@mcp-abap-adt/connection 6.0.0 → 6.0.1

package/CHANGELOG.md

@@ -7,11 +7,119 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [6.0.1] - 2026-08-25
+
+### Removed
+
+- **`express` is no longer a dependency.** It was a runtime dependency for one
+  thing: the localhost server in `bin/sap-abap-auth.js` that catches the OAuth2
+  redirect. The library never touched it, and that file already imported
+  `node:http`. Rewritten on `node:http`, which sheds 5.6MB of `node_modules` and
+  the transitive tree the Dependabot bumps kept arriving for — `qs`,
+  `body-parser` and `follow-redirects` were all express's.
+
+  Two things express was doing implicitly are now stated: a request is the
+  redirect only when it is a `GET` for `/callback`, so a browser fetching
+  `/favicon.ico` no longer reaches the handler waiting for an authorization
+  code; and the success page declares `text/html`, which `res.send()` used to
+  infer. Exercised as a server: `200` with the page, `400` without a code, `404`
+  for anything else including a `POST`.
+
+  Runtime dependencies are now `@mcp-abap-adt/interfaces`, `axios`, `commander`
+  and `open`. The end-to-end flow was measured against the BTP trial — see
+  *Verified* below.
+
+### Changed
+
+- **The browser wait is the caller's to set.** `bin/sap-abap-auth.js` waited a
+  fixed five minutes for the redirect, and a real BTP login does not fit in it —
+  the identity provider, a password manager and whatever second factor the
+  tenant asks for all happen before the redirect is issued. Measured twice, and
+  both times the window closed first; the browser then had nowhere to redirect
+  to, which reads as the authentication having failed rather than as a timeout.
+
+  `--timeout <minutes>`, or `SAP_AUTH_TIMEOUT_MS` for a script that would rather
+  not pass an argument, with the flag winning when both are given. Anything that
+  is not a positive number is refused by name rather than silently becoming a
+  default. **The default is now fifteen minutes**, which covered the login this
+  was measured against with room to spare and still bounds an abandoned run.
+
+### Verified
+
+- **The whole chain, end to end**: `bin/sap-abap-auth.js auth` → browser
+  authorization against the tenant's UAA → redirect to `localhost:3001/callback`
+  → code exchanged for a token → `.env` written with `SAP_JWT_TOKEN`,
+  `SAP_REFRESH_TOKEN` and the UAA fields.
+
+- Each seam the express removal touched, measured on the real handler rather
+  than a stand-in: `GET /favicon.ico` answers `404` and does not reach the
+  handler waiting for a code — routing express used to do; `GET /callback` with
+  no code answers `400`; the success page comes back
+  `200 text/html; charset=utf-8`, the Content-Type `res.send()` used to infer
+  and `node:http` will not.
+
+- **The issued token then drove this library** against the trial:
+  `AdtCloudConnector` with `CloudHttpTransport` connected, took a session
+  (`SAP_SESSIONID_TRL_100`), answered a `GET /sap/bc/adt/discovery` with `200`
+  and 444826 bytes of XML, and `disconnect()` left `isConnected()` false.
+
+### Fixed
+
+- **The live RFC suite skips a wire the machine did not install.** It asked for
+  four environment variables and nothing else, so a checkout with an env file
+  and no SAP NW RFC SDK ran the suite anyway and went eleven tests red, all on
+  `@mcp-abap-adt/sap-rfc-lite is not available`. The dependency is `optional` —
+  `npm ci` leaves it out WITHOUT failing, which is what optional means — so
+  nothing warns and the next run is red for a reason unrelated to the change
+  under test.
+
+  Nothing here is configured at build time the way a C package is: the installed
+  optional dependency IS the choice of wire, made at install and readable only
+  at runtime. `canRun()` now reads it with `require.resolve`, asking whether the
+  wire could be taken rather than loading a native addon to find out. Measured
+  in both states: SDK hidden — 11 skipped, 2 passed, green; SDK present — 13
+  passed.
+
+- `RfcTransport` says why it ignores `request.timeout`. No behaviour change: the
+  file contained no occurrence of the word, and that silence read as an
+  oversight. It is deliberate — the SDK exposes no cancel, its per-call
+  `timeout` is parsed into a commented-out branch, and an abandoned call still
+  holds the conversation, so the next one would queue behind a call nobody is
+  waiting for. A deadline that reports failure while the wire stays busy is
+  worse than none, because the error reads as "safe to retry" when it is not.
+  The server bounds the call at `rdisp/max_wprun_time`.
+
 ## [6.0.0] - 2026-08-24
 
 The wire owns what is the wire's, and the factory and per-credential classes are
 gone. See [Migration to 6.0](./docs/MIGRATION-6.0.md).
 
+### Added — tooling
+
+- **CI.** Until this release the only workflow ran on a tag, and `Release` went
+  from build straight to `npm pack` — so nothing ran the gate before a merge,
+  and the artifact a tag published had been tested nowhere but on a laptop.
+  `ci.yml` runs `lint:check`, `build`, `jest --no-cache`, `check:docs` and
+  `check:pack` on push and pull request, across ubuntu and windows on Node 18
+  and 20. Windows is in the matrix because npm is `npm.cmd` there and Node will
+  not execute a `.cmd` without a shell. `release.yml` runs the same three checks
+  between build and pack, so a tag is not a route around them.
+
+- **`check:pack`** — inspects `npm pack --dry-run --json` and refuses a tarball
+  carrying a test file, a `.tsbuildinfo`, a `.ts` source, an env file or an
+  npmrc. Both defects it was written for had already shipped once:
+  `dist/__tests__/` and 120KB of compiler bookkeeping, neither visible from
+  `files`, because it is the compiler that decides what `dist` holds.
+
+- **`typecheck:scripts`** — `scripts/*.ts` were checked by nothing, which is how
+  three live verification scripts came to sit on a constructor signature two
+  releases old.
+
+### Changed — packaging
+
+- 111 files / 182KB → 95 / 147KB. Test helpers and the compiler's incremental
+  state no longer ship.
+
 ### Added
 
 - **The transport axis is complete and public.** `IAdtTransport` now covers
@@ -1252,7 +1360,8 @@ const connection = createAbapConnection(config, logger);
 - JWT token refresh now properly handles connection errors (401/403 during initial connect)
 - Permission errors (403 with "ExceptionResourceNoAccess") no longer trigger JWT refresh loops
 - Proper separation: base class handles HTTP/session, concrete classes handle auth-specific errors
-[Unreleased]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.0.0...HEAD
+[Unreleased]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.0.1...HEAD
+[6.0.1]: https://github.com/fr0ster/mcp-abap-connection/compare/v6.0.0...v6.0.1
 [6.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v5.0.0...v6.0.0
 [5.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v4.0.0...v5.0.0
 [4.0.0]: https://github.com/fr0ster/mcp-abap-connection/compare/v3.0.0...v4.0.0

package/bin/sap-abap-auth.js

@@ -3,7 +3,6 @@ const fs = require("fs");
 const path = require("path");
 const axios = require("axios");
 const { program } = require("commander");
-const express = require("express");
 const open = require("open").default;
 const http = require("http");
 
@@ -262,6 +261,57 @@ function getJwtAuthorizationUrl(serviceKey, port = 3001) {
   )}&response_type=code&redirect_uri=${encodeURIComponent(redirectUri)}`;
 }
 
+/**
+ * How long to wait for the browser to come back.
+ *
+ * Five minutes was the fixed value, and a real BTP login does not fit in it:
+ * the identity provider, a password manager and whatever second factor the
+ * tenant asks for all happen before the redirect is issued. Measured twice —
+ * both times the window closed first, and the browser then had nowhere to
+ * redirect to, which reads to the user as the authentication having failed.
+ *
+ * So it is a decision the caller makes: `--timeout` in minutes, or
+ * `SAP_AUTH_TIMEOUT_MS` for a script that would rather not pass an argument.
+ * The default is fifteen, which covered the login this was measured against
+ * with room to spare and still bounds a run that has been abandoned.
+ */
+const DEFAULT_AUTH_TIMEOUT_MS = 15 * 60 * 1000;
+
+function resolveAuthTimeout(minutes) {
+  if (minutes !== undefined) {
+    const value = Number(minutes);
+    if (!Number.isFinite(value) || value <= 0) {
+      throw new Error(
+        `--timeout must be a positive number of minutes, got: ${minutes}`
+      );
+    }
+    return value * 60 * 1000;
+  }
+  const fromEnv = process.env.SAP_AUTH_TIMEOUT_MS;
+  if (fromEnv !== undefined && fromEnv !== "") {
+    const value = Number(fromEnv);
+    if (!Number.isFinite(value) || value <= 0) {
+      throw new Error(
+        `SAP_AUTH_TIMEOUT_MS must be a positive number of milliseconds, got: ${fromEnv}`
+      );
+    }
+    return value;
+  }
+  return DEFAULT_AUTH_TIMEOUT_MS;
+}
+
+/**
+ * One reply, with the header express used to set on our behalf.
+ *
+ * `res.send()` chose a Content-Type from what it was handed; `node:http` sends
+ * exactly what it is told, so the type is stated here. Without it a browser is
+ * free to render the success page as plain text.
+ */
+function send(res, status, contentType, body) {
+  res.writeHead(status, { "Content-Type": contentType });
+  res.end(body);
+}
+
 /**
  * Starts a local server to intercept the authentication response
  * @param {Object} serviceKey SAP BTP service key object
@@ -269,26 +319,42 @@ function getJwtAuthorizationUrl(serviceKey, port = 3001) {
  * @param {string} flow Flow type: jwt (OAuth2)
  * @returns {Promise<{accessToken: string, refreshToken?: string}>} Promise that resolves to tokens
  */
-async function startAuthServer(serviceKey, browser = undefined, flow = "jwt") {
+async function startAuthServer(
+  serviceKey,
+  browser = undefined,
+  flow = "jwt",
+  timeoutMs = DEFAULT_AUTH_TIMEOUT_MS
+) {
   return new Promise((resolve, reject) => {
-    const app = express();
-    const server = http.createServer(app);
     const PORT = 3001;
     let serverInstance = null;
 
     // Choose the authorization URL
     const authorizationUrl = getJwtAuthorizationUrl(serviceKey, PORT);
 
-    // JWT OAuth2 flow (get code, exchange for token)
-    app.get("/callback", async (req, res) => {
+    // JWT OAuth2 flow (get code, exchange for token). One route, and the
+    // routing express did is two comparisons: a browser fetching /favicon.ico
+    // must not be mistaken for the redirect we are waiting for.
+    const server = http.createServer(async (req, res) => {
+      const url = new URL(req.url, `http://localhost:${PORT}`);
+      if (req.method !== "GET" || url.pathname !== "/callback") {
+        send(res, 404, "text/plain; charset=utf-8", "Not Found");
+        return;
+      }
+
       try {
-        const { code } = req.query;
+        const code = url.searchParams.get("code");
         if (!code) {
-          res.status(400).send("Error: Authorization code missing");
+          send(
+            res,
+            400,
+            "text/plain; charset=utf-8",
+            "Error: Authorization code missing"
+          );
           return reject(new Error("Authorization code missing"));
         }
         console.log("Authorization code received");
-        res.send(`<!DOCTYPE html>
+        send(res, 200, "text/html; charset=utf-8", `<!DOCTYPE html>
 <html lang="en">
 <head>
     <meta charset="UTF-8">
@@ -363,7 +429,12 @@ async function startAuthServer(serviceKey, browser = undefined, flow = "jwt") {
         }
       } catch (error) {
         console.error("Error handling callback:", error);
-        res.status(500).send("Error processing authentication");
+        send(
+          res,
+          500,
+          "text/plain; charset=utf-8",
+          "Error processing authentication"
+        );
         reject(error);
       }
     });
@@ -395,9 +466,17 @@ async function startAuthServer(serviceKey, browser = undefined, flow = "jwt") {
     setTimeout(() => {
       if (serverInstance) {
         serverInstance.close();
-        reject(new Error("Authentication timeout. Process aborted."));
+        reject(
+          new Error(
+            `Authentication timeout after ${
+              timeoutMs >= 60000
+                ? `${Math.round(timeoutMs / 60000)} min`
+                : `${Math.round(timeoutMs / 1000)}s`
+            }. Process aborted. Raise it with --timeout <minutes> or SAP_AUTH_TIMEOUT_MS if the login needs longer.`
+          )
+        );
       }
-    }, 5 * 60 * 1000);
+    }, timeoutMs);
   });
 }
 
@@ -540,6 +619,10 @@ async function main() {
       "-f, --force",
       "Force browser authentication even if valid tokens exist in .env"
     )
+    .option(
+      "-t, --timeout <minutes>",
+      "How long to wait for the browser redirect, in minutes (default: 15, or SAP_AUTH_TIMEOUT_MS in ms)"
+    )
     .helpOption("-h, --help", "Show help for the auth command")
     .action(async (options) => {
       try {
@@ -594,7 +677,12 @@ async function main() {
         // Fallback to browser authentication if refresh failed or was skipped
         if (!tokens) {
           console.log("🌐 Starting browser authentication...");
-          tokens = await startAuthServer(serviceKey, options.browser, "jwt");
+          tokens = await startAuthServer(
+            serviceKey,
+            options.browser,
+            "jwt",
+            resolveAuthTimeout(options.timeout)
+          );
           if (!tokens || !tokens.accessToken) {
             console.error("JWT token was not obtained. Authentication failed.");
             process.exit(1);

package/dist/connection/RfcTransport.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"RfcTransport.d.ts","sourceRoot":"","sources":["../../src/connection/RfcTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EACV,oBAAoB,EAEpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAE5B,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CACF,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAmCD,qBAAa,YAAa,YAAW,gBAAgB;IA+EjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IA/EzB,QAAQ,CAAC,IAAI,SAAS;IAEtB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAG,QAAQ,CAAU;IAEpC,OAAO,CAAC,YAAY,CAAiC;IACrD,kEAAkE;IAClE,OAAO,CAAC,cAAc,CAAM;IAE5B;;;;;;OAMG;IACH,MAAM,IAAI,IAAI;IAEd,2CAA2C;IAC3C,OAAO,IAAI,IAAI;IAIf;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9D,+BAA+B;IAC/B,SAAS,IAAI,IAAI;IAIjB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAEtB;;;OAGG;IACH,6EAA6E;IAC7E,kBAAkB,IAAI,OAAO;IAI7B,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAQzC,2EAA2E;IAC3E,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIzC;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAErB;;;;;OAKG;gBAEgB,OAAO,EAAE,MAAM,gBAAgB,EAC/B,MAAM,GAAE,OAAO,GAAG,IAAW;IAG1C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B,0DAA0D;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAatB,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA8H1E"}
+{"version":3,"file":"RfcTransport.d.ts","sourceRoot":"","sources":["../../src/connection/RfcTransport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC5C,OAAO,KAAK,EACV,oBAAoB,EAEpB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EACjB,MAAM,oBAAoB,CAAC;AAE5B,sFAAsF;AACtF,MAAM,WAAW,gBAAgB;IAC/B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,IAAI,CACF,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB;AAmCD,qBAAa,YAAa,YAAW,gBAAgB;IA+EjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IA/EzB,QAAQ,CAAC,IAAI,SAAS;IAEtB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,EAAG,QAAQ,CAAU;IAEpC,OAAO,CAAC,YAAY,CAAiC;IACrD,kEAAkE;IAClE,OAAO,CAAC,cAAc,CAAM;IAE5B;;;;;;OAMG;IACH,MAAM,IAAI,IAAI;IAEd,2CAA2C;IAC3C,OAAO,IAAI,IAAI;IAIf;;;;;OAKG;IACG,SAAS,CAAC,QAAQ,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAE9D,+BAA+B;IAC/B,SAAS,IAAI,IAAI;IAIjB;;;OAGG;IACH,cAAc,IAAI,IAAI;IAEtB;;;OAGG;IACH,6EAA6E;IAC7E,kBAAkB,IAAI,OAAO;IAI7B,kBAAkB,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAQzC,2EAA2E;IAC3E,eAAe,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAIzC;;;;OAIG;IACH,aAAa,IAAI,IAAI;IAErB;;;;;OAKG;gBAEgB,OAAO,EAAE,MAAM,gBAAgB,EAC/B,MAAM,GAAE,OAAO,GAAG,IAAW;IAG1C,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;IAiB3B,0DAA0D;IACpD,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAatB,IAAI,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC;CA4I1E"}

package/dist/connection/RfcTransport.js

@@ -187,6 +187,20 @@ class RfcTransport {
             });
         }
         this.logger?.debug(`RFC → ${method} ${uri}`);
+        // `request.timeout` is deliberately not read, and the absence of the word
+        // here is what made that look like an oversight (#42).
+        //
+        // There is nothing to enforce it with: the SDK exposes no cancel, and an
+        // abandoned call still holds the conversation — the next one would queue
+        // behind a call nobody is waiting for. A deadline that reports failure
+        // while the wire stays busy is worse than none, because the error reads as
+        // "safe to retry" when it is not.
+        //
+        // Nor is one needed. What bounds this call is the server: a dialog step
+        // ends at `rdisp/max_wprun_time`. And a call that cannot be torn down
+        // mid-flight is precisely what the connection emulates over HTTP, where
+        // a critical section raises the caller's timeout to a ten-minute ceiling so
+        // an abort cannot orphan a lock handle. Here that comes free.
         let raw;
         try {
             raw = await this.conversation.call('SADT_REST_RFC_ENDPOINT', {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/connection",
-  "version": "6.0.0",
+  "version": "6.0.1",
   "description": "ABAP connection layer for MCP ABAP ADT server",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -55,7 +55,6 @@
     "@mcp-abap-adt/interfaces": "^21.0.0",
     "axios": "^1.16.0",
     "commander": "^14.0.3",
-    "express": "^5.1.0",
     "open": "^11.0.0"
   },
   "optionalDependencies": {