@atxp/client 0.10.4 → 0.10.5

package/dist/index.d.ts

@@ -226,7 +226,9 @@ declare class OAuthClient extends OAuthResourceClient {
     constructor({ userId, db, callbackUrl, clientName, isPublic, fetchFn, sideChannelFetch, strict, allowInsecureRequests, logger }: OAuthClientConfig);
     protected extractResourceUrl: (response: Response) => string | null;
     fetch: FetchLike;
-    makeAuthorizationUrl: (url: string, resourceUrl: string) => Promise<URL>;
+    makeAuthorizationUrl: (url: string, resourceUrl: string, options?: {
+        spendPermissionToken?: string;
+    }) => Promise<URL>;
     handleCallback: (url: string) => Promise<void>;
     getRegistrationMetadata: () => Promise<Partial<oauth.OmitSymbolProperties<oauth.Client>>>;
     protected generatePKCE: (url: string, resourceUrl: string) => Promise<{

package/dist/index.js

@@ -98,7 +98,7 @@ class OAuthClient extends OAuthResourceClient {
             }
             return response;
         };
-        this.makeAuthorizationUrl = async (url, resourceUrl) => {
+        this.makeAuthorizationUrl = async (url, resourceUrl, options) => {
             resourceUrl = this.normalizeResourceServerUrl(resourceUrl);
             const authorizationServer = await this.getAuthorizationServer(resourceUrl);
             const credentials = await this.getClientCredentials(authorizationServer);
@@ -110,6 +110,12 @@ class OAuthClient extends OAuthResourceClient {
             authorizationUrl.searchParams.set('code_challenge', pkceValues.codeChallenge);
             authorizationUrl.searchParams.set('code_challenge_method', 'S256');
             authorizationUrl.searchParams.set('state', pkceValues.state);
+            // Add resource URL so auth server knows which MCP server this is for
+            authorizationUrl.searchParams.set('resource', resourceUrl);
+            // Add spend permission token if provided (for ATXP accounts with scoped spend permissions)
+            if (options?.spendPermissionToken) {
+                authorizationUrl.searchParams.set('spend_permission_token', options.spendPermissionToken);
+            }
             return authorizationUrl;
         };
         this.handleCallback = async (url) => {
@@ -734,7 +740,22 @@ class ATXPFetcher {
                 // We can do the full OAuth flow - we'll generate a signed JWT and call /authorize on the
                 // AS to get a code, then exchange the code for an access token
                 const oauthClient = await this.getOAuthClient();
-                const authorizationUrl = await oauthClient.makeAuthorizationUrl(error.url, error.resourceServerUrl);
+                // Try to create a spend permission before authorization
+                // This allows pre-authorizing spending for MCP servers (returns null for account types that don't support it)
+                let spendPermissionToken = null;
+                try {
+                    const result = await this.account.createSpendPermission(error.resourceServerUrl);
+                    if (result) {
+                        this.logger.info(`Created spend permission for resource ${error.resourceServerUrl}`);
+                        this.logger.debug(`Created spend permission token: ${result.substring(0, 8)}...`);
+                        spendPermissionToken = result;
+                    }
+                }
+                catch (spendPermissionError) {
+                    // Log but don't fail - authorization can still proceed without spend permission
+                    this.logger.warn(`Failed to create spend permission: ${spendPermissionError.message}`);
+                }
+                const authorizationUrl = await oauthClient.makeAuthorizationUrl(error.url, error.resourceServerUrl, spendPermissionToken ? { spendPermissionToken } : undefined);
                 if (!this.isAllowedAuthServer(authorizationUrl)) {
                     throw new Error(`ATXP: resource server ${error.url} is requesting to use ${authorizationUrl} which is not in the allowed list of authorization servers ${this.allowedAuthorizationServers.join(', ')}`);
                 }