Treat an unstamped CIMD record like one stamped elsewhere: drop its tokens, then stamp it

Records this SDK creates for a client ID metadata document always carry
the issuer stamp, so an unstamped one comes from an older store and its
tokens have no confirmed origin. Dropping them once and stamping the record
converges after a single re-authorization instead of presenting a refresh
token of unknown provenance to whichever server PRM names.

Author: maxisbey

src/mcp/client/auth/oauth2.py

@@ -656,10 +656,11 @@ async def async_auth_flow(self, request: httpx2.Request) -> AsyncGenerator[httpx
                         self.context.client_info is not None
                         and self.context.client_info.client_id == self.context.client_metadata_url
                         and self.context.auth_server_url is not None
-                        and self.context.client_info.issuer not in (None, self.context.auth_server_url)
+                        and self.context.client_info.issuer != self.context.auth_server_url
                     ):
                         # A CIMD client_id is portable across authorization servers; the tokens issued
-                        # under it and the cached metadata are not. Keep the record, re-stamped.
+                        # under it and the cached metadata are not. Keep the record, re-stamped. An
+                        # unstamped record's tokens have unknown provenance and are dropped the same way.
                         self.context.clear_tokens()
                         self.context.oauth_metadata = None
                         self.context.client_info.issuer = self.context.auth_server_url

tests/client/test_auth.py

@@ -3282,15 +3282,20 @@ async def test_expired_token_is_not_refreshed_ahead_of_the_request_before_metada
 
 
 @pytest.mark.anyio
+@pytest.mark.parametrize("stamped_issuer", ["https://old-as.example.com", None], ids=["stamped-elsewhere", "unstamped"])
 async def test_cimd_record_is_restamped_and_its_tokens_and_cached_metadata_dropped_when_prm_names_a_new_issuer(
-    client_metadata: OAuthClientMetadata, mock_storage: MockTokenStorage, valid_tokens: OAuthToken
+    client_metadata: OAuthClientMetadata,
+    mock_storage: MockTokenStorage,
+    valid_tokens: OAuthToken,
+    stamped_issuer: str | None,
 ) -> None:
     """SEP-2352 for CIMD: the URL client_id survives an authorization-server change, nothing else does.
 
-    A long-lived provider holds a CIMD record stamped with the old issuer, tokens minted there, and
-    the old server's cached metadata. As soon as PRM names a different issuer, the tokens and the
-    cached metadata are dropped and the record is re-stamped and persisted, so a failed
-    rediscovery cannot leave the old endpoints in play and no refresh reaches the new server.
+    A long-lived provider holds a CIMD record stamped with another issuer (or, from an older store,
+    not stamped at all), tokens of matching provenance, and cached metadata. As soon as PRM names
+    the issuer in use, the tokens and the cached metadata are dropped and the record is re-stamped
+    and persisted, so a failed rediscovery cannot leave old endpoints in play and no refresh token
+    of unconfirmed origin reaches the named server.
     """
     cimd_url = "https://client.example.com/.well-known/mcp-client"
     provider = OAuthClientProvider(
@@ -3300,7 +3305,7 @@ async def test_cimd_record_is_restamped_and_its_tokens_and_cached_metadata_dropp
         client_metadata_url=cimd_url,
     )
     provider.context.client_info = OAuthClientInformationFull(
-        client_id=cimd_url, token_endpoint_auth_method="none", issuer="https://old-as.example.com"
+        client_id=cimd_url, token_endpoint_auth_method="none", issuer=stamped_issuer
     )
     provider.context.current_tokens = valid_tokens
     provider.context.token_expiry_time = time.time() + 1800