Skip to content

v0.4.0 — adopt @arc-mcp/xsuaa-auth

Choose a tag to compare

View all tags
@ClementRingot ClementRingot released this 18 Jun 12:54
· 124 commits to main since this release
v0.4.0
f3ad75a

Adopt the shared @arc-mcp/xsuaa-auth package, retiring LISA's in-tree XSUAA OAuth + DCR + OAuth-state + BTP modules (mirrors arc-1 #456). Net ~-2,100 LOC, behaviour preserved.

Highlights

  • Auth + BTP connectivity now sourced from @arc-mcp/xsuaa-auth (incl. the public-PKCE fix, 0.1.2+).
  • LISA keeps its own transport wiring, /oauth/callback handler, DCR signing secret, and 3-tool surface.
  • Shared toPackageLogger() routes package auth + principal-propagation diagnostics into LISA's (redacted) log stream.
  • Preserves LISA's redirect-uri allowlist, api-key:<profile> identity (timing-safe), optional OIDC audience, authenticate-only model.
  • express 4 -> 5; MCP SDK floor ^1.18.2.
  • New per-landscape deploy tooling: btp:deploy-dev / btp:deploy-sbx, gitignored mta-overrides*.mtaext, per-subaccount xsappname guidance.

Validation

build / lint / 26 tests green, plus a live BTP sandbox deploy (XSUAA OAuth + public-PKCE end-to-end). Code + security reviews clean.

PR: #2

🤖 Generated with Claude Code

Assets 2
Loading