powerautomate-mcp 0.7.1 → 0.7.4

package/dist/index.js

@@ -1006,6 +1006,11 @@ async function createWamAuthProvider(config, silentOnly = false) {
         "No cached credentials available. Run 'powerautomate-mcp --setup' first to authenticate."
       );
     }
+    if (currentAccount) {
+      throw new AuthenticationError(
+        `Silent token acquisition failed for scopes: ${mutableScopes.join(", ")}. Resource may not be registered in the app registration. Re-run --setup to update permissions.`
+      );
+    }
     try {
       const result = await pca.acquireTokenInteractive({
         scopes: mutableScopes,
@@ -1036,6 +1041,19 @@ async function createWamAuthProvider(config, silentOnly = false) {
       const result = await acquireToken(SCOPES.FLOW);
       return result.accessToken;
     },
+    async tryGetTokenForResourceSilent(resource) {
+      try {
+        validateHttpsUrl(resource, "Token resource");
+        const url = new URL(resource);
+        if (!isAllowedTokenDomain(url.hostname)) return null;
+        if (!currentAccount) return null;
+        const scopes = [`${resource}/.default`];
+        const result = await pca.acquireTokenSilent({ scopes, account: currentAccount });
+        return result.accessToken;
+      } catch {
+        return null;
+      }
+    },
     async getTokenForResource(resource) {
       validateHttpsUrl(resource, "Token resource");
       const url = new URL(resource);
@@ -14800,6 +14818,11 @@ async function createDeviceCodeAuthProvider(config, silentOnly = false) {
         "No cached credentials available. Run 'powerautomate-mcp --setup' first to authenticate."
       );
     }
+    if (currentAccount) {
+      throw new AuthenticationError(
+        `Silent token acquisition failed for scopes: ${mutableScopes.join(", ")}. Resource may not be registered in the app registration. Re-run --setup to update permissions.`
+      );
+    }
     try {
       logger.info("Starting device code authentication flow");
       const deviceCodeRequest = {
@@ -14847,6 +14870,26 @@ async function createDeviceCodeAuthProvider(config, silentOnly = false) {
       const result = await acquireToken(scopes);
       return result.accessToken;
     },
+    async tryGetTokenForResourceSilent(resource) {
+      try {
+        validateHttpsUrl(resource, "Token resource");
+        const url = new URL(resource);
+        if (!isAllowedTokenDomain(url.hostname)) {
+          return null;
+        }
+        if (!currentAccount) {
+          return null;
+        }
+        const scopes = [`${resource}/.default`];
+        const result = await pca.acquireTokenSilent({
+          scopes,
+          account: currentAccount
+        });
+        return result.accessToken;
+      } catch {
+        return null;
+      }
+    },
     async logout() {
       if (currentAccount) {
         const cache = pca.getTokenCache();
@@ -14941,6 +14984,18 @@ var REQUIRED_RESOURCE_ACCESS = [
       { id: "d05743e4-fb24-4dff-8a33-0f6c73c964bd", type: "Scope" }
     ]
   },
+  {
+    resourceAppId: "475226c6-020e-4fb2-8a90-7a972cbfc1d4",
+    resourceAccess: [
+      { id: "a4c50e78-6978-4ce3-b1c0-965c1f9b1128", type: "Scope" }
+    ]
+  },
+  {
+    resourceAppId: "0e0bf3cc-3078-4fd4-9ef3-cb6dc0245b10",
+    resourceAccess: [
+      { id: "4ae1bf56-f562-4747-b7bc-2fa0874ed46f", type: "Scope" }
+    ]
+  },
   {
     resourceAppId: "00000007-0000-0000-c000-000000000000",
     resourceAccess: [
@@ -15247,15 +15302,15 @@ async function runSetupWizard() {
         print(`  ${icons.check} ${c.green}Signed in${c.reset}`);
       }
       const additionalResources = [
-        "https://api.bap.microsoft.com",
-        "https://service.powerapps.com"
+        { url: "https://service.powerapps.com", label: "PowerApps (connections)" },
+        { url: "https://api.bap.microsoft.com", label: "Admin API (environments)" }
       ];
-      for (const resource of additionalResources) {
-        try {
-          await authProvider.getTokenForResource(resource);
-          print(`  ${icons.check} ${c.dim}Authorized ${resource.replace("https://", "")}${c.reset}`);
-        } catch {
-          print(`  ${c.dim}${icons.warn} Could not authorize ${resource.replace("https://", "")} (admin tools may be limited)${c.reset}`);
+      for (const { url, label } of additionalResources) {
+        const token = authProvider.tryGetTokenForResourceSilent ? await authProvider.tryGetTokenForResourceSilent(url) : null;
+        if (token) {
+          print(`  ${icons.check} ${c.dim}${label}: authorized${c.reset}`);
+        } else {
+          print(`  ${c.dim}${icons.info || "-"} ${label}: will be authorized via admin consent (Step 3)${c.reset}`);
         }
       }
     } catch (error) {