@mcp-abap-adt/auth-providers 3.0.0 → 4.1.0

package/dist/validation/signedNode.d.ts

@@ -0,0 +1,54 @@
+/**
+ * Which element the signature covers.
+ *
+ * Not "is there a valid signature" — that question has a true answer in a
+ * document built for a wrapping attack, where a genuinely signed fragment sits
+ * beside a forged one. The caller must read the element this returns and no
+ * other.
+ */
+import type { Document, Element } from '@xmldom/xmldom';
+/**
+ * PEM in, PEM out; bare base64 DER gets its armour — and the result is proved
+ * to be a certificate before anything uses it.
+ *
+ * The spec promises `idpCertificates` accepts either, and a consumer copying
+ * `<X509Certificate>` out of identity-provider metadata has bare base64 DER in
+ * their hand — the armour is not in the metadata. `xml-crypto` accepts only
+ * PEM or a Buffer: measured, a bare base64 certificate makes OpenSSL throw
+ * `DECODER routines::unsupported`, while the same bytes re-armoured verify.
+ *
+ * Left unnormalised that throw would be swallowed by the verification loop and
+ * reported as "the signature does not verify against any configured
+ * certificate" — blaming the assertion for the consumer's formatting.
+ *
+ * Base64 syntax alone does not make a string a certificate: `"AAAA"` passes
+ * the character class, armours cleanly, and fails only inside OpenSSL, which
+ * lands back at the same misleading message. So the armoured result is parsed
+ * with `node:crypto`'s `X509Certificate`, which rejects `"AAAA"` with
+ * `asn1 encoding routines::wrong tag` — measured, not assumed. Called once per
+ * certificate at construction, so the cost never falls on a login.
+ */
+export declare function toPem(certificate: string): string;
+/**
+ * Quotes a value from the document, or a message quoting one, before
+ * interpolating it into a refusal: JSON-quoted, so a newline smuggled in as
+ * `&#10;` shows as `\n` rather than forging a line in a log, and cut to 64
+ * characters, so an attacker cannot fill a log with it.
+ */
+export declare function quoteUntrusted(value: string): string;
+/**
+ * Verifies every signature in the document against the certificates and
+ * returns the elements they reference. Throws when there is no signature, or
+ * when any one of them fails a rule below.
+ *
+ * `doc` must be the parse of `xml`, and nothing else: signatures are found and
+ * their references resolved in `doc`, while `xml-crypto` verifies the digests
+ * over `xml`. Handed a `doc` from different bytes, the element returned would
+ * not be the one whose bytes were verified.
+ *
+ * Several signatures are normal — identity providers often sign the Response
+ * and the Assertion both. Each is held to every rule on its own; the caller
+ * then takes the element it requires from the returned list.
+ */
+export declare function resolveSignedElements(xml: string, doc: Document, certificates: readonly string[]): Element[];
+//# sourceMappingURL=signedNode.d.ts.map

package/dist/validation/signedNode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signedNode.d.ts","sourceRoot":"","sources":["../../src/validation/signedNode.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAmB,MAAM,gBAAgB,CAAC;AAKzE;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,KAAK,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAuBjD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,QAAQ,EACb,YAAY,EAAE,SAAS,MAAM,EAAE,GAC9B,OAAO,EAAE,CAeX"}

package/dist/validation/signedNode.js

@@ -0,0 +1,182 @@
+"use strict";
+/**
+ * Which element the signature covers.
+ *
+ * Not "is there a valid signature" — that question has a true answer in a
+ * document built for a wrapping attack, where a genuinely signed fragment sits
+ * beside a forged one. The caller must read the element this returns and no
+ * other.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.toPem = toPem;
+exports.quoteUntrusted = quoteUntrusted;
+exports.resolveSignedElements = resolveSignedElements;
+const node_crypto_1 = require("node:crypto");
+const xml_crypto_1 = require("xml-crypto");
+const DSIG_NS = 'http://www.w3.org/2000/09/xmldsig#';
+/**
+ * PEM in, PEM out; bare base64 DER gets its armour — and the result is proved
+ * to be a certificate before anything uses it.
+ *
+ * The spec promises `idpCertificates` accepts either, and a consumer copying
+ * `<X509Certificate>` out of identity-provider metadata has bare base64 DER in
+ * their hand — the armour is not in the metadata. `xml-crypto` accepts only
+ * PEM or a Buffer: measured, a bare base64 certificate makes OpenSSL throw
+ * `DECODER routines::unsupported`, while the same bytes re-armoured verify.
+ *
+ * Left unnormalised that throw would be swallowed by the verification loop and
+ * reported as "the signature does not verify against any configured
+ * certificate" — blaming the assertion for the consumer's formatting.
+ *
+ * Base64 syntax alone does not make a string a certificate: `"AAAA"` passes
+ * the character class, armours cleanly, and fails only inside OpenSSL, which
+ * lands back at the same misleading message. So the armoured result is parsed
+ * with `node:crypto`'s `X509Certificate`, which rejects `"AAAA"` with
+ * `asn1 encoding routines::wrong tag` — measured, not assumed. Called once per
+ * certificate at construction, so the cost never falls on a login.
+ */
+function toPem(certificate) {
+    const trimmed = certificate.trim();
+    const pem = trimmed.includes('-----BEGIN')
+        ? trimmed
+        : (() => {
+            const body = trimmed.replace(/\s+/g, '');
+            if (!/^[A-Za-z0-9+/]+={0,2}$/.test(body)) {
+                throw new Error('a configured certificate is neither PEM nor base64 DER');
+            }
+            const wrapped = body.replace(/(.{64})/g, '$1\n').trim();
+            return `-----BEGIN CERTIFICATE-----\n${wrapped}\n-----END CERTIFICATE-----\n`;
+        })();
+    try {
+        new node_crypto_1.X509Certificate(pem);
+    }
+    catch (error) {
+        throw new Error(`a configured certificate is not a valid X.509 certificate: ${error.message}`);
+    }
+    return pem;
+}
+/**
+ * Quotes a value from the document, or a message quoting one, before
+ * interpolating it into a refusal: JSON-quoted, so a newline smuggled in as
+ * `&#10;` shows as `\n` rather than forging a line in a log, and cut to 64
+ * characters, so an attacker cannot fill a log with it.
+ */
+function quoteUntrusted(value) {
+    const limit = 64;
+    return JSON.stringify(value.length > limit ? `${value.slice(0, limit)}…` : value);
+}
+/**
+ * Verifies every signature in the document against the certificates and
+ * returns the elements they reference. Throws when there is no signature, or
+ * when any one of them fails a rule below.
+ *
+ * `doc` must be the parse of `xml`, and nothing else: signatures are found and
+ * their references resolved in `doc`, while `xml-crypto` verifies the digests
+ * over `xml`. Handed a `doc` from different bytes, the element returned would
+ * not be the one whose bytes were verified.
+ *
+ * Several signatures are normal — identity providers often sign the Response
+ * and the Assertion both. Each is held to every rule on its own; the caller
+ * then takes the element it requires from the returned list.
+ */
+function resolveSignedElements(xml, doc, certificates) {
+    const signatures = doc.getElementsByTagNameNS(DSIG_NS, 'Signature');
+    if (signatures.length === 0) {
+        throw new Error('the document carries no signature');
+    }
+    // Every signature is held to every rule: an extra signature that fails is
+    // something that should not be there, not noise to skip. Two verifying
+    // signatures over one element cannot occur — under the enveloped-signature
+    // transform the later one changes the bytes the earlier one's digest
+    // covered — so no separate rule guards against it.
+    const covered = [];
+    for (let i = 0; i < signatures.length; i++) {
+        covered.push(resolveOne(xml, doc, signatures[i], certificates));
+    }
+    return covered;
+}
+/** One signature: verified, exactly one reference, enveloped by its target. */
+function resolveOne(xml, doc, signatureNode, certificates) {
+    let verified = false;
+    for (const certificate of certificates) {
+        // Already normalised and proved at construction, so a throw here really
+        // is a bad signature rather than a formatting mistake.
+        // getCertFromKeyInfo is pinned to "none": a certificate the document
+        // carries in its own KeyInfo is the sender's claim about who signed it,
+        // and xml-crypto prefers it to publicCert when the hook returns one. It
+        // defaults to a no-op in 6.x; stating it keeps a future default from
+        // quietly letting an attacker's embedded certificate verify their own
+        // signature.
+        const verifier = new xml_crypto_1.SignedXml({
+            publicCert: certificate,
+            getCertFromKeyInfo: () => null,
+        });
+        // loadSignature throws for a malformed Signature, and xml-crypto's
+        // message embeds the offending element: document text, so quoted.
+        try {
+            verifier.loadSignature(signatureNode);
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            throw new Error(`the signature element is malformed: ${quoteUntrusted(message)}`);
+        }
+        try {
+            // Returns false for a digest mismatch and throws when the signature
+            // value itself fails. Both mean "not this certificate".
+            if (verifier.checkSignature(xml)) {
+                verified = true;
+                break;
+            }
+        }
+        catch {
+            // Try the next certificate in the rotation list.
+        }
+    }
+    if (!verified) {
+        throw new Error('the signature does not verify against any configured certificate');
+    }
+    // The signature is valid; now find what it actually covers. Exactly one
+    // reference: two would be two candidate answers to "what is signed", the
+    // ambiguity this module exists to remove.
+    const references = signatureNode.getElementsByTagNameNS(DSIG_NS, 'Reference');
+    if (references.length === 0) {
+        throw new Error('the signature carries no ds:Reference');
+    }
+    if (references.length > 1) {
+        throw new Error(`the signature carries ${references.length} ds:Reference; exactly one is allowed`);
+    }
+    const uri = references[0].getAttribute('URI') ?? '';
+    let referenced = null;
+    if (uri === '') {
+        // An empty URI signs the whole document. It must still satisfy the
+        // enveloping rule below — returning early here is exactly how a detached
+        // signature with an empty reference walks straight past that rule.
+        referenced = doc.documentElement;
+    }
+    else if (!uri.startsWith('#')) {
+        throw new Error(`the signature reference is not a same-document URI: ${quoteUntrusted(uri)}`);
+    }
+    else {
+        const id = uri.slice(1);
+        const elements = doc.getElementsByTagName('*');
+        for (let i = 0; i < elements.length; i++) {
+            if (elements[i].getAttribute('ID') === id) {
+                referenced = elements[i];
+                break;
+            }
+        }
+    }
+    if (!referenced) {
+        throw new Error(`the signature references ${quoteUntrusted(uri)}, which is not in the document`);
+    }
+    // The enveloped signature must sit inside the element it references. A
+    // signature moved elsewhere stays cryptographically valid over the bytes it
+    // covers, so the maths alone will not catch it — this comparison is what
+    // does. It is the check @node-saml/node-saml makes, and the one whose
+    // absence made every response @mcp-abap-adt/auth-mocks produced
+    // unacceptable to a real library until it was fixed there.
+    if (signatureNode.parentNode !== referenced) {
+        throw new Error('the signature is not inside the element it references, so it does not envelope it');
+    }
+    return referenced;
+}

package/dist/validation/xsdDateTime.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Parsing an `xsd:dateTime` strictly enough to trust the result.
+ *
+ * `Date.parse` is not this. It normalises `2026-02-30` into 2 March instead of
+ * rejecting it, and it will read a timezone offset no calendar has. Both traps
+ * were found in `@mcp-abap-adt/auth-mocks` and fixed there the same way: match
+ * the lexical shape, then require every component to survive a round trip. The
+ * instant is computed from the components rather than handed back to `Date`,
+ * whose handling of invalid strings is implementation-defined.
+ *
+ * Deliberately not implemented: negative (BCE) years, the `24:00:00`
+ * end-of-day form, and leap seconds. No identity provider in this family emits
+ * them, and pretending to cover them would be worse than saying so.
+ */
+/** Returns the instant, or null when the value is not a valid xsd:dateTime. */
+export declare function parseXsdDateTime(value: string | null | undefined): Date | null;
+//# sourceMappingURL=xsdDateTime.d.ts.map

package/dist/validation/xsdDateTime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"xsdDateTime.d.ts","sourceRoot":"","sources":["../../src/validation/xsdDateTime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAKH,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,IAAI,GAAG,IAAI,CAkDb"}

package/dist/validation/xsdDateTime.js

@@ -0,0 +1,67 @@
+"use strict";
+/**
+ * Parsing an `xsd:dateTime` strictly enough to trust the result.
+ *
+ * `Date.parse` is not this. It normalises `2026-02-30` into 2 March instead of
+ * rejecting it, and it will read a timezone offset no calendar has. Both traps
+ * were found in `@mcp-abap-adt/auth-mocks` and fixed there the same way: match
+ * the lexical shape, then require every component to survive a round trip. The
+ * instant is computed from the components rather than handed back to `Date`,
+ * whose handling of invalid strings is implementation-defined.
+ *
+ * Deliberately not implemented: negative (BCE) years, the `24:00:00`
+ * end-of-day form, and leap seconds. No identity provider in this family emits
+ * them, and pretending to cover them would be worse than saying so.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseXsdDateTime = parseXsdDateTime;
+const SHAPE = /^(\d{4})-(\d{2})-(\d{2})T(\d{2}):(\d{2}):(\d{2})(\.\d+)?(Z|[+-]\d{2}:\d{2})$/;
+/** Returns the instant, or null when the value is not a valid xsd:dateTime. */
+function parseXsdDateTime(value) {
+    if (!value)
+        return null;
+    const m = SHAPE.exec(value);
+    if (!m)
+        return null;
+    const [, y, mo, d, h, mi, s, fraction, zone] = m;
+    const year = Number(y);
+    const month = Number(mo);
+    const day = Number(d);
+    const hour = Number(h);
+    const minute = Number(mi);
+    const second = Number(s);
+    if (month < 1 || month > 12)
+        return null;
+    if (hour > 23 || minute > 59 || second > 59)
+        return null;
+    // The calendar round trip. Date.UTC rolls 2026-02-30 into 2026-03-02, so a
+    // component that comes back changed means the date does not exist.
+    const utc = new Date(Date.UTC(year, month - 1, day, hour, minute, second));
+    if (utc.getUTCFullYear() !== year ||
+        utc.getUTCMonth() !== month - 1 ||
+        utc.getUTCDate() !== day) {
+        return null;
+    }
+    // Milliseconds from the fraction: pad to 3 digits and truncate extras.
+    // Avoid floating-point multiplication: 0.57 * 1000 = 569.99999….
+    const ms = fraction
+        ? Number(fraction.slice(1).padEnd(3, '0').slice(0, 3))
+        : 0;
+    // Offset in milliseconds. For zone Z it is 0. Otherwise apply the sign.
+    let offsetMs = 0;
+    if (zone !== 'Z') {
+        const offsetHour = Number(zone.slice(1, 3));
+        const offsetMinute = Number(zone.slice(4, 6));
+        // xsd:dateTime bounds the offset at ±14:00, and exactly 14 allows no
+        // minutes. Both halves matter: +15:00 fails the first, +14:01 the second.
+        if (offsetHour > 14 || offsetMinute > 59)
+            return null;
+        if (offsetHour === 14 && offsetMinute !== 0)
+            return null;
+        const sign = zone[0] === '-' ? -1 : 1;
+        offsetMs = sign * (offsetHour * 60 + offsetMinute) * 60_000;
+    }
+    // The instant is UTC time + milliseconds - offset, because local time = UTC + offset.
+    const instant = utc.getTime() + ms - offsetMs;
+    return new Date(instant);
+}

package/package.json

@@ -1,12 +1,11 @@
 {
   "name": "@mcp-abap-adt/auth-providers",
-  "version": "3.0.0",
+  "version": "4.1.0",
   "description": "Token providers for MCP ABAP ADT auth-broker",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [
     "dist",
-    "bin",
     "README.md",
     "CHANGELOG.md",
     "LICENSE",
@@ -38,10 +37,6 @@
   "publishConfig": {
     "access": "public"
   },
-  "bin": {
-    "auth-authorization-code": "./bin/auth-authorization-code.ts",
-    "auth-client-credentials": "./bin/auth-client-credentials.ts"
-  },
   "scripts": {
     "chrono": "./tools/version-stats.sh",
     "clean": "rm -rf dist tsconfig.tsbuildinfo",
@@ -62,13 +57,14 @@
     "node": "^22 || ^24"
   },
   "dependencies": {
-    "@mcp-abap-adt/interfaces-auth": "^1.2.0",
-    "@mcp-abap-adt/interfaces-auth-sap": "^1.0.0",
+    "@mcp-abap-adt/interfaces-auth": "^2.0.1",
+    "@mcp-abap-adt/interfaces-auth-sap": "^1.0.1",
     "@mcp-abap-adt/interfaces-utils": "^1.1.0",
     "@xmldom/xmldom": "^0.9.12",
     "axios": "^1.13.5",
     "express": "^5.1.0",
-    "open": "^11.0.0"
+    "open": "^11.0.0",
+    "xml-crypto": "^6.1.2"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.3.14",
@@ -86,7 +82,6 @@
     "pino": "^10.3.1",
     "pino-pretty": "^13.1.3",
     "ts-jest": "^29.2.5",
-    "tsx": "^4.19.2",
     "typescript": "^5.9.2"
   }
 }

package/bin/auth-authorization-code.ts

@@ -1,147 +0,0 @@
-#!/usr/bin/env tsx
-/**
- * Authorization Code Provider Test Command
- *
- * Gets tokens using authorization_code grant type
- */
-
-import {
-  ABAP_AUTHORIZATION_VARS,
-  ABAP_CONNECTION_VARS,
-} from '@mcp-abap-adt/auth-stores';
-import { AuthorizationCodeProvider } from '../src/providers/AuthorizationCodeProvider';
-import { browserCallbackStrategy } from '../src/strategies';
-import {
-  getUaaCredentials,
-  parseEnvFile,
-  parseServiceKey,
-  writeEnvFile,
-} from './utils/parseConfig';
-
-async function main() {
-  const args = process.argv.slice(2);
-  let serviceKeyPath: string | undefined;
-  let inputEnvPath: string | undefined;
-  let outputEnvPath: string | undefined;
-  let browser: string = 'none';
-  let port: number = 3001;
-  let authorizationUrl: string | undefined;
-
-  // Parse arguments
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === '--service-key' && args[i + 1]) {
-      serviceKeyPath = args[++i];
-    } else if (arg === '--input-env' && args[i + 1]) {
-      inputEnvPath = args[++i];
-    } else if (arg === '--output-env' && args[i + 1]) {
-      outputEnvPath = args[++i];
-    } else if (arg === '--browser' && args[i + 1]) {
-      browser = args[++i];
-    } else if (arg === '--port' && args[i + 1]) {
-      port = parseInt(args[++i], 10);
-    } else if (arg === '--auth-url' && args[i + 1]) {
-      authorizationUrl = args[++i];
-    } else if (arg === '--help' || arg === '-h') {
-      console.log(`
-Usage: auth-authorization-code [options]
-
-Options:
-  --service-key <path>    Path to service key JSON file
-  --input-env <path>      Path to .env file for reading existing tokens (for refresh)
-  --output-env <path>     Path to .env file for saving tokens (required)
-  --browser <type>        Browser type (auto, system, chrome, none) [default: none]
-  --port <number>         Callback server port [default: 3001]
-  --auth-url <url>        Pre-built authorization URL
-  --help, -h              Show this help message
-
-Example:
-  auth-authorization-code --service-key ./service-key.json --output-env ./tokens.env --browser auto
-  auth-authorization-code --input-env ./tokens.env --output-env ./tokens.env --browser none
-      `);
-      process.exit(0);
-    }
-  }
-
-  if (!serviceKeyPath && !inputEnvPath) {
-    console.error('❌ Error: Either --service-key or --input-env must be provided');
-    process.exit(1);
-  }
-
-  if (!outputEnvPath) {
-    console.error('❌ Error: --output-env is required to save tokens');
-    process.exit(1);
-  }
-
-  try {
-    // Parse config
-    const serviceKey = serviceKeyPath ? parseServiceKey(serviceKeyPath) : undefined;
-    const inputEnv = inputEnvPath ? parseEnvFile(inputEnvPath) : undefined;
-    const { uaaUrl, clientId, clientSecret } = getUaaCredentials(serviceKey, inputEnv);
-
-    // Read existing tokens from input env if provided (use constants, fallback to legacy)
-    const existingRefreshToken =
-      inputEnv?.[ABAP_AUTHORIZATION_VARS.REFRESH_TOKEN] ||
-      inputEnv?.REFRESH_TOKEN;
-
-    // Build authorization URL if not provided
-    if (!authorizationUrl) {
-      const redirectUri = `http://localhost:${port}/callback`;
-      authorizationUrl = `${uaaUrl}/oauth/authorize?client_id=${encodeURIComponent(clientId)}&redirect_uri=${encodeURIComponent(redirectUri)}&response_type=code`;
-    }
-
-    // Create provider. `--port` now reaches the strategy that binds the socket;
-    // it must stay the port baked into the authorization URL above, or the
-    // provider rejects the mismatch before opening anything.
-    const provider = new AuthorizationCodeProvider({
-      authorizationUrl,
-      uaaUrl,
-      clientId,
-      clientSecret,
-      authorization: browserCallbackStrategy({ browser, port }),
-      refreshToken: existingRefreshToken,
-    });
-
-    console.log('🔐 Getting tokens using Authorization Code flow...');
-    if (serviceKeyPath) {
-      console.log(`📁 Service Key: ${serviceKeyPath}`);
-    }
-    if (inputEnvPath) {
-      console.log(`📁 Input Env: ${inputEnvPath}`);
-    }
-    console.log(`💾 Output Env: ${outputEnvPath}`);
-    console.log(`🌐 Browser: ${browser}`);
-    console.log(`🔗 Authorization URL: ${authorizationUrl}\n`);
-
-    // Get tokens
-    const result = await provider.getTokens();
-
-    // Save tokens to output env file
-    writeEnvFile(outputEnvPath, {
-      authorizationToken: result.authorizationToken,
-      refreshToken: result.refreshToken,
-      uaaUrl,
-      clientId,
-      clientSecret,
-    });
-
-    console.log('✅ Tokens obtained and saved successfully!');
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-    console.log(`🔑 Authorization Token: ${result.authorizationToken.substring(0, 50)}...`);
-    if (result.refreshToken) {
-      console.log(`🔄 Refresh Token: ${result.refreshToken.substring(0, 50)}...`);
-    }
-    console.log(`📋 Auth Type: ${result.authType}`);
-    if (result.expiresIn) {
-      console.log(`⏰ Expires In: ${result.expiresIn} seconds`);
-    }
-    console.log(`💾 Saved to: ${outputEnvPath}`);
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-  } catch (error) {
-    console.error('❌ Error:', error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  }
-}
-
-main();
-

package/bin/auth-client-credentials.ts

@@ -1,109 +0,0 @@
-#!/usr/bin/env tsx
-/**
- * Client Credentials Provider Test Command
- *
- * Gets tokens using client_credentials grant type
- */
-
-import { ClientCredentialsProvider } from '../src/providers/ClientCredentialsProvider';
-import {
-  getUaaCredentials,
-  parseEnvFile,
-  parseServiceKey,
-  writeEnvFile,
-} from './utils/parseConfig';
-
-async function main() {
-  const args = process.argv.slice(2);
-  let serviceKeyPath: string | undefined;
-  let inputEnvPath: string | undefined;
-  let outputEnvPath: string | undefined;
-
-  // Parse arguments
-  for (let i = 0; i < args.length; i++) {
-    const arg = args[i];
-    if (arg === '--service-key' && args[i + 1]) {
-      serviceKeyPath = args[++i];
-    } else if (arg === '--input-env' && args[i + 1]) {
-      inputEnvPath = args[++i];
-    } else if (arg === '--output-env' && args[i + 1]) {
-      outputEnvPath = args[++i];
-    } else if (arg === '--help' || arg === '-h') {
-      console.log(`
-Usage: auth-client-credentials [options]
-
-Options:
-  --service-key <path>    Path to service key JSON file
-  --input-env <path>      Path to .env file for reading credentials
-  --output-env <path>     Path to .env file for saving tokens (required)
-  --help, -h              Show this help message
-
-Example:
-  auth-client-credentials --service-key ./service-key.json --output-env ./tokens.env
-  auth-client-credentials --input-env ./tokens.env --output-env ./tokens.env
-      `);
-      process.exit(0);
-    }
-  }
-
-  if (!serviceKeyPath && !inputEnvPath) {
-    console.error('❌ Error: Either --service-key or --input-env must be provided');
-    process.exit(1);
-  }
-
-  if (!outputEnvPath) {
-    console.error('❌ Error: --output-env is required to save tokens');
-    process.exit(1);
-  }
-
-  try {
-    // Parse config
-    const serviceKey = serviceKeyPath ? parseServiceKey(serviceKeyPath) : undefined;
-    const inputEnv = inputEnvPath ? parseEnvFile(inputEnvPath) : undefined;
-    const { uaaUrl, clientId, clientSecret } = getUaaCredentials(serviceKey, inputEnv);
-
-    // Create provider
-    const provider = new ClientCredentialsProvider({
-      uaaUrl,
-      clientId,
-      clientSecret,
-    });
-
-    console.log('🔐 Getting tokens using Client Credentials flow...');
-    if (serviceKeyPath) {
-      console.log(`📁 Service Key: ${serviceKeyPath}`);
-    }
-    if (inputEnvPath) {
-      console.log(`📁 Input Env: ${inputEnvPath}`);
-    }
-    console.log(`💾 Output Env: ${outputEnvPath}\n`);
-
-    // Get tokens
-    const result = await provider.getTokens();
-
-    // Save tokens to output env file
-    writeEnvFile(outputEnvPath, {
-      authorizationToken: result.authorizationToken,
-      refreshToken: result.refreshToken,
-      uaaUrl,
-      clientId,
-      clientSecret,
-    });
-
-    console.log('✅ Tokens obtained and saved successfully!');
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-    console.log(`🔑 Authorization Token: ${result.authorizationToken.substring(0, 50)}...`);
-    console.log(`📋 Auth Type: ${result.authType}`);
-    if (result.expiresIn) {
-      console.log(`⏰ Expires In: ${result.expiresIn} seconds`);
-    }
-    console.log(`💾 Saved to: ${outputEnvPath}`);
-    console.log('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━');
-  } catch (error) {
-    console.error('❌ Error:', error instanceof Error ? error.message : String(error));
-    process.exit(1);
-  }
-}
-
-main();
-