From 0a696c50ddf1d361e44db6d925a0ff41ddb68ff7 Mon Sep 17 00:00:00 2001 From: Tin Chi Lo Date: Wed, 17 Jun 2026 14:20:23 -0700 Subject: [PATCH] fix(mcp/v2): add the assert_never tail to resolve()'s dispatch match resolve() is the one function the whole seam exists for, yet it ended its match on auth_spec_kind without the assert_never tail that both sibling matches (the spike's label_enum and CredError.summary) carry and that the module README documents as load-bearing. The compile-time gate (reportMatchNotExhaustive) already held, so this is defence-in-depth: without the tail a bypassed gate (a stray case _ left in, which suppresses the exhaustiveness check) lets the match fall through and return None, silently violating the declared Result[httpx.Auth, CredError] contract. The tail turns that into a loud failure and brings the seam in line with the documented pattern. --- litellm/proxy/_experimental/mcp_server/v2/oauth/types.py | 1 + 1 file changed, 1 insertion(+) diff --git a/litellm/proxy/_experimental/mcp_server/v2/oauth/types.py b/litellm/proxy/_experimental/mcp_server/v2/oauth/types.py index d4bb076e8a9..44855713e51 100644 --- a/litellm/proxy/_experimental/mcp_server/v2/oauth/types.py +++ b/litellm/proxy/_experimental/mcp_server/v2/oauth/types.py @@ -170,6 +170,7 @@ class UpstreamCredentialProvider: return self._none(subject, server) case AuthSpecKind.aws_sigv4: return self._aws_sigv4(subject, server) + assert_never(server.auth_spec_kind) # --- arms: Phase 0 stubs (errors-as-values, no raise). Filled in Phase 1. ------------- def _authorization_code(