@mcp-abap-adt/auth-providers 2.2.2 → 4.0.0

package/dist/errors/AssertionValidationError.js

@@ -0,0 +1,24 @@
+"use strict";
+/**
+ * An assertion was refused, and by which check.
+ *
+ * The check is a field rather than something to read out of the message: a
+ * consumer telling "your identity provider declined" from "this was not
+ * addressed to us" should not be parsing prose to do it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AssertionValidationError = void 0;
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
+const TokenProviderErrors_1 = require("./TokenProviderErrors");
+class AssertionValidationError extends TokenProviderErrors_1.TokenProviderError {
+    check;
+    constructor(check, message) {
+        super(message, interfaces_auth_1.ASSERTION_ERROR_CODES.VALIDATION_ERROR);
+        this.name = 'AssertionValidationError';
+        this.check = check;
+        // Every sibling in TokenProviderErrors.ts does this; without it
+        // `instanceof` fails across a compiled boundary.
+        Object.setPrototypeOf(this, AssertionValidationError.prototype);
+    }
+}
+exports.AssertionValidationError = AssertionValidationError;

package/dist/errors/TokenProviderErrors.d.ts

@@ -46,4 +46,6 @@ export declare class BrowserAuthError extends TokenProviderError {
     readonly cause?: Error | undefined;
     constructor(message: string, cause?: Error | undefined);
 }
+export type { AssertionCheck } from './AssertionValidationError';
+export { AssertionValidationError } from './AssertionValidationError';
 //# sourceMappingURL=TokenProviderErrors.d.ts.map

package/dist/errors/TokenProviderErrors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"TokenProviderErrors.d.ts","sourceRoot":"","sources":["../../src/errors/TokenProviderErrors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAM/B;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;aAGnC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,kBAAkB;aAGhC,KAAK,CAAC,EAAE,KAAK;gBAD7B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,KAAK,YAAA;CAMhC;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;aAGpC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;aAGnC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;aAGpC,KAAK,CAAC,EAAE,KAAK;gBAD7B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,KAAK,YAAA;CAMhC"}
+{"version":3,"file":"TokenProviderErrors.d.ts","sourceRoot":"","sources":["../../src/errors/TokenProviderErrors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;aAGzB,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAM/B;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;aAGnC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,YAAa,SAAQ,kBAAkB;aAGhC,KAAK,CAAC,EAAE,KAAK;gBAD7B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,KAAK,YAAA;CAMhC;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;aAGpC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,kBAAkB;aAGnC,aAAa,CAAC,EAAE,MAAM,EAAE;gBADxC,OAAO,EAAE,MAAM,EACC,aAAa,CAAC,EAAE,MAAM,EAAE,YAAA;CAM3C;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,kBAAkB;aAGpC,KAAK,CAAC,EAAE,KAAK;gBAD7B,OAAO,EAAE,MAAM,EACC,KAAK,CAAC,EAAE,KAAK,YAAA;CAMhC;AAED,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AACjE,OAAO,EAAE,wBAAwB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/errors/TokenProviderErrors.js

@@ -6,7 +6,7 @@
  * to enable better error handling and debugging.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.BrowserAuthError = exports.ServiceKeyError = exports.SessionDataError = exports.RefreshError = exports.ValidationError = exports.TokenProviderError = void 0;
+exports.AssertionValidationError = exports.BrowserAuthError = exports.ServiceKeyError = exports.SessionDataError = exports.RefreshError = exports.ValidationError = exports.TokenProviderError = void 0;
 const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 /**
  * Base class for all token provider errors
@@ -86,3 +86,5 @@ class BrowserAuthError extends TokenProviderError {
     }
 }
 exports.BrowserAuthError = BrowserAuthError;
+var AssertionValidationError_1 = require("./AssertionValidationError");
+Object.defineProperty(exports, "AssertionValidationError", { enumerable: true, get: function () { return AssertionValidationError_1.AssertionValidationError; } });

package/dist/index.d.ts

@@ -8,11 +8,14 @@ export { withBrowserCallbackServer } from './auth/callbackServer';
 export type { OidcCallbackResult } from './auth/oidcBrowserAuth';
 export { withOidcCallbackServer } from './auth/oidcBrowserAuth';
 export { withSamlCallbackServer } from './auth/saml2Auth';
+export { type AssertionCheck, AssertionValidationError, } from './errors/AssertionValidationError';
 export { BrowserAuthError, RefreshError, ServiceKeyError, SessionDataError, TokenProviderError, ValidationError, } from './errors/TokenProviderErrors';
-export type { AuthorizationCodeProviderConfig, ClientCredentialsProviderConfig, DeviceFlowProviderConfig, OidcBrowserProviderConfig, OidcDeviceFlowProviderConfig, OidcPasswordProviderConfig, OidcTokenExchangeProviderConfig, Saml2BearerProviderConfig, Saml2PureProviderConfig, } from './providers';
-export { AuthorizationCodeProvider, BaseTokenProvider, ClientCredentialsProvider, DeviceFlowProvider, OidcBrowserProvider, OidcDeviceFlowProvider, OidcPasswordProvider, OidcTokenExchangeProvider, Saml2BearerProvider, Saml2PureProvider, } from './providers';
+export type { AuthorizationCodeProviderConfig, ClientCredentialsProviderConfig, OidcBrowserProviderConfig, OidcDeviceFlowProviderConfig, OidcPasswordProviderConfig, OidcTokenExchangeProviderConfig, Saml2BearerProviderConfig, Saml2PureProviderConfig, UaaPasscodeProviderConfig, } from './providers';
+export { AuthorizationCodeProvider, BaseTokenProvider, ClientCredentialsProvider, OidcBrowserProvider, OidcDeviceFlowProvider, OidcPasswordProvider, OidcTokenExchangeProvider, Saml2BearerProvider, Saml2PureProvider, UaaPasscodeProvider, } from './providers';
 export { SsoProviderFactory } from './sso/SsoProviderFactory';
 export type { SsoProviderConfig, SsoProviderInstance } from './sso/types';
 export type { BrowserCallbackStrategyOptions, CallbackStrategyOptions, ExternalCodeStrategyOptions, ManualStrategyOptions, StaticCodeStrategyOptions, } from './strategies';
-export { asOidcResult, BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, externalCodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, oidcCallbackStrategy, samlCallbackStrategy, staticCodeStrategy, } from './strategies';
+export { asOidcResult, BrowserCallbackStrategy, browserCallbackStrategy, DEFAULT_CALLBACK_PORT, DEFAULT_LOGIN_TIMEOUT_MS, externalCodeStrategy, manualPasscodeStrategy, manualPasteStrategy, manualSamlResponseStrategy, oidcCallbackStrategy, samlCallbackStrategy, staticCodeStrategy, } from './strategies';
+export { createSignedAssertionValidator, createSignedResponseValidator, type ShippedValidatorOptions, } from './validation/assertionValidator';
+export { createInMemoryReplayStore, defaultReplayStore, } from './validation/inMemoryReplayStore';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,wBAAwB,EACxB,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,kBAAkB,EAClB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,YAAY,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AACjE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,OAAO,EACL,KAAK,cAAc,EACnB,wBAAwB,GACzB,MAAM,mCAAmC,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,GAChB,MAAM,8BAA8B,CAAC;AACtC,YAAY,EACV,+BAA+B,EAC/B,+BAA+B,EAC/B,yBAAyB,EACzB,4BAA4B,EAC5B,0BAA0B,EAC1B,+BAA+B,EAC/B,yBAAyB,EACzB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,yBAAyB,EACzB,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,mBAAmB,EACnB,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EACV,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,EAC3B,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,uBAAuB,EACvB,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,oBAAoB,EACpB,sBAAsB,EACtB,mBAAmB,EACnB,0BAA0B,EAC1B,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,cAAc,CAAC;AAGtB,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,KAAK,uBAAuB,GAC7B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,yBAAyB,EACzB,kBAAkB,GACnB,MAAM,kCAAkC,CAAC"}

package/dist/index.js

@@ -6,7 +6,7 @@
  * Provides token providers
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
+exports.defaultReplayStore = exports.createInMemoryReplayStore = exports.createSignedResponseValidator = exports.createSignedAssertionValidator = exports.staticCodeStrategy = exports.samlCallbackStrategy = exports.oidcCallbackStrategy = exports.manualSamlResponseStrategy = exports.manualPasteStrategy = exports.manualPasscodeStrategy = exports.externalCodeStrategy = exports.DEFAULT_LOGIN_TIMEOUT_MS = exports.DEFAULT_CALLBACK_PORT = exports.browserCallbackStrategy = exports.BrowserCallbackStrategy = exports.asOidcResult = exports.SsoProviderFactory = exports.UaaPasscodeProvider = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = exports.ValidationError = exports.TokenProviderError = exports.SessionDataError = exports.ServiceKeyError = exports.RefreshError = exports.BrowserAuthError = exports.AssertionValidationError = exports.withSamlCallbackServer = exports.withOidcCallbackServer = exports.withBrowserCallbackServer = void 0;
 // Callback server factories — "take the transport this package gives".
 var callbackServer_1 = require("./auth/callbackServer");
 Object.defineProperty(exports, "withBrowserCallbackServer", { enumerable: true, get: function () { return callbackServer_1.withBrowserCallbackServer; } });
@@ -15,6 +15,8 @@ Object.defineProperty(exports, "withOidcCallbackServer", { enumerable: true, get
 var saml2Auth_1 = require("./auth/saml2Auth");
 Object.defineProperty(exports, "withSamlCallbackServer", { enumerable: true, get: function () { return saml2Auth_1.withSamlCallbackServer; } });
 // Errors
+var AssertionValidationError_1 = require("./errors/AssertionValidationError");
+Object.defineProperty(exports, "AssertionValidationError", { enumerable: true, get: function () { return AssertionValidationError_1.AssertionValidationError; } });
 var TokenProviderErrors_1 = require("./errors/TokenProviderErrors");
 Object.defineProperty(exports, "BrowserAuthError", { enumerable: true, get: function () { return TokenProviderErrors_1.BrowserAuthError; } });
 Object.defineProperty(exports, "RefreshError", { enumerable: true, get: function () { return TokenProviderErrors_1.RefreshError; } });
@@ -27,13 +29,13 @@ var providers_1 = require("./providers");
 Object.defineProperty(exports, "AuthorizationCodeProvider", { enumerable: true, get: function () { return providers_1.AuthorizationCodeProvider; } });
 Object.defineProperty(exports, "BaseTokenProvider", { enumerable: true, get: function () { return providers_1.BaseTokenProvider; } });
 Object.defineProperty(exports, "ClientCredentialsProvider", { enumerable: true, get: function () { return providers_1.ClientCredentialsProvider; } });
-Object.defineProperty(exports, "DeviceFlowProvider", { enumerable: true, get: function () { return providers_1.DeviceFlowProvider; } });
 Object.defineProperty(exports, "OidcBrowserProvider", { enumerable: true, get: function () { return providers_1.OidcBrowserProvider; } });
 Object.defineProperty(exports, "OidcDeviceFlowProvider", { enumerable: true, get: function () { return providers_1.OidcDeviceFlowProvider; } });
 Object.defineProperty(exports, "OidcPasswordProvider", { enumerable: true, get: function () { return providers_1.OidcPasswordProvider; } });
 Object.defineProperty(exports, "OidcTokenExchangeProvider", { enumerable: true, get: function () { return providers_1.OidcTokenExchangeProvider; } });
 Object.defineProperty(exports, "Saml2BearerProvider", { enumerable: true, get: function () { return providers_1.Saml2BearerProvider; } });
 Object.defineProperty(exports, "Saml2PureProvider", { enumerable: true, get: function () { return providers_1.Saml2PureProvider; } });
+Object.defineProperty(exports, "UaaPasscodeProvider", { enumerable: true, get: function () { return providers_1.UaaPasscodeProvider; } });
 // SSO factory
 var SsoProviderFactory_1 = require("./sso/SsoProviderFactory");
 Object.defineProperty(exports, "SsoProviderFactory", { enumerable: true, get: function () { return SsoProviderFactory_1.SsoProviderFactory; } });
@@ -45,8 +47,17 @@ Object.defineProperty(exports, "browserCallbackStrategy", { enumerable: true, ge
 Object.defineProperty(exports, "DEFAULT_CALLBACK_PORT", { enumerable: true, get: function () { return strategies_1.DEFAULT_CALLBACK_PORT; } });
 Object.defineProperty(exports, "DEFAULT_LOGIN_TIMEOUT_MS", { enumerable: true, get: function () { return strategies_1.DEFAULT_LOGIN_TIMEOUT_MS; } });
 Object.defineProperty(exports, "externalCodeStrategy", { enumerable: true, get: function () { return strategies_1.externalCodeStrategy; } });
+Object.defineProperty(exports, "manualPasscodeStrategy", { enumerable: true, get: function () { return strategies_1.manualPasscodeStrategy; } });
 Object.defineProperty(exports, "manualPasteStrategy", { enumerable: true, get: function () { return strategies_1.manualPasteStrategy; } });
 Object.defineProperty(exports, "manualSamlResponseStrategy", { enumerable: true, get: function () { return strategies_1.manualSamlResponseStrategy; } });
 Object.defineProperty(exports, "oidcCallbackStrategy", { enumerable: true, get: function () { return strategies_1.oidcCallbackStrategy; } });
 Object.defineProperty(exports, "samlCallbackStrategy", { enumerable: true, get: function () { return strategies_1.samlCallbackStrategy; } });
 Object.defineProperty(exports, "staticCodeStrategy", { enumerable: true, get: function () { return strategies_1.staticCodeStrategy; } });
+// SAML assertion validation — the two shipped validators and the replay store,
+// or bring your own IAssertionValidator / IAssertionReplayStore.
+var assertionValidator_1 = require("./validation/assertionValidator");
+Object.defineProperty(exports, "createSignedAssertionValidator", { enumerable: true, get: function () { return assertionValidator_1.createSignedAssertionValidator; } });
+Object.defineProperty(exports, "createSignedResponseValidator", { enumerable: true, get: function () { return assertionValidator_1.createSignedResponseValidator; } });
+var inMemoryReplayStore_1 = require("./validation/inMemoryReplayStore");
+Object.defineProperty(exports, "createInMemoryReplayStore", { enumerable: true, get: function () { return inMemoryReplayStore_1.createInMemoryReplayStore; } });
+Object.defineProperty(exports, "defaultReplayStore", { enumerable: true, get: function () { return inMemoryReplayStore_1.defaultReplayStore; } });

package/dist/providers/Saml2BearerProvider.d.ts

@@ -14,6 +14,7 @@ export interface Saml2BearerProviderConfig extends Saml2CommonConfig, Saml2Beare
 }
 export declare class Saml2BearerProvider extends BaseTokenProvider {
     private config;
+    private readonly validator;
     constructor(config: Saml2BearerProviderConfig);
     protected getAuthType(): OAuth2GrantType;
     protected performLogin(): Promise<ITokenResult>;

package/dist/providers/Saml2BearerProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAK9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAOtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;gBAE9B,MAAM,EAAE,yBAAyB;IAiB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAoBrD;;;;OAIG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqBxD"}
+{"version":3,"file":"Saml2BearerProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2BearerProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAEV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAM9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EACV,yBAAyB,EACzB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAQtB,MAAM,WAAW,yBACf,SAAQ,iBAAiB,EACvB,yBAAyB;IAC3B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,MAAM,CAA4B;IAC1C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;gBAEpC,MAAM,EAAE,yBAAyB;IAqB7C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAgCrD;;;;OAIG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAqBxD"}

package/dist/providers/Saml2BearerProvider.js

@@ -8,15 +8,21 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.Saml2BearerProvider = void 0;
 const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
 const saml2TokenExchange_1 = require("../auth/saml2TokenExchange");
+const samlBearerAssertion_1 = require("../auth/samlBearerAssertion");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 const saml2Utils_1 = require("./saml2Utils");
 class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
     config;
+    validator;
     constructor(config) {
         super();
         // A pre-built URL with no declared ACS cannot be verified against whatever
         // the strategy binds, so it is refused here rather than at login time.
         (0, saml2Utils_1.validateSamlConfig)(config);
+        // Before anything reaches a browser or a network: a missing certificate is
+        // the consumer's mistake, and finding it after a completed login wastes
+        // theirs.
+        this.validator = (0, saml2Utils_1.resolveAssertionValidator)(config, 'bearer');
         this.config = config;
         this.logger = config.logger;
         if (config.accessToken) {
@@ -31,9 +37,21 @@ class Saml2BearerProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return interfaces_auth_1.AUTH_TYPE_SAML2_BEARER;
     }
     async performLogin() {
-        const samlResponse = await (0, saml2Utils_1.getSamlAssertion)(this.config);
+        const { payload, requestId, acsUrl } = await (0, saml2Utils_1.getSamlAssertion)(this.config);
+        // Validation establishes trust before anything reaches the token
+        // endpoint; it does not change what is sent beyond toBearerAssertion's
+        // conversion below.
+        await this.validator.validate(payload, {
+            expectedInResponseTo: requestId,
+            audience: this.config.spEntityId,
+            acsUrl,
+            expectedIssuer: this.config.idpEntityId,
+            logger: this.logger,
+        });
         const tokenUrl = (0, saml2Utils_1.resolveTokenUrl)(this.config);
-        const tokens = await (0, saml2TokenExchange_1.exchangeSamlAssertion)(samlResponse, tokenUrl, this.config.clientId, this.config.clientSecret, this.logger);
+        // RFC 7522 takes one base64url Assertion; a login delivers the whole
+        // Response in standard base64, which a conforming endpoint refuses.
+        const tokens = await (0, saml2TokenExchange_1.exchangeSamlAssertion)((0, samlBearerAssertion_1.toBearerAssertion)(payload), tokenUrl, this.config.clientId, this.config.clientSecret, this.logger);
         return {
             authorizationToken: tokens.accessToken,
             refreshToken: tokens.refreshToken,

package/dist/providers/Saml2PureProvider.d.ts

@@ -13,6 +13,7 @@ export interface Saml2PureProviderConfig extends Saml2CommonConfig {
 }
 export declare class Saml2PureProvider extends BaseTokenProvider {
     private config;
+    private readonly validator;
     constructor(config: Saml2PureProviderConfig);
     protected getAuthType(): OAuth2GrantType;
     protected performLogin(): Promise<ITokenResult>;

package/dist/providers/Saml2PureProvider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"Saml2PureProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2PureProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAE9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;IACtD,OAAO,CAAC,MAAM,CAA0B;gBAE5B,MAAM,EAAE,uBAAuB;IAU3C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAarC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxD"}
+{"version":3,"file":"Saml2PureProvider.d.ts","sourceRoot":"","sources":["../../src/providers/Saml2PureProvider.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAEV,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAC9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAOtD,MAAM,WAAW,uBAAwB,SAAQ,iBAAiB;IAChE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,cAAc,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3D;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;IACtD,OAAO,CAAC,MAAM,CAA0B;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAsB;gBAEpC,MAAM,EAAE,uBAAuB;IAc3C,SAAS,CAAC,WAAW,IAAI,eAAe;cAIxB,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;cAuBrC,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAGxD"}

package/dist/providers/Saml2PureProvider.js

@@ -7,16 +7,20 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.Saml2PureProvider = void 0;
 const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
-const saml2Auth_1 = require("../auth/saml2Auth");
 const BaseTokenProvider_1 = require("./BaseTokenProvider");
 const saml2Utils_1 = require("./saml2Utils");
 class Saml2PureProvider extends BaseTokenProvider_1.BaseTokenProvider {
     config;
+    validator;
     constructor(config) {
         super();
         // A pre-built URL with no declared ACS cannot be verified against whatever
         // the strategy binds, so it is refused here rather than at login time.
         (0, saml2Utils_1.validateSamlConfig)(config);
+        // Before anything reaches a browser or a network: a missing certificate is
+        // the consumer's mistake, and finding it after a completed login wastes
+        // theirs.
+        this.validator = (0, saml2Utils_1.resolveAssertionValidator)(config, 'pure');
         this.config = config;
         this.logger = config.logger;
         this.tokenType = 'saml';
@@ -25,14 +29,24 @@ class Saml2PureProvider extends BaseTokenProvider_1.BaseTokenProvider {
         return interfaces_auth_1.AUTH_TYPE_USER_TOKEN;
     }
     async performLogin() {
-        const samlResponse = await (0, saml2Utils_1.getSamlAssertion)(this.config);
-        const expiresAt = (0, saml2Auth_1.parseSamlNotOnOrAfter)(samlResponse);
-        const sessionCookies = await this.config.cookieProvider(samlResponse);
+        const { payload, requestId, acsUrl } = await (0, saml2Utils_1.getSamlAssertion)(this.config);
+        // acsUrl is where the strategy actually listened — with an ephemeral port
+        // the configured value is usually absent and never authoritative.
+        const validated = await this.validator.validate(payload, {
+            expectedInResponseTo: requestId,
+            audience: this.config.spEntityId,
+            acsUrl,
+            expectedIssuer: this.config.idpEntityId,
+            logger: this.logger,
+        });
+        const sessionCookies = await this.config.cookieProvider(payload);
         return {
             authorizationToken: sessionCookies,
             authType: interfaces_auth_1.AUTH_TYPE_USER_TOKEN,
             tokenType: 'saml',
-            expiresAt,
+            // ITokenResult.expiresAt is an epoch-ms number, unlike
+            // ValidatedAssertion.expiresAt, which is a Date.
+            expiresAt: validated.expiresAt.getTime(),
         };
     }
     async performRefresh() {

package/dist/providers/UaaPasscodeProvider.d.ts

@@ -0,0 +1,43 @@
+/**
+ * UAA / XSUAA one-time passcode provider — the login `cf login --sso` uses.
+ *
+ * Nothing is opened and nothing listens on this machine: the user fetches a
+ * code from `<uaaUrl>/passcode` in any browser, anywhere, logging in however
+ * the identity zone asks (SSO through a corporate IdP, MFA), and hands it to
+ * the strategy. The provider exchanges it for tokens and refreshes them
+ * afterwards, so the user is asked again only when the refresh token is gone.
+ */
+import type { IAuthorizationStrategy, ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
+import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
+import { BaseTokenProvider } from './BaseTokenProvider';
+export interface UaaPasscodeProviderConfig {
+    /** UAA / XSUAA base URL, e.g. `https://<subdomain>.authentication.<region>.hana.ondemand.com`. */
+    uaaUrl: string;
+    /** A client allowed the `password` grant; add `refresh_token` to keep the session. */
+    clientId: string;
+    /** Omitted for a public client, which authenticates with an empty secret. */
+    clientSecret?: string;
+    /**
+     * How the user's code reaches the provider. The strategy is handed
+     * `<uaaUrl>/passcode` as the URL to send the user to, and returns the code.
+     * Defaults to `manualPasscodeStrategy()`: announce the URL, read the code
+     * from the terminal.
+     */
+    authorization?: IAuthorizationStrategy<string>;
+    accessToken?: string;
+    refreshToken?: string;
+    logger?: ILogger;
+}
+export declare class UaaPasscodeProvider extends BaseTokenProvider {
+    private readonly config;
+    constructor(config: UaaPasscodeProviderConfig);
+    protected getAuthType(): OAuth2GrantType;
+    private get baseUrl();
+    protected performLogin(): Promise<ITokenResult>;
+    /**
+     * A failure is thrown, not handled: BaseTokenProvider drops the refresh
+     * token and asks for a new passcode through performLogin().
+     */
+    protected performRefresh(): Promise<ITokenResult>;
+}
+//# sourceMappingURL=UaaPasscodeProvider.d.ts.map

package/dist/providers/UaaPasscodeProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UaaPasscodeProvider.d.ts","sourceRoot":"","sources":["../../src/providers/UaaPasscodeProvider.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,sBAAsB,EACtB,YAAY,EACZ,eAAe,EAChB,MAAM,+BAA+B,CAAC;AAEvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAI9D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,WAAW,yBAAyB;IACxC,kGAAkG;IAClG,MAAM,EAAE,MAAM,CAAC;IACf,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IACjB,6EAA6E;IAC7E,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;;;;;OAKG;IACH,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,qBAAa,mBAAoB,SAAQ,iBAAiB;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA4B;gBAEvC,MAAM,EAAE,yBAAyB;IAa7C,SAAS,CAAC,WAAW,IAAI,eAAe;IAIxC,OAAO,KAAK,OAAO,GAElB;cAEe,YAAY,IAAI,OAAO,CAAC,YAAY,CAAC;IAqCrD;;;OAGG;cACa,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;CAkBxD"}

package/dist/providers/UaaPasscodeProvider.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * UAA / XSUAA one-time passcode provider — the login `cf login --sso` uses.
+ *
+ * Nothing is opened and nothing listens on this machine: the user fetches a
+ * code from `<uaaUrl>/passcode` in any browser, anywhere, logging in however
+ * the identity zone asks (SSO through a corporate IdP, MFA), and hands it to
+ * the strategy. The provider exchanges it for tokens and refreshes them
+ * afterwards, so the user is asked again only when the refresh token is gone.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UaaPasscodeProvider = void 0;
+const interfaces_auth_1 = require("@mcp-abap-adt/interfaces-auth");
+const passcodeAuth_1 = require("../auth/passcodeAuth");
+const tokenRefresher_1 = require("../auth/tokenRefresher");
+const manualStrategies_1 = require("../strategies/manualStrategies");
+const BaseTokenProvider_1 = require("./BaseTokenProvider");
+class UaaPasscodeProvider extends BaseTokenProvider_1.BaseTokenProvider {
+    config;
+    constructor(config) {
+        super();
+        this.config = config;
+        this.logger = config.logger;
+        if (config.accessToken) {
+            this.authorizationToken = config.accessToken;
+            this.expiresAt = this.parseExpirationFromJWT(config.accessToken);
+        }
+        if (config.refreshToken) {
+            this.refreshToken = config.refreshToken;
+        }
+    }
+    getAuthType() {
+        return interfaces_auth_1.AUTH_TYPE_PASSWORD;
+    }
+    get baseUrl() {
+        return this.config.uaaUrl.replace(/\/+$/, '');
+    }
+    async performLogin() {
+        const supplied = this.config.authorization;
+        const strategy = supplied ?? (0, manualStrategies_1.manualPasscodeStrategy)();
+        let passcode;
+        try {
+            // The passcode page takes no redirect: the code travels by hand.
+            const outcome = await strategy.authorize({
+                logger: this.logger,
+                buildAuthorizationUrl: async () => `${this.baseUrl}/passcode`,
+            });
+            passcode = outcome.payload;
+        }
+        finally {
+            if (!supplied) {
+                await strategy.dispose?.().catch((error) => {
+                    this.logger?.warn('[UaaPasscodeProvider] dispose failed', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
+                });
+            }
+        }
+        const tokens = await (0, passcodeAuth_1.exchangePasscode)(this.baseUrl, this.config.clientId, this.config.clientSecret, passcode, this.logger);
+        return {
+            authorizationToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken,
+            authType: interfaces_auth_1.AUTH_TYPE_PASSWORD,
+            expiresIn: tokens.expiresIn,
+            tokenType: 'jwt',
+        };
+    }
+    /**
+     * A failure is thrown, not handled: BaseTokenProvider drops the refresh
+     * token and asks for a new passcode through performLogin().
+     */
+    async performRefresh() {
+        if (!this.refreshToken) {
+            throw new Error('Refresh token is required for refresh');
+        }
+        const result = await (0, tokenRefresher_1.refreshJwtToken)(this.refreshToken, this.baseUrl, this.config.clientId, this.config.clientSecret ?? '');
+        return {
+            authorizationToken: result.accessToken,
+            refreshToken: result.refreshToken || this.refreshToken,
+            authType: interfaces_auth_1.AUTH_TYPE_PASSWORD,
+            expiresIn: result.expiresIn,
+            tokenType: 'jwt',
+        };
+    }
+}
+exports.UaaPasscodeProvider = UaaPasscodeProvider;

package/dist/providers/index.d.ts

@@ -9,8 +9,6 @@ export { AuthorizationCodeProvider } from './AuthorizationCodeProvider';
 export { BaseTokenProvider } from './BaseTokenProvider';
 export type { ClientCredentialsProviderConfig } from './ClientCredentialsProvider';
 export { ClientCredentialsProvider } from './ClientCredentialsProvider';
-export type { DeviceFlowProviderConfig } from './DeviceFlowProvider';
-export { DeviceFlowProvider } from './DeviceFlowProvider';
 export type { OidcBrowserProviderConfig } from './OidcBrowserProvider';
 export { OidcBrowserProvider } from './OidcBrowserProvider';
 export type { OidcDeviceFlowProviderConfig } from './OidcDeviceFlowProvider';
@@ -23,4 +21,6 @@ export type { Saml2BearerProviderConfig } from './Saml2BearerProvider';
 export { Saml2BearerProvider } from './Saml2BearerProvider';
 export type { Saml2PureProviderConfig } from './Saml2PureProvider';
 export { Saml2PureProvider } from './Saml2PureProvider';
+export type { UaaPasscodeProviderConfig } from './UaaPasscodeProvider';
+export { UaaPasscodeProvider } from './UaaPasscodeProvider';
 //# sourceMappingURL=index.d.ts.map

package/dist/providers/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/providers/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,4BAA4B,EAAE,MAAM,0BAA0B,CAAC;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAClE,YAAY,EAAE,0BAA0B,EAAE,MAAM,wBAAwB,CAAC;AACzE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAC9D,YAAY,EAAE,+BAA+B,EAAE,MAAM,6BAA6B,CAAC;AACnF,OAAO,EAAE,yBAAyB,EAAE,MAAM,6BAA6B,CAAC;AACxE,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC"}

package/dist/providers/index.js

@@ -6,15 +6,13 @@
  * All providers extend BaseTokenProvider and implement ITokenProvider.
  */
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.DeviceFlowProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = void 0;
+exports.UaaPasscodeProvider = exports.Saml2PureProvider = exports.Saml2BearerProvider = exports.OidcTokenExchangeProvider = exports.OidcPasswordProvider = exports.OidcDeviceFlowProvider = exports.OidcBrowserProvider = exports.ClientCredentialsProvider = exports.BaseTokenProvider = exports.AuthorizationCodeProvider = void 0;
 var AuthorizationCodeProvider_1 = require("./AuthorizationCodeProvider");
 Object.defineProperty(exports, "AuthorizationCodeProvider", { enumerable: true, get: function () { return AuthorizationCodeProvider_1.AuthorizationCodeProvider; } });
 var BaseTokenProvider_1 = require("./BaseTokenProvider");
 Object.defineProperty(exports, "BaseTokenProvider", { enumerable: true, get: function () { return BaseTokenProvider_1.BaseTokenProvider; } });
 var ClientCredentialsProvider_1 = require("./ClientCredentialsProvider");
 Object.defineProperty(exports, "ClientCredentialsProvider", { enumerable: true, get: function () { return ClientCredentialsProvider_1.ClientCredentialsProvider; } });
-var DeviceFlowProvider_1 = require("./DeviceFlowProvider");
-Object.defineProperty(exports, "DeviceFlowProvider", { enumerable: true, get: function () { return DeviceFlowProvider_1.DeviceFlowProvider; } });
 var OidcBrowserProvider_1 = require("./OidcBrowserProvider");
 Object.defineProperty(exports, "OidcBrowserProvider", { enumerable: true, get: function () { return OidcBrowserProvider_1.OidcBrowserProvider; } });
 var OidcDeviceFlowProvider_1 = require("./OidcDeviceFlowProvider");
@@ -27,3 +25,5 @@ var Saml2BearerProvider_1 = require("./Saml2BearerProvider");
 Object.defineProperty(exports, "Saml2BearerProvider", { enumerable: true, get: function () { return Saml2BearerProvider_1.Saml2BearerProvider; } });
 var Saml2PureProvider_1 = require("./Saml2PureProvider");
 Object.defineProperty(exports, "Saml2PureProvider", { enumerable: true, get: function () { return Saml2PureProvider_1.Saml2PureProvider; } });
+var UaaPasscodeProvider_1 = require("./UaaPasscodeProvider");
+Object.defineProperty(exports, "UaaPasscodeProvider", { enumerable: true, get: function () { return UaaPasscodeProvider_1.UaaPasscodeProvider; } });

package/dist/providers/saml2Utils.d.ts

@@ -1,7 +1,7 @@
 /**
  * SAML2 provider shared helpers.
  */
-import type { IAuthorizationStrategy } from '@mcp-abap-adt/interfaces-auth';
+import type { IAssertionReplayStore, IAssertionValidator, IAuthorizationStrategy } from '@mcp-abap-adt/interfaces-auth';
 import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
 export interface Saml2CommonConfig {
     idpSsoUrl: string;
@@ -17,6 +17,32 @@ export interface Saml2CommonConfig {
     /** How the login is conducted. Omitted means a browser callback. */
     authorization?: IAuthorizationStrategy<string>;
     logger?: ILogger;
+    /** PEM or bare base64 DER. Required when no `assertionValidator` is supplied. */
+    idpCertificates?: string[];
+    /**
+     * The `Issuer` the assertion must name. Required unless the supplied
+     * `assertionValidator` is a custom one: a shipped validator supplied there
+     * still needs it, since it fails closed without an expected issuer.
+     */
+    idpEntityId?: string;
+    /** Finite, non-negative, integer. Defaults to 0. */
+    clockSkewMs?: number;
+    /**
+     * The AuthnRequest ID this login answers, when this package did not mint one
+     * itself — a pre-built `authorizationUrl`, or a strategy that obtained the
+     * response some other way after a request the consumer sent.
+     */
+    authnRequestId?: string;
+    /**
+     * Declares that no AuthnRequest is sent: the assertion must carry no
+     * `InResponseTo`. Default `false`. Combining this with a minted or declared
+     * request ID is a configuration error: the two describe different logins.
+     */
+    idpInitiated?: boolean;
+    /** Which validator to use. Omitted means the provider's own default. */
+    assertionValidator?: IAssertionValidator;
+    /** A consumer's own replay store, for a deployment running more than one process. */
+    assertionReplayStore?: IAssertionReplayStore;
 }
 export interface Saml2BearerExchangeConfig {
     tokenUrl?: string;
@@ -26,6 +52,27 @@ export interface Saml2BearerExchangeConfig {
 }
 /** Throw at construction rather than half-verify at runtime. */
 export declare function validateSamlConfig(config: Saml2CommonConfig): void;
+/**
+ * The consumer's validator when supplied, otherwise the provider's default —
+ * `createSignedAssertionValidator` for `"bearer"`, since the token endpoint
+ * receives the Assertion alone (#40) and its own signature is what that
+ * endpoint verifies; `createSignedResponseValidator` for `"pure"`, since the
+ * whole response is handed on and `Status`/`Destination` must be inside a
+ * signature. See the spec's "A bare Assertion, and which validator each
+ * provider defaults to".
+ */
+export declare function resolveAssertionValidator(config: Saml2CommonConfig, provider: 'bearer' | 'pure'): IAssertionValidator;
 export declare function resolveTokenUrl(config: Saml2BearerExchangeConfig): string;
-export declare function getSamlAssertion(config: Saml2CommonConfig): Promise<string>;
+/** What `getSamlAssertion` hands back: the wire payload, plus what it knows about the login. */
+export interface SamlAssertionResult {
+    readonly payload: string;
+    /**
+     * `undefined` exactly when the login is declared `idpInitiated` and no ID
+     * was minted or declared for it.
+     */
+    readonly requestId?: string;
+    /** Where the strategy actually listened — `outcome.redirectUri`, never `config.acsUrl`. */
+    readonly acsUrl: string;
+}
+export declare function getSamlAssertion(config: Saml2CommonConfig): Promise<SamlAssertionResult>;
 //# sourceMappingURL=saml2Utils.d.ts.map

package/dist/providers/saml2Utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"saml2Utils.d.ts","sourceRoot":"","sources":["../../src/providers/saml2Utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAI9D,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAOlE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAQzE;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,MAAM,CAAC,CA+CjB"}
+{"version":3,"file":"saml2Utils.d.ts","sourceRoot":"","sources":["../../src/providers/saml2Utils.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,qBAAqB,EACrB,mBAAmB,EACnB,sBAAsB,EACvB,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAU9D,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,oEAAoE;IACpE,aAAa,CAAC,EAAE,sBAAsB,CAAC,MAAM,CAAC,CAAC;IAC/C,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iFAAiF;IACjF,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B;;;;OAIG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,mBAAmB,CAAC;IACzC,qFAAqF;IACrF,oBAAoB,CAAC,EAAE,qBAAqB,CAAC;CAC9C;AAED,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,gEAAgE;AAChE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,IAAI,CAOlE;AAED;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,iBAAiB,EACzB,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAC1B,mBAAmB,CAsCrB;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAQzE;AAED,gGAAgG;AAChG,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB;;;OAGG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,2FAA2F;IAC3F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,wBAAsB,gBAAgB,CACpC,MAAM,EAAE,iBAAiB,GACxB,OAAO,CAAC,mBAAmB,CAAC,CAuE9B"}