Skip to content

fix: handle None required_scopes in validate_scope #2368

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
IgnazioDS wants to merge 1 commit into
base: main
Choose a base branch
from
+50 −4
Open

fix: handle None required_scopes in validate_scope #2368

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 6 additions & 3 deletions src/mcp/shared/auth.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,11 +71,14 @@ def validate_scope(self, requested_scope: str | None) -> list[str] | None:
if requested_scope is None:
return None
requested_scopes = requested_scope.split(" ")
allowed_scopes = [] if self.scope is None else self.scope.split(" ")
if self.scope is None:
# No scope restrictions registered; all requested scopes are allowed
return requested_scopes
allowed_scopes = self.scope.split(" ")
for scope in requested_scopes:
if scope not in allowed_scopes: # pragma: no branch
if scope not in allowed_scopes:
raise InvalidScopeError(f"Client was not registered with scope {scope}")
return requested_scopes # pragma: no cover
return requested_scopes

def validate_redirect_uri(self, redirect_uri: AnyUrl | None) -> AnyUrl:
if redirect_uri is not None:
Expand Down
45 changes: 44 additions & 1 deletion tests/shared/test_auth.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,9 @@
"""Tests for OAuth 2.0 shared code."""

from mcp.shared.auth import OAuthMetadata
import pytest
from pydantic import AnyUrl

from mcp.shared.auth import InvalidScopeError, OAuthClientMetadata, OAuthMetadata


def test_oauth():
Expand Down Expand Up @@ -58,3 +61,43 @@ def test_oauth_with_jarm():
"token_endpoint_auth_methods_supported": ["client_secret_basic", "client_secret_post"],
}
)


def test_validate_scope_none_required_scopes_accepts_all():
"""When client has no scope restrictions (scope=None), all requested scopes should be accepted."""
client = OAuthClientMetadata(
redirect_uris=[AnyUrl("http://localhost:3030/callback")],
scope=None,
)
result = client.validate_scope("read write admin")
assert result == ["read", "write", "admin"]


def test_validate_scope_none_requested_scope_returns_none():
"""When no scope is requested, validate_scope should return None."""
client = OAuthClientMetadata(
redirect_uris=[AnyUrl("http://localhost:3030/callback")],
scope="read write",
)
result = client.validate_scope(None)
assert result is None


def test_validate_scope_rejects_unauthorized_scope():
"""When client has specific allowed scopes, unauthorized scopes should be rejected."""
client = OAuthClientMetadata(
redirect_uris=[AnyUrl("http://localhost:3030/callback")],
scope="read",
)
with pytest.raises(InvalidScopeError, match="write"):
client.validate_scope("read write")


def test_validate_scope_accepts_authorized_scope():
"""When client has specific allowed scopes, authorized scopes should be accepted."""
client = OAuthClientMetadata(
redirect_uris=[AnyUrl("http://localhost:3030/callback")],
scope="read write",
)
result = client.validate_scope("read write")
assert result == ["read", "write"]
Loading