Tin Chi Lo 2eb37d7948 fix(mcp): re-request the sealed scope on a bridge refresh when the client omits it ... The refresh envelope seals the upstream scope as the scope to re-request (RefreshCredential), but _prepare_bridge_refresh dropped it, unwrapping only the refresh token, and the exchange added scope to the upstream request only from the client's HTTP form. A DCR/MCP client typically omits scope on refresh, so the sealed scope was never sent and a stricter upstream could narrow or drop the renewed token's scope Thread the sealed scope through _BridgeRefreshReady.upstream_scope and fall back to it when the client sends none; a client-supplied scope still wins, which RFC 6749 section 6 bounds to the original grant. The regression test drives a refresh where the client omits scope and asserts the upstream POST carries the sealed scope, mutation-checked against both the drop and the fallback		2026-07-13 15:28:53 -07:00
..
mcp_server	fix(mcp): re-request the sealed scope on a bridge refresh when the client omits it	2026-07-13 15:28:53 -07:00