fix: only advertise protocols with actual challenge data#162
Merged
Conversation
ATXPAccountHandler was hardcoding protocols: ['atxp', 'x402', 'mpp'] regardless of what the MCP server's challenge actually contained. When the server only sent a paymentRequestUrl (no x402 accepts or mpp challenges), /authorize/auto would select x402 via feature flag and fabricate paymentRequirements from the generic receiver field — an ATXP account ID — causing 403 "Destination not allowed for IOU conversion". Now the protocols list is built from what's actually available: - Always 'atxp' (needs only amount + destination) - 'x402' only if paymentRequirements were extracted from the challenge - 'mpp' only if challenges were extracted from the challenge This lets resolveProtocol() fall back to a protocol the client actually has data for, instead of selecting one it can't fulfill. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- atxp-server: prefix unused logger param with underscore - atxp-base: remove unused eslint-disable directive Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Update atxpAccountHandler test to expect protocols=['atxp'] when challenge data has no x402/mpp data - atxp-server: prefix unused logger param with underscore - atxp-base: remove unused eslint-disable directive Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
ATXPAccountHandlerwas hardcodingprotocols: ['atxp', 'x402', 'mpp']when calling/authorize/auto, regardless of what the MCP server's challenge actually containedpaymentRequestUrl(no inline x402/mpp data),/authorize/autowould select x402 via feature flag and fabricatepaymentRequirementsfrom the genericreceiverfield — an ATXP account ID — causing 403 "Destination not allowed for IOU conversion"buildAuthorizeParamsactually extracted: alwaysatxp, plusx402only ifpaymentRequirementsexist, plusmpponly ifchallengesexistCompanion PR
/authorize/autoand whitelists the Music ATXP account IDTest plan
protocols=[atxp]when only ATXP challenge data is present🤖 Generated with Claude Code