test(oauth): add HTTP smoke tests for OAuth metadata-discovery endpoints

[kingpanther13]

What does this PR do?

Adds HTTP-level smoke tests for the OAuth metadata-discovery endpoints, closing a coverage gap surfaced while reviewing the fastmcp 3.4.2 bump (#1557).

The existing OAuth route tests (test_oauth.py::TestOAuthRoutes) only assert that provider.get_routes() lists the well-known routes. They never boot the assembled ASGI app or make a request, so they cannot catch a regression where a framework change mounts a competing /.well-known/openid-configuration route that shadows ours, nor verify the served metadata body. (FastMCP 3.4.0 added its own /.well-known/openid-configuration alias in OAuthProvider.get_well_known_routes(), which makes this exactly the kind of surface worth guarding.)

These tests assemble the real app the way _run_oauth_server does (FastMCP with mcp.auth set, then http_app()) and drive it over HTTP via httpx.ASGITransport. For all three discovery paths — /.well-known/oauth-authorization-server, /.well-known/openid-configuration, and /token/.well-known/openid-configuration — they assert our enhanced metadata is served. The discriminator is the fields our handler injects (response_modes_supported and the "none" token-endpoint auth method for Claude.ai public PKCE clients), so a shadowing or framework-default response would fail. Also covers CORS preflight and cross-path metadata consistency.

Type of change

• Tests only

Testing

• I have tested these changes with a LLM agent
• All automated tests pass (uv run pytest)
• Code follows style guidelines (uv run ruff check)

Checklist

• I have updated documentation if needed (none needed — tests only)

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request introduces comprehensive HTTP-level smoke tests for OAuth metadata-discovery endpoints. By booting the actual ASGI application and driving requests through it, these tests validate that the expected enhanced metadata is served correctly and that CORS preflight requests are properly handled. This change addresses a coverage gap where previous tests only verified route existence without confirming the actual served content or behavior.

Highlights

• Added HTTP smoke tests: Introduced new integration tests for OAuth metadata-discovery endpoints to ensure the ASGI app correctly serves enhanced metadata.
• Improved regression coverage: The new tests verify that discovery routes are not shadowed by framework-level defaults, protecting against regressions in future dependency updates.
• CORS validation: Added tests to confirm that OPTIONS preflight requests are correctly handled, ensuring compatibility with browser-based OAuth clients.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request adds HTTP-level smoke tests for the OAuth metadata-discovery endpoints to ensure they serve the correct enhanced metadata and support CORS preflight requests. The review feedback points out a test isolation issue in the oauth_app fixture, which interacts with the host's real data directory, and suggests mocking get_data_dir with a temporary directory to avoid side effects.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.