From ee38ba16e3849f5e35b23f689fe40011f3ccc6ab Mon Sep 17 00:00:00 2001 From: Claude Date: Wed, 20 May 2026 17:41:52 +0000 Subject: [PATCH] fix(mcp,tests): sync stubs and cold-start assertions with delegate-check MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The merge of base-branch _target_servers_delegate_auth_to_upstream into process_mcp_request inserts an additional get_mcp_server_by_name(name) lookup ahead of the cold-start path, which breaks two test patterns: 1. lookup_by_name(name) side-effect stubs in TestMCPDelegateAuthToUpstream are called positionally by the delegate check, then again by the cold-start path with client_ip=... — raising TypeError: unexpected keyword argument 'client_ip'. Accept **_kwargs to match the real signature. 2. TestMCPPassthroughColdStartAdmission assertions count the lookup exactly once with client_ip=..., but the delegate check now adds a positional-only call ahead of it. Switch assert_called_once_with to assert_any_call for the cold-start invocation, and assert client_ip was *not* passed for the aggregate /mcp test where cold-start must not fire. Both updates align with CLAUDE.md guidance to keep monkeypatch stubs in sync with the real signature when an optional parameter is added. Co-authored-by: Claude --- .../auth/test_user_api_key_auth_mcp.py | 24 ++++++++++++++----- 1 file changed, 18 insertions(+), 6 deletions(-) diff --git a/tests/test_litellm/proxy/_experimental/mcp_server/auth/test_user_api_key_auth_mcp.py b/tests/test_litellm/proxy/_experimental/mcp_server/auth/test_user_api_key_auth_mcp.py index f719b40fe74..241ff89b7e6 100644 --- a/tests/test_litellm/proxy/_experimental/mcp_server/auth/test_user_api_key_auth_mcp.py +++ b/tests/test_litellm/proxy/_experimental/mcp_server/auth/test_user_api_key_auth_mcp.py @@ -918,7 +918,13 @@ class TestMCPPassthroughColdStartAdmission: await MCPRequestHandler.process_mcp_request(scope) assert exc_info.value.status_code == 401 - mock_mgr.get_mcp_server_by_name.assert_not_called() + # Cold-start lookup (signaled by the ``client_ip`` kwarg) must not + # fire for the aggregate ``/mcp`` route — only path-targeted + # routes are eligible for OAuth discovery admission. + assert not any( + "client_ip" in c.kwargs + for c in mock_mgr.get_mcp_server_by_name.call_args_list + ) async def test_cold_start_rejects_server_specific_authorization_header(self): from fastapi import HTTPException @@ -1016,7 +1022,7 @@ class TestMCPPassthroughColdStartAdmission: await MCPRequestHandler.process_mcp_request(scope) assert exc_info.value.status_code == 401 - mock_mgr.get_mcp_server_by_name.assert_called_once_with( + mock_mgr.get_mcp_server_by_name.assert_any_call( "passthrough_server", client_ip="203.0.113.10" ) @@ -1111,7 +1117,7 @@ class TestMCPPassthroughColdStartAdmission: (auth_result, *_rest) = await MCPRequestHandler.process_mcp_request(scope) assert isinstance(auth_result, UserAPIKeyAuth) - mock_mgr.get_mcp_server_by_name.assert_called_once_with( + mock_mgr.get_mcp_server_by_name.assert_any_call( "passthrough_server", client_ip="" ) @@ -1148,7 +1154,7 @@ class TestMCPPassthroughColdStartAdmission: (auth_result, *_rest) = await MCPRequestHandler.process_mcp_request(scope) assert isinstance(auth_result, UserAPIKeyAuth) - mock_mgr.get_mcp_server_by_name.assert_called_once_with( + mock_mgr.get_mcp_server_by_name.assert_any_call( "passthrough_server", client_ip="" ) @@ -1996,9 +2002,12 @@ class TestMCPDelegateAuthToUpstream: delegate_auth_to_upstream=True, ) - def lookup_by_name(name): + def lookup_by_name(name, **_kwargs): # Only the *exact* delegated name resolves. Anything else (e.g. # ``delegated_server/extra``) returns None so the bypass fails. + # ``**_kwargs`` accepts the ``client_ip`` kwarg the cold-start + # admission path now forwards (real signature: + # ``get_mcp_server_by_name(name, client_ip=None)``). if name == "delegated_server": return delegate_server return None @@ -2059,7 +2068,10 @@ class TestMCPDelegateAuthToUpstream: auth_type=MCPAuth.api_key, ) - def lookup_by_name(name): + def lookup_by_name(name, **_kwargs): + # ``**_kwargs`` accepts the ``client_ip`` kwarg the cold-start + # admission path now forwards (real signature: + # ``get_mcp_server_by_name(name, client_ip=None)``). return { "delegated_server": delegate_server, "non_delegate_server": non_delegate,