clean up code

Author: SoldierSacha

src/mcp/client/auth.py

@@ -49,20 +49,25 @@ async def set_client_info(self, client_info: OAuthClientInformationFull) -> None
 
 
 def _get_authorization_base_url(server_url: str) -> str:
-    """Return the authorization base URL for ``server_url``.
+    """
+    Return the authorization base URL for ``server_url``.
 
     Per MCP spec 2.3.2, the path component must be discarded so that
     ``https://api.example.com/v1/mcp`` becomes ``https://api.example.com``.
     """
     from urllib.parse import urlparse, urlunparse
 
     parsed = urlparse(server_url)
+    # Remove path component
     return urlunparse((parsed.scheme, parsed.netloc, "", "", "", ""))
 
 
 async def _discover_oauth_metadata(server_url: str) -> OAuthMetadata | None:
-    """Discover OAuth metadata from the server's well-known endpoint."""
+    """
+    Discover OAuth metadata from the server's well-known endpoint.
+    """
 
+    # Extract base URL per MCP spec
     auth_base_url = _get_authorization_base_url(server_url)
     url = urljoin(auth_base_url, "/.well-known/oauth-authorization-server")
     headers = {"MCP-Protocol-Version": LATEST_PROTOCOL_VERSION}
@@ -73,14 +78,19 @@ async def _discover_oauth_metadata(server_url: str) -> OAuthMetadata | None:
             if response.status_code == 404:
                 return None
             response.raise_for_status()
-            return OAuthMetadata.model_validate(response.json())
+            metadata_json = response.json()
+            logger.debug(f"OAuth metadata discovered: {metadata_json}")
+            return OAuthMetadata.model_validate(metadata_json)
         except Exception:
+            # Retry without MCP header for CORS compatibility
             try:
                 response = await client.get(url)
                 if response.status_code == 404:
                     return None
                 response.raise_for_status()
-                return OAuthMetadata.model_validate(response.json())
+                metadata_json = response.json()
+                logger.debug(f"OAuth metadata discovered (no MCP header): {metadata_json}")
+                return OAuthMetadata.model_validate(metadata_json)
             except Exception:
                 logger.exception("Failed to discover OAuth metadata")
                 return None

src/mcp/server/auth/handlers/token.py

@@ -48,8 +48,7 @@ class RefreshTokenRequest(BaseModel):
 
 
 class ClientCredentialsRequest(BaseModel):
-    """Token request for the client credentials grant."""
-
+    # See https://datatracker.ietf.org/doc/html/rfc6749#section-4.4
     grant_type: Literal["client_credentials"]
     scope: str | None = Field(None, description="Optional scope parameter")
     client_id: str