test: re-pin WWW-Authenticate assertions to the scope-bearing challenge
Claude / Claude Code Review
completed
Aug 11, 2026 in 5m 44s
Code review found 1 important issue
Found 2 candidates, confirmed 3. See review comments for details.
Details
| Severity | Count |
|---|---|
| 🔴 Important | 1 |
| 🟡 Nit | 2 |
| 🟣 Pre-existing | 0 |
| Severity | File:Line | Issue |
|---|---|---|
| 🟡 Nit | tests/interaction/auth/_harness.py:312-318 |
[quality] Stale _FirstChallenge docstring still claims the bearer middleware cannot emit scope= |
| 🟡 Nit | tests/client/test_auth.py:38 |
[quality] test_auth.py imports Server via private path instead of public mcp.server |
Annotations
Check warning on line 318 in tests/interaction/auth/_harness.py
claude / Claude Code Review
[quality] Stale _FirstChallenge docstring still claims the bearer middleware cannot emit scope=
The `_FirstChallenge` docstring (~line 281) still claims the initial 401 needs the shim to carry "parameters (such as `scope=`) that the SDK's own bearer middleware cannot be configured to emit" — after this PR the middleware does emit `scope=` whenever `required_scopes` is non-empty, so that example is now false. Consider rewording it the same way this PR reworded the sibling `step_up_shim` docstring (e.g. "a `scope` differing from the configured `required_scopes`").
Check warning on line 38 in tests/client/test_auth.py
claude / Claude Code Review
[quality] test_auth.py imports Server via private path instead of public mcp.server
Code quality: this new import uses the private module path `from mcp.server.lowlevel.server import Server` instead of the public re-export `from mcp.server import Server` (listed in `__all__`), which every sibling test file in `tests/client/` and 40+ other test files use. A one-line switch to the public import keeps the test decoupled from the internal module layout.
Loading