@mcp-abap-adt/proxy 1.6.4 → 4.0.0

package/dist/proxy/btpProxy.js

@@ -5,20 +5,32 @@
  * For requests with x-sap-destination, proxies to target MCP server
  * with JWT token from auth-broker (XSUAA/BTP)
  */
-var __importDefault = (this && this.__importDefault) || function (mod) {
-    return (mod && mod.__esModule) ? mod : { "default": mod };
-};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BtpProxy = void 0;
 exports.shouldWriteStderr = shouldWriteStderr;
 exports.createBtpProxy = createBtpProxy;
 const auth_broker_1 = require("@mcp-abap-adt/auth-broker");
 const auth_providers_1 = require("@mcp-abap-adt/auth-providers");
-const interfaces_1 = require("@mcp-abap-adt/interfaces");
-const axios_1 = __importDefault(require("axios"));
 const config_js_1 = require("../lib/config.js");
 const logger_js_1 = require("../lib/logger.js");
 const stores_js_1 = require("../lib/stores.js");
+const credentials_js_1 = require("./credentials.js");
+/**
+ * Default port for the local OAuth2 callback server, kept away from the
+ * proxy's own default HTTP port (3001). auth-providers@2.0.0's own default
+ * (61001) is deliberately not inherited here: this port is documented as
+ * `--browser-auth-port` and may be registered with the identity provider, so
+ * silently moving it would break every proxy already relying on 3333.
+ */
+const DEFAULT_BROWSER_AUTH_PORT = 3333;
+/**
+ * auth-providers@2.0.0's `browserCallbackStrategy` defaults `timeoutMs` to 30
+ * seconds — sized for an unattended caller. Here the login is driven by a
+ * person: a browser tab has to open, and they may need to type credentials or
+ * complete MFA before the redirect lands. Five minutes gives them room to do
+ * that without the callback server tearing itself down mid-login.
+ */
+const INTERACTIVE_LOGIN_TIMEOUT_MS = 5 * 60 * 1000;
 /**
  * Adapter to convert proxy Logger to ILogger interface expected by AuthBroker
  */
@@ -54,14 +66,9 @@ function shouldWriteStderr() {
  * BTP Proxy Client
  */
 class BtpProxy {
-    axiosInstance;
     defaultBtpAuthBroker;
     btpAuthBrokers = new Map();
-    tokenCache = new Map();
-    refreshTimers = new Map();
-    TOKEN_CACHE_TTL = 30 * 60 * 1000; // fallback if JWT has no exp
-    REFRESH_LEAD_MS = 5 * 60 * 1000; // refresh 5 min before expiry
-    circuitBreaker;
+    credentials;
     config;
     unsafe;
     constructor(defaultBtpAuthBroker, config) {
@@ -84,53 +91,15 @@ class BtpProxy {
                 type: 'CONFIG_FALLBACK',
             });
         }
-        // Initialize circuit breaker
-        this.circuitBreaker = new errorHandler_js_1.CircuitBreaker(this.config.circuitBreakerThreshold || 5, this.config.circuitBreakerTimeout || 60000);
-        // Create axios instance without baseURL - we'll use full URLs from BTP destination
-        const https = require('node:https');
-        this.axiosInstance = axios_1.default.create({
-            timeout: this.config.requestTimeout || 60000,
-            headers: {
-                [interfaces_1.HEADER_CONTENT_TYPE]: 'application/json',
-            },
-            httpsAgent: new https.Agent({
-                rejectUnauthorized: process.env.NODE_TLS_REJECT_UNAUTHORIZED !== '0',
-                keepAlive: true,
-            }),
-        });
-        // Add request interceptor for logging
-        this.axiosInstance.interceptors.request.use((config) => {
-            logger_js_1.logger?.debug('Proxying request to target service', {
-                type: 'PROXY_REQUEST',
-                method: config.method,
-                url: config.url,
-                baseURL: config.baseURL,
-            });
-            return config;
-        }, (error) => {
-            logger_js_1.logger?.error('Request interceptor error', {
-                type: 'MCP_PROXY_REQUEST_ERROR',
-                error: error instanceof Error ? error.message : String(error),
-            });
-            return Promise.reject(error);
-        });
-        // Add response interceptor for logging
-        this.axiosInstance.interceptors.response.use((response) => {
-            logger_js_1.logger?.debug('Received response from target service', {
-                type: 'PROXY_RESPONSE',
-                status: response.status,
-                url: response.config.url,
-            });
-            return response;
-        }, (error) => {
-            logger_js_1.logger?.error('Response interceptor error', {
-                type: 'MCP_PROXY_RESPONSE_ERROR',
-                error: error instanceof Error ? error.message : String(error),
-                status: error.response?.status,
-                url: error.config?.url,
-            });
-            return Promise.reject(error);
-        });
+        // One credential per destination, over the brokers this class already
+        // caches. The lookup is passed rather than the broker itself so a
+        // destination that has never been seen still gets one built.
+        this.credentials = new credentials_js_1.DestinationCredentials((destination) => this.getOrCreateBtpAuthBroker(destination));
+        // No circuit breaker. It only ever guarded the buffered axios forward that
+        // M2 deleted, and the streaming path has nowhere to put one without
+        // buffering the response again. `circuitBreakerThreshold` and
+        // `circuitBreakerTimeout` are still accepted so existing configs load, and
+        // are documented as inert.
     }
     /**
      * Initialize authentication for destination (eager auth)
@@ -143,7 +112,7 @@ class BtpProxy {
         });
         try {
             // Just getting the token will trigger authentication
-            await this.getJwtToken(destination);
+            await this.getAuthorizationHeader(destination);
             logger_js_1.logger?.info('BTP proxy authentication initialized successfully', {
                 type: 'BTP_PROXY_INIT_SUCCESS',
                 destination,
@@ -211,21 +180,28 @@ class BtpProxy {
         }
         // Always use AuthorizationCodeProvider (enforced)
         // Map IAuthorizationConfig (uaaClientId) to ProviderConfig (clientId)
-        // Default redirectPort to 3333 to avoid conflict with main proxy port (default 3001)
+        // How the login is conducted is now a strategy the provider config
+        // carries under `authorization`; the callback port lives inside it.
+        //
+        // uaaUrl/clientId/clientSecret fall back to '' rather than being omitted
+        // when authConfig is missing: AuthorizationCodeProviderConfig declares
+        // them required, and the provider's own constructor already treats an
+        // empty string the same as absent, throwing its "Missing required
+        // fields" ValidationError — which is the clear failure this was always
+        // meant to produce.
         const providerConfig = {
-            browser: this.config.browser,
-            redirectPort: this.config.browserAuthPort || 3333,
-            // Pass a logger so browserAuth can surface the "Open this URL" prompt in
-            // 'none'/'headless' mode. Without it, startBrowserAuth gets a null logger
-            // and silently drops the authorization URL.
+            authorization: (0, auth_providers_1.browserCallbackStrategy)({
+                browser: this.config.browser,
+                port: this.config.browserAuthPort || DEFAULT_BROWSER_AUTH_PORT,
+                timeoutMs: INTERACTIVE_LOGIN_TIMEOUT_MS,
+            }),
+            // Pass a logger so the callback strategy can surface the "Open this
+            // URL" prompt in 'none'/'headless' mode. Without it, the callback
+            // server gets a null logger and silently drops the authorization URL.
             logger: loggerAdapter,
-            ...(authConfig
-                ? {
-                    uaaUrl: authConfig.uaaUrl,
-                    clientId: authConfig.uaaClientId,
-                    clientSecret: authConfig.uaaClientSecret,
-                }
-                : {}),
+            uaaUrl: authConfig?.uaaUrl ?? '',
+            clientId: authConfig?.uaaClientId ?? '',
+            clientSecret: authConfig?.uaaClientSecret ?? '',
         };
         const tokenProvider = new auth_providers_1.AuthorizationCodeProvider(providerConfig);
         broker = new auth_broker_1.AuthBroker({
@@ -317,170 +293,81 @@ class BtpProxy {
         return broker;
     }
     /**
-     * Get JWT token for BTP destination from auth-broker with retry and token refresh
-     * @param destination Destination name
-     * @param forceRefresh Force token refresh
+     * The `Authorization` header value for a destination, or `null` when this
+     * credential is not a header at all.
+     *
+     * A complete header value, not a token: the caller puts it on the request as
+     * it stands. The credential is asked every time because it renews behind this
+     * call — a cache here would serve the stale token and hide the renewal the
+     * broker exists to do, which is precisely what the token cache, the JWT `exp`
+     * decoder and the per-destination refresh timer that used to live here did.
+     *
+     * Retried, because a refusal here is not always an answer. In the standalone
+     * proxy an authentication failure is FATAL — it exits so something can start
+     * it again — so without this a single transient UAA 503 kills a proxy that
+     * used to ride it out. Only failures that can get better are retried;
+     * `isRetryableError` says which, and a missing service key is not one of
+     * them, so it fails on the first attempt instead of three times slower.
      */
-    async getJwtToken(destination, forceRefresh = false) {
-        logger_js_1.logger?.info('Getting JWT token', {
-            type: 'JWT_TOKEN_GET_START',
+    async getAuthorizationHeader(destination) {
+        logger_js_1.logger?.debug('Asking the credential for a header', {
+            type: 'CREDENTIAL_HEADER_GET',
             destination,
         });
-        const authBroker = await this.getOrCreateBtpAuthBroker(destination);
-        // Check cache first (unless force refresh)
-        if (!forceRefresh) {
-            const cached = this.tokenCache.get(destination);
-            if (cached && cached.expiresAt > Date.now()) {
-                logger_js_1.logger?.debug('Using cached JWT token', {
-                    type: 'JWT_TOKEN_CACHE_HIT',
-                    destination,
-                });
-                return cached.token;
-            }
-        }
-        // Retry logic for token retrieval
         const retryOptions = {
             maxRetries: this.config.maxRetries || 3,
             retryDelay: this.config.retryDelay || 1000,
             retryableStatusCodes: [500, 502, 503, 504],
         };
         try {
-            const token = await (0, errorHandler_js_1.retryWithBackoff)(async () => {
-                // Clear cache if force refresh
-                if (forceRefresh) {
-                    this.tokenCache.delete(destination);
-                }
-                logger_js_1.logger?.debug('Getting JWT token from auth-broker', {
-                    type: 'JWT_TOKEN_REQUEST_START',
-                    destination,
-                    forceRefresh,
-                });
-                // Get token from auth-broker
-                const token = await authBroker.getToken(destination);
-                this.cacheToken(destination, token);
-                logger_js_1.logger?.debug('Retrieved JWT token from auth-broker', {
-                    type: 'JWT_TOKEN_RETRIEVED',
-                    destination,
-                    forceRefresh,
-                });
-                return token;
+            return await (0, errorHandler_js_1.retryWithBackoff)(async () => {
+                const { credential } = await this.credentials.get(destination);
+                return credential.authorizationHeader();
             }, retryOptions);
-            return token;
         }
         catch (error) {
-            let errorMessage = error instanceof Error ? error.message : String(error);
-            // Rewrite error message to remove .env file references (proxy only uses service keys)
-            if (errorMessage.includes('.env') || errorMessage.includes('mcp.env')) {
-                const searchedInMatch = errorMessage.match(/Searched in:\s*([\s\S]*?)(?:\n|$)/);
-                const searchedPaths = searchedInMatch
-                    ? searchedInMatch[1]
-                        .trim()
-                        .split('\n')
-                        .map((p) => p.trim().replace(/^-\s*/, ''))
-                        .filter((p) => p)
-                    : [];
-                errorMessage =
-                    `Service key file not found for destination "${destination}".\n` +
-                        `Please create service key file: ${destination}.json\n`;
-                if (searchedPaths.length > 0) {
-                    errorMessage += `Searched in:\n`;
-                    searchedPaths.forEach((path) => {
-                        errorMessage += `  - ${path}\n`;
-                    });
-                }
-                else {
-                    const isWindows = process.platform === 'win32';
-                    const homeDir = require('node:os').homedir();
-                    const defaultPath = isWindows
-                        ? require('node:path').join(homeDir, 'Documents', 'mcp-abap-adt', 'service-keys')
-                        : require('node:path').join(homeDir, '.config', 'mcp-abap-adt', 'service-keys');
-                    errorMessage += `Searched in:\n  - ${defaultPath}\n`;
-                }
-            }
-            logger_js_1.logger?.error('Failed to get JWT token from auth-broker after retries', {
-                type: 'JWT_TOKEN_ERROR',
+            const message = this.explainAuthFailure(error, destination);
+            logger_js_1.logger?.error('Failed to get an authorization header', {
+                type: 'CREDENTIAL_HEADER_ERROR',
                 destination,
-                error: errorMessage,
+                error: message,
             });
             if (shouldWriteStderr()) {
-                process.stderr.write(`[MCP Proxy] ✗ ${errorMessage}`);
+                process.stderr.write(`[MCP Proxy] ✗ ${message}\n`);
             }
-            throw new Error(errorMessage);
+            throw new Error(message);
         }
     }
     /**
-     * Decode JWT exp claim (seconds since epoch). Returns null if not parseable.
-     */
-    decodeJwtExp(token) {
-        const parts = token.split('.');
-        if (parts.length < 2)
-            return null;
-        try {
-            const payload = JSON.parse(Buffer.from(parts[1], 'base64url').toString('utf8'));
-            return typeof payload.exp === 'number' ? payload.exp : null;
-        }
-        catch {
-            return null;
-        }
-    }
-    /**
-     * Cache token with expiry derived from JWT, and schedule proactive refresh
-     * 5 minutes before expiry.
-     */
-    cacheToken(destination, token) {
-        const exp = this.decodeJwtExp(token);
-        const expiresAt = exp !== null ? exp * 1000 : Date.now() + this.TOKEN_CACHE_TTL;
-        this.tokenCache.set(destination, { token, expiresAt });
-        this.scheduleProactiveRefresh(destination, expiresAt);
-    }
-    /**
-     * Schedule background refresh REFRESH_LEAD_MS before token expiry.
-     */
-    scheduleProactiveRefresh(destination, expiresAt) {
-        const existing = this.refreshTimers.get(destination);
-        if (existing)
-            clearTimeout(existing);
-        const delay = expiresAt - Date.now() - this.REFRESH_LEAD_MS;
-        if (delay <= 0) {
-            // Token already within lead window or expired; skip scheduling.
-            this.refreshTimers.delete(destination);
-            return;
-        }
-        const timer = setTimeout(() => {
-            this.refreshTimers.delete(destination);
-            this.proactiveRefresh(destination).catch((err) => {
-                logger_js_1.logger?.warn('Proactive token refresh failed, will retry reactively', {
-                    type: 'JWT_TOKEN_PROACTIVE_REFRESH_ERROR',
-                    destination,
-                    error: err instanceof Error ? err.message : String(err),
-                });
-            });
-        }, delay);
-        // Don't keep the event loop alive just for refresh timers.
-        timer.unref?.();
-        this.refreshTimers.set(destination, timer);
-    }
-    /**
-     * Background refresh via auth-broker's refreshToken grant.
+     * Turn the broker's failure into one that names what this proxy needs.
+     *
+     * The broker speaks of `.env` and `mcp.env` because it can be fed either way.
+     * This proxy only ever reads service keys, so passing that message through
+     * told the most common failure — a missing key — to go and create a file that
+     * would be ignored.
      */
-    async proactiveRefresh(destination) {
-        logger_js_1.logger?.info('Proactively refreshing JWT token', {
-            type: 'JWT_TOKEN_PROACTIVE_REFRESH',
-            destination,
-        });
-        const broker = await this.getOrCreateBtpAuthBroker(destination);
-        const token = await broker.refreshToken(destination);
-        this.cacheToken(destination, token);
+    explainAuthFailure(error, destination) {
+        const original = error instanceof Error ? error.message : String(error);
+        if (!original.includes('.env') && !original.includes('mcp.env')) {
+            return original;
+        }
+        const searched = original.match(/Searched in:\s*([\s\S]*?)(?:\n\n|$)/);
+        const paths = searched
+            ? searched[1]
+                .trim()
+                .split('\n')
+                .map((p) => p.trim().replace(/^-\s*/, ''))
+                .filter(Boolean)
+            : [(0, stores_js_1.storeDir)('service-keys')];
+        return [
+            `Service key file not found for destination "${destination}".`,
+            `Please create service key file: ${destination}.json`,
+            'Searched in:',
+            ...paths.map((p) => `  - ${p}`),
+        ].join('\n');
     }
-    /**
-     * Cancel all pending refresh timers. Call on shutdown.
-     */
     dispose() {
-        for (const timer of this.refreshTimers.values()) {
-            clearTimeout(timer);
-        }
-        this.refreshTimers.clear();
-        this.tokenCache.clear();
+        this.credentials.clear();
         this.btpAuthBrokers.clear();
     }
     /**
@@ -499,421 +386,6 @@ class BtpProxy {
         throw new Error(`No target URL found for destination "${destination}". ` +
             `Set targetUrl in config or ensure service key contains abap.url.`);
     }
-    /**
-     * Helper function to extract string value from header (handles arrays)
-     */
-    getHeaderValue(headerValue) {
-        if (!headerValue)
-            return undefined;
-        if (Array.isArray(headerValue)) {
-            return headerValue[0]?.trim();
-        }
-        return typeof headerValue === 'string' ? headerValue.trim() : undefined;
-    }
-    /**
-     * Build proxy request with JWT token (BTP authentication only)
-     *
-     * Process flow:
-     *
-     * 1. BTP Authentication (XSUAA):
-     *    1.1 If x-sap-destination header exists:
-     *        - Check map for broker with key = destination, get or create, save to map
-     *        - Get token from xsuaa broker
-     *        - Add/replace Authorization: Bearer <token> header
-     *    1.2 If header doesn't exist but --btp parameter exists:
-     *        - Use destination from parameter, get or create broker, save to map
-     *        - Get token from xsuaa broker
-     *        - Add/replace Authorization: Bearer <token> header
-     *    1.3 If neither header nor parameter:
-     *        - Do nothing, pass request further
-     */
-    async buildProxyRequest(originalRequest, routingDecision, originalHeaders, forceTokenRefresh = false) {
-        logger_js_1.logger?.info('=== BUILD PROXY REQUEST - ORIGINAL ===', {
-            type: 'BUILD_PROXY_REQUEST_ORIGINAL',
-            originalRequestId: originalRequest.id,
-            originalRequestIdType: typeof originalRequest.id,
-            originalRequestMethod: originalRequest.method,
-            fullOriginalRequest: JSON.stringify(originalRequest),
-        });
-        // Build headers for target MCP server
-        const proxyHeaders = {
-            [interfaces_1.HEADER_CONTENT_TYPE]: 'application/json',
-            [interfaces_1.HEADER_ACCEPT]: 'application/json, application/x-ndjson, text/event-stream',
-        };
-        // ============================================
-        // BTP Authentication (XSUAA)
-        // ============================================
-        const btpDestinationHeader = this.getHeaderValue(originalHeaders[interfaces_1.HEADER_SAP_DESTINATION]);
-        const btpDestinationFromParam = routingDecision.btpDestination && !btpDestinationHeader
-            ? routingDecision.btpDestination
-            : undefined;
-        let btpDestination;
-        if (btpDestinationHeader) {
-            btpDestination = btpDestinationHeader;
-            logger_js_1.logger?.debug('Using x-sap-destination from header', {
-                type: 'BTP_DESTINATION_FROM_HEADER',
-                destination: btpDestination,
-            });
-        }
-        else if (btpDestinationFromParam) {
-            btpDestination = btpDestinationFromParam;
-            logger_js_1.logger?.debug('Using x-sap-destination from parameter', {
-                type: 'BTP_DESTINATION_FROM_PARAM',
-                destination: btpDestination,
-            });
-        }
-        if (btpDestination) {
-            const _btpBroker = await this.getOrCreateBtpAuthBroker(btpDestination);
-            const existingAuth = originalHeaders[interfaces_1.HEADER_AUTHORIZATION.toLowerCase()] ||
-                originalHeaders[interfaces_1.HEADER_AUTHORIZATION];
-            const hasExistingAuth = !!existingAuth;
-            const authToken = await this.getJwtToken(btpDestination, forceTokenRefresh);
-            proxyHeaders[interfaces_1.HEADER_AUTHORIZATION] = `Bearer ${authToken}`;
-            logger_js_1.logger?.debug(hasExistingAuth
-                ? 'Replaced existing Authorization header with BTP token'
-                : 'Added BTP Cloud authorization token', {
-                type: hasExistingAuth
-                    ? 'BTP_AUTH_TOKEN_REPLACED'
-                    : 'BTP_AUTH_TOKEN_ADDED',
-                destination: btpDestination,
-                hadExistingAuth: hasExistingAuth,
-            });
-        }
-        else {
-            logger_js_1.logger?.debug('No BTP destination - skipping authentication', {
-                type: 'BTP_AUTH_SKIPPED',
-            });
-        }
-        // Preserve other SAP headers if provided by client
-        const sapHeaders = [interfaces_1.HEADER_SAP_CLIENT, interfaces_1.HEADER_SAP_DESTINATION_SERVICE];
-        for (const headerName of sapHeaders) {
-            const value = originalHeaders[headerName];
-            if (value) {
-                proxyHeaders[headerName] = Array.isArray(value) ? value[0] : value;
-            }
-        }
-        // Get MCP server URL from BTP destination service key
-        let baseUrl;
-        if (btpDestination) {
-            try {
-                const btpBroker = await this.getOrCreateBtpAuthBroker(btpDestination, routingDecision.targetUrl);
-                const connConfig = await btpBroker.getConnectionConfig(btpDestination);
-                // Use service key URL as base (if available)
-                if (connConfig?.serviceUrl) {
-                    baseUrl = connConfig.serviceUrl;
-                    logger_js_1.logger?.debug('Using MCP URL from BTP destination service key', {
-                        type: 'MCP_URL_FROM_BTP_DESTINATION',
-                        destination: btpDestination,
-                        url: baseUrl,
-                    });
-                }
-                else {
-                    logger_js_1.logger?.warn('BTP destination service key does not contain service URL', {
-                        type: 'BTP_DESTINATION_NO_URL',
-                        destination: btpDestination,
-                    });
-                }
-            }
-            catch (error) {
-                logger_js_1.logger?.warn('Failed to get URL from BTP destination service key', {
-                    type: 'BTP_DESTINATION_URL_ERROR',
-                    destination: btpDestination,
-                    error: error instanceof Error ? error.message : String(error),
-                });
-            }
-        }
-        // Apply Target URL override logic
-        if (routingDecision.targetUrl) {
-            if (baseUrl) {
-                logger_js_1.logger?.debug('Overriding service key URL with explicit target URL', {
-                    type: 'TARGET_URL_OVERRIDE',
-                    url: routingDecision.targetUrl,
-                    serviceKeyUrl: baseUrl,
-                });
-            }
-            else {
-                logger_js_1.logger?.debug('Using explicit target URL from configuration', {
-                    type: 'TARGET_URL_FROM_CONFIG',
-                    url: routingDecision.targetUrl,
-                });
-            }
-            baseUrl = routingDecision.targetUrl;
-        }
-        if (!baseUrl) {
-            throw new Error('Cannot determine target URL: provide btpDestination with service key containing URL OR use --target-url');
-        }
-        // Construct full MCP endpoint URL
-        let fullUrl;
-        // Determine the path to append
-        // If original request has a URL/path, use it. Otherwise default to nothing/root.
-        const requestPath = originalRequest.url || '';
-        // Check if we should use URL as-is
-        // 1. If it already looks like an MCP URL
-        // 2. OR if it was explicitly provided via targetUrl (user knows best)
-        const isExplicitTarget = !!routingDecision.targetUrl;
-        const hasMcpPath = baseUrl.includes('/mcp/') ||
-            baseUrl.endsWith('/mcp') ||
-            baseUrl.includes('/mcp/stream/');
-        if (isExplicitTarget) {
-            // Explicit Target URL logic (as per User request):
-            // "whatever endpoint [proxy] received, it adds to the target URL"
-            // Use join logic to avoid double slashes and ensure correctness
-            // Remove trailing slash from base
-            const base = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;
-            // Ensure path starts with slash if not empty
-            const path = requestPath.startsWith('/')
-                ? requestPath
-                : `/${requestPath}`;
-            // If requestPath is empty or just '/', ensure we don't end up with empty path if base is root
-            // But typically we just append.
-            fullUrl = `${base}${path}`;
-            logger_js_1.logger?.debug('Using explicit target URL with forwarded path', {
-                type: 'TARGET_URL_PATH_FORWARDING',
-                base,
-                path,
-                final: fullUrl,
-            });
-        }
-        else if (hasMcpPath) {
-            // Use as-is (strip trailing slash if present, though typically not needed if strictly as-is, but good practice for consistency)
-            fullUrl = baseUrl.endsWith('/') ? baseUrl.slice(0, -1) : baseUrl;
-            logger_js_1.logger?.debug('Using target URL as-is', {
-                type: 'MCP_URL_AS_IS',
-                original: baseUrl,
-                final: fullUrl,
-                reason: 'path detection',
-            });
-        }
-        else {
-            // Default: append MCP path
-            const mcpPath = '/mcp/stream/http';
-            fullUrl = baseUrl.endsWith('/')
-                ? `${baseUrl.slice(0, -1)}${mcpPath}`
-                : `${baseUrl}${mcpPath}`;
-            logger_js_1.logger?.debug('Appended MCP path to base URL', {
-                type: 'MCP_URL_APPENDED',
-                original: baseUrl,
-                final: fullUrl,
-            });
-        }
-        const builtHeaders = {};
-        for (const [key, value] of Object.entries(proxyHeaders)) {
-            const lowerKey = key.toLowerCase();
-            if (lowerKey.includes('token') ||
-                lowerKey.includes('authorization') ||
-                lowerKey.includes('password') ||
-                lowerKey.includes('secret')) {
-                builtHeaders[key] = value
-                    ? `${String(value).substring(0, 20)}...`
-                    : '[REDACTED]';
-            }
-            else {
-                builtHeaders[key] = String(value || '');
-            }
-        }
-        const sanitizedRequestParams = {};
-        const requestData = originalRequest.data;
-        if (requestData &&
-            requestData.params &&
-            typeof requestData.params === 'object' &&
-            requestData.params !== null) {
-            const params = requestData.params;
-            // ... (existing sanitization logic) ...
-            if (params.arguments &&
-                typeof params.arguments === 'object' &&
-                params.arguments !== null) {
-                sanitizedRequestParams.arguments = {};
-                const sanitizedArgs = sanitizedRequestParams.arguments;
-                for (const [key, value] of Object.entries(params.arguments)) {
-                    const lowerKey = key.toLowerCase();
-                    if (lowerKey.includes('password') ||
-                        lowerKey.includes('token') ||
-                        lowerKey.includes('secret')) {
-                        sanitizedArgs[key] = '[REDACTED]';
-                    }
-                    else {
-                        sanitizedArgs[key] = value;
-                    }
-                }
-            }
-            for (const [key, value] of Object.entries(params)) {
-                if (key === 'arguments')
-                    continue;
-                sanitizedRequestParams[key] = value;
-            }
-        }
-        logger_js_1.logger?.info('=== BUILDING PROXY REQUEST ===', {
-            type: 'PROXY_REQUEST_BUILT',
-            btpDestination: btpDestination,
-            url: fullUrl,
-            headers: builtHeaders,
-            baseUrl,
-            fullUrl,
-            hasAuthToken: !!proxyHeaders[interfaces_1.HEADER_AUTHORIZATION],
-            btpSource: btpDestinationHeader
-                ? 'header'
-                : btpDestinationFromParam
-                    ? 'parameter'
-                    : 'none',
-            requestMethod: originalRequest.method,
-            requestId: originalRequest.id,
-            requestParams: sanitizedRequestParams,
-        });
-        // Return axios config with full URL
-        // Use original request method
-        const axiosConfig = {
-            method: originalRequest.method,
-            url: fullUrl,
-            headers: proxyHeaders,
-            data: originalRequest.data, // Send the original data (body)
-        };
-        logger_js_1.logger?.debug('Axios request config', {
-            type: 'AXIOS_REQUEST_CONFIG',
-            method: axiosConfig.method,
-            url: axiosConfig.url,
-            headers: Object.keys(axiosConfig.headers),
-            dataKeys: originalRequest ? Object.keys(originalRequest) : [],
-        });
-        return axiosConfig;
-    }
-    /**
-     * Proxy MCP request to target server with retry, circuit breaker, and error handling
-     */
-    async proxyRequest(originalRequest, routingDecision, originalHeaders) {
-        // Check circuit breaker
-        if (!this.circuitBreaker.canProceed()) {
-            logger_js_1.logger?.warn('Circuit breaker is open, rejecting request', {
-                type: 'CIRCUIT_BREAKER_REJECTED',
-                btpDestination: routingDecision.btpDestination,
-            });
-            return (0, errorHandler_js_1.createErrorResponse)(originalRequest.id || null, -32001, 'Service temporarily unavailable (circuit breaker open)', { circuitBreakerState: this.circuitBreaker.getState() });
-        }
-        const retryOptions = {
-            maxRetries: this.config.maxRetries || 3,
-            retryDelay: this.config.retryDelay || 1000,
-            retryableStatusCodes: [500, 502, 503, 504],
-        };
-        try {
-            let forceTokenRefresh = false;
-            const executeRequest = async () => {
-                const proxyConfig = await this.buildProxyRequest(originalRequest, routingDecision, originalHeaders, forceTokenRefresh);
-                // Log outgoing request details
-                const outgoingHeaders = {};
-                for (const [key, value] of Object.entries(proxyConfig.headers || {})) {
-                    const lowerKey = key.toLowerCase();
-                    if (lowerKey.includes('token') ||
-                        lowerKey.includes('authorization') ||
-                        lowerKey.includes('password') ||
-                        lowerKey.includes('secret')) {
-                        outgoingHeaders[key] = value
-                            ? `${String(value).substring(0, 20)}...`
-                            : '[REDACTED]';
-                    }
-                    else {
-                        outgoingHeaders[key] = String(value || '');
-                    }
-                }
-                const sanitizedOutgoingBody = {};
-                if (proxyConfig.data && typeof proxyConfig.data === 'object') {
-                    if (proxyConfig.data.params &&
-                        typeof proxyConfig.data.params === 'object' &&
-                        proxyConfig.data.params !== null) {
-                        const params = proxyConfig.data.params;
-                        sanitizedOutgoingBody.params = {};
-                        const sanitizedParams = sanitizedOutgoingBody.params;
-                        if (params.arguments &&
-                            typeof params.arguments === 'object' &&
-                            params.arguments !== null) {
-                            sanitizedParams.arguments = {};
-                            const sanitizedArgs = sanitizedParams.arguments;
-                            for (const [key, value] of Object.entries(params.arguments)) {
-                                const lowerKey = key.toLowerCase();
-                                if (lowerKey.includes('password') ||
-                                    lowerKey.includes('token') ||
-                                    lowerKey.includes('secret')) {
-                                    sanitizedArgs[key] = '[REDACTED]';
-                                }
-                                else {
-                                    sanitizedArgs[key] = value;
-                                }
-                            }
-                        }
-                        for (const [key, value] of Object.entries(params)) {
-                            if (key === 'arguments')
-                                continue;
-                            sanitizedParams[key] = value;
-                        }
-                    }
-                    sanitizedOutgoingBody.method = proxyConfig.data.method;
-                    sanitizedOutgoingBody.id = proxyConfig.data.id;
-                    sanitizedOutgoingBody.jsonrpc = proxyConfig.data.jsonrpc;
-                }
-                logger_js_1.logger?.info('=== SENDING PROXY REQUEST ===', {
-                    type: 'PROXY_REQUEST_SENDING',
-                    url: proxyConfig.url,
-                    headers: outgoingHeaders,
-                    body: sanitizedOutgoingBody,
-                });
-                const response = await this.axiosInstance.request(proxyConfig);
-                this.circuitBreaker.recordSuccess();
-                return response;
-            };
-            const response = await (0, errorHandler_js_1.retryWithBackoff)(async () => {
-                try {
-                    return await executeRequest();
-                }
-                catch (error) {
-                    if (!forceTokenRefresh && (0, errorHandler_js_1.isTokenExpirationError)(error)) {
-                        const destination = routingDecision.btpDestination ||
-                            this.getHeaderValue(originalHeaders[interfaces_1.HEADER_SAP_DESTINATION]);
-                        logger_js_1.logger?.warn('Token expired, retrying with refreshed token', {
-                            type: 'TOKEN_EXPIRED_RETRY',
-                            destination,
-                        });
-                        if (destination) {
-                            this.tokenCache.delete(destination);
-                        }
-                        forceTokenRefresh = true;
-                        return await executeRequest();
-                    }
-                    throw error;
-                }
-            }, retryOptions);
-            // Return response in JSON-RPC format
-            return {
-                jsonrpc: '2.0',
-                id: originalRequest.id || null,
-                result: response.data.result,
-                error: response.data.error,
-            };
-        }
-        catch (error) {
-            this.circuitBreaker.recordFailure();
-            let statusCode = 500;
-            let errorMessage = 'Internal Server Error';
-            let errorData;
-            if (axios_1.default.isAxiosError(error)) {
-                statusCode = error.response?.status || 500;
-                errorMessage = error.message;
-                errorData = error.response?.data;
-                logger_js_1.logger?.error('Axios error in proxy request', {
-                    type: 'AXIOS_PROXY_ERROR',
-                    status: statusCode,
-                    message: errorMessage,
-                    data: errorData,
-                    url: error.config?.url,
-                });
-            }
-            else {
-                errorMessage = error instanceof Error ? error.message : String(error);
-                logger_js_1.logger?.error('Generic error in proxy request', {
-                    type: 'GENERIC_PROXY_ERROR',
-                    message: errorMessage,
-                });
-            }
-            return (0, errorHandler_js_1.createErrorResponse)(originalRequest.id || null, -32000, `Proxy error: ${errorMessage}`, errorData);
-        }
-    }
     /**
      * Create a new BtpProxy instance
      */
@@ -928,8 +400,21 @@ class BtpProxy {
                 uaaUrl: 'https://placeholder.authentication.sap.hana.ondemand.com',
                 clientId: 'placeholder',
                 clientSecret: 'placeholder',
-                browser: loadedConfig.browser,
-                redirectPort: loadedConfig.browserAuthPort,
+                authorization: (0, auth_providers_1.browserCallbackStrategy)({
+                    browser: loadedConfig.browser,
+                    // This call site never had its own fallback: it passed
+                    // `redirectPort` straight through and relied on
+                    // auth-providers@1.2.0 defaulting an omitted value to 3001
+                    // internally — which is this proxy's own default `httpPort`
+                    // (src/lib/config.ts). An omitted `browserAuthPort` therefore
+                    // told the callback server to bind the port the proxy already
+                    // listens on, failing every such login with "Port 3001 is
+                    // already in use". Both call sites now share the one documented
+                    // default instead of leaving this one to an invisible, colliding
+                    // number.
+                    port: loadedConfig.browserAuthPort || DEFAULT_BROWSER_AUTH_PORT,
+                    timeoutMs: INTERACTIVE_LOGIN_TIMEOUT_MS,
+                }),
                 logger: loggerAdapter,
             }),
         }, 'none', loggerAdapter);