From 551fe883d955970824353467333f6cd2fa52eaac Mon Sep 17 00:00:00 2001 From: KoNit-K <124019182+KoNit-K@users.noreply.github.com> Date: Tue, 15 Sep 2026 11:50:50 -0700 Subject: [PATCH] test: device login through a later issuer-bound authorization server Extend the real-wire device fixture with a `multi_issuer` mode whose protected-resource metadata lists an issuer-mismatching server before the valid one, and run the production CLI login through it. Red on main (`Authorization server metadata issuer mismatch`), green with the scan. Ported from PR #112068. --- evals/mcp_device_flow.py | 3 ++- tests/tools/test_mcp_device_flow.py | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/evals/mcp_device_flow.py b/evals/mcp_device_flow.py index af151f047c..eedb7fab90 100644 --- a/evals/mcp_device_flow.py +++ b/evals/mcp_device_flow.py @@ -46,7 +46,8 @@ def oauth_fixture(mode="success"): return self.reply(401, {}, {"WWW-Authenticate": f'Bearer resource_metadata="{base}/prm"'}) if self.path == "/prm" or "oauth-protected-resource" in self.path: return self.reply(200, {"resource": base + ("/wrong" if mode == "resource" else "/mcp"), - "authorization_servers": [base]}) + "authorization_servers": ([base + "/wrong", base] + if mode == "multi_issuer" else [base])}) if "oauth-authorization-server" in self.path: metadata = {"issuer": base + ("/wrong" if mode == "issuer" else ""), "authorization_endpoint": base + "/authorize", "token_endpoint": base + "/token", diff --git a/tests/tools/test_mcp_device_flow.py b/tests/tools/test_mcp_device_flow.py index 031e3bd4de..704d43401d 100644 --- a/tests/tools/test_mcp_device_flow.py +++ b/tests/tools/test_mcp_device_flow.py @@ -6,7 +6,7 @@ import pytest from evals.mcp_device_flow import DEVICE_GRANT, run_cli -@pytest.mark.parametrize("mode", ["success", "preregistered"]) +@pytest.mark.parametrize("mode", ["success", "preregistered", "multi_issuer"]) def test_device_login_registers_authorizes_and_persists(mode): result = run_cli(Path(__file__).resolve().parents[2], mode) assert result["token_persisted"], result @@ -20,7 +20,7 @@ def test_device_login_registers_authorizes_and_persists(mode): assert all(row["data"]["resource"].endswith("/mcp") for row in polls) if mode == "success": assert polls[2]["at"] - polls[1]["at"] >= 5 - else: + elif mode == "preregistered": assert not any(row["path"] == "/register" for row in result["wire"])