@sap/cds-dk 7.9.6 → 8.0.3

package/lib/mtx/download_legacy.js

@@ -23,13 +23,13 @@ module.exports = class Download {
         }
 
         console.log(`Downloading migrated @sap/mtx extension project(s)`);
-        const downloadedTgz = await this.getTgz(params);
+        const downloadedTgz = await this.pullTgz(params);
         await fs.promises.writeFile(downloadPath, downloadedTgz);
 
         console.log(`Finished.`);
     }
 
-    static async getTgz(params) {
+    static async pullTgz(params) {
         const tagRule = params.get('tagRule');
         const defaultTag = params.get('defaultTag');
         const downloadUrl = `${(params.get('appUrl'))}/-/cds/extensibility/getMigratedProjects`;

package/lib/mtx/index.js

@@ -1,12 +1,8 @@
-const Activate = require('./activate');
 const AuthManager = require('./auth_manager');
-const Extend = require('./extend');
 const { SettingsManager } = require('./settings_manager');
 const Question = require('./util/question');
 
 module.exports = {
-    extend: Extend.run,
-    activate: Activate.run,
     login: AuthManager.login,
     logout: AuthManager.logout,
     question: Question,

package/lib/mtx/params.js

@@ -36,7 +36,7 @@ class Param {
      * @param options constructor options
      */
     constructor(name,
-                val,
+                val = undefined,
                 options = {}) {
 
         this.persist = Persistence.none;
@@ -44,6 +44,11 @@ class Param {
         this.abbreviate = false;
         this.internal = false;
         this.allowedValues = null;
+        this.type = val === undefined
+            ? this.allowedValues
+                ? typeof this.allowedValues[0]
+                : 'string'  // default
+            : typeof val;
 
         this.name = name;
         this._val = val;
@@ -102,12 +107,8 @@ class Param {
         if (val === undefined) {
             return; // Allow `undefined` always.
         }
-        let expectedType = typeof this.val;
-        if (expectedType === 'undefined' && this.allowedValues) {
-            expectedType = typeof this.allowedValues[0];
-        }
-        if (typeof val !== expectedType) {
-            throw `Failed to set '${(this.name)}' = ${JSON.stringify(val)}: expected value of type ${expectedType}`;
+        if (typeof val !== this.type) {
+            throw `Failed to set '${(this.name)}' = ${JSON.stringify(val)}: expected value of type ${this.type}`;
         }
         if (this.allowedValues && !(this.allowedValues).includes(val)) {
             throw `Failed to set '${(this.name)}' = ${JSON.stringify(val)}: expected one of ${JSON.stringify(this.allowedValues)}`;
@@ -125,7 +126,7 @@ class Param {
             ? undefined
             : this.obfuscate === ObfuscationLevel.none && (!this.abbreviate || process.env.DEBUG)
                 ? this.val
-                : this.obfuscate === ObfuscationLevel.partial && process.env.DEBUG && typeof this.val === 'string'
+                : this.obfuscate === ObfuscationLevel.partial && process.env.DEBUG && this.type === 'string'
                     ? this.val.slice(0, DISCLOSURE_LENGTH) + '...' + this.val.slice(-DISCLOSURE_LENGTH)
                     : '...';
     }
@@ -161,48 +162,44 @@ class BasicParams {
     constructor() {
         // GENERAL PARAMS
         // - non-persisted
-        this.projectFolder          = new Param('projectFolder',          '');
+        this.projectFolder          = new Param('projectFolder');
         this.directory              = this.projectFolder.newAlias('directory');
 
-        this.tagRule                = new Param('tagRule', '');
-        this.defaultTag             = new Param('defaultTag', '');
-
-        // - non-persisted, internal
-        this.reqAuth                = new Param('reqAuth',                null, { obfuscate: ObfuscationLevel.full, internal: true });
-        this.clearOtherTokenStorage = new Param('clearOtherTokenStorage', false, { internal: true });
-
         // - persisted
-        this.appUrl                 = new Param('appUrl',                 '', { persist: Persistence.setting }); // any trailing slash (/) is removed
+        this.appUrl                 = new Param('appUrl',                 undefined, { persist: Persistence.setting }); // any trailing slash (/) is removed
         this.url                    = this.appUrl.newAlias('url');
         this.from                   = this.appUrl.newAlias('from');
         this.to                     = this.appUrl.newAlias('to');
         this.at                     = this.appUrl.newAlias('at');
-        this.subdomain              = new Param('subdomain',              '', { persist: Persistence.setting }); // only needed to fetch token
-        this.passcodeUrl            = new Param('passcodeUrl',            '', { persist: Persistence.setting, abbreviate: true });
+        this.subdomain              = new Param('subdomain',              undefined, { persist: Persistence.setting }); // only needed to fetch token
+        this.passcodeUrl            = new Param('passcodeUrl',            undefined, { persist: Persistence.setting, abbreviate: true });
         this.passcode_url           = this.passcodeUrl.newAlias('passcode_url');
-        this.tokenUrl               = new Param('tokenUrl',               '', { persist: Persistence.setting, abbreviate: true })
+        this.tokenUrl               = new Param('tokenUrl',               undefined, { persist: Persistence.setting, abbreviate: true })
 
         // AUTH PARAMS
         // - non-persisted
-        this.passcode               = new Param('passcode',               '', { obfuscate: ObfuscationLevel.partial });
+        this.passcode               = new Param('passcode',               undefined, { obfuscate: ObfuscationLevel.partial });
+        this.password               = new Param('password',               undefined, { obfuscate: ObfuscationLevel.full });
+        this.clientid               = new Param('clientid',               undefined);
+        this.clientsecret           = new Param('clientsecret',           undefined, { obfuscate: ObfuscationLevel.partial });
+        this.key                    = new Param('key',                    undefined, { obfuscate: ObfuscationLevel.partial }); // private key of client certificate
         this.tokenStorage           = new Param('tokenStorage',           undefined, { allowedValues: ['plain', 'keyring'] });
+        this.clearOtherTokenStorage = new Param('clearOtherTokenStorage', false, { internal: true });
         this.plain                  = new Param('plain',                  false, { internal: true }); // for backward compatibility - superseded by tokenStorage
         this.saveData               = new Param('saveData',               false, { internal: true });
-        this.renewLogin             = new Param('renewLogin',             false);
-        this.password               = new Param('password',               '', { obfuscate: ObfuscationLevel.full });
-        this.clientid               = new Param('clientid',               '');
-        this.clientsecret           = new Param('clientsecret',           '', { obfuscate: ObfuscationLevel.partial });
-        this.key                    = new Param('key',                    '', { obfuscate: ObfuscationLevel.partial }); // private key of client certificate
+        this.renewLogin             = new Param('renewLogin',             false, { internal: true });
+        this.reqAuth                = new Param('reqAuth',                undefined, { internal: true, type: 'object', obfuscate: ObfuscationLevel.full });
 
         // - persisted
-        this.username               = new Param('username',               '', { persist: Persistence.setting }); // only saved against localhost (non-productive); as setting due to ambiguous app URL
+        this.username               = new Param('username',               undefined, { persist: Persistence.setting }); // only saved against localhost (non-productive); as setting due to ambiguous app URL
         this.isEmptyPassword        = new Param('isEmptyPassword',        false, { internal: true, persist: Persistence.setting }); // extra param so we can ensure we never save a password
-        this.token                  = new Param('token',                  '', { persist: Persistence.auth, obfuscate: ObfuscationLevel.partial });
+        this.token                  = new Param('token',                  undefined, { persist: Persistence.auth, obfuscate: ObfuscationLevel.partial });
         this.tokenExpirationDate    = new Param('tokenExpirationDate',    Number.MAX_SAFE_INTEGER, { persist: Persistence.auth });
-        this.refreshToken           = new Param('refreshToken',           '', { persist: Persistence.auth, obfuscate: ObfuscationLevel.partial });
+        this.refreshToken           = new Param('refreshToken',           undefined, { persist: Persistence.auth, obfuscate: ObfuscationLevel.partial });
     }
 }
 
+// TODO pass these as extra arguments to lib functions
 /**
  * All known params including those needed for specific commands.
  */
@@ -211,28 +208,25 @@ class AllParams extends BasicParams {
         super();
 
         // `extend` PARAMS
-        this.force                  = new Param('force',                  false);
-        this.templates              = new Param('templates',              false);
-        this["download-migrated-projects"]   = new Param('download-migrated-projects', false)
+        this.defaultTag             = new Param('defaultTag',             undefined);
+        this.tagRule                = new Param('tagRule',                undefined);
 
-        // `activate` PARAMS
-        this.undeploy               = new Param('undeploy',               false);
-        this.wsdl                   = new Param('wsdl',                   false);
+        // `push` PARAMS
         this.sync                   = new Param('sync',                   false);
         this.async                   = new Param('async',                 false);
 
         // `subscribe` PARAMS
-        this.body                   = new Param('body',                   '', { persist: Persistence.none });
+        this.body                   = new Param('body',                   undefined, { internal: true, persist: Persistence.none });
 
         // `login` PARAMS
         this.skipToken              = new Param('skipToken',              false, { internal: true });
+        this.saveRefreshToken       = new Param('saveRefreshToken',       false, { internal: true });
 
         // `logout` PARAMS
         this.deleteSettings         = new Param('deleteSettings',         false);
         this["delete-settings"]     = this.deleteSettings.newAlias('delete-settings');
         this.clearInvalid           = new Param('clearInvalid',           false);
         this["clear-invalid"]       = this.clearInvalid.newAlias('clear-invalid');
-
     }
 }
 
@@ -411,7 +405,7 @@ class ParamCollection {
     }
 
     /**
-     * Return an object mapping each of the contained params' names to its corresponding value.
+     * Return an object mapping the names of each of the contained params to their corresponding values.
      * @param persistence the type of persistence to filter for (omit to disable filtering)
      */
     toEntries(persistence) {

package/lib/mtx/pull.js

@@ -2,7 +2,7 @@ const cds = require ('../cds')
 const { local, tar } = cds.utils;
 
 const fs = require('fs');
-const { join } = require('path');
+const { join, dirname } = require('path');
 const axios = require('axios');
 
 const { login } = require('./auth_manager');
@@ -10,73 +10,181 @@ const { login } = require('./auth_manager');
 require('../util/axios').pruneErrors();
 const { getMessage } = require('./util/logging');
 const { handleHttpError } = require('./util/errors');
+const { grepQR } = require('./util/fs');
+const { escapeRegex } = require('./util/strings');
 
-module.exports = class Pull {
+function tabSize(jsonString, defaultSize) {
+    return /^ +/m.exec(jsonString)?.[0].length ?? defaultSize;
+}
 
-    static async run(paramValues) {
-        if (!tar) {
-            throw `cds pull requires @sap/cds version >= 6.2. Current version is ${cds.version}\n`;
+function getPackageContentsAndTabSize(pkgPath, defaultContents = undefined, defaultTabSize = 0) {
+    try {
+        const contents = fs.readFileSync(pkgPath, { encoding: 'utf-8' });
+        const tab = tabSize(contents, defaultTabSize);
+        return [JSON.parse(contents), tab];
+    } catch (error) {
+        if (defaultContents) {
+            return [defaultContents, defaultTabSize];
         }
+        throw getMessage('package.json missing or unreadable', { error });
+    }
+}
+
+function writeObj(obj, objPath, tabSize) {
+    if (!fs.existsSync(dirname(objPath))) {
+        fs.mkdirSync(dirname(objPath), { recursive: true });
+    }
+    fs.writeFileSync(objPath, JSON.stringify(obj, undefined, tabSize), { encoding: 'utf-8' });
+}
+
+const INVALID_BASE_MODEL_NAME = /^[._]/; // See https://docs.npmjs.com/cli/v10/configuring-npm/package-json#name
 
+
+module.exports = class Pull {
+
+    static async run(paramValues) {
         const params = await login(paramValues);
-        const url = params.get('appUrl')
-        const projectFolder = params.get('projectFolder');
-        const env = cds.env.for('cds', projectFolder);
-        const target = join(projectFolder, 'node_modules', this.getAppPackageName(env));
-        const subdomain = params.get('subdomain') // REVISIT: Why are subdomains not transparently encoded in URLs?
+        return new Pull(params).run();
+    }
+
+    params;
+    projectFolder;
+    env;
+    baseModelName;
+    packagePath;
+    baseModelFolder;
+    #amendPackage = {};
+    #baseModelWorkspace;
+    #packageContentsAndTabSize;
+
+    static get DEFAULTS() {
+        return {
+            tabSize: 2,
+            baseModelFolder: '.base',
+            baseModelName: 'base-model'
+        };
+    }
+
+    constructor(params) {
+        this.params = params;
+        this.projectFolder = params.get('projectFolder');
+        this.env = cds.env.for('cds', this.projectFolder);
+        this.baseModelName = this.env.extends;
+        this.packagePath = join(this.projectFolder, 'package.json');
+        this.baseModelFolder = join(this.projectFolder, this.baseModelWorkspace);
+    }
 
-        this.amendPackageJson(projectFolder, env);
+    async run() {
+        console.log(`Pulling app base model`, {
+            from: this.params.get('appUrl'),
+            to: local(this.baseModelFolder),
+            ...(this.params.has('subdomain') && { subdomain: this.params.get('subdomain') })
+        });
 
-        console.log(`Pulling app base model`, Object.assign({ from: url, to: local(target) }, subdomain && {subdomain}))
+        this.validateBaseModelName();
 
-        fs.rmSync(target, { force: true, recursive: true });
-        fs.mkdirSync(target, { recursive: true });
+        fs.rmSync(this.baseModelFolder, { force: true, recursive: true });
+        fs.mkdirSync(this.baseModelFolder, { recursive: true });
 
-        const baseModelTgz = await this.getTgz(params);
-        await tar.xz(baseModelTgz).to(target);
+        const baseModelTgz = await this.pullTgz();
+        await tar.xz(baseModelTgz).to(this.baseModelFolder);
+        Pull.transformBasePackage(this.baseModelFolder, this.baseModelName);
+        this.amendExtPackage();
 
-        console.log(`Finished. Refer to the base model like so:   using from '${this.getAppPackageName(env)}'`);
+        console.log(`Finished. Refer to the base model like so:   using from '${this.baseModelName}'`);
+
+        const baseModelSymlink = join(this.projectFolder, 'node_modules', this.baseModelName);
+        if (!fs.statSync(baseModelSymlink, { throwIfNoEntry: false })?.isSymbolicLink()) {
+            console.log(`Note: the base model has been pulled to an NPM workspace in folder '${local(this.baseModelFolder)}'. Run 'npm install' to install it.`);
+        }
     }
 
-    static getAppPackageName(env) {
-        return env.extends || '_base';
+    get baseModelWorkspace() {
+        const defaultFolder = Pull.DEFAULTS.baseModelFolder;
+        if (!this.#baseModelWorkspace) {
+            if (this.packageContents.workspaces) {
+                if (this.packageContents.workspaces.includes(defaultFolder)) {
+                    this.#baseModelWorkspace = defaultFolder;
+                } else {
+                    this.#baseModelWorkspace = this.packageContents.workspaces
+                        .map(ws => String(ws))
+                        .find(ws => {
+                            try {
+                                return require(join(this.projectFolder, ws, 'package.json')).name === this.baseModelName;
+                            } catch (e) { /* ignore */ }
+                        }) ?? defaultFolder;
+                }
+            } else {
+                this.#amendPackage.workspaces = [defaultFolder];
+                this.#baseModelWorkspace = defaultFolder;
+            }
+        }
+        return this.#baseModelWorkspace;
+    }
+
+    validateBaseModelName() {
+        if (!this.baseModelName) {
+            throw getMessage(`Missing configuration 'cds.extends' in package.json`);
+        }
+        if (this.baseModelName.match(INVALID_BASE_MODEL_NAME)) {
+            console.warn(`Invalid base-model name '${this.baseModelName}': must not start with '_' or '.'. ` +
+                `Using '${Pull.DEFAULTS.baseModelName}' instead.`);
+            const invalidNameInUse = grepQR(this.projectFolder, ['.cds', '.csn'], new RegExp(`\\b${escapeRegex(this.baseModelName)}\\b`));
+            if (invalidNameInUse) {
+                console.error(`Some model files seem to reference the invalid name. Please update them manually.`);
+            }
+            this.baseModelName = Pull.DEFAULTS.baseModelName;
+            this.#amendPackage.extends = this.baseModelName;
+        }
     }
 
-    static async getTgz(params) {
-        const pullUrl = `${(params.get('appUrl'))}/-/cds/extensibility/pull`;
-        const options = { ...params.get('reqAuth'), responseType: 'arraybuffer' };
+    async pullTgz() {
+        const pullUrl = `${(this.params.get('appUrl'))}/-/cds/extensibility/pull`;
+        const options = { ...this.params.get('reqAuth'), responseType: 'arraybuffer' };
 
         return axios.post(pullUrl, {}, options)
             .then(response => Buffer.from(response.data))
-            .catch(error => handleHttpError(error, params, { url: pullUrl }));
+            .catch(error => handleHttpError(error, this.params, { url: pullUrl }));
     }
 
-    static getPackageJsonIndentation(packageContents) {
-        return /^ +/m.exec(packageContents)?.[0].length ?? 2;
-    }
+    static transformBasePackage(baseModelFolder, baseModelName) {
+        const baseRcPath = join(baseModelFolder, '.cdsrc.json');
+        const baseRc = getPackageContentsAndTabSize(baseRcPath, {}, this.DEFAULTS.tabSize)[0];
+        fs.rmSync(baseRcPath, { force: true });
+
+        const basePkgPath = join(baseModelFolder, 'package.json');
+        const basePkg = {
+            ...getPackageContentsAndTabSize(basePkgPath, {}, this.DEFAULTS.tabSize)[0],
+            name: baseModelName,
+            cds: baseRc
+        };
 
-    static formatPackageJson(newObj, oldContents) {
-        return JSON.stringify(newObj, undefined, this.getPackageJsonIndentation(oldContents));
+        writeObj(basePkg, basePkgPath, this.DEFAULTS.tabSize);
     }
 
-    static amendPackageJson(projectFolder, env) {
-        if ('extends' in env) {
+    amendExtPackage() {
+        if (Object.keys(this.#amendPackage).length === 0) {
             return;
         }
         console.log(`Amending extension package.json with project configuration`);
-        const packageJson = join(projectFolder, 'package.json');
-        let packageContents;
-        try {
-            packageContents = JSON.parse(fs.readFileSync(packageJson, { encoding: 'utf-8' }));
-        } catch (error) {
-            throw getMessage('package.json missing or unreadable', { error });
+        fs.writeFileSync(this.packagePath, JSON.stringify({
+            ...this.packageContents,
+            ...this.#amendPackage
+        }, undefined, this.tabSize));
+        this.#packageContentsAndTabSize = undefined;
+    }
+
+    get packageContents() {
+        if (!this.#packageContentsAndTabSize) {
+            this.#packageContentsAndTabSize = getPackageContentsAndTabSize(this.packagePath, undefined, Pull.DEFAULTS.tabSize);
         }
-        fs.writeFileSync(packageJson, this.formatPackageJson({
-            ...packageContents,
-            cds: {
-                ...(packageContents.cds ?? {}),
-                extends: this.getAppPackageName(projectFolder) // Default unless configured through current process.env
-            }
-        }));
+        return this.#packageContentsAndTabSize[0];
+    }
+
+    get tabSize() {
+        if (!this.#packageContentsAndTabSize) {
+            this.#packageContentsAndTabSize = getPackageContentsAndTabSize(this.packagePath, undefined, Pull.DEFAULTS.tabSize);
+        }
+        return this.#packageContentsAndTabSize[1];
     }
 }

package/lib/mtx/push.js

@@ -1,4 +1,4 @@
-const cds = require ('../cds'), { local } = cds.utils;
+const { utils: { local }} = require ('../cds');
 const { join } = require('path');
 const { readFileSync, existsSync } = require('fs');
 const axios = require('axios');
@@ -33,7 +33,7 @@ module.exports = class Push {
         const { src, content } = await this.readSource(params, pushOptions);
         const url = params.get('appUrl');
         const subdomain = params.get('subdomain');
-        const target = Object.assign({ url }, subdomain && { subdomain });
+        const target = { url, ...subdomain && { subdomain } };
 
         console.log(`\nPushing extension '${extensionName}' from`, { src }, 'to', target);
         const push = await this.pushTgz(params, content, extensionName);
@@ -51,7 +51,7 @@ module.exports = class Push {
             src = local(src);
         } else {
             if (!schemaRegex.test(src)) {
-                throw getMessage(`Nonexistent path: ${src}`, { command: 'push' });
+                throw getMessage(`Non-existent path: ${src}`, { command: 'push' });
             }
             try {
                 content = (await axios.get(src, { responseEncoding: 'base64' })).data;

package/lib/mtx/settings_manager.js

@@ -8,6 +8,7 @@ const cds = require('../cds');
 const { requireGlobal } = require('./util/dependencies');
 const { getAppFromSuggestions, getSubdomain } = require('./util/cf');
 const isBas = require('./util/env');
+const { getMessage } = require('./util/logging');
 const Question = require('./util/question');
 const { httpSchema, httpsSchema, schemaRegex, localhostRegex } = require('./util/urls');
 const { capitalize } = require('./util/strings');
@@ -34,8 +35,9 @@ const KEYRING_DESC = {
 };
 
 const MTX_FULLY_QUALIFIED = 'com.sap.cds.mtx';
-const OAUTH_PATH_OLD_MTX = '/mtx/v1/oauth/token';
-const OAUTH_PATH_STREAMLINED_MTX = '/-/cds/login/token';
+const OAUTH_PATH_LEGACY = '/mtx/v1/oauth/token';
+const OAUTH_PATH = '/-/cds/login/token';
+const OAUTH_META_PATH = '/-/cds/login/authorization-metadata';
 
 const SETTINGS_DIR = path.join(os.homedir(), CONFIG_SUBDIRS[os.platform()] || '', MTX_FULLY_QUALIFIED);
 const SETTINGS_FILE = 'projects.json';
@@ -92,30 +94,46 @@ async function getSubdomainFromCfAndNotify(appName) {
     return subdomain;
 }
 
-async function getTokenBaseUrl(params, renewUrl) {
+function appUrlWith(pathname, params) {
+    const url = new URL(params.get('appUrl'));
+    url.pathname = url.pathname.replace(/\/*$/, pathname);
+    return url.toString();
+}
+
+async function getTokenUrl(params, renewUrl) {
     if (params.has('tokenUrl') && !renewUrl) {
         return params.get('tokenUrl');
     }
     if (!params.has('appUrl')) {
         throw 'Failed to determine token URL: app URL not given';
     }
-    const appUrlWith = pathname => {
-        const url = new URL(params.get('appUrl'));
-        url.pathname = url.pathname.replace(/\/*$/, pathname);
-        return url.toString();
-    };
+    return appUrlWith(OAUTH_PATH, params);
+}
 
-    let path = OAUTH_PATH_OLD_MTX;
+async function fetchPasscodeUrl(params) {
+    const url = appUrlWith(OAUTH_META_PATH, params);
+    DEBUG?.(`Trying to get passcode URL from GET`, url);
+    let responseData;
     try {
-        await axios.head(appUrlWith(OAUTH_PATH_STREAMLINED_MTX));
-        path = OAUTH_PATH_STREAMLINED_MTX;
+        const response = await axios.get(url /* no auth required */);
+        responseData = response.data;
     } catch (error) {
-        if (![401, 404].includes(error.status)) {
-            throw error;
+        if (error.status === 404) {
+            DEBUG?.(`Request unsupported by server, ignoring (${error.message.replace(/ *Details:.*/s, '')})`);
+        } else {
+            DEBUG?.(getMessage(`Getting passcode URL failed`, { error }));
         }
-        DEBUG?.(`Falling back to legacy token URL: ${error.message}`);
+        return undefined;
+    }
+    DEBUG?.(`Received ${JSON.stringify(responseData)}`);
+    if (responseData.includes?.('<html')) {
+        throw 'HTML response received. Check if route to MTX is configured correctly in App Router.';
     }
-    return appUrlWith(path);
+    if (responseData.signed_metadata) {
+        DEBUG?.(`Unsupported signed metadata received. Since these should take precedence, ignoring response.`);
+        return undefined;
+    }
+    return responseData.passcode_url;
 }
 
 function getKeyringAccountName(params) {
@@ -135,7 +153,7 @@ function logConfigPaths() {
     DEBUG?.(`Authentication data is stored in ${CONFIG.paths.auth} (${TOKEN_STORAGE_DESC.plain}) or ${CONFIG.keyringDesignation} (${TOKEN_STORAGE_DESC.keyring})`);
 }
 
-function notifyLoggedIn(params) {
+function notifyLogin(params) {
     return params.get('renewLogin')
            ? console.log.bind(console)
            : DEBUG;
@@ -201,8 +219,13 @@ class SettingsManager {
         const loadedSettings = await this._loadFromFile(projectFolder);
         DEBUG?.(`Loaded project settings for ${params.get('projectFolder')}: ${loadedSettings.format()}`);
 
+        const clashing = ['passcode', 'clientid', 'username'].filter(param => params.has(param));
+        if (clashing.length > 1) {
+            throw `Conflicting parameters: ${clashing.join(', ')}. Please provide only one of them.`;
+        }
+
         if (params.has('passcode') && loadedSettings.has('username')) {
-            console.log(`Unsetting username${(loadedSettings.has('isEmptyPassword') ? ' and empty-password hint' : '')}`);
+            console.log(`Discarding saved username${(loadedSettings.has('isEmptyPassword') ? ' and empty-password hint' : '')}: passcode given`);
             loadedSettings.delete('username');
             loadedSettings.delete('isEmptyPassword');
         }
@@ -219,6 +242,23 @@ class SettingsManager {
     }
 
     static async updateUrls(params, logout, loadedSettings) {
+        function secure(url, label) {
+            if (!url) {
+                return url;
+            }
+            if (url.startsWith(httpSchema) && !localhostRegex.test(url)) {
+                url = url.replace(httpSchema, httpsSchema);
+                DEBUG?.(`Replaced HTTP with HTTPS in ${label}: ${url}`);
+            } else if (!schemaRegex.test(url)) {
+                if (localhostRegex.test(url)) {
+                    url = httpSchema + url;
+                } else {
+                    url = httpsSchema + url;
+                }
+                DEBUG?.(`Added schema to ${label}: ${url}`);
+            }
+            return url;
+        }
         async function updateAppUrl() {
             if (!logout && !params.has('appUrl')) {
                 // Get appUrl from CF
@@ -231,30 +271,23 @@ class SettingsManager {
             }
 
             // Prefix URL schema
-            let appUrl = params.get('appUrl');
+            let appUrl = secure(params.get('appUrl'), 'app URL');
             if (appUrl.endsWith('/')) {
                 appUrl = appUrl.replace(/\/+$/, '');
                 DEBUG?.(`Removed trailing slash from app URL: ${appUrl}`);
             }
-            if (!schemaRegex.test(appUrl)) {
-                if (localhostRegex.test(appUrl)) {
-                    appUrl = httpSchema + appUrl;
-                } else {
-                    appUrl = httpsSchema + appUrl;
-                }
-                DEBUG?.(`Added schema to app URL: ${appUrl}`);
-            }
             params.set('appUrl', appUrl);
             if (params.get('appUrl') !== loadedSettings.get('appUrl')) {
-                DEBUG?.(`Updated app URL from '${loadedSettings.get('appUrl')}' (loaded) to '${appUrl}'`);
+                DEBUG?.(`Updated app URL from loaded value '${loadedSettings.get('appUrl')}'`);
             }
+            console.log(`App URL: ${params.get('appUrl')}`);
         }
         async function updateTokenUrl() {
-            const tokenUrl = params.get('tokenUrl');
+            const tokenUrl = secure(params.get('tokenUrl'), 'token URL');
             const renewUrl = !logout && !params.get('skipToken')
-                && (!tokenUrl || tokenUrl.includes('//-/cds') || tokenUrl.includes(OAUTH_PATH_OLD_MTX) || params.get('appUrl') !== loadedSettings.get('appUrl'));
+                && (!tokenUrl || tokenUrl.includes('//-/cds') || tokenUrl.includes(OAUTH_PATH_LEGACY) || params.get('appUrl') !== loadedSettings.get('appUrl'));
             if (renewUrl) {
-                const tokenUrl = await getTokenBaseUrl(params, renewUrl);
+                const tokenUrl = await getTokenUrl(params, renewUrl);
                 params.set('tokenUrl', tokenUrl);
                 DEBUG?.(`Updated token URL from '${loadedSettings.get('tokenUrl')}' (loaded) to '${tokenUrl}'`);
             }
@@ -317,7 +350,13 @@ class SettingsManager {
             }
         }
         async function addPasscode() {
-            const prompt = `Passcode${params.get('passcodeUrl') ? ' (visit ' + params.get('passcodeUrl') + ' to generate)' : ''}: `;
+            if (!params.has('passcodeUrl')) {
+                const passcodeUrl = await fetchPasscodeUrl(params);
+                if (passcodeUrl) {
+                    params.set('passcodeUrl', passcodeUrl);
+                }
+            }
+            const prompt = `Passcode${params.has('passcodeUrl') ? ' (visit ' + params.get('passcodeUrl') + ' to generate)' : ''}: `;
             params.set('passcode', (await Question.askQuestion(prompt, undefined, true)).trim());
             console.log();
             if (params.get('passcode') === '') {
@@ -515,7 +554,7 @@ class SettingsManager {
             (allAuthValues[appUrl] || (allAuthValues[appUrl] = {}))[params.get('subdomain')] = authValues;
             await fs.promises.mkdir(path.dirname(CONFIG.paths.auth), { recursive: true })
             await fs.promises.writeFile(CONFIG.paths.auth, JSON.stringify(allAuthValues, null, 2));
-            notifyLoggedIn(params)?.(`Saved authentication data to ${location}`);
+            notifyLogin(params)?.(`Saved authentication data to ${location}`);
         } else if (allAuthValues[appUrl]) {
             delete allAuthValues[appUrl][params.get('subdomain')];
             if (Object.keys(allAuthValues[appUrl]).length === 0) {
@@ -525,7 +564,7 @@ class SettingsManager {
             await fs.promises.writeFile(CONFIG.paths.auth, JSON.stringify(allAuthValues, null, 2));
             console.log('Deleted authentication data from', location);
         } else {
-            notifyLoggedIn(params)?.(`No authentication data to delete from ${location}`);
+            notifyLogin(params)?.(`No authentication data to delete from ${location}`);
         }
     }
 
@@ -538,7 +577,7 @@ class SettingsManager {
 
         if (auth !== null) {
             await keytar.setPassword(MTX_FULLY_QUALIFIED, getKeyringAccountName(params), JSON.stringify(auth));
-            notifyLoggedIn(params)?.(`Saved authentication data to ${location}`);
+            notifyLogin(params)?.(`Saved authentication data to ${location}`);
         } else {
             await keytar.deletePassword(MTX_FULLY_QUALIFIED, getKeyringAccountName(params));
             console.log('Deleted authentication data from', location);
@@ -663,5 +702,6 @@ class SettingsManager {
 
 module.exports = {
     SettingsManager,
-    other
+    other,
+    notifyLogin
 };