@mcp-abap-adt/auth-stores 0.2.0 → 0.2.3

package/CHANGELOG.md

@@ -7,6 +7,42 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.2.3] - 2025-12-16
+
+### Changed
+- Dependency bump: `@mcp-abap-adt/interfaces` to `^0.1.17` for basic auth support
+
+### Added
+- **Basic Authentication Support for On-Premise Systems**: Added support for basic auth (username/password) in addition to JWT tokens
+  - **envLoader.ts**: Now loads `SAP_USERNAME` and `SAP_PASSWORD` from `.env` files
+    - Automatically detects auth type: if username/password present and no JWT token, uses basic auth
+    - If JWT token present, uses JWT auth
+  - **AbapSessionStore.getConnectionConfig()**: Returns basic auth config when username/password are present
+    - Returns `IConnectionConfig` with `username`, `password`, and `authType: 'basic'` for on-premise systems
+    - Returns `IConnectionConfig` with `authorizationToken` and `authType: 'jwt'` for cloud systems
+  - **tokenStorage.ts**: Now saves `SAP_USERNAME` and `SAP_PASSWORD` to `.env` files
+    - Handles both JWT and basic auth configurations
+    - Clears username/password when JWT auth is used, and vice versa
+  - **constants.ts**: Added `USERNAME: 'SAP_USERNAME'` and `PASSWORD: 'SAP_PASSWORD'` to `ABAP_CONNECTION_VARS`
+  - This enables on-premise systems to use `--mcp` parameter with basic auth instead of requiring JWT tokens
+
+## [0.2.2] - 2025-12-13
+
+### Changed
+- Dependency bump: `@mcp-abap-adt/interfaces` to `^0.1.16` for alignment with latest interfaces docs
+
+## [0.2.1] - 2025-12-12
+
+### Changed
+
+- **Import Organization**: Reorganized imports across storage modules for consistency
+  - Moved `ILogger` type import after standard library imports (`fs`, `path`, `dotenv`)
+  - Affected files: `envLoader.ts`, `tokenStorage.ts`, `xsuaaEnvLoader.ts`, `xsuaaTokenStorage.ts`
+
+### Fixed
+
+- **testLogger.ts**: Removed unused `ILogger` import
+
 ## [0.2.0] - 2025-12-08
 
 ### Breaking Changes

package/dist/storage/abap/envLoader.d.ts

@@ -5,7 +5,10 @@ import type { ILogger } from '@mcp-abap-adt/interfaces';
 interface EnvConfig {
     sapUrl: string;
     sapClient?: string;
-    jwtToken: string;
+    jwtToken?: string;
+    username?: string;
+    password?: string;
+    authType?: 'basic' | 'jwt';
     refreshToken?: string;
     uaaUrl?: string;
     uaaClientId?: string;

package/dist/storage/abap/envLoader.js

@@ -65,16 +65,38 @@ async function loadEnvFile(destination, directory, log) {
         // Extract required fields
         const sapUrl = parsed[constants_1.ABAP_CONNECTION_VARS.SERVICE_URL];
         const jwtToken = parsed[constants_1.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN];
-        log?.debug(`Extracted fields: hasSapUrl(${!!sapUrl}), hasJwtToken(${jwtToken !== undefined && jwtToken !== null})`);
-        // sapUrl is required, jwtToken can be empty string (for authorization-only sessions)
-        if (!sapUrl || jwtToken === undefined || jwtToken === null) {
-            log?.warn(`Env file missing required fields: sapUrl(${!!sapUrl}), jwtToken(${jwtToken !== undefined && jwtToken !== null})`);
+        const username = parsed[constants_1.ABAP_CONNECTION_VARS.USERNAME];
+        const password = parsed[constants_1.ABAP_CONNECTION_VARS.PASSWORD];
+        log?.debug(`Extracted fields: hasSapUrl(${!!sapUrl}), hasJwtToken(${jwtToken !== undefined && jwtToken !== null}), hasUsername(${!!username}), hasPassword(${!!password})`);
+        // sapUrl is always required
+        if (!sapUrl) {
+            log?.warn(`Env file missing required field: sapUrl`);
             return null;
         }
+        // Determine auth type: if username/password present and no jwtToken, use basic auth
+        // If jwtToken present, use JWT auth
+        // If neither is present, it's OK - auth can be set later (e.g., via setAuthorizationConfig)
+        const isBasicAuth = !!(username && password) && (!jwtToken || jwtToken.trim() === '');
+        const isJwtAuth = !!(jwtToken && jwtToken.trim() !== '');
+        const hasNoAuth = !isBasicAuth && !isJwtAuth;
         const config = {
             sapUrl: sapUrl.trim(),
-            jwtToken: jwtToken.trim(), // Can be empty string for authorization-only sessions
         };
+        // Set authentication fields based on type
+        if (isBasicAuth) {
+            config.username = username.trim();
+            config.password = password.trim();
+            config.authType = 'basic';
+        }
+        else if (isJwtAuth) {
+            config.jwtToken = jwtToken.trim();
+            config.authType = 'jwt';
+        }
+        else {
+            // No auth yet - will be set later (e.g., via setAuthorizationConfig)
+            config.jwtToken = jwtToken || '';
+            config.authType = undefined;
+        }
         // Optional fields
         if (parsed[constants_1.ABAP_CONNECTION_VARS.SAP_CLIENT]) {
             config.sapClient = parsed[constants_1.ABAP_CONNECTION_VARS.SAP_CLIENT].trim();
@@ -94,7 +116,11 @@ async function loadEnvFile(destination, directory, log) {
         if (parsed[constants_1.ABAP_CONNECTION_VARS.SAP_LANGUAGE]) {
             config.language = parsed[constants_1.ABAP_CONNECTION_VARS.SAP_LANGUAGE].trim();
         }
-        log?.info(`Env config loaded from ${envFilePath}: sapUrl(${config.sapUrl.substring(0, 50)}...), token(${config.jwtToken.length} chars), hasRefreshToken(${!!config.refreshToken}), hasUaaUrl(${!!config.uaaUrl})`);
+        const tokenLength = config.jwtToken?.length || 0;
+        const authInfo = config.authType === 'basic'
+            ? `basic auth (username: ${config.username})`
+            : `JWT token(${tokenLength} chars)`;
+        log?.info(`Env config loaded from ${envFilePath}: sapUrl(${config.sapUrl.substring(0, 50)}...), ${authInfo}, hasRefreshToken(${!!config.refreshToken}), hasUaaUrl(${!!config.uaaUrl})`);
         return config;
     }
     catch (error) {

package/dist/storage/abap/tokenStorage.d.ts

@@ -5,7 +5,10 @@ import type { ILogger } from '@mcp-abap-adt/interfaces';
 interface EnvConfig {
     sapUrl: string;
     sapClient?: string;
-    jwtToken: string;
+    jwtToken?: string;
+    username?: string;
+    password?: string;
+    authType?: 'basic' | 'jwt';
     refreshToken?: string;
     uaaUrl?: string;
     uaaClientId?: string;
@@ -20,7 +23,7 @@ interface EnvConfig {
  * @param log Optional logger for logging operations
  */
 export declare function saveTokenToEnv(destination: string, savePath: string, config: Partial<EnvConfig> & {
-    sapUrl?: string;
-    jwtToken: string;
+    sapUrl: string;
+    jwtToken?: string;
 }, log?: ILogger): Promise<void>;
 export {};

package/dist/storage/abap/tokenStorage.js

@@ -51,7 +51,9 @@ async function saveTokenToEnv(destination, savePath, config, log) {
     const envFilePath = path.join(savePath, `${destination}.env`);
     const tempFilePath = `${envFilePath}.tmp`;
     log?.debug(`Saving token to env file: ${envFilePath}`);
-    log?.debug(`Config to save: hasSapUrl(${!!config.sapUrl}), token(${config.jwtToken.length} chars), hasRefreshToken(${!!config.refreshToken}), hasUaaUrl(${!!config.uaaUrl})`);
+    const tokenLength = config.jwtToken?.length || 0;
+    const hasBasicAuth = !!(config.username && config.password);
+    log?.debug(`Config to save: hasSapUrl(${!!config.sapUrl}), token(${tokenLength} chars), hasBasicAuth(${hasBasicAuth}), hasRefreshToken(${!!config.refreshToken}), hasUaaUrl(${!!config.uaaUrl})`);
     // Ensure directory exists
     if (!fs.existsSync(savePath)) {
         log?.debug(`Creating directory: ${savePath}`);
@@ -83,10 +85,25 @@ async function saveTokenToEnv(destination, savePath, config, log) {
     }
     log?.debug(`Preserved ${existingVars.size} existing variables from env file`);
     // Update with new values
-    if (config.sapUrl) {
-        existingVars.set(constants_1.ABAP_CONNECTION_VARS.SERVICE_URL, config.sapUrl);
+    // sapUrl is required - always save it
+    existingVars.set(constants_1.ABAP_CONNECTION_VARS.SERVICE_URL, config.sapUrl);
+    // Handle authentication: JWT or basic auth
+    if (config.username && config.password) {
+        // Basic auth - save username/password
+        existingVars.set(constants_1.ABAP_CONNECTION_VARS.USERNAME, config.username);
+        existingVars.set(constants_1.ABAP_CONNECTION_VARS.PASSWORD, config.password);
+        // Clear JWT token if basic auth is used
+        if (config.jwtToken) {
+            existingVars.set(constants_1.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN, '');
+        }
+    }
+    else if (config.jwtToken) {
+        // JWT auth - save token
+        existingVars.set(constants_1.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN, config.jwtToken);
+        // Clear username/password if JWT auth is used
+        existingVars.delete(constants_1.ABAP_CONNECTION_VARS.USERNAME);
+        existingVars.delete(constants_1.ABAP_CONNECTION_VARS.PASSWORD);
     }
-    existingVars.set(constants_1.ABAP_CONNECTION_VARS.AUTHORIZATION_TOKEN, config.jwtToken);
     if (config.sapClient) {
         existingVars.set(constants_1.ABAP_CONNECTION_VARS.SAP_CLIENT, config.sapClient);
     }
@@ -120,5 +137,8 @@ async function saveTokenToEnv(destination, savePath, config, log) {
     fs.writeFileSync(tempFilePath, envContent, 'utf8');
     // Atomic rename
     fs.renameSync(tempFilePath, envFilePath);
-    log?.info(`Token saved to ${envFilePath}: token(${config.jwtToken.length} chars), sapUrl(${config.sapUrl ? config.sapUrl.substring(0, 50) + '...' : 'none'}), variables(${envLines.length})`);
+    const authInfo = hasBasicAuth
+        ? `basic auth (username: ${config.username})`
+        : `JWT token(${tokenLength} chars)`;
+    log?.info(`Token saved to ${envFilePath}: ${authInfo}, sapUrl(${config.sapUrl ? config.sapUrl.substring(0, 50) + '...' : 'none'}), variables(${envLines.length})`);
 }

package/dist/stores/abap/AbapSessionStore.js

@@ -94,9 +94,8 @@ class AbapSessionStore {
     convertToInternalFormat(config) {
         const obj = config;
         // Convert IConfig format (serviceUrl, authorizationToken) to internal format (sapUrl, jwtToken)
-        return {
+        const result = {
             sapUrl: (obj.serviceUrl || obj.sapUrl),
-            jwtToken: (obj.authorizationToken || obj.jwtToken || ''), // Ensure jwtToken is always a string
             refreshToken: obj.refreshToken,
             uaaUrl: obj.uaaUrl,
             uaaClientId: obj.uaaClientId,
@@ -104,6 +103,20 @@ class AbapSessionStore {
             sapClient: obj.sapClient,
             language: obj.language,
         };
+        // Handle authentication: JWT or basic auth
+        if (obj.username && obj.password) {
+            // Basic auth
+            result.username = obj.username;
+            result.password = obj.password;
+            result.authType = 'basic';
+            result.jwtToken = obj.authorizationToken || obj.jwtToken || '';
+        }
+        else {
+            // JWT auth
+            result.jwtToken = (obj.authorizationToken || obj.jwtToken || '');
+            result.authType = 'jwt';
+        }
+        return result;
     }
     /**
      * Save session to ENV file
@@ -125,6 +138,9 @@ class AbapSessionStore {
         await (0, tokenStorage_1.saveTokenToEnv)(destination, savePath, {
             sapUrl: abapConfig.sapUrl,
             jwtToken: abapConfig.jwtToken,
+            username: abapConfig.username,
+            password: abapConfig.password,
+            authType: abapConfig.authType,
             refreshToken: abapConfig.refreshToken,
             uaaUrl: abapConfig.uaaUrl,
             uaaClientId: abapConfig.uaaClientId,
@@ -193,6 +209,16 @@ class AbapSessionStore {
         if (rawSession.jwtToken !== undefined) {
             result.authorizationToken = rawSession.jwtToken;
         }
+        // Basic auth fields (if present)
+        if (rawSession.username) {
+            result.username = rawSession.username;
+        }
+        if (rawSession.password) {
+            result.password = rawSession.password;
+        }
+        if (rawSession.authType) {
+            result.authType = rawSession.authType;
+        }
         if (rawSession.sapClient) {
             result.sapClient = rawSession.sapClient;
         }
@@ -230,7 +256,7 @@ class AbapSessionStore {
         try {
             const raw = await this.loadFromFile(sessionPath);
             if (!raw || !isEnvConfig(raw)) {
-                this.log?.debug(`Invalid session format for ${destination}: missing required fields (sapUrl, jwtToken)`);
+                this.log?.debug(`Invalid session format for ${destination}: missing required field (sapUrl)`);
                 return null;
             }
             return raw;
@@ -276,14 +302,38 @@ class AbapSessionStore {
             this.log?.debug(`Connection config not found for ${destination}`);
             return null;
         }
-        if (!sessionConfig.jwtToken || !sessionConfig.sapUrl) {
-            this.log?.warn(`Connection config for ${destination} missing required fields: jwtToken(${!!sessionConfig.jwtToken}), sapUrl(${!!sessionConfig.sapUrl})`);
+        if (!sessionConfig.sapUrl) {
+            this.log?.warn(`Connection config for ${destination} missing required field: sapUrl`);
             return null;
         }
-        this.log?.debug(`Connection config loaded for ${destination}: token(${sessionConfig.jwtToken.length} chars), sapUrl(${sessionConfig.sapUrl.substring(0, 40)}...)`);
+        // Check for basic auth: if username/password present and no jwtToken, use basic auth
+        const isBasicAuth = sessionConfig.authType === 'basic' ||
+            (!sessionConfig.jwtToken && sessionConfig.username && sessionConfig.password);
+        if (isBasicAuth) {
+            if (!sessionConfig.username || !sessionConfig.password) {
+                this.log?.warn(`Connection config for ${destination} missing required fields for basic auth: username(${!!sessionConfig.username}), password(${!!sessionConfig.password})`);
+                return null;
+            }
+            this.log?.debug(`Connection config loaded for ${destination} (basic auth): username(${sessionConfig.username}), sapUrl(${sessionConfig.sapUrl.substring(0, 40)}...)`);
+            return {
+                serviceUrl: sessionConfig.sapUrl,
+                username: sessionConfig.username,
+                password: sessionConfig.password,
+                authType: 'basic',
+                sapClient: sessionConfig.sapClient,
+                language: sessionConfig.language,
+            };
+        }
+        // JWT auth: check jwtToken
+        if (!sessionConfig.jwtToken) {
+            this.log?.warn(`Connection config for ${destination} missing required field for JWT auth: jwtToken`);
+            return null;
+        }
+        this.log?.debug(`Connection config loaded for ${destination} (JWT auth): token(${sessionConfig.jwtToken.length} chars), sapUrl(${sessionConfig.sapUrl.substring(0, 40)}...)`);
         return {
             serviceUrl: sessionConfig.sapUrl,
             authorizationToken: sessionConfig.jwtToken,
+            authType: 'jwt',
             sapClient: sessionConfig.sapClient,
             language: sessionConfig.language,
         };
@@ -298,10 +348,27 @@ class AbapSessionStore {
     async setAuthorizationConfig(destination, config) {
         const current = await this.loadRawSession(destination);
         if (!current) {
-            // Session doesn't exist - try to get serviceUrl from connection config or use defaultServiceUrl
+            // Session doesn't exist - try to get serviceUrl from existing session file or use defaultServiceUrl
             // For ABAP, we need sapUrl to create session
-            const connConfig = await this.getConnectionConfig(destination);
-            const sapUrl = connConfig?.serviceUrl || this.defaultServiceUrl;
+            let sapUrl = this.defaultServiceUrl;
+            let existingAuthToken = '';
+            let existingUsername;
+            let existingPassword;
+            let existingAuthType;
+            // Try to load existing session file to get serviceUrl and auth info
+            try {
+                const existingSession = await this.loadSession(destination);
+                if (existingSession?.serviceUrl) {
+                    sapUrl = existingSession.serviceUrl;
+                    existingAuthToken = existingSession.authorizationToken || '';
+                    existingUsername = existingSession?.username;
+                    existingPassword = existingSession?.password;
+                    existingAuthType = existingSession?.authType;
+                }
+            }
+            catch {
+                // Ignore errors when loading session - will use defaultServiceUrl
+            }
             if (!sapUrl) {
                 this.log?.error(`Cannot set authorization config for ${destination}: session does not exist and serviceUrl is required. Missing defaultServiceUrl in constructor.`);
                 throw new Error(`Cannot set authorization config for destination "${destination}": session does not exist and serviceUrl is required for ABAP sessions. Call setConnectionConfig first or provide defaultServiceUrl in constructor.`);
@@ -309,7 +376,10 @@ class AbapSessionStore {
             this.log?.debug(`Creating new session for ${destination} via setAuthorizationConfig: sapUrl(${sapUrl.substring(0, 40)}...)`);
             const newSession = {
                 serviceUrl: sapUrl,
-                authorizationToken: connConfig?.authorizationToken || '', // Use token from connection config if available
+                authorizationToken: existingAuthToken,
+                username: existingUsername,
+                password: existingPassword,
+                authType: existingAuthType,
                 uaaUrl: config.uaaUrl,
                 uaaClientId: config.uaaClientId,
                 uaaClientSecret: config.uaaClientSecret,
@@ -387,5 +457,6 @@ function isEnvConfig(config) {
     if (!config || typeof config !== 'object')
         return false;
     const obj = config;
-    return 'sapUrl' in obj && 'jwtToken' in obj;
+    // Must have sapUrl (authentication fields are optional - can be set later)
+    return 'sapUrl' in obj;
 }

package/dist/stores/abap/SafeAbapSessionStore.js

@@ -55,6 +55,9 @@ class SafeAbapSessionStore {
         const internal = {
             sapUrl: (obj.serviceUrl || obj.sapUrl),
             jwtToken: (obj.authorizationToken || obj.jwtToken),
+            username: obj.username,
+            password: obj.password,
+            authType: obj.authType,
             refreshToken: obj.refreshToken,
             uaaUrl: obj.uaaUrl,
             uaaClientId: obj.uaaClientId,
@@ -130,14 +133,38 @@ class SafeAbapSessionStore {
             this.log?.debug(`Connection config not found for ${destination}`);
             return null;
         }
-        if (!sessionConfig.jwtToken || !sessionConfig.sapUrl) {
-            this.log?.warn(`Connection config for ${destination} missing required fields: jwtToken(${!!sessionConfig.jwtToken}), sapUrl(${!!sessionConfig.sapUrl})`);
+        if (!sessionConfig.sapUrl) {
+            this.log?.warn(`Connection config for ${destination} missing required field: sapUrl`);
             return null;
         }
-        this.log?.debug(`Connection config loaded for ${destination}: token(${sessionConfig.jwtToken.length} chars), sapUrl(${sessionConfig.sapUrl.substring(0, 40)}...)`);
+        // Check for basic auth: if username/password present and no jwtToken, use basic auth
+        const isBasicAuth = sessionConfig.authType === 'basic' ||
+            (!sessionConfig.jwtToken && sessionConfig.username && sessionConfig.password);
+        if (isBasicAuth) {
+            if (!sessionConfig.username || !sessionConfig.password) {
+                this.log?.warn(`Connection config for ${destination} missing required fields for basic auth: username(${!!sessionConfig.username}), password(${!!sessionConfig.password})`);
+                return null;
+            }
+            this.log?.debug(`Connection config loaded for ${destination} (basic auth): username(${sessionConfig.username}), sapUrl(${sessionConfig.sapUrl.substring(0, 40)}...)`);
+            return {
+                serviceUrl: sessionConfig.sapUrl,
+                username: sessionConfig.username,
+                password: sessionConfig.password,
+                authType: 'basic',
+                sapClient: sessionConfig.sapClient,
+                language: sessionConfig.language,
+            };
+        }
+        // JWT auth: check jwtToken
+        if (!sessionConfig.jwtToken) {
+            this.log?.warn(`Connection config for ${destination} missing required field for JWT auth: jwtToken`);
+            return null;
+        }
+        this.log?.debug(`Connection config loaded for ${destination} (JWT auth): token(${sessionConfig.jwtToken.length} chars), sapUrl(${sessionConfig.sapUrl.substring(0, 40)}...)`);
         return {
             serviceUrl: sessionConfig.sapUrl,
             authorizationToken: sessionConfig.jwtToken,
+            authType: 'jwt',
             sapClient: sessionConfig.sapClient,
             language: sessionConfig.language,
         };
@@ -155,7 +182,10 @@ class SafeAbapSessionStore {
             this.log?.debug(`Creating new session for ${destination} via setConnectionConfig: serviceUrl(${serviceUrl.substring(0, 40)}...), token(${config.authorizationToken?.length || 0} chars)`);
             const newSession = {
                 sapUrl: serviceUrl,
-                jwtToken: config.authorizationToken || '',
+                jwtToken: config.authorizationToken,
+                username: config.username,
+                password: config.password,
+                authType: config.authType,
                 sapClient: config.sapClient,
                 language: config.language,
             };
@@ -168,7 +198,10 @@ class SafeAbapSessionStore {
         const updated = {
             ...current,
             sapUrl: config.serviceUrl || current.sapUrl,
-            jwtToken: config.authorizationToken,
+            jwtToken: config.authorizationToken || current.jwtToken || '',
+            username: config.username !== undefined ? config.username : current.username,
+            password: config.password !== undefined ? config.password : current.password,
+            authType: config.authType !== undefined ? config.authType : current.authType,
             sapClient: config.sapClient !== undefined ? config.sapClient : current.sapClient,
             language: config.language !== undefined ? config.language : current.language,
         };

package/dist/utils/constants.d.ts

@@ -48,6 +48,10 @@ export declare const ABAP_CONNECTION_VARS: {
     readonly SERVICE_URL: "SAP_URL";
     /** Authorization token (JWT token) */
     readonly AUTHORIZATION_TOKEN: "SAP_JWT_TOKEN";
+    /** Username for basic authentication (on-premise systems) */
+    readonly USERNAME: "SAP_USERNAME";
+    /** Password for basic authentication (on-premise systems) */
+    readonly PASSWORD: "SAP_PASSWORD";
     /** SAP client number (optional) */
     readonly SAP_CLIENT: "SAP_CLIENT";
     /** Language (optional) */

package/dist/utils/constants.js

@@ -51,6 +51,10 @@ exports.ABAP_CONNECTION_VARS = {
     SERVICE_URL: 'SAP_URL',
     /** Authorization token (JWT token) */
     AUTHORIZATION_TOKEN: 'SAP_JWT_TOKEN',
+    /** Username for basic authentication (on-premise systems) */
+    USERNAME: 'SAP_USERNAME',
+    /** Password for basic authentication (on-premise systems) */
+    PASSWORD: 'SAP_PASSWORD',
     /** SAP client number (optional) */
     SAP_CLIENT: 'SAP_CLIENT',
     /** Language (optional) */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/auth-stores",
-  "version": "0.2.0",
+  "version": "0.2.3",
   "description": "Stores for MCP ABAP ADT auth-broker - BTP, ABAP, and XSUAA implementations",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -49,7 +49,7 @@
     "node": ">=18.0.0"
   },
   "dependencies": {
-    "@mcp-abap-adt/interfaces": "^0.1.4",
+    "@mcp-abap-adt/interfaces": "^0.1.17",
     "dotenv": "^17.2.1"
   },
   "devDependencies": {