modelcontextprotocol/python-sdk
Watch
1
0
Fork
You've already forked python-sdk
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Make refresh_token grant type optional in DCR handler (#1651)

Browse source 
Co-authored-by: Claude <noreply@anthropic.com>
This commit is contained in:
gazzadownunder 2026-01-05 23:41:45 +10:00 • committed by GitHub
commit d52937b39c
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 20 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/mcp/server/auth/handlers/register.py
View file

@ -73,11 +73,11 @@ class RegistrationHandler:
), ),
status_code=400, status_code=400,
) )
if not {"authorization_code", "refresh_token"}.issubset(set(client_metadata.grant_types)): if "authorization_code" not in client_metadata.grant_types:
return PydanticJSONResponse( return PydanticJSONResponse(
content=RegistrationErrorResponse( content=RegistrationErrorResponse(
error="invalid_client_metadata", error="invalid_client_metadata",
error_description="grant_types must be authorization_code and refresh_token", error_description="grant_types must include 'authorization_code'",
), ),
status_code=400, status_code=400,
) )

20
tests/server/fastmcp/auth/test_auth_integration.py
View file

@ -939,19 +939,35 @@ class TestAuthEndpoints:
assert registered_client.scope == "read write" assert registered_client.scope == "read write"
@pytest.mark.anyio @pytest.mark.anyio
async def test_client_registration_invalid_grant_type(self, test_client: httpx.AsyncClient): async def test_client_registration_with_authorization_code_only(self, test_client: httpx.AsyncClient):
"""Test that registration succeeds with only authorization_code (refresh_token is optional per RFC 7591)."""
client_metadata = { client_metadata = {
"redirect_uris": ["https://client.example.com/callback"], "redirect_uris": ["https://client.example.com/callback"],
"client_name": "Test Client", "client_name": "Test Client",
"grant_types": ["authorization_code"], "grant_types": ["authorization_code"],
} }
response = await test_client.post("/register", json=client_metadata)
assert response.status_code == 201
client_info = response.json()
assert "client_id" in client_info
assert client_info["grant_types"] == ["authorization_code"]
@pytest.mark.anyio
async def test_client_registration_missing_authorization_code(self, test_client: httpx.AsyncClient):
"""Test that registration fails when authorization_code grant type is missing."""
client_metadata = {
"redirect_uris": ["https://client.example.com/callback"],
"client_name": "Test Client",
"grant_types": ["refresh_token"],
}
response = await test_client.post("/register", json=client_metadata) response = await test_client.post("/register", json=client_metadata)
assert response.status_code == 400 assert response.status_code == 400
error_data = response.json() error_data = response.json()
assert "error" in error_data assert "error" in error_data
assert error_data["error"] == "invalid_client_metadata" assert error_data["error"] == "invalid_client_metadata"
assert error_data["error_description"] == "grant_types must be authorization_code and refresh_token" assert error_data["error_description"] == "grant_types must include 'authorization_code'"
@pytest.mark.anyio @pytest.mark.anyio
async def test_client_registration_with_additional_grant_type(self, test_client: httpx.AsyncClient): async def test_client_registration_with_additional_grant_type(self, test_client: httpx.AsyncClient):