Compare commits

...

5 commits

Author SHA1 Message Date
Eloi Zalczer
efdb00965e revert changes to auto-generated docs 2025-12-19 17:56:57 +01:00
Eloi Zalczer
4476bbd8b9 feat:fixed docstring 2025-12-19 15:26:42 +01:00
Eloi Zalczer
69f77d4d2c feat:fixed coderabbit comments 2025-12-19 15:26:42 +01:00
Eloi Zalczer
e2d424e1d6 feat:updated documentation 2025-12-19 15:26:42 +01:00
Eloi Zalczer
7418ad783c feat:added auth_route argument in supabase provider 2025-12-19 15:26:42 +01:00
3 changed files with 42 additions and 8 deletions

View file

@ -17,7 +17,7 @@ This guide shows you how to secure your FastMCP server using **Supabase Auth**.
### Prerequisites
Before you begin, you will need:
1. A **[Supabase Account](https://supabase.com/)** with a project
1. A **[Supabase Account](https://supabase.com/)** with a project or a self-hosted **Supabase Auth** instance
2. Your FastMCP server's URL (can be localhost for development, e.g., `http://localhost:8000`)
### Step 1: Get Supabase Project URL
@ -37,7 +37,8 @@ from fastmcp.server.auth.providers.supabase import SupabaseProvider
# Configure Supabase Auth
auth = SupabaseProvider(
project_url="https://abc123.supabase.co",
base_url="http://localhost:8000"
base_url="http://localhost:8000",
auth_route="/my/auth/route" # if self-hosting and using custom routes
)
mcp = FastMCP("Supabase Protected Server", auth=auth)
@ -117,6 +118,10 @@ Your Supabase project URL (e.g., `https://abc123.supabase.co`)
Public URL of your FastMCP server (e.g., `https://your-server.com` or `http://localhost:8000` for development)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_SUPABASE_AUTH_ROUTE" default="/auth/v1">
Your Supabase auth route (e.g., `/auth/v1`)
</ParamField>
<ParamField path="FASTMCP_SERVER_AUTH_SUPABASE_REQUIRED_SCOPES" default="[]">
Comma-, space-, or JSON-separated list of required OAuth scopes (e.g., `openid email` or `["openid", "email"]`)
</ParamField>

View file

@ -34,6 +34,7 @@ class SupabaseProviderSettings(BaseSettings):
project_url: AnyHttpUrl
base_url: AnyHttpUrl
auth_route: str = "/auth/v1"
algorithm: Literal["HS256", "RS256", "ES256"] = "ES256"
required_scopes: list[str] | None = None
@ -59,8 +60,8 @@ class SupabaseProvider(RemoteAuthProvider):
- Asymmetric keys (RS256/ES256) are recommended for production
2. JWT Verification:
- FastMCP verifies JWTs using the JWKS endpoint at {project_url}/auth/v1/.well-known/jwks.json
- JWTs are issued by {project_url}/auth/v1
- FastMCP verifies JWTs using the JWKS endpoint at {project_url}{auth_route}/.well-known/jwks.json
- JWTs are issued by {project_url}{auth_route}
- Tokens are cached for up to 10 minutes by Supabase's edge servers
- Algorithm must match your Supabase Auth configuration
@ -93,6 +94,7 @@ class SupabaseProvider(RemoteAuthProvider):
*,
project_url: AnyHttpUrl | str | NotSetT = NotSet,
base_url: AnyHttpUrl | str | NotSetT = NotSet,
auth_route: str | NotSetT = NotSet,
algorithm: Literal["HS256", "RS256", "ES256"] | NotSetT = NotSet,
required_scopes: list[str] | NotSetT | None = NotSet,
token_verifier: TokenVerifier | None = None,
@ -102,6 +104,7 @@ class SupabaseProvider(RemoteAuthProvider):
Args:
project_url: Your Supabase project URL (e.g., "https://abc123.supabase.co")
base_url: Public URL of this FastMCP server
auth_route: Supabase Auth route. Defaults to "/auth/v1".
algorithm: JWT signing algorithm (HS256, RS256, or ES256). Must match your
Supabase Auth configuration. Defaults to ES256.
required_scopes: Optional list of scopes to require for all requests.
@ -115,6 +118,7 @@ class SupabaseProvider(RemoteAuthProvider):
for k, v in {
"project_url": project_url,
"base_url": base_url,
"auth_route": auth_route,
"algorithm": algorithm,
"required_scopes": required_scopes,
}.items()
@ -124,12 +128,13 @@ class SupabaseProvider(RemoteAuthProvider):
self.project_url = str(settings.project_url).rstrip("/")
self.base_url = AnyHttpUrl(str(settings.base_url).rstrip("/"))
self.auth_route = settings.auth_route.strip("/")
# Create default JWT verifier if none provided
if token_verifier is None:
token_verifier = JWTVerifier(
jwks_uri=f"{self.project_url}/auth/v1/.well-known/jwks.json",
issuer=f"{self.project_url}/auth/v1",
jwks_uri=f"{self.project_url}/{self.auth_route}/.well-known/jwks.json",
issuer=f"{self.project_url}/{self.auth_route}",
algorithm=settings.algorithm,
required_scopes=settings.required_scopes,
)
@ -137,7 +142,7 @@ class SupabaseProvider(RemoteAuthProvider):
# Initialize RemoteAuthProvider with Supabase as the authorization server
super().__init__(
token_verifier=token_verifier,
authorization_servers=[AnyHttpUrl(f"{self.project_url}/auth/v1")],
authorization_servers=[AnyHttpUrl(f"{self.project_url}/{self.auth_route}")],
base_url=self.base_url,
)
@ -162,7 +167,7 @@ class SupabaseProvider(RemoteAuthProvider):
try:
async with httpx.AsyncClient() as client:
response = await client.get(
f"{self.project_url}/auth/v1/.well-known/oauth-authorization-server"
f"{self.project_url}/{self.auth_route}/.well-known/oauth-authorization-server"
)
response.raise_for_status()
metadata = response.json()

View file

@ -40,12 +40,14 @@ class TestSupabaseProvider:
{
"FASTMCP_SERVER_AUTH_SUPABASE_PROJECT_URL": "https://env123.supabase.co",
"FASTMCP_SERVER_AUTH_SUPABASE_BASE_URL": "https://envserver.com",
"FASTMCP_SERVER_AUTH_SUPABASE_AUTH_ROUTE": "/custom/auth/route",
},
):
provider = SupabaseProvider()
assert provider.project_url == "https://env123.supabase.co"
assert str(provider.base_url) == "https://envserver.com/"
assert provider.auth_route == "custom/auth/route"
def test_environment_variable_loading(self):
"""Test that environment variables are loaded correctly."""
@ -150,6 +152,28 @@ class TestSupabaseProvider:
assert provider.token_verifier.algorithm == "RS256" # type: ignore[attr-defined]
def test_custom_auth_route(self):
provider = SupabaseProvider(
project_url="https://abc123.supabase.co",
base_url="https://myserver.com",
auth_route="/custom/auth/route",
)
assert provider.auth_route == "custom/auth/route"
assert (
provider.token_verifier.jwks_uri
== "https://abc123.supabase.co/custom/auth/route/.well-known/jwks.json"
) # type: ignore[attr-defined]
def test_custom_auth_route_trailing_slash(self):
provider = SupabaseProvider(
project_url="https://abc123.supabase.co",
base_url="https://myserver.com",
auth_route="/custom/auth/route/",
)
assert provider.auth_route == "custom/auth/route"
def run_mcp_server(host: str, port: int) -> None:
mcp = FastMCP(