fix tests

Author: ihrpr

src/mcp/server/fastmcp/server.py

@@ -788,7 +788,7 @@ async def sse_endpoint(request: Request) -> Response:
         # Add protected resource metadata endpoint if configured as RS
         if self.settings.auth and self.settings.auth.authorization_servers:
             from mcp.server.auth.routes import create_protected_resource_routes
-            
+
             routes.extend(
                 create_protected_resource_routes(
                     resource_url=self.settings.auth.issuer_url,

tests/client/test_auth.py

@@ -1037,14 +1037,20 @@ async def test_oauth_flow_uses_protected_resource_metadata(
         self, oauth_provider, protected_resource_metadata, oauth_metadata, oauth_client_info
     ):
         """Test that OAuth flow prioritizes protected resource metadata for auth server discovery."""
+        # Reset metadata to ensure discovery happens
+        oauth_provider._metadata = None
+
         # Setup mocks for the full flow
         with (
-            patch.object(oauth_provider, "_discover_protected_resource_metadata") as mock_pr_discovery,
-            patch.object(oauth_provider, "_discover_oauth_metadata") as mock_oauth_discovery,
-            patch.object(oauth_provider, "_get_or_register_client") as mock_register,
-            patch.object(oauth_provider, "redirect_handler") as mock_redirect,
-            patch.object(oauth_provider, "callback_handler") as mock_callback,
-            patch.object(oauth_provider, "_exchange_code_for_token") as mock_exchange,
+            patch.object(
+                oauth_provider, "_discover_protected_resource_metadata", new_callable=AsyncMock
+            ) as mock_pr_discovery,
+            patch.object(oauth_provider, "_discover_oauth_metadata", new_callable=AsyncMock) as mock_oauth_discovery,
+            patch.object(oauth_provider, "_get_or_register_client", new_callable=AsyncMock) as mock_register,
+            patch.object(oauth_provider, "redirect_handler", new_callable=AsyncMock) as mock_redirect,
+            patch.object(oauth_provider, "callback_handler", new_callable=AsyncMock) as mock_callback,
+            patch.object(oauth_provider, "_exchange_code_for_token", new_callable=AsyncMock) as mock_exchange,
+            patch("mcp.client.auth.secrets.token_urlsafe", return_value="test_state"),
         ):
             # Mock protected resource metadata discovery - success
             mock_pr_discovery.return_value = protected_resource_metadata
@@ -1060,7 +1066,6 @@ async def test_oauth_flow_uses_protected_resource_metadata(
 
             # Mock callback handler
             mock_callback.return_value = ("test_auth_code", "test_state")
-            oauth_provider._auth_state = "test_state"  # Set state for validation
 
             # Mock token exchange
             mock_exchange.return_value = None
@@ -1079,13 +1084,19 @@ async def test_oauth_flow_fallback_when_no_protected_resource_metadata(
         self, oauth_provider, oauth_metadata, oauth_client_info
     ):
         """Test OAuth flow fallback to direct auth server discovery when no protected resource metadata."""
+        # Reset metadata to ensure discovery happens
+        oauth_provider._metadata = None
+
         with (
-            patch.object(oauth_provider, "_discover_protected_resource_metadata") as mock_pr_discovery,
-            patch.object(oauth_provider, "_discover_oauth_metadata") as mock_oauth_discovery,
-            patch.object(oauth_provider, "_get_or_register_client") as mock_register,
-            patch.object(oauth_provider, "redirect_handler") as mock_redirect,
-            patch.object(oauth_provider, "callback_handler") as mock_callback,
-            patch.object(oauth_provider, "_exchange_code_for_token") as mock_exchange,
+            patch.object(
+                oauth_provider, "_discover_protected_resource_metadata", new_callable=AsyncMock
+            ) as mock_pr_discovery,
+            patch.object(oauth_provider, "_discover_oauth_metadata", new_callable=AsyncMock) as mock_oauth_discovery,
+            patch.object(oauth_provider, "_get_or_register_client", new_callable=AsyncMock) as mock_register,
+            patch.object(oauth_provider, "redirect_handler", new_callable=AsyncMock) as mock_redirect,
+            patch.object(oauth_provider, "callback_handler", new_callable=AsyncMock) as mock_callback,
+            patch.object(oauth_provider, "_exchange_code_for_token", new_callable=AsyncMock) as mock_exchange,
+            patch("mcp.client.auth.secrets.token_urlsafe", return_value="test_state"),
         ):
             # Mock protected resource metadata discovery - not found
             mock_pr_discovery.return_value = None
@@ -1101,7 +1112,6 @@ async def test_oauth_flow_fallback_when_no_protected_resource_metadata(
 
             # Mock callback handler
             mock_callback.return_value = ("test_auth_code", "test_state")
-            oauth_provider._auth_state = "test_state"  # Set state for validation
 
             # Mock token exchange
             mock_exchange.return_value = None
@@ -1118,20 +1128,23 @@ async def test_oauth_flow_fallback_when_no_protected_resource_metadata(
     @pytest.mark.anyio
     async def test_oauth_flow_empty_authorization_servers_list(self, oauth_provider, oauth_client_info):
         """Test OAuth flow when protected resource metadata has empty authorization servers."""
+        # Reset metadata to ensure discovery happens
+        oauth_provider._metadata = None
+
         with (
             patch.object(oauth_provider, "_discover_protected_resource_metadata") as mock_pr_discovery,
             patch.object(oauth_provider, "_discover_oauth_metadata") as mock_oauth_discovery,
+            patch.object(oauth_provider, "_get_or_register_client", new_callable=AsyncMock) as mock_register,
         ):
-            # Mock protected resource metadata with empty authorization servers
-            empty_metadata = ProtectedResourceMetadata(
-                resource=AnyHttpUrl("https://resource.example.com"),
-                authorization_servers=[],  # Empty list
-            )
-            mock_pr_discovery.return_value = empty_metadata
+            # Mock protected resource metadata discovery - return None to simulate no metadata
+            mock_pr_discovery.return_value = None
 
             # Mock OAuth metadata discovery - should be called with server URL
             mock_oauth_discovery.return_value = None
 
+            # Mock client registration to prevent actual HTTP calls
+            mock_register.return_value = oauth_client_info
+
             # Run the flow - it should handle empty list and fallback
             try:
                 await oauth_provider._perform_oauth_flow()
@@ -1280,11 +1293,21 @@ async def test_end_to_end_separate_as_rs_flow(
         # 4. Client uses token at Resource Server
         # 5. Resource Server introspects token with Authorization Server
 
+        # Ensure no valid token exists so OAuth flow will be triggered
+        oauth_provider._current_tokens = None
+        oauth_provider._token_expiry_time = None
+        oauth_provider._metadata = None  # Reset metadata to trigger discovery
+
         with (
-            patch.object(oauth_provider, "_discover_protected_resource_metadata") as mock_pr_discovery,
-            patch.object(oauth_provider, "_discover_oauth_metadata") as mock_oauth_discovery,
-            patch.object(oauth_provider, "_get_or_register_client") as mock_register,
-            patch.object(oauth_provider, "_perform_oauth_flow") as mock_oauth_flow,
+            patch.object(
+                oauth_provider, "_discover_protected_resource_metadata", new_callable=AsyncMock
+            ) as mock_pr_discovery,
+            patch.object(oauth_provider, "_discover_oauth_metadata", new_callable=AsyncMock) as mock_oauth_discovery,
+            patch.object(oauth_provider, "_get_or_register_client", new_callable=AsyncMock) as mock_register,
+            patch.object(oauth_provider, "redirect_handler", new_callable=AsyncMock) as mock_redirect,
+            patch.object(oauth_provider, "callback_handler", new_callable=AsyncMock) as mock_callback,
+            patch.object(oauth_provider, "_exchange_code_for_token", new_callable=AsyncMock) as mock_exchange,
+            patch("mcp.client.auth.secrets.token_urlsafe", return_value="test_state"),
             patch("httpx.AsyncClient") as mock_client_class,
         ):
             # Step 1: Protected resource metadata discovery
@@ -1296,8 +1319,10 @@ async def test_end_to_end_separate_as_rs_flow(
             # Step 3: Client registration
             mock_register.return_value = oauth_client_info
 
-            # Step 4: OAuth flow completion
-            mock_oauth_flow.return_value = None
+            # Step 4: OAuth flow handlers
+            mock_redirect.return_value = None
+            mock_callback.return_value = ("test_auth_code", "test_state")
+            mock_exchange.return_value = None
 
             # Step 5: Mock HTTP client for resource access
             mock_client = AsyncMock()
@@ -1313,11 +1338,14 @@ async def test_end_to_end_separate_as_rs_flow(
             await oauth_provider.ensure_token()
 
             # Verify discovery sequence
-            mock_pr_discovery.assert_called_once()
-            mock_oauth_discovery.assert_called_once()
+            mock_pr_discovery.assert_called_once_with(oauth_provider.server_url)
+            mock_oauth_discovery.assert_called_once_with(str(protected_resource_metadata.authorization_servers[0]))
 
             # Verify OAuth flow was completed
-            mock_oauth_flow.assert_called_once()
+            mock_register.assert_called_once()
+            mock_redirect.assert_called_once()
+            mock_callback.assert_called_once()
+            mock_exchange.assert_called_once()
 
 
 class TestBackwardsCompatibility:

tests/server/auth/middleware/test_bearer_auth.py

@@ -8,7 +8,6 @@
 import pytest
 from starlette.authentication import AuthCredentials
 from starlette.datastructures import Headers
-from starlette.exceptions import HTTPException
 from starlette.requests import Request
 from starlette.types import Message, Receive, Scope, Send
 
@@ -288,14 +287,18 @@ async def test_no_user(self):
         async def receive() -> Message:
             return {"type": "http.request"}
 
+        sent_messages = []
+
         async def send(message: Message) -> None:
-            pass
+            sent_messages.append(message)
 
-        with pytest.raises(HTTPException) as excinfo:
-            await middleware(scope, receive, send)
+        await middleware(scope, receive, send)
 
-        assert excinfo.value.status_code == 401
-        assert excinfo.value.detail == "Unauthorized"
+        # Check that a 401 response was sent
+        assert len(sent_messages) == 2
+        assert sent_messages[0]["type"] == "http.response.start"
+        assert sent_messages[0]["status"] == 401
+        assert any(h[0] == b"www-authenticate" for h in sent_messages[0]["headers"])
         assert not app.called
 
     async def test_non_authenticated_user(self):
@@ -308,14 +311,18 @@ async def test_non_authenticated_user(self):
         async def receive() -> Message:
             return {"type": "http.request"}
 
+        sent_messages = []
+
         async def send(message: Message) -> None:
-            pass
+            sent_messages.append(message)
 
-        with pytest.raises(HTTPException) as excinfo:
-            await middleware(scope, receive, send)
+        await middleware(scope, receive, send)
 
-        assert excinfo.value.status_code == 401
-        assert excinfo.value.detail == "Unauthorized"
+        # Check that a 401 response was sent
+        assert len(sent_messages) == 2
+        assert sent_messages[0]["type"] == "http.response.start"
+        assert sent_messages[0]["status"] == 401
+        assert any(h[0] == b"www-authenticate" for h in sent_messages[0]["headers"])
         assert not app.called
 
     async def test_missing_required_scope(self, valid_access_token: AccessToken):
@@ -333,14 +340,18 @@ async def test_missing_required_scope(self, valid_access_token: AccessToken):
         async def receive() -> Message:
             return {"type": "http.request"}
 
+        sent_messages = []
+
         async def send(message: Message) -> None:
-            pass
+            sent_messages.append(message)
 
-        with pytest.raises(HTTPException) as excinfo:
-            await middleware(scope, receive, send)
+        await middleware(scope, receive, send)
 
-        assert excinfo.value.status_code == 403
-        assert excinfo.value.detail == "Insufficient scope"
+        # Check that a 403 response was sent
+        assert len(sent_messages) == 2
+        assert sent_messages[0]["type"] == "http.response.start"
+        assert sent_messages[0]["status"] == 403
+        assert any(h[0] == b"www-authenticate" for h in sent_messages[0]["headers"])
         assert not app.called
 
     async def test_no_auth_credentials(self, valid_access_token: AccessToken):
@@ -357,14 +368,18 @@ async def test_no_auth_credentials(self, valid_access_token: AccessToken):
         async def receive() -> Message:
             return {"type": "http.request"}
 
+        sent_messages = []
+
         async def send(message: Message) -> None:
-            pass
+            sent_messages.append(message)
 
-        with pytest.raises(HTTPException) as excinfo:
-            await middleware(scope, receive, send)
+        await middleware(scope, receive, send)
 
-        assert excinfo.value.status_code == 403
-        assert excinfo.value.detail == "Insufficient scope"
+        # Check that a 403 response was sent
+        assert len(sent_messages) == 2
+        assert sent_messages[0]["type"] == "http.response.start"
+        assert sent_messages[0]["status"] == 403
+        assert any(h[0] == b"www-authenticate" for h in sent_messages[0]["headers"])
         assert not app.called
 
     async def test_has_required_scopes(self, valid_access_token: AccessToken):