fix(auth): drop duplicate validate_issuer_url and redundant redirect_uris guard

Author: Varshith-Kali

src/mcp/server/auth/__init__.py

@@ -1,3 +1 @@
 """MCP OAuth server authorization components."""
-
-from .url_validators import validate_issuer_url, validate_redirect_uri

src/mcp/server/auth/handlers/register.py

@@ -1,10 +1,10 @@
 import secrets
 import time
 from dataclasses import dataclass
-from typing import Any
+from typing import Any, cast
 from uuid import uuid4
 
-from pydantic import BaseModel, ValidationError
+from pydantic import AnyUrl, BaseModel, ValidationError
 from starlette.requests import Request
 from starlette.responses import Response
 
@@ -36,19 +36,20 @@ async def handle(self, request: Request) -> Response:
             body = await request.body()
             client_metadata = OAuthClientMetadata.model_validate_json(body)
 
-            # Validate redirect_uris per RFC 7591 section 2
-            if client_metadata.redirect_uris:
-                for uri in client_metadata.redirect_uris:
-                    try:
-                        validate_redirect_uri(uri)
-                    except ValueError as e:
-                        return PydanticJSONResponse(
-                            content=RegistrationErrorResponse(
-                                error="invalid_redirect_uri",
-                                error_description=str(e),
-                            ),
-                            status_code=400,
-                        )
+            # Validate redirect_uris per RFC 7591 section 2. The metadata
+            # model requires a non-empty list (min_length=1), so no presence
+            # guard is needed; cast narrows the optional field for pyright.
+            for uri in cast(list[AnyUrl], client_metadata.redirect_uris):
+                try:
+                    validate_redirect_uri(uri)
+                except ValueError as e:
+                    return PydanticJSONResponse(
+                        content=RegistrationErrorResponse(
+                            error="invalid_redirect_uri",
+                            error_description=str(e),
+                        ),
+                        status_code=400,
+                    )
 
             # Scope validation is handled below
         except ValidationError as validation_error:

src/mcp/server/auth/url_validators.py

@@ -8,24 +8,6 @@
 from pydantic import AnyUrl
 
 
-def validate_issuer_url(url: AnyUrl):
-    """Validate that the issuer URL meets OAuth 2.0 requirements.
-
-    Args:
-        url: The issuer URL to validate.
-
-    Raises:
-        ValueError: If the issuer URL is invalid.
-    """
-    if url.scheme != "https" and not (url.scheme == "http" and url.host in ("localhost", "127.0.0.1", "[::1]")):
-        raise ValueError("Issuer URL must be HTTPS")
-
-    if url.fragment:
-        raise ValueError("Issuer URL must not have a fragment")
-    if url.query:
-        raise ValueError("Issuer URL must not have a query string")
-
-
 def validate_redirect_uri(url: AnyUrl):
     """Validate a registered redirect_uri for DCR.