@mcp-abap-adt/proxy 1.1.0 → 1.2.0

package/CHANGELOG.md

@@ -7,6 +7,15 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [1.2.0] - 2026-04-20
+
+### Added
+- **Proactive JWT token refresh** — proxy now decodes the `exp` claim from the JWT and refreshes the token in the background 5 minutes before expiry via `authBroker.refreshToken()` (OAuth2 refresh_token grant, preserves role assignment). Eliminates latency spikes from on-demand 401 refreshes while keeping the reactive 401/403 fallback.
+
+### Changed
+- **@mcp-abap-adt/interfaces 7.0** — updated from v6.0 to v7.0
+- **typescript 6.0.3**, **@biomejs/biome 2.4.12**, **@modelcontextprotocol/inspector 0.21.2**, **axios 1.15.1**, **@inquirer/prompts 8.4.2** — patch bumps
+
 ## [1.1.0] - 2026-04-12
 
 ### Changed

package/README.md

@@ -1,4 +1,5 @@
 # @mcp-abap-adt/proxy
+[![Stand With Ukraine](https://raw.githubusercontent.com/vshymanskyy/StandWithUkraine/main/badges/StandWithUkraine.svg)](https://stand-with-ukraine.pp.ua)
 
 MCP proxy server for SAP ABAP ADT - proxies local requests to MCP servers with JWT authentication.
 

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAqBlC;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAoDlE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE1B;;OAEG;YACW,eAAe;IAgG7B;;OAEG;YACW,kBAAkB;IA8ChC;;OAEG;YACW,cAAc;IA6T5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAmBhC;AAGD,eAAe,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAuBH,OAAO,EAEL,KAAK,eAAe,EAErB,MAAM,0BAA0B,CAAC;AAqBlC;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAY;IAC1B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,MAAM,CAAgC;IAC9C,OAAO,CAAC,UAAU,CAAC,CAAa;IAChC,OAAO,CAAC,QAAQ,CAAC,CAAW;gBAEhB,eAAe,CAAC,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM;IAoDlE;;OAEG;IACH,OAAO,CAAC,aAAa;IAMrB;;OAEG;IACG,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC;IAuE1B;;OAEG;YACW,eAAe;IAgG7B;;OAEG;YACW,kBAAkB;IA8ChC;;OAEG;YACW,cAAc;IA6T5B;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC;CAoBhC;AAGD,eAAe,qBAAqB,CAAC"}

package/dist/index.js

@@ -544,6 +544,7 @@ Authorization source: ${authSourceObj}`;
      * Shutdown server
      */
     async shutdown() {
+        this.btpProxy?.dispose();
         try {
             await this.server.close();
         }

package/dist/proxy/btpProxy.d.ts

@@ -38,7 +38,9 @@ export declare class BtpProxy {
     private defaultBtpAuthBroker;
     private btpAuthBrokers;
     private tokenCache;
+    private refreshTimers;
     private readonly TOKEN_CACHE_TTL;
+    private readonly REFRESH_LEAD_MS;
     private circuitBreaker;
     private config;
     private unsafe;
@@ -64,6 +66,27 @@ export declare class BtpProxy {
      * @param forceRefresh Force token refresh
      */
     getJwtToken(destination: string, forceRefresh?: boolean): Promise<string>;
+    /**
+     * Decode JWT exp claim (seconds since epoch). Returns null if not parseable.
+     */
+    private decodeJwtExp;
+    /**
+     * Cache token with expiry derived from JWT, and schedule proactive refresh
+     * 5 minutes before expiry.
+     */
+    private cacheToken;
+    /**
+     * Schedule background refresh REFRESH_LEAD_MS before token expiry.
+     */
+    private scheduleProactiveRefresh;
+    /**
+     * Background refresh via auth-broker's refreshToken grant.
+     */
+    private proactiveRefresh;
+    /**
+     * Cancel all pending refresh timers. Call on shutdown.
+     */
+    dispose(): void;
     /**
      * Get the target service URL for a destination.
      * Priority: config.targetUrl > service key's serviceUrl

package/dist/proxy/btpProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAYrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA4CnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3D;;;;OAIG;YACW,wBAAwB;IAqFtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,CAAC;IAqHlB;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IAiLzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CAyB7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}
+{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAYrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA4CnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAuB3D;;;;OAIG;YACW,wBAAwB;IAqFtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,CAAC;IAiHlB;;OAEG;IACH,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA6BhC;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACI,OAAO,IAAI,IAAI;IAOtB;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IAiLzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CAyB7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}

package/dist/proxy/btpProxy.js

@@ -58,7 +58,9 @@ class BtpProxy {
     defaultBtpAuthBroker;
     btpAuthBrokers = new Map();
     tokenCache = new Map();
-    TOKEN_CACHE_TTL = 30 * 60 * 1000; // 30 minutes
+    refreshTimers = new Map();
+    TOKEN_CACHE_TTL = 30 * 60 * 1000; // fallback if JWT has no exp
+    REFRESH_LEAD_MS = 5 * 60 * 1000; // refresh 5 min before expiry
     circuitBreaker;
     config;
     unsafe;
@@ -349,11 +351,7 @@ class BtpProxy {
                 });
                 // Get token from auth-broker
                 const token = await authBroker.getToken(destination);
-                // Cache token (assume it's valid for 30 minutes)
-                this.tokenCache.set(destination, {
-                    token,
-                    expiresAt: Date.now() + this.TOKEN_CACHE_TTL,
-                });
+                this.cacheToken(destination, token);
                 logger_js_1.logger?.debug('Retrieved JWT token from auth-broker', {
                     type: 'JWT_TOKEN_RETRIEVED',
                     destination,
@@ -404,6 +402,79 @@ class BtpProxy {
             throw new Error(errorMessage);
         }
     }
+    /**
+     * Decode JWT exp claim (seconds since epoch). Returns null if not parseable.
+     */
+    decodeJwtExp(token) {
+        const parts = token.split('.');
+        if (parts.length < 2)
+            return null;
+        try {
+            const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
+            return typeof payload.exp === 'number' ? payload.exp : null;
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * Cache token with expiry derived from JWT, and schedule proactive refresh
+     * 5 minutes before expiry.
+     */
+    cacheToken(destination, token) {
+        const exp = this.decodeJwtExp(token);
+        const expiresAt = exp !== null ? exp * 1000 : Date.now() + this.TOKEN_CACHE_TTL;
+        this.tokenCache.set(destination, { token, expiresAt });
+        this.scheduleProactiveRefresh(destination, expiresAt);
+    }
+    /**
+     * Schedule background refresh REFRESH_LEAD_MS before token expiry.
+     */
+    scheduleProactiveRefresh(destination, expiresAt) {
+        const existing = this.refreshTimers.get(destination);
+        if (existing)
+            clearTimeout(existing);
+        const delay = expiresAt - Date.now() - this.REFRESH_LEAD_MS;
+        if (delay <= 0) {
+            // Token already within lead window or expired; skip scheduling.
+            this.refreshTimers.delete(destination);
+            return;
+        }
+        const timer = setTimeout(() => {
+            this.refreshTimers.delete(destination);
+            this.proactiveRefresh(destination).catch((err) => {
+                logger_js_1.logger?.warn('Proactive token refresh failed, will retry reactively', {
+                    type: 'JWT_TOKEN_PROACTIVE_REFRESH_ERROR',
+                    destination,
+                    error: err instanceof Error ? err.message : String(err),
+                });
+            });
+        }, delay);
+        // Don't keep the event loop alive just for refresh timers.
+        timer.unref?.();
+        this.refreshTimers.set(destination, timer);
+    }
+    /**
+     * Background refresh via auth-broker's refreshToken grant.
+     */
+    async proactiveRefresh(destination) {
+        logger_js_1.logger?.info('Proactively refreshing JWT token', {
+            type: 'JWT_TOKEN_PROACTIVE_REFRESH',
+            destination,
+        });
+        const broker = await this.getOrCreateBtpAuthBroker(destination);
+        const token = await broker.refreshToken(destination);
+        this.cacheToken(destination, token);
+    }
+    /**
+     * Cancel all pending refresh timers. Call on shutdown.
+     */
+    dispose() {
+        for (const timer of this.refreshTimers.values()) {
+            clearTimeout(timer);
+        }
+        this.refreshTimers.clear();
+    }
     /**
      * Get the target service URL for a destination.
      * Priority: config.targetUrl > service key's serviceUrl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/proxy",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "MCP proxy server for SAP ABAP ADT - proxies local requests to cloud-llm-hub with JWT authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -44,9 +44,9 @@
     "access": "public"
   },
   "devDependencies": {
-    "@biomejs/biome": "^2.3.15",
+    "@biomejs/biome": "^2.4.12",
     "@jest/globals": "^30.2.0",
-    "@modelcontextprotocol/inspector": "^0.21.1",
+    "@modelcontextprotocol/inspector": "^0.21.2",
     "@types/jest": "^30.0.0",
     "@types/js-yaml": "^4.0.9",
     "@types/node": "^25.2.3",
@@ -61,18 +61,18 @@
     "rimraf": "^6.1.2",
     "ts-jest": "^29.2.5",
     "tsx": "^4.21.0",
-    "typescript": "^6.0.2"
+    "typescript": "^6.0.3"
   },
   "dependencies": {
-    "@inquirer/prompts": "^8.3.2",
+    "@inquirer/prompts": "^8.4.2",
     "@mcp-abap-adt/auth-broker": "^1.0.5",
     "@mcp-abap-adt/auth-providers": "^1.0.5",
     "@mcp-abap-adt/auth-stores": "^1.0.4",
     "@mcp-abap-adt/header-validator": "^0.1.8",
-    "@mcp-abap-adt/interfaces": "^6.0.0",
+    "@mcp-abap-adt/interfaces": "^7.0.0",
     "@mcp-abap-adt/logger": "^0.1.4",
     "@modelcontextprotocol/sdk": "^1.26.0",
-    "axios": "^1.13.5",
+    "axios": "^1.15.1",
     "js-yaml": "^4.1.1",
     "zod": "^4.3.6"
   },