feat: OAuth 2.1 Authentication with DCR and Consent Form (#368)

* feat: add OAuth 2.1 authentication with DCR and consent form

Implements OAuth 2.1 authentication for ha-mcp using FastMCP's OAuthProvider pattern
with Dynamic Client Registration (DCR). This enables secure, zero-config authentication
for MCP clients like Claude.ai.

Features:
- HomeAssistantOAuthProvider subclass with full OAuth 2.1 support
- Consent form for collecting Home Assistant URL and Long-Lived Access Token
- LLAT validation against HA API before issuing auth codes
- Token management with refresh token support
- New `ha-mcp-oauth` entry point for OAuth-enabled server mode

The OAuth flow:
1. Claude.ai registers dynamically via DCR
2. User is redirected to consent form
3. User enters HA URL and LLAT
4. Credentials are validated against HA
5. Auth code is issued and exchanged for tokens

Closes #245

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix(oauth): enhance OAuth metadata for Claude.ai compatibility

Add missing OAuth 2.1 metadata fields required by Claude.ai and other MCP clients:

- **response_modes_supported**: Added ["query"] to comply with OAuth spec
- **token_endpoint_auth_methods_supported**: Added "none" for public clients with PKCE
- **revocation_endpoint_auth_methods_supported**: Added "none" for consistency

## Changes Made

### Enhanced OAuth Metadata Endpoint
- Override `/.well-known/oauth-authorization-server` route in `HomeAssistantOAuthProvider`
- Use `metadata.model_dump(mode='json')` to properly serialize `AnyHttpUrl` objects
- Append "none" auth method to support public clients (Claude.ai uses this pattern)
- Add response_modes_supported field per OAuth 2.1 spec

## Comparison with Production MCP Servers

Analyzed metadata from known-good servers (Linear, Asana, Sentry) and identified
that they all include:
- `response_modes_supported: ["query"]`
- `token_endpoint_auth_methods_supported` includes `"none"`

These fields are critical for Claude.ai's OAuth client which operates as a
public client with PKCE (no client_secret).

## Testing

✅ Tested locally on port 8086
✅ Verified via cloudflare tunnel at https://kijiji-mesa-algebra-arrange.trycloudflare.com
✅ Metadata now matches production MCP server patterns

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix(oauth): enable full toolset in OAuth mode

Changed OAuth server to use the complete HomeAssistantSmartMCPServer with
all 80+ tools instead of just a test tool.

## Changes

### Config (src/ha_mcp/config.py)
- Made `homeassistant_url` and `homeassistant_token` optional with OAuth-mode defaults
- Updated validators to accept OAuth placeholder values
- Enables server initialization without environment variables in OAuth mode

### OAuth Server (src/ha_mcp/__main__.py)
- Use `HomeAssistantSmartMCPServer` instead of minimal FastMCP instance
- Override `client` property to provide OAuth-aware HomeAssistant clients
- Extract credentials from OAuth access tokens per-request
- Cache clients by credential set for performance
- Fixed `list_tools()` → `get_tools()` and made it async-aware

## How It Works
1. Server starts without requiring HA env vars (uses placeholders)
2. Client property is overridden to dynamically get credentials
3. Each tool request extracts access token from request context
4. OAuth provider returns HA credentials based on token
5. Dynamic client is created/cached with those credentials

This allows multiple users to authenticate with different HA instances
via the same server instance.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix(oauth): implement claims-based stateless auth with proxy client pattern

Changes:
- Store HA credentials (URL + LLAT) in JWT access token claims
- Enables stateless operation - credentials survive server restarts
- Implement OAuthProxyClient to dynamically inject credentials per-request
- Fixes closure issue where tools captured placeholder client at registration
- Preserve claims across token refresh
- Fix NameError when accessing ha_credentials during token exchange

Architecture:
- Claims contain: ha_url, ha_token (embedded in JWT)
- Proxy intercepts tool calls via __getattr__
- Extracts credentials from request token.claims
- Creates/reuses HomeAssistantClient with real credentials

Known Issue:
- FastMCP returns 'invalid_token' error during token validation
- Need to debug verify_token() / load_access_token() methods

Related: #245

🤖 Generated with Claude Code
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* fix(oauth): use FastMCP AccessToken with claims and correct client init

Critical fixes:
- Import AccessToken from fastmcp.server.auth.auth (has claims field)
  instead of mcp.server.auth.provider (no claims field)
- Initialize HomeAssistantClient with base_url and token params
  instead of settings object
- Store HA credentials in JWT claims for stateless auth

Working:
✅ OAuth 2.1 flow with consent form
✅ Credentials stored in access_token.claims
✅ OAuthProxyClient extracts claims and creates HA client
✅ All 97 tools functional with real HA data

Limitation:
❌ Tokens don't persist across server restart (in-memory storage)
- We generate random strings, not cryptographic JWTs
- For true stateless persistence, need JWT encoding/decoding

Next steps for full persistence:
- Use python-jose or similar to create signed JWTs
- Encode claims in JWT payload
- Decode/validate in load_access_token() without memory lookup

Related: #245

🤖 Generated with Claude Code
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* feat(oauth): implement stateless encrypted tokens for persistence

Replaced in-memory token storage with Fernet encryption for stateless,
persistent authentication tokens:

- Access tokens now contain encrypted HA credentials (URL + token)
- Tokens survive server restarts when OAUTH_ENCRYPTION_KEY is set
- No server-side session storage required
- Credentials encrypted/decrypted on-demand from token string

Changes:
- Added cryptography dependency for Fernet symmetric encryption
- Updated token generation to encrypt credentials
- Updated token validation to decrypt and verify
- Cleaned up debug print() statements
- Updated all OAuth unit tests (24/24 passing)
- Fixed test_revoke_token for stateless token architecture

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

* test(oauth): add comprehensive test coverage for routes and proxy client

Added 13 new tests to improve OAuth test coverage from 64% to higher:

**TestOAuthRoutes (7 tests):**
- Enhanced metadata endpoint verification
- Consent form GET (success, missing txn_id, invalid, expired)
- Consent form POST (success, invalid credentials)

**TestEndToEndOAuthFlow (1 test):**
- Complete OAuth flow from registration to token refresh
- Tests full lifecycle: register → authorize → consent → exchange → refresh

**TestOAuthProxyClient (5 tests):**
- Initialization and attribute forwarding
- Client reuse for same credentials
- Error handling (no token, missing claims)

**Code improvements:**
- Moved OAuthProxyClient to top-level for testability
- Fixed all test mocking paths for fastmcp.server.dependencies

All 37 OAuth unit tests now passing.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: julienld

coverage.json

@@ -0,0 +1 @@
+{"meta": {"format": 3, "version": "7.10.6", "timestamp": "2025-12-25T23:06:14.401774", "branch_coverage": false, "show_contexts": false}, "files": {"src/ha_mcp/auth/__init__.py": {"executed_lines": [1, 8, 10], "summary": {"covered_lines": 2, "num_statements": 2, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": [], "functions": {"": {"executed_lines": [1, 8, 10], "summary": {"covered_lines": 2, "num_statements": 2, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}}, "classes": {"": {"executed_lines": [1, 8, 10], "summary": {"covered_lines": 2, "num_statements": 2, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}}}, "src/ha_mcp/auth/consent_form.py": {"executed_lines": [1, 9, 31, 32, 34, 35, 36, 42, 400, 411], "summary": {"covered_lines": 9, "num_statements": 9, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": [], "functions": {"create_consent_html": {"executed_lines": [31, 32, 34, 35, 36, 42], "summary": {"covered_lines": 6, "num_statements": 6, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "create_error_html": {"executed_lines": [411], "summary": {"covered_lines": 1, "num_statements": 1, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "": {"executed_lines": [1, 9, 400], "summary": {"covered_lines": 2, "num_statements": 2, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}}, "classes": {"": {"executed_lines": [1, 9, 31, 32, 34, 35, 36, 42, 400, 411], "summary": {"covered_lines": 9, "num_statements": 9, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}}}, "src/ha_mcp/auth/provider.py": {"executed_lines": [1, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 27, 28, 29, 30, 31, 33, 39, 41, 44, 45, 46, 49, 50, 52, 53, 54, 55, 57, 59, 66, 67, 81, 102, 103, 109, 110, 112, 122, 123, 124, 125, 128, 131, 134, 135, 138, 139, 141, 143, 150, 151, 156, 157, 162, 164, 166, 167, 168, 170, 172, 173, 174, 175, 176, 177, 179, 180, 181, 183, 193, 198, 200, 232, 233, 234, 238, 239, 249, 252, 257, 258, 260, 262, 264, 267, 272, 273, 274, 275, 276, 280, 283, 284, 286, 295, 301, 302, 308, 311, 323, 324, 326, 327, 329, 381, 483, 494, 495, 497, 498, 506, 507, 509, 512, 516, 517, 518, 523, 526, 528, 529, 536, 550, 554, 560, 562, 566, 567, 569, 570, 573, 574, 582, 588, 596, 599, 600, 602, 604, 616, 630, 638, 639, 640, 646, 650, 651, 652, 657, 660, 661, 663, 664, 667, 675, 682, 683, 685, 693, 702, 703, 704, 706, 710, 721, 723, 725, 729, 739, 740, 741, 743, 744, 749, 751, 753, 754, 756, 769, 771, 783, 784, 785, 786], "summary": {"covered_lines": 182, "num_statements": 291, "percent_covered": 62.54295532646048, "percent_covered_display": "63", "missing_lines": 109, "excluded_lines": 0}, "missing_lines": [152, 153, 178, 202, 205, 214, 217, 220, 221, 222, 225, 226, 227, 229, 281, 296, 331, 332, 334, 335, 343, 344, 345, 354, 355, 356, 364, 374, 379, 383, 384, 386, 387, 388, 389, 391, 392, 400, 401, 402, 410, 412, 413, 419, 425, 428, 429, 430, 436, 442, 443, 447, 450, 451, 453, 454, 455, 457, 468, 471, 474, 480, 481, 510, 513, 519, 520, 521, 530, 531, 532, 533, 534, 540, 541, 542, 543, 544, 545, 546, 547, 548, 555, 563, 575, 620, 621, 622, 623, 624, 625, 626, 627, 628, 641, 647, 653, 654, 730, 731, 733, 734, 735, 736, 737, 745, 746, 747, 752], "excluded_lines": [], "functions": {"HomeAssistantCredentials.__init__": {"executed_lines": [53, 54, 55], "summary": {"covered_lines": 3, "num_statements": 3, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "HomeAssistantCredentials.to_dict": {"executed_lines": [59], "summary": {"covered_lines": 1, "num_statements": 1, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "HomeAssistantOAuthProvider.__init__": {"executed_lines": [102, 103, 109, 110, 112, 122, 123, 124, 125, 128, 131, 134, 135, 138, 139, 141], "summary": {"covered_lines": 16, "num_statements": 16, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "HomeAssistantOAuthProvider._get_or_create_encryption_key": {"executed_lines": [150, 151, 156, 157, 162], "summary": {"covered_lines": 5, "num_statements": 7, "percent_covered": 71.42857142857143, "percent_covered_display": "71", "missing_lines": 2, "excluded_lines": 0}, "missing_lines": [152, 153], "excluded_lines": []}, "HomeAssistantOAuthProvider._encrypt_credentials": {"executed_lines": [166, 167, 168], "summary": {"covered_lines": 3, "num_statements": 3, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "HomeAssistantOAuthProvider._decrypt_credentials": {"executed_lines": [172, 173, 174, 175, 176, 177, 179, 180, 181], "summary": {"covered_lines": 9, "num_statements": 10, "percent_covered": 90.0, "percent_covered_display": "90", "missing_lines": 1, "excluded_lines": 0}, "missing_lines": [178], "excluded_lines": []}, "HomeAssistantOAuthProvider.get_routes": {"executed_lines": [193, 198, 200, 232, 233, 234, 238, 239, 249, 252, 257, 258], "summary": {"covered_lines": 12, "num_statements": 12, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "HomeAssistantOAuthProvider.get_routes.enhanced_metadata_handler": {"executed_lines": [], "summary": {"covered_lines": 0, "num_statements": 11, "percent_covered": 0.0, "percent_covered_display": "0", "missing_lines": 11, "excluded_lines": 0}, "missing_lines": [202, 205, 214, 217, 220, 221, 222, 225, 226, 227, 229], "excluded_lines": []}, "HomeAssistantOAuthProvider.get_client": {"executed_lines": [262], "summary": {"covered_lines": 1, "num_statements": 1, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "HomeAssistantOAuthProvider.register_client": {"executed_lines": [267, 272, 273, 274, 275, 276, 280, 283, 284], "summary": {"covered_lines": 9, "num_statements": 10, "percent_covered": 90.0, "percent_covered_display": "90", "missing_lines": 1, "excluded_lines": 0}, "missing_lines": [281], "excluded_lines": []}, "HomeAssistantOAuthProvider.authorize": {"executed_lines": [295, 301, 302, 308, 311, 323, 324, 326, 327], "summary": {"covered_lines": 9, "num_statements": 10, "percent_covered": 90.0, "percent_covered_display": "90", "missing_lines": 1, "excluded_lines": 0}, "missing_lines": [296], "excluded_lines": []}, "HomeAssistantOAuthProvider._consent_get": {"executed_lines": [], "summary": {"covered_lines": 0, "num_statements": 13, "percent_covered": 0.0, "percent_covered_display": "0", "missing_lines": 13, "excluded_lines": 0}, "missing_lines": [331, 332, 334, 335, 343, 344, 345, 354, 355, 356, 364, 374, 379], "excluded_lines": []}, "HomeAssistantOAuthProvider._consent_post": {"executed_lines": [], "summary": {"covered_lines": 0, "num_statements": 34, "percent_covered": 0.0, "percent_covered_display": "0", "missing_lines": 34, "excluded_lines": 0}, "missing_lines": [383, 384, 386, 387, 388, 389, 391, 392, 400, 401, 402, 410, 412, 413, 419, 425, 428, 429, 430, 436, 442, 443, 447, 450, 451, 453, 454, 455, 457, 468, 471, 474, 480, 481], "excluded_lines": []}, "HomeAssistantOAuthProvider._validate_ha_credentials": {"executed_lines": [494, 495, 497, 498, 506, 507, 509, 512, 516, 517, 518, 523, 526, 528, 529], "summary": {"covered_lines": 15, "num_statements": 25, "percent_covered": 60.0, "percent_covered_display": "60", "missing_lines": 10, "excluded_lines": 0}, "missing_lines": [510, 513, 519, 520, 521, 530, 531, 532, 533, 534], "excluded_lines": []}, "HomeAssistantOAuthProvider.load_authorization_code": {"executed_lines": [], "summary": {"covered_lines": 0, "num_statements": 9, "percent_covered": 0.0, "percent_covered_display": "0", "missing_lines": 9, "excluded_lines": 0}, "missing_lines": [540, 541, 542, 543, 544, 545, 546, 547, 548], "excluded_lines": []}, "HomeAssistantOAuthProvider.exchange_authorization_code": {"executed_lines": [554, 560, 562, 566, 567, 569, 570, 573, 574, 582, 588, 596, 599, 600, 602, 604], "summary": {"covered_lines": 16, "num_statements": 19, "percent_covered": 84.21052631578948, "percent_covered_display": "84", "missing_lines": 3, "excluded_lines": 0}, "missing_lines": [555, 563, 575], "excluded_lines": []}, "HomeAssistantOAuthProvider.load_refresh_token": {"executed_lines": [], "summary": {"covered_lines": 0, "num_statements": 9, "percent_covered": 0.0, "percent_covered_display": "0", "missing_lines": 9, "excluded_lines": 0}, "missing_lines": [620, 621, 622, 623, 624, 625, 626, 627, 628], "excluded_lines": []}, "HomeAssistantOAuthProvider.exchange_refresh_token": {"executed_lines": [638, 639, 640, 646, 650, 651, 652, 657, 660, 661, 663, 664, 667, 675, 682, 683, 685], "summary": {"covered_lines": 17, "num_statements": 21, "percent_covered": 80.95238095238095, "percent_covered_display": "81", "missing_lines": 4, "excluded_lines": 0}, "missing_lines": [641, 647, 653, 654], "excluded_lines": []}, "HomeAssistantOAuthProvider.load_access_token": {"executed_lines": [702, 703, 704, 706, 710], "summary": {"covered_lines": 5, "num_statements": 5, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "HomeAssistantOAuthProvider.verify_token": {"executed_lines": [723], "summary": {"covered_lines": 1, "num_statements": 1, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "HomeAssistantOAuthProvider._revoke_internal": {"executed_lines": [729, 739, 740, 741, 743, 744], "summary": {"covered_lines": 6, "num_statements": 16, "percent_covered": 37.5, "percent_covered_display": "38", "missing_lines": 10, "excluded_lines": 0}, "missing_lines": [730, 731, 733, 734, 735, 736, 737, 745, 746, 747], "excluded_lines": []}, "HomeAssistantOAuthProvider.revoke_token": {"executed_lines": [751, 753, 754], "summary": {"covered_lines": 3, "num_statements": 4, "percent_covered": 75.0, "percent_covered_display": "75", "missing_lines": 1, "excluded_lines": 0}, "missing_lines": [752], "excluded_lines": []}, "HomeAssistantOAuthProvider.get_ha_credentials": {"executed_lines": [769], "summary": {"covered_lines": 1, "num_statements": 1, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "HomeAssistantOAuthProvider.get_ha_credentials_for_token": {"executed_lines": [783, 784, 785, 786], "summary": {"covered_lines": 4, "num_statements": 4, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "": {"executed_lines": [1, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 27, 28, 29, 30, 31, 33, 39, 41, 44, 45, 46, 49, 50, 52, 57, 66, 67, 81, 143, 164, 170, 183, 260, 264, 286, 329, 381, 483, 536, 550, 616, 630, 693, 721, 725, 749, 756, 771], "summary": {"covered_lines": 46, "num_statements": 46, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}}, "classes": {"HomeAssistantCredentials": {"executed_lines": [53, 54, 55, 59], "summary": {"covered_lines": 4, "num_statements": 4, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}, "HomeAssistantOAuthProvider": {"executed_lines": [102, 103, 109, 110, 112, 122, 123, 124, 125, 128, 131, 134, 135, 138, 139, 141, 150, 151, 156, 157, 162, 166, 167, 168, 172, 173, 174, 175, 176, 177, 179, 180, 181, 193, 198, 200, 232, 233, 234, 238, 239, 249, 252, 257, 258, 262, 267, 272, 273, 274, 275, 276, 280, 283, 284, 295, 301, 302, 308, 311, 323, 324, 326, 327, 494, 495, 497, 498, 506, 507, 509, 512, 516, 517, 518, 523, 526, 528, 529, 554, 560, 562, 566, 567, 569, 570, 573, 574, 582, 588, 596, 599, 600, 602, 604, 638, 639, 640, 646, 650, 651, 652, 657, 660, 661, 663, 664, 667, 675, 682, 683, 685, 702, 703, 704, 706, 710, 723, 729, 739, 740, 741, 743, 744, 751, 753, 754, 769, 783, 784, 785, 786], "summary": {"covered_lines": 132, "num_statements": 241, "percent_covered": 54.77178423236514, "percent_covered_display": "55", "missing_lines": 109, "excluded_lines": 0}, "missing_lines": [152, 153, 178, 202, 205, 214, 217, 220, 221, 222, 225, 226, 227, 229, 281, 296, 331, 332, 334, 335, 343, 344, 345, 354, 355, 356, 364, 374, 379, 383, 384, 386, 387, 388, 389, 391, 392, 400, 401, 402, 410, 412, 413, 419, 425, 428, 429, 430, 436, 442, 443, 447, 450, 451, 453, 454, 455, 457, 468, 471, 474, 480, 481, 510, 513, 519, 520, 521, 530, 531, 532, 533, 534, 540, 541, 542, 543, 544, 545, 546, 547, 548, 555, 563, 575, 620, 621, 622, 623, 624, 625, 626, 627, 628, 641, 647, 653, 654, 730, 731, 733, 734, 735, 736, 737, 745, 746, 747, 752], "excluded_lines": []}, "": {"executed_lines": [1, 9, 10, 11, 12, 13, 14, 16, 17, 18, 19, 27, 28, 29, 30, 31, 33, 39, 41, 44, 45, 46, 49, 50, 52, 57, 66, 67, 81, 143, 164, 170, 183, 260, 264, 286, 329, 381, 483, 536, 550, 616, 630, 693, 721, 725, 749, 756, 771], "summary": {"covered_lines": 46, "num_statements": 46, "percent_covered": 100.0, "percent_covered_display": "100", "missing_lines": 0, "excluded_lines": 0}, "missing_lines": [], "excluded_lines": []}}}}, "totals": {"covered_lines": 193, "num_statements": 302, "percent_covered": 63.90728476821192, "percent_covered_display": "64", "missing_lines": 109, "excluded_lines": 0}}

pyproject.toml

@@ -31,6 +31,7 @@ dependencies = [
     "python-dotenv>=1.0.0",
     "truststore>=0.10.0",
     "websockets>=12.0",
+    "cryptography>=45.0.7",
 ]
 
 [project.urls]
@@ -44,6 +45,7 @@ ha-mcp-smoke-test = "ha_mcp.smoke_test:main"
 hamcp-test-env = "tests.test_env_manager:main"
 ha-mcp-web = "ha_mcp.__main__:main_web"
 ha-mcp-sse = "ha_mcp.__main__:main_sse"
+ha-mcp-oauth = "ha_mcp.__main__:main_oauth"
 
 [tool.setuptools]
 package-dir = {"" = "src", "tests" = "tests"}

src/ha_mcp/__init__.py

@@ -9,6 +9,7 @@
 __author__ = "Julien"
 __license__ = "MIT"
 
+from .auth import HomeAssistantOAuthProvider
 from .client.rest_client import HomeAssistantClient
 from .config import Settings
 from .errors import (
@@ -32,6 +33,7 @@
     "Settings",
     "HomeAssistantClient",
     "HomeAssistantSmartMCPServer",
+    "HomeAssistantOAuthProvider",
     # Error handling exports
     "ErrorCode",
     "create_error_response",