-      authorizationToken: result.authorizationToken,
-      refreshToken: result.refreshToken,
-      uaaUrl,
-      clientId,
-      clientSecret,
-    });
-
-    console.log('✅ Tokens obtained and saved successfully!');
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-    console.log(`🔑 Authorization Token: ${result.authorizationToken.substring(0, 50)}...`);
-    if (result.refreshToken) {
-      console.log(`🔄 Refresh Token: ${result.refreshToken.substring(0, 50)}...`);
-    }
-    console.log(`📋 Auth Type: ${result.authType}`);
-    if (result.expiresIn) {
-      console.log(`⏰ Expires In: ${result.expiresIn} seconds`);
-    }
-    console.log(`💾 Saved to: ${outputEnvPath}`);
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-  } catch (error) {
-    console.error('❌ Error:', error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  }
-}
-
-main();
-

package/dist/auth/deviceFlowAuth.d.ts

@@ -1,43 +0,0 @@
-/**
- * Device Flow authentication
- *
- * OAuth2 Device Flow for devices without browser or input capabilities.
- * User authorizes on another device by entering a code.
- */
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-export interface DeviceFlowResult {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    verificationUriComplete?: string;
-    expiresIn: number;
-    interval?: number;
-}
-export interface DeviceFlowTokens {
-    accessToken: string;
-    refreshToken?: string;
-    expiresIn?: number;
-}
-/**
- * Initiate device flow - get device code and user code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param scope Optional scope (space-separated)
- * @param logger Optional logger
- * @returns Promise that resolves to device flow result
- * @internal - Internal function, not exported from package
- */
-export declare function initiateDeviceFlow(uaaUrl: string, clientId: string, scope?: string, logger?: ILogger): Promise<DeviceFlowResult>;
-/**
- * Poll for tokens using device code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param clientSecret Client secret (optional for public clients)
- * @param deviceCode Device code from initiateDeviceFlow
- * @param interval Polling interval in seconds
- * @param logger Optional logger
- * @returns Promise that resolves to tokens
- * @internal - Internal function, not exported from package
- */
-export declare function pollForDeviceTokens(uaaUrl: string, clientId: string, clientSecret: string | undefined, deviceCode: string, interval?: number, logger?: ILogger): Promise<DeviceFlowTokens>;
-//# sourceMappingURL=deviceFlowAuth.d.ts.map

package/dist/auth/deviceFlowAuth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deviceFlowAuth.d.ts","sourceRoot":"","sources":["../../src/auth/deviceFlowAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CA4D3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAU,EACpB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAoG3B"}

package/dist/auth/deviceFlowAuth.js

@@ -1,168 +0,0 @@
-"use strict";
-/**
- * Device Flow authentication
- *
- * OAuth2 Device Flow for devices without browser or input capabilities.
- * User authorizes on another device by entering a code.
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.initiateDeviceFlow = initiateDeviceFlow;
-exports.pollForDeviceTokens = pollForDeviceTokens;
-const axios_1 = __importDefault(require("axios"));
-/**
- * Initiate device flow - get device code and user code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param scope Optional scope (space-separated)
- * @param logger Optional logger
- * @returns Promise that resolves to device flow result
- * @internal - Internal function, not exported from package
- */
-async function initiateDeviceFlow(uaaUrl, clientId, scope, logger) {
-    try {
-        const deviceUrl = `${uaaUrl}/oauth/device_authorization`;
-        const params = new URLSearchParams();
-        params.append('client_id', clientId);
-        if (scope) {
-            params.append('scope', scope);
-        }
-        logger?.info(`Initiating device flow: ${deviceUrl}`);
-        const response = await (0, axios_1.default)({
-            method: 'post',
-            url: deviceUrl,
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            data: params.toString(),
-            timeout: 30000,
-        });
-        if (response.data?.device_code &&
-            response.data?.user_code &&
-            response.data?.verification_uri) {
-            return {
-                deviceCode: response.data.device_code,
-                userCode: response.data.user_code,
-                verificationUri: response.data.verification_uri,
-                verificationUriComplete: response.data.verification_uri_complete,
-                expiresIn: response.data.expires_in || 1800, // Default 30 minutes
-                interval: response.data.interval || 5, // Default 5 seconds
-            };
-        }
-        else {
-            throw new Error('Response does not contain required device flow fields');
-        }
-    }
-    catch (error) {
-        if (error &&
-            typeof error === 'object' &&
-            'response' in error &&
-            error.response &&
-            typeof error.response === 'object' &&
-            'status' in error.response &&
-            'data' in error.response) {
-            const axiosError = error;
-            throw new Error(`Device flow initiation failed (${axiosError.response.status}): ${JSON.stringify(axiosError.response.data)}`);
-        }
-        else {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            throw new Error(`Device flow initiation failed: ${errorMessage}`);
-        }
-    }
-}
-/**
- * Poll for tokens using device code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param clientSecret Client secret (optional for public clients)
- * @param deviceCode Device code from initiateDeviceFlow
- * @param interval Polling interval in seconds
- * @param logger Optional logger
- * @returns Promise that resolves to tokens
- * @internal - Internal function, not exported from package
- */
-async function pollForDeviceTokens(uaaUrl, clientId, clientSecret, deviceCode, interval = 5, logger) {
-    const tokenUrl = `${uaaUrl}/oauth/token`;
-    const params = new URLSearchParams();
-    params.append('grant_type', 'urn:ietf:params:oauth:grant-type:device_code');
-    params.append('device_code', deviceCode);
-    params.append('client_id', clientId);
-    const headers = {
-        'Content-Type': 'application/x-www-form-urlencoded',
-    };
-    // Add client secret if provided (for confidential clients)
-    if (clientSecret) {
-        const authString = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
-        headers.Authorization = `Basic ${authString}`;
-    }
-    // Poll until authorization is complete or expires
-    const maxAttempts = 120; // 10 minutes max (120 * 5 seconds)
-    let attempts = 0;
-    while (attempts < maxAttempts) {
-        try {
-            logger?.debug(`Polling for device tokens (attempt ${attempts + 1})`);
-            const response = await (0, axios_1.default)({
-                method: 'post',
-                url: tokenUrl,
-                headers,
-                data: params.toString(),
-                timeout: 30000,
-            });
-            if (response.data?.access_token) {
-                logger?.info('Device flow authorization successful');
-                return {
-                    accessToken: response.data.access_token,
-                    refreshToken: response.data.refresh_token,
-                    expiresIn: response.data.expires_in,
-                };
-            }
-            else {
-                throw new Error('Response does not contain access_token');
-            }
-        }
-        catch (error) {
-            // Check if it's an "authorization_pending" error (expected during polling)
-            if (error &&
-                typeof error === 'object' &&
-                'response' in error &&
-                error.response &&
-                typeof error.response === 'object' &&
-                'status' in error.response &&
-                'data' in error.response) {
-                const axiosError = error;
-                if (axiosError.response.data?.error === 'authorization_pending') {
-                    // Still waiting for user authorization - continue polling
-                    attempts++;
-                    if (attempts >= maxAttempts) {
-                        throw new Error('Device flow authorization timeout - user did not authorize in time');
-                    }
-                    // Wait for interval before next poll
-                    await new Promise((resolve) => setTimeout(resolve, interval * 1000));
-                    continue;
-                }
-                else if (axiosError.response.data?.error === 'slow_down') {
-                    // Server requests slower polling - increase interval by 5 seconds
-                    interval += 5;
-                    attempts++;
-                    if (attempts >= maxAttempts) {
-                        throw new Error('Device flow authorization timeout - user did not authorize in time');
-                    }
-                    await new Promise((resolve) => setTimeout(resolve, interval * 1000));
-                    continue;
-                }
-                else if (axiosError.response.data?.error === 'expired_token') {
-                    throw new Error('Device code expired - please restart device flow');
-                }
-                else if (axiosError.response.data?.error === 'access_denied') {
-                    throw new Error('User denied device authorization');
-                }
-            }
-            // Other error - rethrow
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            throw new Error(`Device flow polling failed: ${errorMessage}`);
-        }
-    }
-    throw new Error('Device flow authorization timeout - maximum polling attempts reached');
-}

package/dist/providers/DeviceFlowProvider.d.ts

@@ -1,32 +0,0 @@
-/**
- * Device Flow Token Provider
- *
- * Uses OAuth2 Device Flow for devices without browser or input capabilities.
- * User authorizes on another device by entering a code.
- */
-import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-import { BaseTokenProvider } from './BaseTokenProvider';
-export interface DeviceFlowProviderConfig {
-    uaaUrl: string;
-    clientId: string;
-    clientSecret?: string;
-    scope?: string;
-    accessToken?: string;
-    refreshToken?: string;
-    logger?: ILogger;
-}
-/**
- * Device Flow token provider
- *
- * Uses OAuth2 Device Flow - user authorizes on another device.
- * Supports refresh token if provided by server.
- */
-export declare class DeviceFlowProvider extends BaseTokenProvider {
-    private config;
-    constructor(config: DeviceFlowProviderConfig);
-    protected getAuthType(): OAuth2GrantType;
-    protected performLogin(): Promise<ITokenResult>;
-    protected performRefresh(): Promise<ITokenResult>;
-}
-//# sourceMappingURL=DeviceFlowProvider.d.ts.map

package/dist/providers/DeviceFlowProvider.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"DeviceFlowProvider.d.ts","sourceRoot":"","sources":["../../src/providers/DeviceFlowProvider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAO9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED;;;;;GAKG;AACH,qBAAa,kBAAmB,SAAQ,iBAAiB;IACvD,OAAO,CAAC,MAAM,CAA2B;gBAE7B,MAAM,EAAE,wBAAwB;IAc5C,SAAS,CAAC,WAAW,IAAI,eAAe;cAOxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAyCrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CA2BxD"}

package/dist/providers/DeviceFlowProvider.js

@@ -1,86 +0,0 @@
-"use strict";
-/**
- * Device Flow Token Provider
- *
- * Uses OAuth2 Device Flow for devices without browser or input capabilities.
- * User authorizes on another device by entering a code.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.DeviceFlowProvider = void 0;
-const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
-const announce_1 = require("../auth/announce");
-const deviceFlowAuth_1 = require("../auth/deviceFlowAuth");
-const tokenRefresher_1 = require("../auth/tokenRefresher");
-const BaseTokenProvider_1 = require("./BaseTokenProvider");
-/**
- * Device Flow token provider
- *
- * Uses OAuth2 Device Flow - user authorizes on another device.
- * Supports refresh token if provided by server.
- */
-class DeviceFlowProvider extends BaseTokenProvider_1.BaseTokenProvider {
-    config;
-    constructor(config) {
-        super();
-        this.config = config;
-        this.logger = config.logger;
-        if (config.accessToken) {
-            this.authorizationToken = config.accessToken;
-            this.expiresAt = this.parseExpirationFromJWT(config.accessToken);
-        }
-        if (config.refreshToken) {
-            this.refreshToken = config.refreshToken;
-        }
-    }
-    getAuthType() {
-        // Device Flow is not a standard grant type in OAuth2 spec
-        // We'll use a custom type or map it to authorization_code
-        // For now, using authorization_code as it's similar
-        return interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE;
-    }
-    async performLogin() {
-        // Initiate device flow
-        const deviceFlow = await (0, deviceFlowAuth_1.initiateDeviceFlow)(this.config.uaaUrl, this.config.clientId, this.config.scope, this.logger);
-        // Display user code and verification URI. This is a prompt the user must
-        // see to complete the flow, not a log line — it goes to the logger when
-        // there is one and to stderr otherwise, never to stdout.
-        const announce = (0, announce_1.announcer)(this.logger);
-        announce('Device Flow Authorization');
-        announce(`Go to: ${deviceFlow.verificationUri}`);
-        if (deviceFlow.verificationUriComplete) {
-            announce(`Or use complete URL: ${deviceFlow.verificationUriComplete}`);
-        }
-        announce(`Enter code: ${deviceFlow.userCode}`);
-        announce('Waiting for authorization...');
-        // Poll for tokens
-        const result = await (0, deviceFlowAuth_1.pollForDeviceTokens)(this.config.uaaUrl, this.config.clientId, this.config.clientSecret, deviceFlow.deviceCode, deviceFlow.interval, this.logger);
-        const expiresIn = this.calculateExpiresIn(result.accessToken);
-        return {
-            authorizationToken: result.accessToken,
-            refreshToken: result.refreshToken,
-            authType: interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE, // Device flow maps to authorization_code
-            expiresIn,
-        };
-    }
-    async performRefresh() {
-        if (!this.refreshToken) {
-            // No refresh token - re-authenticate with device flow
-            return await this.performLogin();
-        }
-        try {
-            const result = await (0, tokenRefresher_1.refreshJwtToken)(this.refreshToken, this.config.uaaUrl, this.config.clientId, this.config.clientSecret || '');
-            const expiresIn = this.calculateExpiresIn(result.accessToken);
-            return {
-                authorizationToken: result.accessToken,
-                refreshToken: result.refreshToken || this.refreshToken,
-                authType: interfaces_auth_1.AUTH_TYPE_AUTHORIZATION_CODE,
-                expiresIn,
-            };
-        }
-        catch (_error) {
-            // Refresh failed - try device flow login
-            return await this.performLogin();
-        }
-    }
-}
-exports.DeviceFlowProvider = DeviceFlowProvider;