@mcp-abap-adt/interfaces-auth-broker 1.0.1 → 1.1.0

package/CHANGELOG.md

@@ -7,6 +7,20 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.1.0] - 2026-10-02
+
+### Added
+
+- **`IConnectionConfig.issuedFor` and `issuedBy`** (optional strings) — what a
+  stored secret is bound to: the canonical URI of the resource it was obtained
+  for (`https://host:443/path?sap-client=100`), and of who issued it to which
+  client (`<uaaUrl or issuer>?client_id=<id>`, or the ACS that set SAML
+  cookies). A session store keeps both beside the secret, written and cleared
+  with it; a key store never answers them. They are what
+  `@mcp-abap-adt/auth-broker` 4 compares before it presents a stored secret, so
+  a custom `ISessionStore` must persist them — see the README's note for store
+  authors. Optional: every 1.0.x implementation still satisfies the type.
+
 ## [1.0.1] - 2026-10-02
 
 ### Changed

package/README.md

@@ -10,7 +10,7 @@ npm install @mcp-abap-adt/interfaces-auth-broker
 
 | symbol | what it is |
 |---|---|
-| `IConnectionConfig` | a destination's connection settings, as a store hands them to the broker: `serviceUrl`, `sapClient`, `language`, the credential (`authorizationToken`, `username`/`password`, `sessionCookies`), `authType`, `grantType`, `expiresAt`, and the settings a grant needs — SNC (`snc*`), OIDC (`oidc*`) and the SAML IdP's trust (`saml*`) |
+| `IConnectionConfig` | a destination's connection settings, as a store hands them to the broker: `serviceUrl`, `sapClient`, `language`, the credential (`authorizationToken`, `username`/`password`, `sessionCookies`), `authType`, `grantType`, `expiresAt`, what a stored secret is bound to (`issuedFor`, `issuedBy`), and the settings a grant needs — SNC (`snc*`), OIDC (`oidc*`) and the SAML IdP's trust (`saml*`) |
 | `DestinationGrant` | how a destination obtains a new credential: the UAA, OIDC and SAML grants, or `'none'` — handed over, not renewed |
 | `IConfig` | `Partial<IAuthorizationConfig> & Partial<IConnectionConfig>` — what a session store loads and saves |
 | `ISessionStore` | loads, saves and updates a destination's session |
@@ -38,6 +38,19 @@ Kept apart, a release of the destination — new grant settings for the broker
 no longer asks every provider and connection to follow, and a change to the
 SAP system's configuration no longer reaches the stores.
 
+## For store authors: the secret's binding (1.1.0)
+
+A session store keeps two strings beside the secret — `issuedFor`, the
+canonical URI of the resource the secret was obtained for, and `issuedBy`, the
+canonical URI of who issued it and to which client — written and cleared with
+the secret. The broker (`@mcp-abap-adt/auth-broker` 4) uses a stored secret
+only when both equal what the destination's means give, so a secret never goes
+to another resource and a secret from another issuer is never used in place of
+this one. **A custom `ISessionStore` (a database, a message log, a secret store)
+must persist both fields**; one that drops them still type-checks, but the
+broker then never uses its sessions — every process start logs in afresh, a
+browser each time for an interactive grant. A key store never answers them.
+
 ## Where these contracts were
 
 `@mcp-abap-adt/interfaces-auth-sap`, until its 2.0.0 — same names, same shapes;

package/dist/auth/IConnectionConfig.d.ts

@@ -24,6 +24,25 @@ export interface IConnectionConfig {
      * provider reported it. A JWT carries its own `exp`; session cookies do not.
      */
     expiresAt?: number;
+    /**
+     * The canonical URI of the resource the secret was obtained for: scheme and
+     * host lower-cased, the port explicit, the path without a trailing `/`, the
+     * SAP client as `sap-client=<n>` when the destination states one, nothing
+     * else (`https://my-abap.example.com:443/sap/bc/adt?sap-client=100`). A
+     * session store keeps it with the secret, written and cleared with it; a key
+     * store never answers it. Compared as a string: whoever presents the secret
+     * compares it with the URI of the resource it is about to be presented to,
+     * and uses the secret only when they are equal.
+     */
+    issuedFor?: string;
+    /**
+     * The canonical URI of who issued the secret, and to which client — the same
+     * rules: for an OAuth/OIDC token the authorization server and the client
+     * (`<uaaUrl or issuer>?client_id=<clientId>`), for SAML session cookies the
+     * ACS of the system that set them (origin and path). Kept, written, cleared
+     * and compared like `issuedFor`.
+     */
+    issuedBy?: string;
     /** SAP client number (optional, for ABAP/BTP) */
     sapClient?: string;
     /** Language (optional, for ABAP/BTP) */

package/dist/auth/IConnectionConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IConnectionConfig.d.ts","sourceRoot":"","sources":["../../src/auth/IConnectionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAC5C,8FAA8F;IAC9F,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IAIxB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IAKnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAG5B,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}
+{"version":3,"file":"IConnectionConfig.d.ts","sourceRoot":"","sources":["../../src/auth/IConnectionConfig.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAE3D;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,uFAAuF;IACvF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,yFAAyF;IACzF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,KAAK,GAAG,MAAM,GAAG,KAAK,CAAC;IAC5C,8FAA8F;IAC9F,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iDAAiD;IACjD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wCAAwC;IACxC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IAIxB,qDAAqD;IACrD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sGAAsG;IACtG,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,iEAAiE;IACjE,SAAS,CAAC,EAAE,MAAM,CAAC;IAKnB,yEAAyE;IACzE,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,+BAA+B,CAAC,EAAE,MAAM,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,mEAAmE;IACnE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,mCAAmC;IACnC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,6CAA6C;IAC7C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,mCAAmC;IACnC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAG5B,mCAAmC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,2CAA2C;IAC3C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,uFAAuF;IACvF,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,mEAAmE;IACnE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,8EAA8E;IAC9E,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/interfaces-auth-broker",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "The broker's port: the destination (IConnectionConfig, DestinationGrant, IConfig) and the stores that hold it",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",