feat: add claims field to AccessToken for decoded token payload

[robertofalk]

Add optional claims dict to AccessToken class to provide access to all decoded JWT claims (both standard and custom) instead of restricting to only specific fields like scopes and expires_at.

Motivation and Context

FastMCP provides a BearerAuthProvider class to validate bearer tokens and returns it using the AccessToken class (https://github.com/jlowin/fastmcp/blob/main/src/fastmcp/server/auth/providers/bearer.py#L387). With the current implementation the claims from the token are limited to the ones defined so far, so any additional claim is not available and to get it currently I had to define an additional middleware that decodes the token again, which is a waste since the token is was already decoded by BearerAuthProvider.

How Has This Been Tested?

I was not able to test it since it's just an attribute that will be used by applications relying on the python-sdk AccessToken class.

Breaking Changes

No, it's an optional attribute.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Resolves #1038

[robertofalk]

@ihrpr, @ochafik Any comments? since you have been driving the auth milestone.

[ochafik]

Hi @robertofalk, thanks for sending this PR!

Currently, there is no JWT payload used to build the AccessToken, afaict.

To handle JWT tokens, you might want to create a new JWTAccessToken / created by a new JWTTokenVerifier (responsible for verifying the token signature), used by a JWT-specific OAuthAuthorizationServerProvider subclass distinct from SimpleOAuthProvider.

(and if we get there, I reckon the non-standard claims should go to a JWTAccessToken.additional_claims field to avoid duplication)

Does this make sense?

[felixweinberger]

Closing this as per @ochafik's comment this is incomplete and it's been a while since the last update here.

If others find this PR and need this, feel free to submit a fresh PR.