informatics-isi-edu / deriva-mcp-core / 23559869742

91%

push

github

Fix stale derived-token bug in StreamableHTTP transport; harden _is_401 detection

  - server.py: set stateless_http=True in the FastMCP constructor.
    In stateful (default) mode the MCP lowlevel server spawns a single long-lived
    task per session; that task copies the asyncio context at spawn time (T1 creds).
    When the derived token expires and verify_token() exchanges T1->T2, T2 is set
    in the middleware coroutine's context but the long-lived task -- and all
    message-handler child tasks it spawns -- still carry T1. ERMrest then receives
    the expired T1 and returns 401. With stateless_http=True each HTTP request
    spawns a fresh task inside the auth middleware call stack, so every tool
    handler inherits the correct per-request credential.

  - context.py: extend _is_401() to also inspect exc.caused_by. The deriva-py
    datapath API wraps HTTP errors in DataPathException; the underlying HTTPError
    (with .response.status_code) is on caused_by, not on the exception itself, so
    the old single-level check missed it.

8 of 8 new or added lines in 1 file covered. (100.0%)

1487 of 2068 relevant lines covered (71.91%)

0.72 hits per line