fastmcp/tests/server/auth
Jeremiah Lowin 4ebb3fd5e6
Emit scope step-up challenges for incremental authorization (SEP-2350) (#4623)
* Signal component-level scope shortfalls as insufficient_scope (SEP-2350)

* Fix ty type narrowing in scope step-up test

* Respect check short-circuit when reporting scope shortfall (P2)

* Report union of unmet scopes and document step-up contract

* Aggregate scope shortfall across the AuthMiddleware chain

* Stop chain scope aggregation at the first unevaluated gate
2026-07-26 14:13:26 -04:00
..
oauth_proxy Advertise only supported token endpoint auth methods in OAuthProxy metadata (#4608) 2026-07-23 18:11:18 -04:00
providers Speed up the unit test suite, and fix the task-notification race it surfaced (#4550) 2026-07-19 18:52:04 -04:00
__init__.py Add WorkOS and Azure OAuth providers (#1550) 2025-08-20 16:22:03 -04:00
test_auth_provider.py Migrate to MCP SDK v2.0.0b2 (httpx2) (#4503) 2026-07-18 15:12:47 -04:00
test_authorization.py Emit scope step-up challenges for incremental authorization (SEP-2350) (#4623) 2026-07-26 14:13:26 -04:00
test_cimd.py Stabilize upgraded ty checks (#4526) 2026-07-17 17:46:53 -04:00
test_cimd_validators.py Speed up the unit test suite, and fix the task-notification race it surfaced (#4550) 2026-07-19 18:52:04 -04:00
test_debug_verifier.py Add DebugTokenVerifier with custom sync/async validation (#2296) 2025-10-31 10:38:01 -04:00
test_enhanced_error_responses.py Speed up the unit test suite, and fix the task-notification race it surfaced (#4550) 2026-07-19 18:52:04 -04:00
test_jwt_issuer.py Make the unit suite fast: in-process HTTP tests, no real sleeps, parallel Windows CI (#4554) 2026-07-20 10:51:14 -04:00
test_jwt_provider.py Speed up the unit test suite, and fix the task-notification race it surfaced (#4550) 2026-07-19 18:52:04 -04:00
test_jwt_provider_bearer.py Speed up the unit test suite, and fix the task-notification race it surfaced (#4550) 2026-07-19 18:52:04 -04:00
test_multi_auth.py Include scopes in auth challenges (#4527) 2026-07-18 20:53:52 -04:00
test_oauth_consent_flow.py [codex] Add OAuthProxy RFC 9207 issuer responses (#4438) 2026-07-19 09:52:43 -04:00
test_oauth_consent_page.py Migrate to MCP Python SDK v2 (#4437) 2026-07-06 17:36:45 -04:00
test_oauth_mounting.py Migrate to MCP SDK v2.0.0b2 (httpx2) (#4503) 2026-07-18 15:12:47 -04:00
test_oauth_proxy_redirect_validation.py Block unsafe OAuth redirect schemes (#4419) 2026-07-05 17:16:10 -04:00
test_oauth_proxy_storage.py Migrate to MCP Python SDK v2 (#4437) 2026-07-06 17:36:45 -04:00
test_oidc_proxy.py Migrate to MCP SDK v2.0.0b2 (httpx2) (#4503) 2026-07-18 15:12:47 -04:00
test_oidc_proxy_token.py fix: use intent-based flag for OIDC scope patch in load_access_token (#3465) 2026-03-13 17:59:03 -04:00
test_redirect_validation.py [codex] Add OAuthProxy RFC 9207 issuer responses (#4438) 2026-07-19 09:52:43 -04:00
test_remote_auth_provider.py Include scopes in auth challenges (#4527) 2026-07-18 20:53:52 -04:00
test_ssrf_protection.py Fix #4292: SSRF guard breaks OAuth/JWKS fetches behind a corporate HTTP proxy (#4412) 2026-07-18 21:42:52 -04:00
test_static_token_verifier.py Add subject field to AccessToken initialization (#4267) 2026-07-18 21:15:13 -04:00