@mcp-abap-adt/connection 5.0.0 → 6.0.1

package/bin/sap-abap-auth.js

@@ -3,7 +3,6 @@ const fs = require("fs");
 const path = require("path");
 const axios = require("axios");
 const { program } = require("commander");
-const express = require("express");
 const open = require("open").default;
 const http = require("http");
 
@@ -262,6 +261,57 @@ function getJwtAuthorizationUrl(serviceKey, port = 3001) {
   )}&response_type=code&redirect_uri=${encodeURIComponent(redirectUri)}`;
 }
 
+/**
+ * How long to wait for the browser to come back.
+ *
+ * Five minutes was the fixed value, and a real BTP login does not fit in it:
+ * the identity provider, a password manager and whatever second factor the
+ * tenant asks for all happen before the redirect is issued. Measured twice —
+ * both times the window closed first, and the browser then had nowhere to
+ * redirect to, which reads to the user as the authentication having failed.
+ *
+ * So it is a decision the caller makes: `--timeout` in minutes, or
+ * `SAP_AUTH_TIMEOUT_MS` for a script that would rather not pass an argument.
+ * The default is fifteen, which covered the login this was measured against
+ * with room to spare and still bounds a run that has been abandoned.
+ */
+const DEFAULT_AUTH_TIMEOUT_MS = 15 * 60 * 1000;
+
+function resolveAuthTimeout(minutes) {
+  if (minutes !== undefined) {
+    const value = Number(minutes);
+    if (!Number.isFinite(value) || value <= 0) {
+      throw new Error(
+        `--timeout must be a positive number of minutes, got: ${minutes}`
+      );
+    }
+    return value * 60 * 1000;
+  }
+  const fromEnv = process.env.SAP_AUTH_TIMEOUT_MS;
+  if (fromEnv !== undefined && fromEnv !== "") {
+    const value = Number(fromEnv);
+    if (!Number.isFinite(value) || value <= 0) {
+      throw new Error(
+        `SAP_AUTH_TIMEOUT_MS must be a positive number of milliseconds, got: ${fromEnv}`
+      );
+    }
+    return value;
+  }
+  return DEFAULT_AUTH_TIMEOUT_MS;
+}
+
+/**
+ * One reply, with the header express used to set on our behalf.
+ *
+ * `res.send()` chose a Content-Type from what it was handed; `node:http` sends
+ * exactly what it is told, so the type is stated here. Without it a browser is
+ * free to render the success page as plain text.
+ */
+function send(res, status, contentType, body) {
+  res.writeHead(status, { "Content-Type": contentType });
+  res.end(body);
+}
+
 /**
  * Starts a local server to intercept the authentication response
  * @param {Object} serviceKey SAP BTP service key object
@@ -269,26 +319,42 @@ function getJwtAuthorizationUrl(serviceKey, port = 3001) {
  * @param {string} flow Flow type: jwt (OAuth2)
  * @returns {Promise<{accessToken: string, refreshToken?: string}>} Promise that resolves to tokens
  */
-async function startAuthServer(serviceKey, browser = undefined, flow = "jwt") {
+async function startAuthServer(
+  serviceKey,
+  browser = undefined,
+  flow = "jwt",
+  timeoutMs = DEFAULT_AUTH_TIMEOUT_MS
+) {
   return new Promise((resolve, reject) => {
-    const app = express();
-    const server = http.createServer(app);
     const PORT = 3001;
     let serverInstance = null;
 
     // Choose the authorization URL
     const authorizationUrl = getJwtAuthorizationUrl(serviceKey, PORT);
 
-    // JWT OAuth2 flow (get code, exchange for token)
-    app.get("/callback", async (req, res) => {
+    // JWT OAuth2 flow (get code, exchange for token). One route, and the
+    // routing express did is two comparisons: a browser fetching /favicon.ico
+    // must not be mistaken for the redirect we are waiting for.
+    const server = http.createServer(async (req, res) => {
+      const url = new URL(req.url, `http://localhost:${PORT}`);
+      if (req.method !== "GET" || url.pathname !== "/callback") {
+        send(res, 404, "text/plain; charset=utf-8", "Not Found");
+        return;
+      }
+
       try {
-        const { code } = req.query;
+        const code = url.searchParams.get("code");
         if (!code) {
-          res.status(400).send("Error: Authorization code missing");
+          send(
+            res,
+            400,
+            "text/plain; charset=utf-8",
+            "Error: Authorization code missing"
+          );
           return reject(new Error("Authorization code missing"));
         }
         console.log("Authorization code received");
-        res.send(`<!DOCTYPE html>
+        send(res, 200, "text/html; charset=utf-8", `<!DOCTYPE html>
 <html lang="en">
 <head>
     <meta charset="UTF-8">
@@ -363,7 +429,12 @@ async function startAuthServer(serviceKey, browser = undefined, flow = "jwt") {
         }
       } catch (error) {
         console.error("Error handling callback:", error);
-        res.status(500).send("Error processing authentication");
+        send(
+          res,
+          500,
+          "text/plain; charset=utf-8",
+          "Error processing authentication"
+        );
         reject(error);
       }
     });
@@ -395,9 +466,17 @@ async function startAuthServer(serviceKey, browser = undefined, flow = "jwt") {
     setTimeout(() => {
       if (serverInstance) {
         serverInstance.close();
-        reject(new Error("Authentication timeout. Process aborted."));
+        reject(
+          new Error(
+            `Authentication timeout after ${
+              timeoutMs >= 60000
+                ? `${Math.round(timeoutMs / 60000)} min`
+                : `${Math.round(timeoutMs / 1000)}s`
+            }. Process aborted. Raise it with --timeout <minutes> or SAP_AUTH_TIMEOUT_MS if the login needs longer.`
+          )
+        );
       }
-    }, 5 * 60 * 1000);
+    }, timeoutMs);
   });
 }
 
@@ -540,6 +619,10 @@ async function main() {
       "-f, --force",
       "Force browser authentication even if valid tokens exist in .env"
     )
+    .option(
+      "-t, --timeout <minutes>",
+      "How long to wait for the browser redirect, in minutes (default: 15, or SAP_AUTH_TIMEOUT_MS in ms)"
+    )
     .helpOption("-h, --help", "Show help for the auth command")
     .action(async (options) => {
       try {
@@ -594,7 +677,12 @@ async function main() {
         // Fallback to browser authentication if refresh failed or was skipped
         if (!tokens) {
           console.log("🌐 Starting browser authentication...");
-          tokens = await startAuthServer(serviceKey, options.browser, "jwt");
+          tokens = await startAuthServer(
+            serviceKey,
+            options.browser,
+            "jwt",
+            resolveAuthTimeout(options.timeout)
+          );
           if (!tokens || !tokens.accessToken) {
             console.error("JWT token was not obtained. Authentication failed.");
             process.exit(1);

package/dist/auth/providers.d.ts

@@ -7,16 +7,20 @@
  * `CertificateAuthProvider` returns are what `CertificateAbapConnection`
  * returned. Nothing about how a credential works changed; only who owns it.
  */
-import type { AgentOptions } from 'node:https';
-import type { ICertificateMaterialLoader, ISapConfig, ITokenRefresher } from '@mcp-abap-adt/interfaces';
-import type { IAuthProvider } from './IAuthProvider.js';
+import type { IAuthProvider, ICertificateMaterial, ICertificateMaterialLoader, IRenewableCredential, ISapConfig, ITokenRefresher } from '@mcp-abap-adt/interfaces';
 /** Username and password, as `Basic base64(user:pass)`. */
 export declare class BasicAuthProvider implements IAuthProvider {
     private readonly username;
     private readonly password;
     readonly kind = "basic";
+    /** Nothing to get ready: this credential is complete as constructed. */
+    prepare(): Promise<void>;
+    /** Not cookies. This one authenticates with a header. */
+    cookies(): string | null;
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial(): ICertificateMaterial;
     constructor(username: string, password: string);
-    authorizationHeader(): Promise<string>;
+    authorizationHeader(): Promise<string | null>;
 }
 /**
  * A bearer token, kept current by whoever issued it.
@@ -30,9 +34,15 @@ export declare class BasicAuthProvider implements IAuthProvider {
  * credential behind it is renewed mid-flight is the connection's business and
  * stays there; see `JwtAbapConnection`, which still owns that machinery.
  */
-export declare class TokenAuthProvider implements IAuthProvider {
+export declare class TokenAuthProvider implements IRenewableCredential {
     private readonly source;
     readonly kind = "token";
+    /** Nothing to get ready: this credential is complete as constructed. */
+    prepare(): Promise<void>;
+    /** Not cookies. This one authenticates with a header. */
+    cookies(): string | null;
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial(): ICertificateMaterial;
     /**
      * A token, or something that can produce one.
      *
@@ -50,10 +60,21 @@ export declare class TokenAuthProvider implements IAuthProvider {
      * stale one and hide exactly the renewal the provider exists to do — which
      * is what the first version of this class did.
      */
-    authorizationHeader(): Promise<string>;
+    authorizationHeader(): Promise<string | null>;
     /**
      * The token was refused, so force a new one.
      *
+     * Declared through `IRenewableCredential` rather than as an optional member
+     * of every credential, so a consumer narrows to it: a password has nothing
+     * behind it to ask again, and a SAML session was negotiated elsewhere.
+     *
+     * **Nothing in this package calls it.** A token that EXPIRED is replaced
+     * inside `authorizationHeader()` above, which is asked per request — nobody
+     * decides anything. This is the other case, a token the source still believes
+     * in and the server refuses, and whether a refusal meant that is a judgement
+     * made with what the caller knows. So the refusal surfaces, and this is the
+     * seam the caller decides with.
+     *
      * `getToken()` is documented to return the cached token while it believes it
      * is still valid — which is exactly the situation after a 401 on a token the
      * provider has not yet noticed is dead. `refreshToken()` is the contract's
@@ -70,8 +91,13 @@ export declare class TokenAuthProvider implements IAuthProvider {
 export declare class SamlAuthProvider implements IAuthProvider {
     private readonly sessionCookies;
     readonly kind = "saml";
+    /** Nothing to get ready: this credential is complete as constructed. */
+    prepare(): Promise<void>;
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial(): ICertificateMaterial;
     constructor(sessionCookies: string);
-    authorizationHeader(): Promise<string>;
+    /** Not a header: this credential authenticates with the cookies below. */
+    authorizationHeader(): Promise<string | null>;
     /** The cookies to present. */
     cookies(): string;
 }
@@ -86,10 +112,13 @@ export declare class CertificateAuthProvider implements IAuthProvider {
     private readonly loader;
     private readonly config;
     readonly kind = "certificate";
+    /** Not cookies. This one authenticates with a header. */
+    cookies(): string | null;
     private material;
     constructor(loader: ICertificateMaterialLoader, config: ISapConfig);
     prepare(): Promise<void>;
-    authorizationHeader(): Promise<string>;
-    httpsAgentOptions(): AgentOptions;
+    /** Not a header: this credential authenticates through TLS. */
+    authorizationHeader(): Promise<string | null>;
+    transportMaterial(): ICertificateMaterial;
 }
 //# sourceMappingURL=providers.d.ts.map

package/dist/auth/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/auth/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC/C,OAAO,KAAK,EAEV,0BAA0B,EAC1B,UAAU,EACV,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD,2DAA2D;AAC3D,qBAAa,iBAAkB,YAAW,aAAa;IAInD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAJ3B,QAAQ,CAAC,IAAI,WAAW;gBAGL,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;IAG7B,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;CAG7C;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAkB,YAAW,aAAa;IAYnD,OAAO,CAAC,QAAQ,CAAC,MAAM;IAXzB,QAAQ,CAAC,IAAI,WAAW;IAExB;;;;;;;OAOG;gBAEgB,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E;;;;;;;OAOG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAU5C;;;;;;;OAOG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ7B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAGxC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAF3C,QAAQ,CAAC,IAAI,UAAU;gBAEM,cAAc,EAAE,MAAM;IAE7C,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI5C,8BAA8B;IAC9B,OAAO,IAAI,MAAM;CAGlB;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,aAAa;IAKzD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IALzB,QAAQ,CAAC,IAAI,iBAAiB;IAC9B,OAAO,CAAC,QAAQ,CAAqC;gBAGlC,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,UAAU;IAG/B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAMxB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI5C,iBAAiB,IAAI,YAAY;CASlC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/auth/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,0BAA0B,EAC1B,oBAAoB,EACpB,UAAU,EACV,eAAe,EAChB,MAAM,0BAA0B,CAAC;AAElC,2DAA2D;AAC3D,qBAAa,iBAAkB,YAAW,aAAa;IAiBnD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAjB3B,QAAQ,CAAC,IAAI,WAAW;IAExB,wEAAwE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,yDAAyD;IACzD,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB,gFAAgF;IAChF,iBAAiB,IAAI,oBAAoB;gBAKtB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM;IAG7B,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGpD;AAED;;;;;;;;;;;GAWG;AACH,qBAAa,iBAAkB,YAAW,oBAAoB;IAyB1D,OAAO,CAAC,QAAQ,CAAC,MAAM;IAxBzB,QAAQ,CAAC,IAAI,WAAW;IAExB,wEAAwE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,yDAAyD;IACzD,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB,gFAAgF;IAChF,iBAAiB,IAAI,oBAAoB;IAIzC;;;;;;;OAOG;gBAEgB,MAAM,EAAE,MAAM,GAAG,eAAe,GAAG,CAAC,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAG7E;;;;;;;OAOG;IACG,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAUnD;;;;;;;;;;;;;;;;;;OAkBG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAQ7B;AAED;;;;;GAKG;AACH,qBAAa,gBAAiB,YAAW,aAAa;IAWxC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAV3C,QAAQ,CAAC,IAAI,UAAU;IAEvB,wEAAwE;IAClE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAE9B,gFAAgF;IAChF,iBAAiB,IAAI,oBAAoB;gBAIZ,cAAc,EAAE,MAAM;IAEnD,0EAA0E;IACpE,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAInD,8BAA8B;IAC9B,OAAO,IAAI,MAAM;CAGlB;AAED;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,aAAa;IAWzD,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAXzB,QAAQ,CAAC,IAAI,iBAAiB;IAE9B,yDAAyD;IACzD,OAAO,IAAI,MAAM,GAAG,IAAI;IAIxB,OAAO,CAAC,QAAQ,CAAqC;gBAGlC,MAAM,EAAE,0BAA0B,EAClC,MAAM,EAAE,UAAU;IAG/B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAM9B,+DAA+D;IACzD,mBAAmB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAInD,iBAAiB,IAAI,oBAAoB;CAS1C"}

package/dist/auth/providers.js

@@ -15,6 +15,16 @@ class BasicAuthProvider {
     username;
     password;
     kind = 'basic';
+    /** Nothing to get ready: this credential is complete as constructed. */
+    async prepare() { }
+    /** Not cookies. This one authenticates with a header. */
+    cookies() {
+        return null;
+    }
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial() {
+        return {};
+    }
     constructor(username, password) {
         this.username = username;
         this.password = password;
@@ -39,6 +49,16 @@ exports.BasicAuthProvider = BasicAuthProvider;
 class TokenAuthProvider {
     source;
     kind = 'token';
+    /** Nothing to get ready: this credential is complete as constructed. */
+    async prepare() { }
+    /** Not cookies. This one authenticates with a header. */
+    cookies() {
+        return null;
+    }
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial() {
+        return {};
+    }
     /**
      * A token, or something that can produce one.
      *
@@ -69,6 +89,17 @@ class TokenAuthProvider {
     /**
      * The token was refused, so force a new one.
      *
+     * Declared through `IRenewableCredential` rather than as an optional member
+     * of every credential, so a consumer narrows to it: a password has nothing
+     * behind it to ask again, and a SAML session was negotiated elsewhere.
+     *
+     * **Nothing in this package calls it.** A token that EXPIRED is replaced
+     * inside `authorizationHeader()` above, which is asked per request — nobody
+     * decides anything. This is the other case, a token the source still believes
+     * in and the server refuses, and whether a refusal meant that is a judgement
+     * made with what the caller knows. So the refusal surfaces, and this is the
+     * seam the caller decides with.
+     *
      * `getToken()` is documented to return the cached token while it believes it
      * is still valid — which is exactly the situation after a 401 on a token the
      * provider has not yet noticed is dead. `refreshToken()` is the contract's
@@ -93,11 +124,18 @@ exports.TokenAuthProvider = TokenAuthProvider;
 class SamlAuthProvider {
     sessionCookies;
     kind = 'saml';
+    /** Nothing to get ready: this credential is complete as constructed. */
+    async prepare() { }
+    /** No TLS material: this credential lives in a header, not in the transport. */
+    transportMaterial() {
+        return {};
+    }
     constructor(sessionCookies) {
         this.sessionCookies = sessionCookies;
     }
+    /** Not a header: this credential authenticates with the cookies below. */
     async authorizationHeader() {
-        return '';
+        return null;
     }
     /** The cookies to present. */
     cookies() {
@@ -116,6 +154,10 @@ class CertificateAuthProvider {
     loader;
     config;
     kind = 'certificate';
+    /** Not cookies. This one authenticates with a header. */
+    cookies() {
+        return null;
+    }
     material = null;
     constructor(loader, config) {
         this.loader = loader;
@@ -126,10 +168,11 @@ class CertificateAuthProvider {
             this.material = await this.loader.load(this.config);
         }
     }
+    /** Not a header: this credential authenticates through TLS. */
     async authorizationHeader() {
-        return '';
+        return null;
     }
-    httpsAgentOptions() {
+    transportMaterial() {
         if (!this.material) {
             throw new Error('CertificateAuthProvider: certificate material not loaded. connect() prepares it; a request before that has nothing to present.');
         }