From 7c111480a7ad4b87694a30b2abfd568d3f4a8537 Mon Sep 17 00:00:00 2001
From: Mateo Wang <277851410+mateo-berri@users.noreply.github.com>
Date: Tue, 23 Jun 2026 23:22:41 -0700
Subject: [PATCH] test(mcp): restore the AuthSpecKind completeness guard in the
 resolver tests

The resolver-test restructure dropped the meta-test that pinned every AuthSpecKind to a
resolver test. The type-level assert_never gate forces a new mode to have an arm, but it
cannot see a new mode shipping without a test; this guard fails when the live plus stubbed
configs stop covering the full AuthSpecKind set, so a new mode has to add a test case here
---
 .../outbound_credentials/test_resolver.py       | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/outbound_credentials/test_resolver.py b/tests/test_litellm/proxy/_experimental/mcp_server/outbound_credentials/test_resolver.py
index 75be6dfc157..32242f16086 100644
--- a/tests/test_litellm/proxy/_experimental/mcp_server/outbound_credentials/test_resolver.py
+++ b/tests/test_litellm/proxy/_experimental/mcp_server/outbound_credentials/test_resolver.py
@@ -12,6 +12,7 @@ from pydantic import SecretStr
 
 from litellm.proxy._experimental.mcp_server.outbound_credentials import (
     ApiKeyConfig,
+    AuthSpecKind,
     AuthorizationCodeConfig,
     AwsSigV4Config,
     Byok,
@@ -102,3 +103,19 @@ async def test_unbuilt_arms_fail_closed_with_not_implemented(label, config):
     )
     assert isinstance(result, Error)
     assert result.error.tag == "not_implemented"
+
+
+def test_every_auth_spec_kind_is_exercised():
+    """A new AuthSpecKind that ships without a resolver test fails here.
+
+    The resolver's match over the config union is exhaustive at the type level (assert_never), so
+    a missing arm fails basedpyright; this guards the parallel gap the type checker cannot see, a
+    new mode that ships without a test exercising its arm. The two live arms cover `none` and the
+    shared-key `api_key`; `_STUBBED` covers the BYOK `api_key` source and every remaining mode.
+    """
+    live_kinds = {
+        NoneConfig().kind,
+        ApiKeyConfig(key_source=SharedKey(value=SecretStr("k"))).kind,
+    }
+    stubbed_kinds = {config.kind for _, config in _STUBBED}
+    assert live_kinds | stubbed_kinds == set(AuthSpecKind)