Add MultiAuth for composing multiple token verification sources (#3335)

* Add MultiAuth for composing multiple token verification sources

🤖 Generated with Claude Code

https://claude.ai/code/session_01WwKYDCqjM2FqYwY5ZNVvjb

* Fix ruff lint/format in MultiAuth tests

🤖 Generated with Claude Code

https://claude.ai/code/session_01WwKYDCqjM2FqYwY5ZNVvjb

* Fix MultiAuth well-known route delegation and empty scopes handling

🤖 Generated with Claude Code

https://claude.ai/code/session_01WwKYDCqjM2FqYwY5ZNVvjb

* Harden MultiAuth: exception resilience, mcp_path propagation, test coverage

- verify_token now catches exceptions from individual sources and
  continues to the next, so one broken verifier can't take down the
  whole chain
- set_mcp_path propagates to verifiers, not just the server
- Fix jwks_url→jwks_uri typo in class docstring
- Add tests for raising verifiers, valid-token HTTP acceptance,
  and set_mcp_path propagation

* Clean up MultiAuth: precompute sources, deduplicate test helpers

* Fix version badges to 3.1.0

---------

Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
Jeremiah Lowin 2026-03-02 12:09:22 -05:00 committed by GitHub
commit 33a69d7d0a
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
6 changed files with 653 additions and 1 deletions

View file

@ -179,7 +179,8 @@
"servers/auth/remote-oauth",
"servers/auth/oauth-proxy",
"servers/auth/oidc-proxy",
"servers/auth/full-oauth-server"
"servers/auth/full-oauth-server",
"servers/auth/multi-auth"
]
},
"servers/authorization",