da19abc3d6
Align scope selection with the spec chain and stop mutating caller metadata
...
Drop the authorization-server scopes_supported tier from scope selection.
That list is the server's catalog rather than what the resource needs,
so falling back to it could request every scope the server supports
when the protected resource metadata published an empty list. The
chain is now WWW-Authenticate scope, then PRM scopes_supported, then the
caller-configured scope, then omit; an empty published list falls
through instead of pinning an empty scope. AS metadata is still consulted
for whether offline_access may be added.
The provider now works on a copy of the caller's OAuthClientMetadata, so
the flow's scope selection no longer rewrites the caller's model and the
configured-scope snapshot cannot pick up another provider's discovered
scopes when metadata is reused across providers.
2026-07-27 19:46:08 +00:00
218510ee1c
Fall back to the caller-configured scope when the server advertises none
...
The OAuth client's scope-selection step overwrote the scope a caller
set on the provider on every 401, and when the server advertised no
scopes at all it left the token request with no scope. The configured
scope is now the last-resort tier after the WWW-Authenticate challenge
and the server's scopes_supported, matching the TypeScript SDK.
A source that yields no scopes (absent, null, or an empty list) now
falls through to the next tier instead of pinning an empty scope.
2026-07-25 20:47:59 +00:00
2713b53b12
Replace httpx and httpx-sse with httpx2 ( #2972 )
...
CI / checks (push) Failing after 1s
CI / all-green (push) Has been cancelled
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-07-14 17:05:08 +01:00
c0ecb70e24
Support RFC 8693 token exchange for enterprise IdP flows (SEP-990) ( #2988 )
...
Co-authored-by: Max Isbey <224885523+maxisbey@users.noreply.github.com >
2026-06-26 17:57:10 +02:00
44ce901ce3
OAuth client: keep refresh_token on non-rotating refresh; restore same-origin issuer binding ( #2946 )
2026-06-22 15:21:52 +01:00
5e013d9c54
OAuth client: harden SEP-2352/SEP-2350 edge cases; fix conformance comment ( #2936 )
2026-06-22 14:45:20 +01:00
44724284b3
Bind client credentials to their authorization server (SEP-2352) ( #2933 )
2026-06-20 18:47:22 +01:00
3169922492
Move scope step-up test to top-level function ( #2932 )
2026-06-20 18:45:10 +01:00
1331131650
Union previously requested scopes on step-up re-authorization (SEP-2350) ( #2931 )
2026-06-20 18:45:04 +02:00
cf41441e44
Send application_type during Dynamic Client Registration (SEP-837) ( #2930 )
2026-06-20 18:19:12 +02:00
48cf4950dc
Validate the iss authorization-response parameter (RFC 9207 / SEP-2468) ( #2921 )
2026-06-20 17:54:18 +02:00
b7a5bffed0
Preserve empty URL paths on OAuth metadata models ( #2925 )
2026-06-20 15:32:03 +00:00
7267818e44
Fix unknown-method error code and add a protocol version registry ( #2836 )
2026-06-11 16:47:22 +01:00
437d15aa71
SEP-2207: Refresh token guidance ( #2039 )
2026-04-14 11:48:07 +01:00
239d682b6f
fix: pass conformance auth scenarios, add RFC 8707 resource validation ( #2010 )
2026-02-09 11:41:03 +00:00
a7ddfdae07
ci: add strict-no-cover to detect unnecessary coverage pragmas ( #1897 )
2026-01-23 21:00:20 +01:00
d41d0c0128
chore: add D212 lint rule to enforce Google-style docstrings ( #1892 )
2026-01-16 16:10:52 +00:00
5d80f4efc8
refactor: move inline imports to module level ( #1893 )
2026-01-16 14:54:08 +00:00
a9cc822a10
fix: accept HTTP 201 status code in token exchange ( #1503 )
...
Co-authored-by: Paul Carleton <paulcarletonjr@gmail.com >
2025-12-19 18:22:00 +00:00
8b984d93a3
refactor(auth): remove unused _register_client method ( #1748 )
2025-12-08 21:50:20 +00:00
f22501315e
feat: implement SEP-991 URL-based client ID (CIMD) support ( #1652 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-11-24 17:21:03 +00:00
c51936f61f
Add client_secret_basic authentication support ( #1334 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-11-20 20:53:37 +00:00
91ccdb3d65
Fix OAuth discovery fallback and URL ordering ( #1624 )
2025-11-13 19:37:24 +00:00
7d12e83cf4
refactor: extract OAuth helper functions and simplify provider state ( #1586 )
2025-11-13 13:28:48 +00:00
89e9c43acf
Get baseline 100% clean coverage ( #1553 )
2025-11-11 14:09:32 +01:00
3390e49c01
Implement SEP-985: OAuth Protected Resource Metadata discovery fallback ( #1548 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-11-05 15:51:02 +00:00
f161149680
Implement RFC 7523 JWT flows ( #1247 )
...
Co-authored-by: Yann Jouanin <yann.jouanin@valueandco.com >
2025-10-29 16:48:08 +00:00
0e29cc4130
[client] Implement MCP OAuth scope selection and step-up authorization ( #1324 )
2025-10-13 14:18:00 +01:00
e750a06a99
fix: avoid uncessary retries in OAuth authenticated requests ( #1206 )
...
Co-authored-by: Felix Weinberger <fweinberger@anthropic.com >
2025-08-22 11:45:54 +01:00
c7671e470c
Add pyright strict mode on the whole project ( #1254 )
2025-08-11 18:56:37 +01:00
35777b9811
fix: perform auth server metadata discovery fallbacks on any 4xx ( #1193 )
Main branch checks / checks (push) Failing after 1s
2025-07-24 11:32:35 +01:00
6a84a2f79f
fix: fix OAuth flow request object handling ( #1174 )
Main branch checks / checks (push) Failing after 2s
2025-07-21 13:36:21 +01:00
99c4f3c906
Support falling back to OIDC metadata for auth ( #1061 )
Main branch checks / checks (push) Failing after 1s
2025-07-17 20:06:38 +01:00
eb5146dc8b
Implement RFC9728 - Support WWW-Authenticate header by MCP client ( #1071 )
2025-07-15 10:23:39 +01:00
95b44fb0d7
tests: use inline_snapshot.Is on parametrized test ( #945 )
...
Co-authored-by: Felix Weinberger <3823880+felixweinberger@users.noreply.github.com >
2025-07-14 21:59:37 +01:00
81fe63a81d
Ensure failed oauth registration response is read before accessing response.text ( #1118 )
...
Co-authored-by: ihrpr <inna@anthropic.com >
2025-07-10 22:01:17 +01:00
41f3bc35ce
Make "resource" optional on earlier protocols ( #1017 )
...
Co-authored-by: Andres March <>
2025-06-25 10:18:24 +01:00
674768802a
Fix /.well-known/oauth-authorization-server dropping path ( #1014 )
2025-06-24 15:43:26 +01:00
17f9c00c53
MCP server separation into Authorization Server (AS) and Resource Server (RS) roles per spec PR #338 ( #982 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-06-23 14:19:03 +01:00
543961968c
Use 120 characters instead of 88 ( #856 )
2025-06-11 11:45:50 +02:00
1a9ead07f5
relax validation ( #879 )
2025-06-09 19:21:01 +01:00
2bce10bdb1
Support Cursor OAuth client registration ( #895 )
2025-06-07 07:24:11 -07:00
9dad26620f
Fix auth tests and ruff format ( #818 )
2025-05-27 17:00:01 +01:00
6e418e62f9
Fix building auth metadata paths ( #779 )
...
Co-authored-by: Marcelo Trylesinski <marcelotryle@gmail.com >
2025-05-26 15:19:18 +02:00
e33cd41c7a
Add OAuth authentication client for HTTPX ( #751 )
...
Co-authored-by: Paul Carleton <paulc@anthropic.com >
2025-05-19 20:38:04 +01:00
Max Isbey