diff --git a/src/mcp/shared/auth.py b/src/mcp/shared/auth.py index 3b48152d5..d2bcc3264 100644 --- a/src/mcp/shared/auth.py +++ b/src/mcp/shared/auth.py @@ -1,4 +1,4 @@ -from typing import Any, Literal +from typing import Any, Literal, cast from pydantic import AnyHttpUrl, AnyUrl, BaseModel, Field, field_validator @@ -67,6 +67,17 @@ class OAuthClientMetadata(BaseModel): software_id: str | None = None software_version: str | None = None + @field_validator("redirect_uris", mode="before") + @classmethod + def _coerce_redirect_uris_to_any_url(cls, v: object) -> object: + # Pydantic v2 keeps AnyUrl subclasses such as AnyHttpUrl as-is, while + # AnyUrl equality is type-strict. Store the declared base type so later + # redirect_uri membership checks compare URLs, not URL wrapper classes. + if isinstance(v, list | tuple): + items = cast("list[object] | tuple[object, ...]", v) + return [str(item) if isinstance(item, AnyUrl) else item for item in items] + return v + @field_validator( "client_uri", "logo_uri", diff --git a/tests/shared/test_auth.py b/tests/shared/test_auth.py index 7463bc5a8..cd05add89 100644 --- a/tests/shared/test_auth.py +++ b/tests/shared/test_auth.py @@ -1,9 +1,9 @@ """Tests for OAuth 2.0 shared code.""" import pytest -from pydantic import ValidationError +from pydantic import AnyHttpUrl, AnyUrl, ValidationError -from mcp.shared.auth import OAuthClientInformationFull, OAuthClientMetadata, OAuthMetadata +from mcp.shared.auth import InvalidRedirectUriError, OAuthClientInformationFull, OAuthClientMetadata, OAuthMetadata def test_oauth(): @@ -130,6 +130,19 @@ def test_information_full_inherits_coercion(): assert info.jwks_uri is None +def test_redirect_uris_normalize_any_url_subtypes(): + info = OAuthClientInformationFull( + client_id="abc123", + redirect_uris=[AnyHttpUrl("https://example.com/callback")], + ) + + assert info.validate_redirect_uri(AnyUrl("https://example.com/callback")) == AnyUrl("https://example.com/callback") + assert info.model_dump(mode="json")["redirect_uris"] == ["https://example.com/callback"] + + with pytest.raises(InvalidRedirectUriError): + info.validate_redirect_uri(AnyUrl("https://example.com/other")) + + def test_invalid_non_empty_url_still_rejected(): """Coercion must only touch empty strings — garbage URLs still raise.""" data = {