Function auth_settings

tests/interaction/auth/_harness.py:180–202

Build `AuthSettings` for the co-hosted authorization + resource server. The issuer and resource URLs use the suite's loopback origin, which `validate_issuer_url` accepts in lieu of HTTPS. Dynamic client registration is enabled. `valid_scopes` defaults to `required_scopes` so a client re

(
    *, required_scopes: Sequence[str] = ("mcp",), valid_scopes: Sequence[str] | None = None
)

def auth_settings(
    *, required_scopes: Sequence[str] = ("mcp",), valid_scopes: Sequence[str] | None = None
) -> AuthSettings:
    """Build `AuthSettings` for the co-hosted authorization + resource server.

    The issuer and resource URLs use the suite's loopback origin, which `validate_issuer_url`
    accepts in lieu of HTTPS. Dynamic client registration is enabled. `valid_scopes` defaults
    to `required_scopes` so a client requesting exactly those passes registration scope
    validation; tests pass a wider set when they need the protected-resource metadata's
    `scopes_supported` (which mirrors `required_scopes`) to differ from what the client may
    register or when AS metadata should advertise additional scopes such as `offline_access`.
    """
    required = list(required_scopes)
    valid = list(valid_scopes) if valid_scopes is not None else required
    return AuthSettings(
        issuer_url=AnyHttpUrl(BASE_URL),
        resource_server_url=AnyHttpUrl(f"{BASE_URL}/mcp"),
        required_scopes=required,
        client_registration_options=ClientRegistrationOptions(
            enabled=True, valid_scopes=valid, default_scopes=required
        ),
        revocation_options=RevocationOptions(enabled=False),
    )


def oauth_client_metadata() -> OAuthClientMetadata: