@mcp-abap-adt/auth-providers 2.2.2 → 4.0.0

package/dist/validation/signedNode.js

@@ -0,0 +1,171 @@
+"use strict";
+/**
+ * Which element the signature covers.
+ *
+ * Not "is there a valid signature" — that question has a true answer in a
+ * document built for a wrapping attack, where a genuinely signed fragment sits
+ * beside a forged one. The caller must read the element this returns and no
+ * other.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPem = toPem;
+exports.quoteUntrusted = quoteUntrusted;
+exports.resolveSignedElements = resolveSignedElements;
+const node_crypto_1 = require("node:crypto");
+const xml_crypto_1 = require("xml-crypto");
+const DSIG_NS = 'http://www.w3.org/2000/09/xmldsig#';
+/**
+ * PEM in, PEM out; bare base64 DER gets its armour — and the result is proved
+ * to be a certificate before anything uses it.
+ *
+ * The spec promises `idpCertificates` accepts either, and a consumer copying
+ * `<X509Certificate>` out of identity-provider metadata has bare base64 DER in
+ * their hand — the armour is not in the metadata. `xml-crypto` accepts only
+ * PEM or a Buffer: measured, a bare base64 certificate makes OpenSSL throw
+ * `DECODER routines::unsupported`, while the same bytes re-armoured verify.
+ *
+ * Left unnormalised that throw would be swallowed by the verification loop and
+ * reported as "the signature does not verify against any configured
+ * certificate" — blaming the assertion for the consumer's formatting.
+ *
+ * Base64 syntax alone does not make a string a certificate: `"AAAA"` passes
+ * the character class, armours cleanly, and fails only inside OpenSSL, which
+ * lands back at the same misleading message. So the armoured result is parsed
+ * with `node:crypto`'s `X509Certificate`, which rejects `"AAAA"` with
+ * `asn1 encoding routines::wrong tag` — measured, not assumed. Called once per
+ * certificate at construction, so the cost never falls on a login.
+ */
+function toPem(certificate) {
+    const trimmed = certificate.trim();
+    const pem = trimmed.includes('-----BEGIN')
+        ? trimmed
+        : (() => {
+            const body = trimmed.replace(/\s+/g, '');
+            if (!/^[A-Za-z0-9+/]+={0,2}$/.test(body)) {
+                throw new Error('a configured certificate is neither PEM nor base64 DER');
+            }
+            const wrapped = body.replace(/(.{64})/g, '$1\n').trim();
+            return `-----BEGIN CERTIFICATE-----\n${wrapped}\n-----END CERTIFICATE-----\n`;
+        })();
+    try {
+        new node_crypto_1.X509Certificate(pem);
+    }
+    catch (error) {
+        throw new Error(`a configured certificate is not a valid X.509 certificate: ${error.message}`);
+    }
+    return pem;
+}
+/**
+ * A value taken from the document before any signature has been verified,
+ * made safe to put in a message: JSON-quoted, so a newline smuggled in as
+ * `&#10;` shows as `\n` rather than forging a line in a log, and cut to 64
+ * characters, so an attacker cannot fill a log with it.
+ */
+function quoteUntrusted(value) {
+    const limit = 64;
+    return JSON.stringify(value.length > limit ? `${value.slice(0, limit)}…` : value);
+}
+/**
+ * Verifies every signature in the document against the certificates and
+ * returns the elements they reference. Throws when there is no signature, or
+ * when any one of them fails a rule below.
+ *
+ * `doc` must be the parse of `xml`, and nothing else: signatures are found and
+ * their references resolved in `doc`, while `xml-crypto` verifies the digests
+ * over `xml`. Handed a `doc` from different bytes, the element returned would
+ * not be the one whose bytes were verified.
+ *
+ * Several signatures are normal — identity providers often sign the Response
+ * and the Assertion both. Each is held to every rule on its own; the caller
+ * then takes the element it requires from the returned list.
+ */
+function resolveSignedElements(xml, doc, certificates) {
+    const signatures = doc.getElementsByTagNameNS(DSIG_NS, 'Signature');
+    if (signatures.length === 0) {
+        throw new Error('the document carries no signature');
+    }
+    // Every signature is held to every rule: an extra signature that fails is
+    // something that should not be there, not noise to skip. Two verifying
+    // signatures over one element cannot occur — under the enveloped-signature
+    // transform the later one changes the bytes the earlier one's digest
+    // covered — so no separate rule guards against it.
+    const covered = [];
+    for (let i = 0; i < signatures.length; i++) {
+        covered.push(resolveOne(xml, doc, signatures[i], certificates));
+    }
+    return covered;
+}
+/** One signature: verified, exactly one reference, enveloped by its target. */
+function resolveOne(xml, doc, signatureNode, certificates) {
+    let verified = false;
+    for (const certificate of certificates) {
+        // Already normalised and proved at construction, so a throw here really
+        // is a bad signature rather than a formatting mistake.
+        // getCertFromKeyInfo is pinned to "none": a certificate the document
+        // carries in its own KeyInfo is the sender's claim about who signed it,
+        // and xml-crypto prefers it to publicCert when the hook returns one. It
+        // defaults to a no-op in 6.x; stating it keeps a future default from
+        // quietly letting an attacker's embedded certificate verify their own
+        // signature.
+        const verifier = new xml_crypto_1.SignedXml({
+            publicCert: certificate,
+            getCertFromKeyInfo: () => null,
+        });
+        verifier.loadSignature(signatureNode);
+        try {
+            // Returns false for a digest mismatch and throws when the signature
+            // value itself fails. Both mean "not this certificate".
+            if (verifier.checkSignature(xml)) {
+                verified = true;
+                break;
+            }
+        }
+        catch {
+            // Try the next certificate in the rotation list.
+        }
+    }
+    if (!verified) {
+        throw new Error('the signature does not verify against any configured certificate');
+    }
+    // The signature is valid; now find what it actually covers. Exactly one
+    // reference: two would be two candidate answers to "what is signed", the
+    // ambiguity this module exists to remove.
+    const references = signatureNode.getElementsByTagNameNS(DSIG_NS, 'Reference');
+    if (references.length !== 1) {
+        throw new Error(`the signature carries ${references.length} references; exactly one is required`);
+    }
+    const uri = references[0].getAttribute('URI') ?? '';
+    let referenced = null;
+    if (uri === '') {
+        // An empty URI signs the whole document. It must still satisfy the
+        // enveloping rule below — returning early here is exactly how a detached
+        // signature with an empty reference walks straight past that rule.
+        referenced = doc.documentElement;
+    }
+    else if (!uri.startsWith('#')) {
+        throw new Error(`the signature reference is not a same-document URI: ${quoteUntrusted(uri)}`);
+    }
+    else {
+        const id = uri.slice(1);
+        const elements = doc.getElementsByTagName('*');
+        for (let i = 0; i < elements.length; i++) {
+            if (elements[i].getAttribute('ID') === id) {
+                referenced = elements[i];
+                break;
+            }
+        }
+    }
+    if (!referenced) {
+        throw new Error(`the signature references ${quoteUntrusted(uri)}, which is not in the document`);
+    }
+    // The enveloped signature must sit inside the element it references. A
+    // signature moved elsewhere stays cryptographically valid over the bytes it
+    // covers, so the maths alone will not catch it — this comparison is what
+    // does. It is the check @node-saml/node-saml makes, and the one whose
+    // absence made every response @mcp-abap-adt/auth-mocks produced
+    // unacceptable to a real library until it was fixed there.
+    if (signatureNode.parentNode !== referenced) {
+        throw new Error('the signature is not inside the element it references, so it does not envelope it');
+    }
+    return referenced;
+}

package/dist/validation/xsdDateTime.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Parsing an `xsd:dateTime` strictly enough to trust the result.
+ *
+ * `Date.parse` is not this. It normalises `2026-02-30` into 2 March instead of
+ * rejecting it, and it will read a timezone offset no calendar has. Both traps
+ * were found in `@mcp-abap-adt/auth-mocks` and fixed there the same way: match
+ * the lexical shape, then require every component to survive a round trip. The
+ * instant is computed from the components rather than handed back to `Date`,
+ * whose handling of invalid strings is implementation-defined.
+ *
+ * Deliberately not implemented: negative (BCE) years, the `24:00:00`
+ * end-of-day form, and leap seconds. No identity provider in this family emits
+ * them, and pretending to cover them would be worse than saying so.
+ */
+/** Returns the instant, or null when the value is not a valid xsd:dateTime. */
+export declare function parseXsdDateTime(value: string | null | undefined): Date | null;
+//# sourceMappingURL=xsdDateTime.d.ts.map

package/dist/validation/xsdDateTime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xsdDateTime.d.ts","sourceRoot":"","sources":["../../src/validation/xsdDateTime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,IAAI,GAAG,IAAI,CAkDb"}

package/dist/validation/xsdDateTime.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Parsing an `xsd:dateTime` strictly enough to trust the result.
+ *
+ * `Date.parse` is not this. It normalises `2026-02-30` into 2 March instead of
+ * rejecting it, and it will read a timezone offset no calendar has. Both traps
+ * were found in `@mcp-abap-adt/auth-mocks` and fixed there the same way: match
+ * the lexical shape, then require every component to survive a round trip. The
+ * instant is computed from the components rather than handed back to `Date`,
+ * whose handling of invalid strings is implementation-defined.
+ *
+ * Deliberately not implemented: negative (BCE) years, the `24:00:00`
+ * end-of-day form, and leap seconds. No identity provider in this family emits
+ * them, and pretending to cover them would be worse than saying so.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseXsdDateTime = parseXsdDateTime;
+const SHAPE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+/** Returns the instant, or null when the value is not a valid xsd:dateTime. */
+function parseXsdDateTime(value) {
+    if (!value)
+        return null;
+    const m = SHAPE.exec(value);
+    if (!m)
+        return null;
+    const [, y, mo, d, h, mi, s, fraction, zone] = m;
+    const year = Number(y);
+    const month = Number(mo);
+    const day = Number(d);
+    const hour = Number(h);
+    const minute = Number(mi);
+    const second = Number(s);
+    if (month < 1 || month > 12)
+        return null;
+    if (hour > 23 || minute > 59 || second > 59)
+        return null;
+    // The calendar round trip. Date.UTC rolls 2026-02-30 into 2026-03-02, so a
+    // component that comes back changed means the date does not exist.
+    const utc = new Date(Date.UTC(year, month - 1, day, hour, minute, second));
+    if (utc.getUTCFullYear() !== year ||
+        utc.getUTCMonth() !== month - 1 ||
+        utc.getUTCDate() !== day) {
+        return null;
+    }
+    // Milliseconds from the fraction: pad to 3 digits and truncate extras.
+    // Avoid floating-point multiplication: 0.57 * 1000 = 569.99999….
+    const ms = fraction
+        ? Number(fraction.slice(1).padEnd(3, '0').slice(0, 3))
+        : 0;
+    // Offset in milliseconds. For zone Z it is 0. Otherwise apply the sign.
+    let offsetMs = 0;
+    if (zone !== 'Z') {
+        const offsetHour = Number(zone.slice(1, 3));
+        const offsetMinute = Number(zone.slice(4, 6));
+        // xsd:dateTime bounds the offset at ±14:00, and exactly 14 allows no
+        // minutes. Both halves matter: +15:00 fails the first, +14:01 the second.
+        if (offsetHour > 14 || offsetMinute > 59)
+            return null;
+        if (offsetHour === 14 && offsetMinute !== 0)
+            return null;
+        const sign = zone[0] === '-' ? -1 : 1;
+        offsetMs = sign * (offsetHour * 60 + offsetMinute) * 60_000;
+    }
+    // The instant is UTC time + milliseconds - offset, because local time = UTC + offset.
+    const instant = utc.getTime() + ms - offsetMs;
+    return new Date(instant);
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "2.2.2",
+  "version": "4.0.0",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -40,8 +40,7 @@
   },
   "bin": {
     "auth-authorization-code": "./bin/auth-authorization-code.ts",
-    "auth-client-credentials": "./bin/auth-client-credentials.ts",
-    "auth-device-flow": "./bin/auth-device-flow.ts"
+    "auth-client-credentials": "./bin/auth-client-credentials.ts"
   },
   "scripts": {
     "chrono": "./tools/version-stats.sh",
@@ -53,22 +52,29 @@
     "build:fast": "npx tsc -p tsconfig.json",
     "test": "NODE_OPTIONS=--experimental-vm-modules jest",
     "test:check": "npx tsc --noEmit",
-    "prepublishOnly": "npm run build"
+    "prepublishOnly": "npm run build",
+    "stand:up": "tests/stand/up.sh",
+    "stand:down": "tests/stand/down.sh",
+    "test:stand": "tests/stand/run.sh",
+    "test:xsuaa": "tests/xsuaa/run.sh"
   },
   "engines": {
-    "node": ">=18.2.0"
+    "node": "^22 || ^24"
   },
   "dependencies": {
-    "@mcp-abap-adt/interfaces-auth": "^1.2.0",
-    "@mcp-abap-adt/interfaces-auth-sap": "^1.0.0",
+    "@mcp-abap-adt/interfaces-auth": "^2.0.0",
+    "@mcp-abap-adt/interfaces-auth-sap": "^1.0.1",
     "@mcp-abap-adt/interfaces-utils": "^1.1.0",
+    "@xmldom/xmldom": "^0.9.12",
     "axios": "^1.13.5",
     "express": "^5.1.0",
-    "open": "^11.0.0"
+    "open": "^11.0.0",
+    "xml-crypto": "^6.1.2"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.3.14",
     "@jest/globals": "^30.2.0",
+    "@mcp-abap-adt/auth-mocks": "^0.3.0",
     "@mcp-abap-adt/auth-stores": "^1.0.1",
     "@mcp-abap-adt/logger": "^0.4.0",
     "@types/express": "^5.0.5",

package/bin/auth-device-flow.ts

@@ -1,114 +0,0 @@
-#!/usr/bin/env tsx
-/**
- * Device Flow Provider Test Command
- */
-
-import { DeviceFlowProvider } from '../src/providers/DeviceFlowProvider';
-import {
-  getUaaCredentials,
-  parseEnvFile,
-  parseServiceKey,
-  writeEnvFile,
-} from './utils/parseConfig';
-
-async function main() {
-  const args = process.argv.slice(2);
-  let serviceKeyPath: string | undefined;
-  let inputEnvPath: string | undefined;
-  let outputEnvPath: string | undefined;
-  let scope: string | undefined;
-
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === '--service-key' && args[i + 1]) {
-      serviceKeyPath = args[++i];
-    } else if (arg === '--input-env' && args[i + 1]) {
-      inputEnvPath = args[++i];
-    } else if (arg === '--output-env' && args[i + 1]) {
-      outputEnvPath = args[++i];
-    } else if (arg === '--scope' && args[i + 1]) {
-      scope = args[++i];
-    } else if (arg === '--help' || arg === '-h') {
-      console.log(`
-Usage: auth-device-flow [options]
-
-Options:
-  --service-key <path>    Path to service key JSON file
-  --input-env <path>      Path to .env file for reading existing tokens (for refresh)
-  --output-env <path>     Path to .env file for saving tokens
-  --scope <scope>         Optional scope (space-separated)
-  --help, -h              Show this help message
-      `);
-      process.exit(0);
-    }
-  }
-
-  if (!serviceKeyPath && !inputEnvPath) {
-    console.error('❌ Error: Either --service-key or --input-env must be provided');
-    process.exit(1);
-  }
-
-  if (!outputEnvPath) {
-    console.error('❌ Error: --output-env is required to save tokens');
-    process.exit(1);
-  }
-
-  try {
-    // Read config from service key or input env
-    const serviceKey = serviceKeyPath ? parseServiceKey(serviceKeyPath) : undefined;
-    const inputEnv = inputEnvPath ? parseEnvFile(inputEnvPath) : undefined;
-    const { uaaUrl, clientId, clientSecret } = getUaaCredentials(serviceKey, inputEnv);
-
-    // Read existing tokens from input env if provided
-    const existingAccessToken = inputEnv?.AUTHORIZATION_TOKEN;
-    const existingRefreshToken = inputEnv?.REFRESH_TOKEN;
-
-    const provider = new DeviceFlowProvider({
-      uaaUrl,
-      clientId,
-      clientSecret,
-      scope,
-      accessToken: existingAccessToken,
-      refreshToken: existingRefreshToken,
-    });
-
-    console.log('🔐 Getting tokens using Device Flow...');
-    if (serviceKeyPath) {
-      console.log(`📁 Service Key: ${serviceKeyPath}`);
-    }
-    if (inputEnvPath) {
-      console.log(`📁 Input Env: ${inputEnvPath}`);
-    }
-    console.log(`💾 Output Env: ${outputEnvPath}\n`);
-
-    const result = await provider.getTokens();
-
-    // Save tokens to output env file
-    writeEnvFile(outputEnvPath, {
-      authorizationToken: result.authorizationToken,
-      refreshToken: result.refreshToken,
-      uaaUrl,
-      clientId,
-      clientSecret,
-    });
-
-    console.log('✅ Tokens obtained and saved successfully!');
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-    console.log(`🔑 Authorization Token: ${result.authorizationToken.substring(0, 50)}...`);
-    if (result.refreshToken) {
-      console.log(`🔄 Refresh Token: ${result.refreshToken.substring(0, 50)}...`);
-    }
-    console.log(`📋 Auth Type: ${result.authType}`);
-    if (result.expiresIn) {
-      console.log(`⏰ Expires In: ${result.expiresIn} seconds`);
-    }
-    console.log(`💾 Saved to: ${outputEnvPath}`);
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-  } catch (error) {
-    console.error('❌ Error:', error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  }
-}
-
-main();
-

package/dist/auth/deviceFlowAuth.d.ts

@@ -1,43 +0,0 @@
-/**
- * Device Flow authentication
- *
- * OAuth2 Device Flow for devices without browser or input capabilities.
- * User authorizes on another device by entering a code.
- */
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-export interface DeviceFlowResult {
-    deviceCode: string;
-    userCode: string;
-    verificationUri: string;
-    verificationUriComplete?: string;
-    expiresIn: number;
-    interval?: number;
-}
-export interface DeviceFlowTokens {
-    accessToken: string;
-    refreshToken?: string;
-    expiresIn?: number;
-}
-/**
- * Initiate device flow - get device code and user code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param scope Optional scope (space-separated)
- * @param logger Optional logger
- * @returns Promise that resolves to device flow result
- * @internal - Internal function, not exported from package
- */
-export declare function initiateDeviceFlow(uaaUrl: string, clientId: string, scope?: string, logger?: ILogger): Promise<DeviceFlowResult>;
-/**
- * Poll for tokens using device code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param clientSecret Client secret (optional for public clients)
- * @param deviceCode Device code from initiateDeviceFlow
- * @param interval Polling interval in seconds
- * @param logger Optional logger
- * @returns Promise that resolves to tokens
- * @internal - Internal function, not exported from package
- */
-export declare function pollForDeviceTokens(uaaUrl: string, clientId: string, clientSecret: string | undefined, deviceCode: string, interval?: number, logger?: ILogger): Promise<DeviceFlowTokens>;
-//# sourceMappingURL=deviceFlowAuth.d.ts.map

package/dist/auth/deviceFlowAuth.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"deviceFlowAuth.d.ts","sourceRoot":"","sources":["../../src/auth/deviceFlowAuth.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;;GAQG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,KAAK,CAAC,EAAE,MAAM,EACd,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CA4D3B;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,UAAU,EAAE,MAAM,EAClB,QAAQ,GAAE,MAAU,EACpB,MAAM,CAAC,EAAE,OAAO,GACf,OAAO,CAAC,gBAAgB,CAAC,CAoG3B"}

package/dist/auth/deviceFlowAuth.js

@@ -1,168 +0,0 @@
-"use strict";
-/**
- * Device Flow authentication
- *
- * OAuth2 Device Flow for devices without browser or input capabilities.
- * User authorizes on another device by entering a code.
- */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.initiateDeviceFlow = initiateDeviceFlow;
-exports.pollForDeviceTokens = pollForDeviceTokens;
-const axios_1 = __importDefault(require("axios"));
-/**
- * Initiate device flow - get device code and user code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param scope Optional scope (space-separated)
- * @param logger Optional logger
- * @returns Promise that resolves to device flow result
- * @internal - Internal function, not exported from package
- */
-async function initiateDeviceFlow(uaaUrl, clientId, scope, logger) {
-    try {
-        const deviceUrl = `${uaaUrl}/oauth/device_authorization`;
-        const params = new URLSearchParams();
-        params.append('client_id', clientId);
-        if (scope) {
-            params.append('scope', scope);
-        }
-        logger?.info(`Initiating device flow: ${deviceUrl}`);
-        const response = await (0, axios_1.default)({
-            method: 'post',
-            url: deviceUrl,
-            headers: {
-                'Content-Type': 'application/x-www-form-urlencoded',
-            },
-            data: params.toString(),
-            timeout: 30000,
-        });
-        if (response.data?.device_code &&
-            response.data?.user_code &&
-            response.data?.verification_uri) {
-            return {
-                deviceCode: response.data.device_code,
-                userCode: response.data.user_code,
-                verificationUri: response.data.verification_uri,
-                verificationUriComplete: response.data.verification_uri_complete,
-                expiresIn: response.data.expires_in || 1800, // Default 30 minutes
-                interval: response.data.interval || 5, // Default 5 seconds
-            };
-        }
-        else {
-            throw new Error('Response does not contain required device flow fields');
-        }
-    }
-    catch (error) {
-        if (error &&
-            typeof error === 'object' &&
-            'response' in error &&
-            error.response &&
-            typeof error.response === 'object' &&
-            'status' in error.response &&
-            'data' in error.response) {
-            const axiosError = error;
-            throw new Error(`Device flow initiation failed (${axiosError.response.status}): ${JSON.stringify(axiosError.response.data)}`);
-        }
-        else {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            throw new Error(`Device flow initiation failed: ${errorMessage}`);
-        }
-    }
-}
-/**
- * Poll for tokens using device code
- * @param uaaUrl UAA URL
- * @param clientId Client ID
- * @param clientSecret Client secret (optional for public clients)
- * @param deviceCode Device code from initiateDeviceFlow
- * @param interval Polling interval in seconds
- * @param logger Optional logger
- * @returns Promise that resolves to tokens
- * @internal - Internal function, not exported from package
- */
-async function pollForDeviceTokens(uaaUrl, clientId, clientSecret, deviceCode, interval = 5, logger) {
-    const tokenUrl = `${uaaUrl}/oauth/token`;
-    const params = new URLSearchParams();
-    params.append('grant_type', 'urn:ietf:params:oauth:grant-type:device_code');
-    params.append('device_code', deviceCode);
-    params.append('client_id', clientId);
-    const headers = {
-        'Content-Type': 'application/x-www-form-urlencoded',
-    };
-    // Add client secret if provided (for confidential clients)
-    if (clientSecret) {
-        const authString = Buffer.from(`${clientId}:${clientSecret}`).toString('base64');
-        headers.Authorization = `Basic ${authString}`;
-    }
-    // Poll until authorization is complete or expires
-    const maxAttempts = 120; // 10 minutes max (120 * 5 seconds)
-    let attempts = 0;
-    while (attempts < maxAttempts) {
-        try {
-            logger?.debug(`Polling for device tokens (attempt ${attempts + 1})`);
-            const response = await (0, axios_1.default)({
-                method: 'post',
-                url: tokenUrl,
-                headers,
-                data: params.toString(),
-                timeout: 30000,
-            });
-            if (response.data?.access_token) {
-                logger?.info('Device flow authorization successful');
-                return {
-                    accessToken: response.data.access_token,
-                    refreshToken: response.data.refresh_token,
-                    expiresIn: response.data.expires_in,
-                };
-            }
-            else {
-                throw new Error('Response does not contain access_token');
-            }
-        }
-        catch (error) {
-            // Check if it's an "authorization_pending" error (expected during polling)
-            if (error &&
-                typeof error === 'object' &&
-                'response' in error &&
-                error.response &&
-                typeof error.response === 'object' &&
-                'status' in error.response &&
-                'data' in error.response) {
-                const axiosError = error;
-                if (axiosError.response.data?.error === 'authorization_pending') {
-                    // Still waiting for user authorization - continue polling
-                    attempts++;
-                    if (attempts >= maxAttempts) {
-                        throw new Error('Device flow authorization timeout - user did not authorize in time');
-                    }
-                    // Wait for interval before next poll
-                    await new Promise((resolve) => setTimeout(resolve, interval * 1000));
-                    continue;
-                }
-                else if (axiosError.response.data?.error === 'slow_down') {
-                    // Server requests slower polling - increase interval by 5 seconds
-                    interval += 5;
-                    attempts++;
-                    if (attempts >= maxAttempts) {
-                        throw new Error('Device flow authorization timeout - user did not authorize in time');
-                    }
-                    await new Promise((resolve) => setTimeout(resolve, interval * 1000));
-                    continue;
-                }
-                else if (axiosError.response.data?.error === 'expired_token') {
-                    throw new Error('Device code expired - please restart device flow');
-                }
-                else if (axiosError.response.data?.error === 'access_denied') {
-                    throw new Error('User denied device authorization');
-                }
-            }
-            // Other error - rethrow
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            throw new Error(`Device flow polling failed: ${errorMessage}`);
-        }
-    }
-    throw new Error('Device flow authorization timeout - maximum polling attempts reached');
-}

package/dist/providers/DeviceFlowProvider.d.ts

@@ -1,32 +0,0 @@
-/**
- * Device Flow Token Provider
- *
- * Uses OAuth2 Device Flow for devices without browser or input capabilities.
- * User authorizes on another device by entering a code.
- */
-import type { ITokenResult, OAuth2GrantType } from '@mcp-abap-adt/interfaces-auth';
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-import { BaseTokenProvider } from './BaseTokenProvider';
-export interface DeviceFlowProviderConfig {
-    uaaUrl: string;
-    clientId: string;
-    clientSecret?: string;
-    scope?: string;
-    accessToken?: string;
-    refreshToken?: string;
-    logger?: ILogger;
-}
-/**
- * Device Flow token provider
- *
- * Uses OAuth2 Device Flow - user authorizes on another device.
- * Supports refresh token if provided by server.
- */
-export declare class DeviceFlowProvider extends BaseTokenProvider {
-    private config;
-    constructor(config: DeviceFlowProviderConfig);
-    protected getAuthType(): OAuth2GrantType;
-    protected performLogin(): Promise<ITokenResult>;
-    protected performRefresh(): Promise<ITokenResult>;
-}
-//# sourceMappingURL=DeviceFlowProvider.d.ts.map