@mcp-abap-adt/proxy 1.6.3 → 2.0.0

package/CHANGELOG.md

@@ -7,6 +7,71 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.0.0] - 2026-08-01
+
+### Breaking Changes
+- **Pasting the authorization code into the proxy's terminal no longer works.** A headless login
+  (`--browser none`/`headless`) used to accept the code three ways; the terminal was one of them.
+  `auth-providers@2.0.0`'s callback strategy reads no stdin at all — deliberately, since under an
+  MCP stdio transport stdin carries the protocol itself, and reading from it there would corrupt
+  the stream. **If you relied on terminal paste**, switch to one of the two remaining paths: let
+  the automatic callback reach the proxy (browser on the same machine), or open
+  `http://<proxy-host>:<browser-auth-port>/` and use the paste form the callback server already
+  serves there — it covers the same "my browser is elsewhere" case without touching stdin. See
+  [Configuration Guide](./docs/CONFIGURATION.md#headless-login---browser-none).
+- **Requires `@mcp-abap-adt/auth-providers` `^2.0.0`** (was `^1.2.0`). That release is what removes
+  the terminal-paste channel above; it also replaces the `browser`/`redirectPort` fields on
+  `AuthorizationCodeProviderConfig` with an `authorization` strategy the consumer supplies. The
+  proxy now builds one with `browserCallbackStrategy({ browser, port, timeoutMs })` at both places
+  it constructs the provider — an internal change with no configuration impact (see below).
+
+### Fixed
+- **The no-destination placeholder broker's callback port collided with the proxy's own.** The
+  `AuthorizationCodeProvider` built for `BtpProxy.create()`'s default broker never had its own
+  port fallback; an unset `browserAuthPort` fell through to `auth-providers@1.2.0`'s internal
+  default of `3001` — the same port the proxy's own HTTP server listens on by default. Making the
+  migration to `auth-providers@2.0.0` explicit is what surfaced it. Both call sites now share the
+  documented `3333` default. This only affects logins with no destination configured, which use
+  placeholder credentials and could never complete a real login anyway.
+
+### Changed
+- **`--browser-auth-port` keeps its meaning and its `3333` default.** Nothing changes for existing
+  configs or CLI invocations — the port still lands inside the strategy instead of a bare config
+  field.
+- **The login timeout is now explicit and longer.** `browserCallbackStrategy` defaults to a
+  30-second `timeoutMs`, sized for an unattended caller; this proxy drives a browser login for a
+  person, so both call sites now pass 5 minutes instead, giving room to open a tab, sign in and
+  clear MFA before the callback server gives up.
+
+## [1.6.4] - 2026-07-29
+
+### Fixed
+- **The two callback-port leaks that 1.6.3 deferred are now closed**, through
+  `@mcp-abap-adt/auth-providers@1.2.0`. 1.6.3 fixed the half that survived stopping the
+  proxy — the orphaned server — and recorded these as outstanding: a callback arriving
+  without a `code` parameter left the socket bound for the lifetime of the process, and a
+  failed token exchange released it about 300 ms after the login promise had already been
+  rejected. Both are gone: the port is released when the login ends by any means, and the
+  promise settles only once the socket is actually free.
+- **An interactive login can no longer strand a port by being abandoned.** The OIDC and
+  SAML flows in the dependency had no timeout at all, so a user who closed the tab left the
+  port held until the process exited. Every flow now has one.
+
+### Changed
+- Requires `@mcp-abap-adt/auth-broker` `^1.0.8` (was `^1.0.7`) and
+  `@mcp-abap-adt/auth-providers` `^1.2.0` (was `^1.1.0`).
+- **`engines.node` is now `>=18.2.0`** (was `>=18.0.0`), matching the floor those packages
+  require for `server.closeAllConnections()`.
+
+### Notes
+- No change in this package's own code. `src/__tests__/bin/callbackPortLifecycle.test.ts`
+  was written in 1.6.3 against behaviour rather than implementation, and passes unchanged
+  against the rewritten dependency — including the case that starts a second proxy on the
+  same configured auth port while the first is still running.
+- Two proxies whose interactive logins overlap still cannot share one `browserAuthPort`.
+  That is inherent: the port is held for the duration of a login.
+
+
 ## [1.6.3] - 2026-07-27
 
 ### Fixed

package/dist/proxy/btpProxy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAYrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA4CnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3D;;;;OAIG;YACW,wBAAwB;IA0FtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,CAAC;IAiHlB;;OAEG;IACH,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA6BhC;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACI,OAAO,IAAI,IAAI;IAStB;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IAiLzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CA0B7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}
+{"version":3,"file":"btpProxy.d.ts","sourceRoot":"","sources":["../../src/proxy/btpProxy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAgB,MAAM,2BAA2B,CAAC;AAgBrE,OAAO,EAAc,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAGhE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AA8DnE;;;GAGG;AACH,wBAAgB,iBAAiB,IAAI,OAAO,CAU3C;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAGD,MAAM,MAAM,YAAY,GAAG,mBAAmB,CAAC;AAE/C,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;QAChB,IAAI,CAAC,EAAE,OAAO,CAAC;KAChB,CAAC;CACH;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,oBAAoB,CAAa;IACzC,OAAO,CAAC,cAAc,CAAsC;IAC5D,OAAO,CAAC,UAAU,CACN;IACZ,OAAO,CAAC,aAAa,CAA0C;IAC/D,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAkB;IAClD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAiB;IACjD,OAAO,CAAC,cAAc,CAAiB;IACvC,OAAO,CAAC,MAAM,CAAc;IAC5B,OAAO,CAAC,MAAM,CAAU;gBAEZ,oBAAoB,EAAE,UAAU,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC;IAqF3E;;;OAGG;IACU,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAwB3D;;;;OAIG;YACW,wBAAwB;IAiGtC;;OAEG;YACW,uBAAuB;IAyFrC;;;;OAIG;IACG,WAAW,CACf,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,OAAe,GAC5B,OAAO,CAAC,MAAM,CAAC;IAiHlB;;OAEG;IACH,OAAO,CAAC,YAAY;IAapB;;;OAGG;IACH,OAAO,CAAC,UAAU;IASlB;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA6BhC;;OAEG;YACW,gBAAgB;IAU9B;;OAEG;IACI,OAAO,IAAI,IAAI;IAStB;;;OAGG;IACG,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAexD;;OAEG;IACH,OAAO,CAAC,cAAc;IAUtB;;;;;;;;;;;;;;;;OAgBG;YACW,iBAAiB;IAmT/B;;OAEG;IACG,YAAY,CAChB,eAAe,EAAE,YAAY,EAC7B,eAAe,EAAE,eAAe,EAChC,eAAe,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,CAAC,GAC7D,OAAO,CAAC,aAAa,CAAC;IAiLzB;;OAEG;WACiB,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;CAuC7E;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAC5B,OAAO,CAAC,QAAQ,CAAC,CAEnB"}

package/dist/proxy/btpProxy.js

@@ -19,6 +19,22 @@ const axios_1 = __importDefault(require("axios"));
 const config_js_1 = require("../lib/config.js");
 const logger_js_1 = require("../lib/logger.js");
 const stores_js_1 = require("../lib/stores.js");
+/**
+ * Default port for the local OAuth2 callback server, kept away from the
+ * proxy's own default HTTP port (3001). auth-providers@2.0.0's own default
+ * (61001) is deliberately not inherited here: this port is documented as
+ * `--browser-auth-port` and may be registered with the identity provider, so
+ * silently moving it would break every proxy already relying on 3333.
+ */
+const DEFAULT_BROWSER_AUTH_PORT = 3333;
+/**
+ * auth-providers@2.0.0's `browserCallbackStrategy` defaults `timeoutMs` to 30
+ * seconds — sized for an unattended caller. Here the login is driven by a
+ * person: a browser tab has to open, and they may need to type credentials or
+ * complete MFA before the redirect lands. Five minutes gives them room to do
+ * that without the callback server tearing itself down mid-login.
+ */
+const INTERACTIVE_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 /**
  * Adapter to convert proxy Logger to ILogger interface expected by AuthBroker
  */
@@ -211,21 +227,28 @@ class BtpProxy {
         }
         // Always use AuthorizationCodeProvider (enforced)
         // Map IAuthorizationConfig (uaaClientId) to ProviderConfig (clientId)
-        // Default redirectPort to 3333 to avoid conflict with main proxy port (default 3001)
+        // How the login is conducted is now a strategy the provider config
+        // carries under `authorization`; the callback port lives inside it.
+        //
+        // uaaUrl/clientId/clientSecret fall back to '' rather than being omitted
+        // when authConfig is missing: AuthorizationCodeProviderConfig declares
+        // them required, and the provider's own constructor already treats an
+        // empty string the same as absent, throwing its "Missing required
+        // fields" ValidationError — which is the clear failure this was always
+        // meant to produce.
         const providerConfig = {
-            browser: this.config.browser,
-            redirectPort: this.config.browserAuthPort || 3333,
-            // Pass a logger so browserAuth can surface the "Open this URL" prompt in
-            // 'none'/'headless' mode. Without it, startBrowserAuth gets a null logger
-            // and silently drops the authorization URL.
+            authorization: (0, auth_providers_1.browserCallbackStrategy)({
+                browser: this.config.browser,
+                port: this.config.browserAuthPort || DEFAULT_BROWSER_AUTH_PORT,
+                timeoutMs: INTERACTIVE_LOGIN_TIMEOUT_MS,
+            }),
+            // Pass a logger so the callback strategy can surface the "Open this
+            // URL" prompt in 'none'/'headless' mode. Without it, the callback
+            // server gets a null logger and silently drops the authorization URL.
             logger: loggerAdapter,
-            ...(authConfig
-                ? {
-                    uaaUrl: authConfig.uaaUrl,
-                    clientId: authConfig.uaaClientId,
-                    clientSecret: authConfig.uaaClientSecret,
-                }
-                : {}),
+            uaaUrl: authConfig?.uaaUrl ?? '',
+            clientId: authConfig?.uaaClientId ?? '',
+            clientSecret: authConfig?.uaaClientSecret ?? '',
         };
         const tokenProvider = new auth_providers_1.AuthorizationCodeProvider(providerConfig);
         broker = new auth_broker_1.AuthBroker({
@@ -928,8 +951,21 @@ class BtpProxy {
                 uaaUrl: 'https://placeholder.authentication.sap.hana.ondemand.com',
                 clientId: 'placeholder',
                 clientSecret: 'placeholder',
-                browser: loadedConfig.browser,
-                redirectPort: loadedConfig.browserAuthPort,
+                authorization: (0, auth_providers_1.browserCallbackStrategy)({
+                    browser: loadedConfig.browser,
+                    // This call site never had its own fallback: it passed
+                    // `redirectPort` straight through and relied on
+                    // auth-providers@1.2.0 defaulting an omitted value to 3001
+                    // internally — which is this proxy's own default `httpPort`
+                    // (src/lib/config.ts). An omitted `browserAuthPort` therefore
+                    // told the callback server to bind the port the proxy already
+                    // listens on, failing every such login with "Port 3001 is
+                    // already in use". Both call sites now share the one documented
+                    // default instead of leaving this one to an invisible, colliding
+                    // number.
+                    port: loadedConfig.browserAuthPort || DEFAULT_BROWSER_AUTH_PORT,
+                    timeoutMs: INTERACTIVE_LOGIN_TIMEOUT_MS,
+                }),
                 logger: loggerAdapter,
             }),
         }, 'none', loggerAdapter);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mcp-abap-adt/proxy",
-  "version": "1.6.3",
+  "version": "2.0.0",
   "description": "MCP proxy server for SAP ABAP ADT - proxies local requests to cloud-llm-hub with JWT authentication",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -62,8 +62,8 @@
     "typescript": "^6.0.3"
   },
   "dependencies": {
-    "@mcp-abap-adt/auth-broker": "^1.0.7",
-    "@mcp-abap-adt/auth-providers": "^1.1.0",
+    "@mcp-abap-adt/auth-broker": "^1.0.8",
+    "@mcp-abap-adt/auth-providers": "^2.0.0",
     "@mcp-abap-adt/auth-stores": "^1.0.4",
     "@mcp-abap-adt/header-validator": "^0.1.8",
     "@mcp-abap-adt/interfaces": "^7.0.0",
@@ -75,7 +75,7 @@
     "zod": "^4.3.6"
   },
   "engines": {
-    "node": ">=18.0.0",
+    "node": ">=18.2.0",
     "npm": ">=9.0.0"
   },
   "files": [