mirror of
https://github.com/PrefectHQ/fastmcp.git
synced 2026-08-18 03:29:11 +02:00
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com> Co-authored-by: Jeremiah Lowin <jlowin@users.noreply.github.com> Co-authored-by: Marvin Context Protocol <41898282+Marvin Context Protocol@users.noreply.github.com> Co-authored-by: voidborne-d <voidborne-d@users.noreply.github.com> Co-authored-by: marvin-context-protocol[bot] <225465937+marvin-context-protocol[bot]@users.noreply.github.com> Co-authored-by: Claude <noreply@anthropic.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: d 🔹 <258577966+voidborne-d@users.noreply.github.com> Co-authored-by: Jeremiah Lowin <153965+jlowin@users.noreply.github.com> Co-authored-by: nightcityblade <nightcityblade@gmail.com> Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com> Co-authored-by: Bill Easton <strawgate@users.noreply.github.com> Co-authored-by: Sumanshu Nankana <sumanshunankana@gmail.com> Co-authored-by: Eric Robinson <ericrobinson@indeed.com> Co-authored-by: Martim Santos <martimfasantos@gmail.com> Co-authored-by: d 🔹 <liusway405@gmail.com> Co-authored-by: Matthieu B <66959271+mtthidoteu@users.noreply.github.com> Co-authored-by: Sascha Buehrle <47737812+saschabuehrle@users.noreply.github.com> Co-authored-by: Hakancan <142545736+hkc5@users.noreply.github.com> Co-authored-by: nightcityblade <jackchen@haloailabs.com> Co-authored-by: Matt Hallowell <17804673+mhallo@users.noreply.github.com> Co-authored-by: nate nowack <thrast36@gmail.com> Co-authored-by: Bill Easton <williamseaston@gmail.com> Co-authored-by: Marcus Shu <46469249+shulkx@users.noreply.github.com> Co-authored-by: Rushabh Doshi <radoshi@gmail.com> Co-authored-by: AIKAWA Shigechika <shige@aikawa.jp> Co-authored-by: Jeremy Simon <simonjer805@gmail.com> Co-authored-by: Miguel Miranda Dias <7780875+pandego@users.noreply.github.com> Co-authored-by: Anthony James Padavano <padavano.anthony@gmail.com> Co-authored-by: Mostafa Kamal <hiremostafa@gmail.com> Fix auto-close MRE script posting comment without closing (#3386) Fix WorkOS token scope verification bypass 🤖 Generated with Codex (#3407) Fix initialize McpError fallthrough 🤖 Generated with Codex (#3413) Fix transform arg collisions with passthrough params (#3431) Fix get_* returning None when latest version is disabled (#3439) Fix get_* returning None when latest version is disabled (#3421) Fix server lifespan overlap teardown (#3415) Fix $ref output schema object detection regression (#3420) resolved annotations (#3429) Fix async partial callables rejected by iscoroutinefunction (#3438) Fix async partial callables rejected by iscoroutinefunction (#3423) fix: add version to components (#3458) fix: use intent-based flag for OIDC scope patch in load_access_token (#3465) Fixes #3461 fix: normalize Google scope shorthands and surface valid_scopes (#3477) fix: resolve ty 0.0.23 type-checking errors and bump pin (#3481) fix: shield lifespan teardown from cancellation (#3480) fix: forward custom_route endpoints from mounted servers (#3462) fix updates _get_additional_http_routes() to traverse providers, Fixes #3457 fix: remove hardcoded version from CLI help text (#3456) fix: monty 0.0.8 compatibility, drop external_functions from constructor (#3468) fix: task test teardown hanging 5s per test (#3499) Closes #3498 fix: validate workspace path is a directory before cursor install (#3440) Fixes #3426 fix: handle re.error from malformed URI templates in build_regex (#3501) fix: reject empty/OIDC-only required_scopes in AzureProvider (#3503) fix: restrict $ref resolution to local refs only (SSRF/LFI) (#3502) fix warnings and timeouts (#3504) close upgrade check issue when build passes (#3505) Closes #3484 fix: URL-encode path params to prevent SSRF/path traversal (GHSA-vv7q-7jx5-f767) (#3507) fix: prevent path traversal in skill download (#3493) fix: prefer IdP-granted scopes over client-requested scopes in OAuthProxy (#3492) fix: remove unrelated transform and http.py changes from PR scope fix: remove forced follow_redirects from httpx_client_factory calls (#3496) fix: stop passing follow_redirects to httpx_client_factory fix: restore follow_redirects=True for custom httpx client factories Closes #3509 fix: CSRF double-submit cookie check in consent flow (#3519) fix: validate server names in install commands (#3522) fix: use raw strings for regex in pytest.raises match (#3523) fix: reject refresh tokens used as Bearer access tokens (#3524) fix: route ResourcesAsTools/PromptsAsTools through server middleware (#3495) fix: resolve Pyright "Module is not callable" on @tool, @resource, @prompt decorators (#3540) fix: filter warnings by message in KEY_PREFIX test (#3549) fix: suppress output schema for ToolResult subclass annotations (#3548) fix: increase sleep duration in proxy cache tests (#3567) fix: store absolute token expiry to prevent stale expires_in on reload (#3572) fix: preserve tool properties named 'title' during schema compression (#3582) Fix loopback redirect URI port matching per RFC 8252 §7.3 (#3589) Fix app tool routing: visibility check and middleware propagation (#3591) Fix query parameter serialization to respect OpenAPI explode/style settings (#3595) Fix dev apps form: union types, textarea support, JSON parsing (#3597) fix(google): replace deprecated /oauth2/v1/tokeninfo with /oauth2/v3/userinfo (#3603) fix: resolve EntraOBOToken dependency injection through MultiAuth (#3609) fix(docs): correct misleading stateless_http header (#3622) fix: filesystem provider import machinery (#3626) Closes #3625 (issues 2, 3, 6) fix: recover StdioTransport after subprocess exits (#3630) fix(server): preserve mounted tool task metadata (#3632) fix: scope deprecation warning filter to FastMCPDeprecationWarning (#3649) fix imports, add PrefabAppConfig (#3650) fix: resolve CurrentFastMCP/ctx.fastmcp to child server in mounted background tasks (#3651) Fix blocking docs issues: chart imports, Select API, Rx consistency (#3652) closed by default (#3657) Fix prompt caching middleware missing wrap/unwrap round-trip (#3666) fix: serialize object query params per OpenAPI style/explode rules (#3662) Fixes #2857 fix: HTTP request headers not accessible in background task workers (#3631) fix: restore HTTP headers in worker execution path for background tasks (#3681) fix: strip discriminator after dereferencing schemas (#3682) fix: remove stale ty:ignore directives for ty 0.0.26 (#3684) Fix docs gaps in app provider pages (#3690) fix: dev apps log panel UX improvements (#3698) fix dev server empty string args (#3700)
229 lines
7.2 KiB
Python
229 lines
7.2 KiB
Python
"""Tests for middleware in HTTP apps."""
|
|
|
|
from collections.abc import Callable
|
|
from typing import Any
|
|
|
|
import httpx
|
|
from httpx import ASGITransport
|
|
from starlette.middleware import Middleware
|
|
from starlette.middleware.base import BaseHTTPMiddleware
|
|
from starlette.requests import Request
|
|
from starlette.responses import JSONResponse
|
|
from starlette.routing import BaseRoute, Route
|
|
from starlette.types import ASGIApp
|
|
|
|
from fastmcp.server import FastMCP
|
|
from fastmcp.server.http import create_sse_app, create_streamable_http_app
|
|
|
|
|
|
class HeaderMiddleware(BaseHTTPMiddleware):
|
|
"""Simple middleware that adds a custom header to responses."""
|
|
|
|
def __init__(self, app: ASGIApp, header_name: str, header_value: str):
|
|
super().__init__(app)
|
|
self.header_name = header_name
|
|
self.header_value = header_value
|
|
|
|
async def dispatch(self, request: Request, call_next: Callable):
|
|
response = await call_next(request)
|
|
response.headers[self.header_name] = self.header_value
|
|
return response
|
|
|
|
|
|
class RequestModifierMiddleware(BaseHTTPMiddleware):
|
|
"""Middleware that adds a value to request state."""
|
|
|
|
def __init__(self, app: ASGIApp, key: str, value: Any):
|
|
super().__init__(app)
|
|
self.key = key
|
|
self.value = value
|
|
|
|
async def dispatch(self, request: Request, call_next: Callable):
|
|
request.state.custom_value = {self.key: self.value}
|
|
return await call_next(request)
|
|
|
|
|
|
async def endpoint_handler(request: Request):
|
|
"""Endpoint that returns request state or headers."""
|
|
if hasattr(request.state, "custom_value"):
|
|
return JSONResponse({"state": request.state.custom_value})
|
|
return JSONResponse({"message": "Hello, world!"})
|
|
|
|
|
|
async def test_sse_app_with_custom_middleware():
|
|
"""Test that custom middleware works with SSE app."""
|
|
server = FastMCP(name="TestServer")
|
|
|
|
# Create custom middleware
|
|
custom_middleware = [
|
|
Middleware(
|
|
HeaderMiddleware, # type: ignore[arg-type]
|
|
header_name="X-Custom-Header",
|
|
header_value="test-value",
|
|
)
|
|
]
|
|
|
|
# Add a test route to server's additional routes
|
|
routes: list[BaseRoute] = [Route("/test", endpoint_handler)]
|
|
server._additional_http_routes = routes
|
|
|
|
# Create the app with custom middleware
|
|
app = server.http_app(transport="sse", middleware=custom_middleware)
|
|
|
|
# Create a test client
|
|
transport = ASGITransport(app=app)
|
|
async with httpx.AsyncClient(
|
|
transport=transport, base_url="http://testserver"
|
|
) as client:
|
|
response = await client.get("/test")
|
|
|
|
# Verify middleware was applied
|
|
assert response.status_code == 200
|
|
assert response.headers["X-Custom-Header"] == "test-value"
|
|
|
|
|
|
async def test_streamable_http_app_with_custom_middleware():
|
|
"""Test that custom middleware works with StreamableHTTP app."""
|
|
server = FastMCP(name="TestServer")
|
|
|
|
# Create custom middleware
|
|
custom_middleware = [
|
|
Middleware(
|
|
HeaderMiddleware, # type: ignore[arg-type]
|
|
header_name="X-Custom-Header",
|
|
header_value="test-value",
|
|
)
|
|
]
|
|
|
|
# Add a test route to server's additional routes
|
|
routes: list[BaseRoute] = [Route("/test", endpoint_handler)]
|
|
server._additional_http_routes = routes
|
|
|
|
# Create the app with custom middleware
|
|
app = server.http_app(transport="http", middleware=custom_middleware)
|
|
|
|
# Create a test client
|
|
transport = ASGITransport(app=app)
|
|
async with httpx.AsyncClient(
|
|
transport=transport, base_url="http://testserver"
|
|
) as client:
|
|
response = await client.get("/test")
|
|
|
|
# Verify middleware was applied
|
|
assert response.status_code == 200
|
|
assert response.headers["X-Custom-Header"] == "test-value"
|
|
|
|
|
|
async def test_create_sse_app_with_custom_middleware():
|
|
"""Test that custom middleware works with create_sse_app function."""
|
|
server = FastMCP(name="TestServer")
|
|
|
|
# Create custom middleware
|
|
custom_middleware = [
|
|
Middleware(
|
|
RequestModifierMiddleware, # type: ignore[arg-type]
|
|
key="modified_by",
|
|
value="middleware",
|
|
)
|
|
]
|
|
|
|
# Add a test route
|
|
additional_routes: list[BaseRoute] = [Route("/test", endpoint_handler)]
|
|
|
|
# Create the app with custom middleware
|
|
app = create_sse_app(
|
|
server=server,
|
|
message_path="/message",
|
|
sse_path="/sse/",
|
|
middleware=custom_middleware,
|
|
routes=additional_routes,
|
|
)
|
|
|
|
# Create a test client
|
|
transport = ASGITransport(app=app)
|
|
async with httpx.AsyncClient(
|
|
transport=transport, base_url="http://testserver"
|
|
) as client:
|
|
response = await client.get("/test")
|
|
|
|
# Verify middleware was applied
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
assert "state" in data
|
|
assert data["state"]["modified_by"] == "middleware"
|
|
|
|
|
|
async def test_create_streamable_http_app_with_custom_middleware():
|
|
"""Test that custom middleware works with create_streamable_http_app function."""
|
|
server = FastMCP(name="TestServer")
|
|
|
|
# Create custom middleware
|
|
custom_middleware = [
|
|
Middleware(
|
|
RequestModifierMiddleware, # type: ignore[arg-type]
|
|
key="modified_by",
|
|
value="middleware",
|
|
)
|
|
]
|
|
|
|
# Add a test route
|
|
additional_routes: list[BaseRoute] = [Route("/test", endpoint_handler)]
|
|
|
|
# Create the app with custom middleware
|
|
app = create_streamable_http_app(
|
|
server=server,
|
|
streamable_http_path="/streamable",
|
|
middleware=custom_middleware,
|
|
routes=additional_routes,
|
|
)
|
|
|
|
# Create a test client
|
|
transport = ASGITransport(app=app)
|
|
async with httpx.AsyncClient(
|
|
transport=transport, base_url="http://testserver"
|
|
) as client:
|
|
response = await client.get("/test")
|
|
|
|
# Verify middleware was applied
|
|
assert response.status_code == 200
|
|
data = response.json()
|
|
assert "state" in data
|
|
assert data["state"]["modified_by"] == "middleware"
|
|
|
|
|
|
async def test_multiple_middleware_ordering():
|
|
"""Test that multiple middleware are applied in the correct order."""
|
|
server = FastMCP(name="TestServer")
|
|
|
|
# Create multiple middleware
|
|
custom_middleware = [
|
|
Middleware(
|
|
HeaderMiddleware, # type: ignore[arg-type]
|
|
header_name="X-First-Header",
|
|
header_value="first",
|
|
),
|
|
Middleware(
|
|
HeaderMiddleware, # type: ignore[arg-type]
|
|
header_name="X-Second-Header",
|
|
header_value="second",
|
|
),
|
|
]
|
|
|
|
# Add a test route to server's additional routes
|
|
routes: list[BaseRoute] = [Route("/test", endpoint_handler)]
|
|
server._additional_http_routes = routes
|
|
|
|
# Create the app with custom middleware
|
|
app = server.http_app(transport="sse", middleware=custom_middleware)
|
|
|
|
# Create a test client
|
|
transport = ASGITransport(app=app)
|
|
async with httpx.AsyncClient(
|
|
transport=transport, base_url="http://testserver"
|
|
) as client:
|
|
response = await client.get("/test")
|
|
|
|
# Verify both middleware were applied
|
|
assert response.status_code == 200
|
|
assert response.headers["X-First-Header"] == "first"
|
|
assert response.headers["X-Second-Header"] == "second"
|