@mcp-abap-adt/auth-providers 4.0.0 → 4.1.2

package/dist/__tests__/helpers/configHelpers.js

@@ -1,232 +0,0 @@
-"use strict";
-/**
- * Configuration helpers for auth-providers tests
- * Loads test configuration from test-config.yaml
- */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.loadTestConfig = loadTestConfig;
-exports.hasRealConfigValue = hasRealConfigValue;
-exports.getDestination = getDestination;
-exports.getServiceKeysDir = getServiceKeysDir;
-exports.getSessionsDir = getSessionsDir;
-exports.getServiceKeyPath = getServiceKeyPath;
-exports.getSessionPath = getSessionPath;
-exports.getAbapDestination = getAbapDestination;
-exports.hasRealConfig = hasRealConfig;
-const fs = __importStar(require("node:fs"));
-const path = __importStar(require("node:path"));
-const yaml = __importStar(require("js-yaml"));
-let cachedConfig = null;
-/**
- * Find project root directory by looking for package.json
- */
-function findProjectRoot() {
-    let currentDir = __dirname;
-    while (currentDir !== path.dirname(currentDir)) {
-        const packageJsonPath = path.join(currentDir, 'package.json');
-        if (fs.existsSync(packageJsonPath)) {
-            return currentDir;
-        }
-        currentDir = path.dirname(currentDir);
-    }
-    // Fallback to process.cwd() if package.json not found
-    return process.cwd();
-}
-/**
- * Load test configuration from YAML
- * Uses test-config.yaml from tests/ directory
- */
-function loadTestConfig() {
-    if (cachedConfig) {
-        return cachedConfig;
-    }
-    // Find project root and load from tests/test-config.yaml
-    const projectRoot = findProjectRoot();
-    const configPath = path.resolve(projectRoot, 'tests', 'test-config.yaml');
-    const templatePath = path.resolve(projectRoot, 'tests', 'test-config.yaml.template');
-    if (process.env.TEST_VERBOSE) {
-        console.log(`[configHelpers] Project root: ${projectRoot}`);
-        console.log(`[configHelpers] Config path: ${configPath}`);
-        console.log(`[configHelpers] Config exists: ${fs.existsSync(configPath)}`);
-    }
-    if (fs.existsSync(configPath)) {
-        try {
-            const configContent = fs.readFileSync(configPath, 'utf8');
-            cachedConfig = yaml.load(configContent) || {};
-            if (process.env.TEST_VERBOSE) {
-                console.log(`[configHelpers] Loaded config:`, JSON.stringify(cachedConfig, null, 2));
-            }
-            return cachedConfig;
-        }
-        catch (error) {
-            console.warn(`Failed to load test config from ${configPath}:`, error);
-            return {};
-        }
-    }
-    if (fs.existsSync(templatePath)) {
-        console.warn('⚠️  tests/test-config.yaml not found. Using template (all integration tests will be disabled).');
-        try {
-            const templateContent = fs.readFileSync(templatePath, 'utf8');
-            cachedConfig = yaml.load(templateContent) || {};
-            return cachedConfig;
-        }
-        catch (error) {
-            console.warn(`Failed to load test config template from ${templatePath}:`, error);
-            return {};
-        }
-    }
-    console.warn('⚠️  Test configuration files not found.');
-    console.warn('Please create tests/test-config.yaml with test parameters.');
-    return {};
-}
-/**
- * Check if test config has real values (not placeholders)
- */
-function hasRealConfigValue(config) {
-    const cfg = config || loadTestConfig();
-    if (!cfg.destination) {
-        return false;
-    }
-    // Check if destination is not a placeholder
-    return !cfg.destination.includes('<') && !cfg.destination.includes('>');
-}
-/**
- * Get destination from config
- */
-function getDestination(config) {
-    const cfg = config || loadTestConfig();
-    return cfg.destination || null;
-}
-/**
- * Get default destination directory based on platform
- */
-function getDefaultDestinationDir() {
-    const homeDir = process.env.HOME || process.env.USERPROFILE || '';
-    if (process.platform === 'win32') {
-        return path.join(homeDir, 'Documents', 'mcp-abap-adt');
-    }
-    return path.join(homeDir, '.config', 'mcp-abap-adt');
-}
-/**
- * Get destination directory from config or use default
- */
-function getDestinationDir(config) {
-    const cfg = config || loadTestConfig();
-    if (cfg.destination_dir) {
-        // Expand ~ to home directory
-        if (cfg.destination_dir.startsWith('~')) {
-            const homeDir = process.env.HOME || process.env.USERPROFILE || '';
-            return cfg.destination_dir.replace('~', homeDir);
-        }
-        return cfg.destination_dir;
-    }
-    return getDefaultDestinationDir();
-}
-/**
- * Get service keys directory from config
- * Uses base_dir/service-keys or default platform path
- */
-function getServiceKeysDir(config) {
-    const cfg = config || loadTestConfig();
-    // If service_key_path is specified, return its directory
-    if (cfg.service_key_path) {
-        const projectRoot = findProjectRoot();
-        const fullPath = path.resolve(projectRoot, cfg.service_key_path);
-        return path.dirname(fullPath);
-    }
-    // Use destination_dir/service-keys
-    const destinationDir = getDestinationDir(cfg);
-    return path.join(destinationDir, 'service-keys');
-}
-/**
- * Get sessions directory from config
- * Uses base_dir/sessions or default platform path
- */
-function getSessionsDir(config) {
-    const cfg = config || loadTestConfig();
-    // If session_path is specified, return its directory
-    if (cfg.session_path) {
-        const projectRoot = findProjectRoot();
-        const fullPath = path.resolve(projectRoot, cfg.session_path);
-        return path.dirname(fullPath);
-    }
-    // Use destination_dir/sessions
-    const destinationDir = getDestinationDir(cfg);
-    return path.join(destinationDir, 'sessions');
-}
-/**
- * Get service key file path
- * Returns full path to service key file
- */
-function getServiceKeyPath(config) {
-    const cfg = config || loadTestConfig();
-    const destination = cfg.destination;
-    if (!destination)
-        return null;
-    // If service_key_path is specified, use it
-    if (cfg.service_key_path) {
-        const projectRoot = findProjectRoot();
-        return path.resolve(projectRoot, cfg.service_key_path);
-    }
-    // Construct from directory + destination
-    const serviceKeysDir = getServiceKeysDir(cfg);
-    return path.join(serviceKeysDir, `${destination}.json`);
-}
-/**
- * Get session file path
- * Returns full path to session file
- */
-function getSessionPath(config) {
-    const cfg = config || loadTestConfig();
-    const destination = cfg.destination;
-    if (!destination)
-        return null;
-    // If session_path is specified, use it
-    if (cfg.session_path) {
-        const projectRoot = findProjectRoot();
-        return path.resolve(projectRoot, cfg.session_path);
-    }
-    // Construct from directory + destination
-    const sessionsDir = getSessionsDir(cfg);
-    return path.join(sessionsDir, `${destination}.env`);
-}
-// Legacy functions for backward compatibility
-function getAbapDestination(config) {
-    return getDestination(config);
-}
-function hasRealConfig(config, _section) {
-    return hasRealConfigValue(config);
-}

package/dist/__tests__/helpers/netHelpers.d.ts

@@ -1,19 +0,0 @@
-export declare function getAvailablePort(): Promise<number>;
-export declare function canListenOnLocalhost(): Promise<boolean>;
-/**
- * Whether a login in this test could own `port` — and therefore whether
- * asserting that it released the port means anything.
- *
- * A release assertion is a claim about our own cleanup. When an unrelated
- * process already holds the port, the login fails at the probe, never binds
- * anything, and cannot release anything: the port is still held afterwards,
- * the code is behaving exactly as it should, and the assertion fails anyway.
- * That is a test reporting on what else is running on the machine.
- *
- * So the gate is placed *before* the login rather than the assertion being
- * widened until it always passes — a `toBe(true)` relaxed into "free or held"
- * would also pass when our own cleanup leaked, which is the one thing these
- * cases exist to catch.
- */
-export declare function canOwnPort(port: number, context: string): Promise<boolean>;
-//# sourceMappingURL=netHelpers.d.ts.map

package/dist/__tests__/helpers/netHelpers.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"netHelpers.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/netHelpers.ts"],"names":[],"mappings":"AAEA,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,CAcxD;AAED,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,OAAO,CAAC,CAQ7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,OAAO,CAAC,CAclB"}

package/dist/__tests__/helpers/netHelpers.js

@@ -1,92 +0,0 @@
-"use strict";
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.getAvailablePort = getAvailablePort;
-exports.canListenOnLocalhost = canListenOnLocalhost;
-exports.canOwnPort = canOwnPort;
-const net = __importStar(require("node:net"));
-async function getAvailablePort() {
-    return new Promise((resolve, reject) => {
-        const server = net.createServer();
-        server.once('error', reject);
-        server.listen(0, '127.0.0.1', () => {
-            const address = server.address();
-            if (typeof address === 'object' && address?.port) {
-                const port = address.port;
-                server.close(() => resolve(port));
-            }
-            else {
-                server.close(() => reject(new Error('Failed to acquire a port')));
-            }
-        });
-    });
-}
-async function canListenOnLocalhost() {
-    return new Promise((resolve) => {
-        const server = net.createServer();
-        server.once('error', () => resolve(false));
-        server.listen(0, '127.0.0.1', () => {
-            server.close(() => resolve(true));
-        });
-    });
-}
-/**
- * Whether a login in this test could own `port` — and therefore whether
- * asserting that it released the port means anything.
- *
- * A release assertion is a claim about our own cleanup. When an unrelated
- * process already holds the port, the login fails at the probe, never binds
- * anything, and cannot release anything: the port is still held afterwards,
- * the code is behaving exactly as it should, and the assertion fails anyway.
- * That is a test reporting on what else is running on the machine.
- *
- * So the gate is placed *before* the login rather than the assertion being
- * widened until it always passes — a `toBe(true)` relaxed into "free or held"
- * would also pass when our own cleanup leaked, which is the one thing these
- * cases exist to catch.
- */
-async function canOwnPort(port, context) {
-    const free = await new Promise((resolve) => {
-        const probe = net.createServer();
-        probe.once('error', () => resolve(false));
-        probe.listen(port, () => probe.close(() => resolve(true)));
-    });
-    if (!free) {
-        console.warn(`⚠️  Port ${port} is held by another process — skipping the port-release ` +
-            `assertions in "${context}". A login that never bound the socket cannot ` +
-            'release it; the remaining assertions in this case still run.');
-    }
-    return free;
-}

package/dist/__tests__/helpers/testLogger.d.ts

@@ -1,7 +0,0 @@
-/**
- * Test logger with environment variable control
- * Uses DefaultLogger from @mcp-abap-adt/logger for proper formatting
- */
-import type { ILogger } from '@mcp-abap-adt/interfaces-utils';
-export declare function createTestLogger(prefix?: string): ILogger;
-//# sourceMappingURL=testLogger.d.ts.map

package/dist/__tests__/helpers/testLogger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"testLogger.d.ts","sourceRoot":"","sources":["../../../src/__tests__/helpers/testLogger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,gCAAgC,CAAC;AAG9D,wBAAgB,gBAAgB,CAAC,MAAM,GAAE,MAAe,GAAG,OAAO,CAwCjE"}

package/dist/__tests__/helpers/testLogger.js

@@ -1,45 +0,0 @@
-"use strict";
-/**
- * Test logger with environment variable control
- * Uses DefaultLogger from @mcp-abap-adt/logger for proper formatting
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.createTestLogger = createTestLogger;
-const logger_1 = require("@mcp-abap-adt/logger");
-function createTestLogger(prefix = 'TEST') {
-    // Check if logging is enabled
-    const isEnabled = () => {
-        return (process.env.DEBUG_PROVIDER === 'true' ||
-            process.env.DEBUG_AUTH_PROVIDERS === 'true' ||
-            process.env.DEBUG_BROWSER_AUTH === 'true' ||
-            process.env.DEBUG === 'true' ||
-            process.env.DEBUG?.includes('provider') === true ||
-            process.env.DEBUG?.includes('auth-providers') === true);
-    };
-    // Create DefaultLogger with appropriate log level
-    // getLogLevel respects AUTH_LOG_LEVEL env var and defaults to INFO
-    const baseLogger = new logger_1.DefaultLogger((0, logger_1.getLogLevel)());
-    // Return wrapper that checks if logging is enabled
-    return {
-        debug: (message, meta) => {
-            if (isEnabled()) {
-                baseLogger.debug(`[${prefix}] ${message}`, meta);
-            }
-        },
-        info: (message, meta) => {
-            if (isEnabled()) {
-                baseLogger.info(`[${prefix}] ${message}`, meta);
-            }
-        },
-        warn: (message, meta) => {
-            if (isEnabled()) {
-                baseLogger.warn(`[${prefix}] ${message}`, meta);
-            }
-        },
-        error: (message, meta) => {
-            if (isEnabled()) {
-                baseLogger.error(`[${prefix}] ${message}`, meta);
-            }
-        },
-    };
-}

package/dist/__tests__/integration/stand/formLogin.d.ts

@@ -1,68 +0,0 @@
-/**
- * Plays the user in an interactive login against a stand server's own login
- * page: follows redirects, keeps cookies, finds the form with a password
- * field, fills it in with every hidden field it carries (UAA's CSRF token,
- * Keycloak's session code), and submits it.
- *
- * Deliberately small: enough for UAA's and Keycloak's stock login pages, which
- * the pinned image versions keep stable. It is a test helper, not a browser.
- */
-export interface Credentials {
-    username: string;
-    password: string;
-}
-export declare class FormBrowser {
-    private readonly cookies;
-    /** GET `url` and follow redirects until `stop(url)` or a page is served. */
-    open(url: string, stop?: (next: string) => boolean): Promise<{
-        url: string;
-        html?: string;
-    }>;
-    /**
-     * Submit the login form on `page`, then follow redirects until `stop` says
-     * the next location is the one the caller wants — typically the client's
-     * redirect URI carrying the code — without requesting it.
-     */
-    submitLogin(page: {
-        url: string;
-        html?: string;
-    }, credentials: Credentials, stop?: (next: string) => boolean): Promise<{
-        url: string;
-        html?: string;
-    }>;
-    /**
-     * Accept a consent page ("Do you grant these access privileges?"): submit
-     * the form that carries an `accept` button, with its hidden fields.
-     */
-    acceptConsent(page: {
-        url: string;
-        html?: string;
-    }): Promise<{
-        url: string;
-        html?: string;
-    }>;
-    private follow;
-    private remember;
-    private cookieHeader;
-}
-/**
- * Log in through the authorization URL and return the redirect URI the server
- * sends the browser back to, with its `code` — not requested, since nothing
- * listens there.
- */
-export declare function authorizeByForm(authorizationUrl: string, redirectUri: string, credentials: Credentials): Promise<URL>;
-/**
- * Approve a device authorization the way a user would: open the verification
- * URI (with the user code already in it), log in, and grant access.
- */
-export declare function approveDevice(verificationUriComplete: string, credentials: Credentials): Promise<void>;
-/**
- * A SAML login at an identity provider: open the AuthnRequest URL, log in,
- * and take the SAMLResponse from the auto-posting form the IdP answers with —
- * what a browser would post to the assertion consumer service.
- */
-export declare function samlResponseByForm(authnRequestUrl: string, credentials: Credentials): Promise<{
-    samlResponse: string;
-    acsUrl: string;
-}>;
-//# sourceMappingURL=formLogin.d.ts.map

package/dist/__tests__/integration/stand/formLogin.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"formLogin.d.ts","sourceRoot":"","sources":["../../../../src/__tests__/integration/stand/formLogin.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,4EAA4E;IACtE,IAAI,CACR,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAqB,GAC5C,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAI1C;;;;OAIG;IACG,WAAW,CACf,IAAI,EAAE;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EACpC,WAAW,EAAE,WAAW,EACxB,IAAI,GAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAqB,GAC5C,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAmB1C;;;OAGG;IACG,aAAa,CAAC,IAAI,EAAE;QACxB,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,CAAC,EAAE,MAAM,CAAC;KACf,GAAG,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;YAgC7B,MAAM;IA4BpB,OAAO,CAAC,QAAQ;IAUhB,OAAO,CAAC,YAAY;CAGrB;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CACnC,gBAAgB,EAAE,MAAM,EACxB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,GAAG,CAAC,CAcd;AAED;;;GAGG;AACH,wBAAsB,aAAa,CACjC,uBAAuB,EAAE,MAAM,EAC/B,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CACtC,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,WAAW,GACvB,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAgBnD"}

package/dist/__tests__/integration/stand/formLogin.js

@@ -1,194 +0,0 @@
-"use strict";
-/**
- * Plays the user in an interactive login against a stand server's own login
- * page: follows redirects, keeps cookies, finds the form with a password
- * field, fills it in with every hidden field it carries (UAA's CSRF token,
- * Keycloak's session code), and submits it.
- *
- * Deliberately small: enough for UAA's and Keycloak's stock login pages, which
- * the pinned image versions keep stable. It is a test helper, not a browser.
- */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.FormBrowser = void 0;
-exports.authorizeByForm = authorizeByForm;
-exports.approveDevice = approveDevice;
-exports.samlResponseByForm = samlResponseByForm;
-const MAX_HOPS = 20;
-class FormBrowser {
-    cookies = new Map();
-    /** GET `url` and follow redirects until `stop(url)` or a page is served. */
-    async open(url, stop = () => false) {
-        return this.follow(url, { method: 'GET' }, stop);
-    }
-    /**
-     * Submit the login form on `page`, then follow redirects until `stop` says
-     * the next location is the one the caller wants — typically the client's
-     * redirect URI carrying the code — without requesting it.
-     */
-    async submitLogin(page, credentials, stop = () => false) {
-        const form = findPasswordForm(page.html ?? '');
-        if (!form) {
-            throw new Error(`no login form on ${page.url}`);
-        }
-        const body = new URLSearchParams(form.hidden);
-        body.set(form.userField, credentials.username);
-        body.set(form.passwordField, credentials.password);
-        return this.follow(new URL(form.action, page.url).toString(), {
-            method: 'POST',
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-            body: body.toString(),
-        }, stop);
-    }
-    /**
-     * Accept a consent page ("Do you grant these access privileges?"): submit
-     * the form that carries an `accept` button, with its hidden fields.
-     */
-    async acceptConsent(page) {
-        for (const match of (page.html ?? '').matchAll(/<form\b[^>]*>[\s\S]*?<\/form>/gi)) {
-            const formHtml = match[0];
-            const inputs = [...formHtml.matchAll(/<(?:input|button)\b[^>]*>/gi)].map((m) => m[0]);
-            const accept = inputs.find((i) => attribute(i, 'name') === 'accept');
-            if (!accept)
-                continue;
-            const body = new URLSearchParams();
-            for (const input of inputs) {
-                const name = attribute(input, 'name');
-                if (name && attribute(input, 'type') === 'hidden') {
-                    body.set(name, attribute(input, 'value') ?? '');
-                }
-            }
-            body.set('accept', attribute(accept, 'value') ?? 'Yes');
-            const formTag = /<form\b[^>]*>/i.exec(formHtml)?.[0] ?? '';
-            return this.follow(new URL(attribute(formTag, 'action') ?? '', page.url).toString(), {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-                body: body.toString(),
-            }, () => false);
-        }
-        throw new Error(`no consent form on ${page.url}`);
-    }
-    async follow(url, init, stop) {
-        let current = url;
-        let request = init;
-        for (let hop = 0; hop < MAX_HOPS; hop++) {
-            const response = await fetch(current, {
-                ...request,
-                redirect: 'manual',
-                headers: { ...(request.headers ?? {}), Cookie: this.cookieHeader() },
-                signal: AbortSignal.timeout(15_000),
-            });
-            this.remember(response);
-            const location = response.headers.get('location');
-            if (response.status >= 300 && response.status < 400 && location) {
-                const next = new URL(location, current).toString();
-                if (stop(next))
-                    return { url: next };
-                current = next;
-                request = { method: 'GET' };
-                continue;
-            }
-            return { url: current, html: await response.text() };
-        }
-        throw new Error(`more than ${MAX_HOPS} redirects from ${url}`);
-    }
-    remember(response) {
-        for (const line of response.headers.getSetCookie()) {
-            const [pair] = line.split(';');
-            const eq = pair.indexOf('=');
-            if (eq > 0) {
-                this.cookies.set(pair.slice(0, eq).trim(), pair.slice(eq + 1).trim());
-            }
-        }
-    }
-    cookieHeader() {
-        return [...this.cookies].map(([k, v]) => `${k}=${v}`).join('; ');
-    }
-}
-exports.FormBrowser = FormBrowser;
-/**
- * Log in through the authorization URL and return the redirect URI the server
- * sends the browser back to, with its `code` — not requested, since nothing
- * listens there.
- */
-async function authorizeByForm(authorizationUrl, redirectUri, credentials) {
-    const reached = (next) => next.startsWith(redirectUri);
-    const browser = new FormBrowser();
-    const page = await browser.open(authorizationUrl, reached);
-    const done = page.html === undefined
-        ? page
-        : await browser.submitLogin(page, credentials, reached);
-    if (!reached(done.url)) {
-        throw new Error(`login did not return to ${redirectUri}; ended at ${done.url}`);
-    }
-    return new URL(done.url);
-}
-/**
- * Approve a device authorization the way a user would: open the verification
- * URI (with the user code already in it), log in, and grant access.
- */
-async function approveDevice(verificationUriComplete, credentials) {
-    const browser = new FormBrowser();
-    const page = await browser.open(verificationUriComplete);
-    const consent = await browser.submitLogin(page, credentials);
-    await browser.acceptConsent(consent);
-}
-/**
- * A SAML login at an identity provider: open the AuthnRequest URL, log in,
- * and take the SAMLResponse from the auto-posting form the IdP answers with —
- * what a browser would post to the assertion consumer service.
- */
-async function samlResponseByForm(authnRequestUrl, credentials) {
-    const browser = new FormBrowser();
-    const page = await browser.submitLogin(await browser.open(authnRequestUrl), credentials);
-    const html = page.html ?? '';
-    const input = [...html.matchAll(/<input\b[^>]*>/gi)]
-        .map((m) => m[0])
-        .find((i) => attribute(i, 'name') === 'SAMLResponse');
-    const samlResponse = input ? attribute(input, 'value') : undefined;
-    const formTag = /<form\b[^>]*>/i.exec(html)?.[0] ?? '';
-    if (!samlResponse) {
-        throw new Error(`no SAMLResponse form on ${page.url}`);
-    }
-    return { samlResponse, acsUrl: attribute(formTag, 'action') ?? '' };
-}
-const decode = (value) => value
-    .replace(/&amp;/g, '&')
-    .replace(/&quot;/g, '"')
-    .replace(/&#39;/g, "'")
-    .replace(/&lt;/g, '<')
-    .replace(/&gt;/g, '>');
-const attribute = (tag, name) => {
-    const match = new RegExp(`\\s${name}\\s*=\\s*("([^"]*)"|'([^']*)')`, 'i').exec(tag);
-    return match ? decode(match[2] ?? match[3] ?? '') : undefined;
-};
-function findPasswordForm(html) {
-    for (const match of html.matchAll(/<form\b[^>]*>[\s\S]*?<\/form>/gi)) {
-        const formHtml = match[0];
-        const inputs = [...formHtml.matchAll(/<input\b[^>]*>/gi)].map((m) => m[0]);
-        const password = inputs.find((i) => attribute(i, 'type') === 'password');
-        if (!password)
-            continue;
-        const hidden = {};
-        let userField = 'username';
-        for (const input of inputs) {
-            const type = (attribute(input, 'type') ?? 'text').toLowerCase();
-            const name = attribute(input, 'name');
-            if (!name)
-                continue;
-            if (type === 'hidden')
-                hidden[name] = attribute(input, 'value') ?? '';
-            if ((type === 'text' || type === 'email') &&
-                /user|email|login/i.test(name)) {
-                userField = name;
-            }
-        }
-        const formTag = /<form\b[^>]*>/i.exec(formHtml)?.[0] ?? '';
-        return {
-            action: attribute(formTag, 'action') ?? '',
-            userField,
-            passwordField: attribute(password, 'name') ?? 'password',
-            hidden,
-        };
-    }
-    return undefined;
-}