airano a806671e2d fix(oauth): fix invalid_scope and invalid_token errors for user OAuth clients ...

Three bugs fixed for social-login users connecting Claude.ai via OAuth:

1. User OAuth clients now allow 'admin' scope by default — previously
   defaulted to ['read', 'write'], causing invalid_scope when Claude.ai
   requests 'admin' scope during authorization.

2. Fix JWT tokens with 'aud' claim being rejected by middleware — when
   Claude.ai sends RFC 8707 resource parameter, the issued JWT gets an
   aud claim. validate_access_token() now sets verify_aud=False to
   prevent PyJWT InvalidAudienceError from silently marking valid tokens
   as invalid in _is_valid_token().

3. Fix NameError in user_mcp_handler tools/call scope check — key_info
   was only defined in the mhu_ auth path but referenced in tools/call
   for both paths. Replaced with key_scopes variable set by both mhu_
   and JWT auth paths.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-02-26 00:37:43 +03:30

107 KiB

Raw Blame History

View Raw