- Remove CORS header assertions as CORSMiddleware handles these at ASGI level
- Simplify OPTIONS test to just verify endpoint responds
- MCP's create_protected_resource_routes already wraps handlers properly
Implements the missing /.well-known/oauth-protected-resource endpoint
required by the MCP spec for OAuth discovery. Also adds proper
resource_metadata URL to WWW-Authenticate headers for 401 responses.
This fixes OAuth authentication issues with FastMCP Client and Claude
Integration by providing the complete OAuth discovery mechanism.
Closes#972🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
Fixes breaking changes from mcp-python-sdk PR #982 which updated
BearerAuthBackend to use TokenVerifier protocol instead of OAuth providers.
Changes:
- Add verify_token() method to BearerAuthProvider implementing TokenVerifier protocol
- Add verify_token() method to InMemoryOAuthProvider implementing TokenVerifier protocol
- Update BearerAuthBackend usage in setup_auth_middleware_and_routes() to pass TokenVerifier
- Add comprehensive unit tests for TokenVerifier implementations
- Add integration tests for BearerAuthBackend with TokenVerifier
- Add tests for HTTP auth setup functions
All existing functionality preserved with full backwards compatibility.
🤖 Generated with [Claude Code](https://claude.ai/code)
Co-Authored-By: Claude <noreply@anthropic.com>
