cited-cli 0.5.0__tar.gz → 0.5.2__tar.gz

{cited_cli-0.5.0 → cited_cli-0.5.2}/PKG-INFO

@@ -1,23 +1,23 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: cited-cli
-Version: 0.5.0
+Version: 0.5.2
 Summary: CLI for the Cited GEO platform
 Author-email: Cited <support@youcited.com>
 License-Expression: LicenseRef-Proprietary
 License-File: LICENSE
 Requires-Python: >=3.11
-Requires-Dist: cited-core>=0.5.0
+Requires-Dist: cited-core>=0.5.2
 Requires-Dist: rich>=13.0.0
 Requires-Dist: typer>=0.15.0
 Provides-Extra: dev
-Requires-Dist: cited-mcp>=0.5.0; extra == 'dev'
+Requires-Dist: cited-mcp>=0.5.2; extra == 'dev'
 Requires-Dist: mypy>=1.10; extra == 'dev'
 Requires-Dist: pytest>=8.0; extra == 'dev'
 Requires-Dist: respx>=0.21; extra == 'dev'
 Requires-Dist: ruff>=0.4; extra == 'dev'
 Requires-Dist: types-pyyaml>=6.0; extra == 'dev'
 Provides-Extra: mcp
-Requires-Dist: cited-mcp>=0.5.0; extra == 'mcp'
+Requires-Dist: cited-mcp>=0.5.2; extra == 'mcp'
 Description-Content-Type: text/markdown
 
 # Cited CLI

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/core/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cited-core"
-version = "0.5.0"
+version = "0.5.2"
 description = "Core library for the Cited GEO platform"
 license = "LicenseRef-Proprietary"
 requires-python = ">=3.11"

cited_cli-0.5.2/packages/core/src/cited_core/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.5.2"

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/core/src/cited_core/api/client.py

@@ -72,8 +72,16 @@ class CitedClient:
             message = response.text or message
         raise CitedAPIError(response.status_code, str(message), error_code)
 
-    def get(self, path: str, params: dict[str, Any] | None = None) -> Any:
-        response = self._client.get(path, params=params)
+    def get(
+        self,
+        path: str,
+        params: dict[str, Any] | None = None,
+        timeout: float | None = None,
+    ) -> Any:
+        kwargs: dict[str, Any] = {"params": params}
+        if timeout is not None:
+            kwargs["timeout"] = timeout
+        response = self._client.get(path, **kwargs)
         return self._handle_response(response)
 
     def post(

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/core/src/cited_core/api/endpoints.py

@@ -43,6 +43,10 @@ AUDIT_EXPORT_PDF = "/audit/{job_id}/export/pdf"
 AUDIT_EXPORT_URL = "/audit/{job_id}/export/url"
 AUDIT_HISTORY = "/audit/history"
 AUDIT_CANCEL = "/audit/{job_id}/cancel"
+
+# Free audit (no login; same audit the youcited.com homepage prompt runs)
+FREE_AUDIT = "/free-audit"
+FREE_AUDIT_REPORT = "/free-audit/report/{token}"
 AUDIT_DELETE = "/audit/{job_id}"
 AUDIT_PROVIDERS = "/audit/{job_id}/providers"
 AUDIT_QUESTION_DETAIL = "/audit/{job_id}/question/{question_id}"

cited_cli-0.5.2/packages/core/src/cited_core/free_audit.py

@@ -0,0 +1,39 @@
+"""Free audit: the no-login GEO audit behind the youcited.com homepage prompt.
+
+``GET /free-audit?url=...`` starts an audit (or returns the one already run for
+that domain in the last 24 hours) and hands back a ``report_url``. Fetching the
+report returns status while the audit runs and the full report once it is done.
+Neither call needs a token, so these work before the user has an account.
+"""
+
+from __future__ import annotations
+
+from typing import Any
+
+from cited_core.api import endpoints
+from cited_core.api.client import LONG_TIMEOUT, CitedClient
+
+
+def report_token(report_url: str) -> str:
+    """Extract the report token from a ``report_url`` returned by the API."""
+    return report_url.rstrip("/").rsplit("/", 1)[-1]
+
+
+def check_free_audit(client: CitedClient, url: str) -> dict[str, Any]:
+    """Start (or resume) the free audit for ``url`` and return its current report.
+
+    Safe to call repeatedly: the API reuses the same audit for a domain, so
+    calling again later returns progress or, once complete, the full report.
+    """
+    # Starting a new audit generates its questions in-request, which can be slow.
+    started = client.get(endpoints.FREE_AUDIT, params={"url": url}, timeout=LONG_TIMEOUT)
+    token = report_token(started["report_url"])
+    report: dict[str, Any] = client.get(endpoints.FREE_AUDIT_REPORT.format(token=token))
+    report.setdefault("report_url", started["report_url"])
+    report.setdefault("share_url", started.get("share_url"))
+    report.setdefault("domain", started.get("domain"))
+    return report
+
+
+def is_finished(report: dict[str, Any]) -> bool:
+    return report.get("status") not in ("pending", "processing")

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/mcp/README.md

@@ -1,6 +1,6 @@
 # cited-mcp
 
-MCP server for the [Cited](https://youcited.com) Generative Engine Optimization (GEO) platform. Exposes 56 tools that let AI assistants like Claude manage businesses, run GEO audits, generate recommendations, work a prioritized action plan, verify fixes via the Validation Engine, and create solutions — all through the [Model Context Protocol](https://modelcontextprotocol.io/).
+MCP server for the [Cited](https://youcited.com) Generative Engine Optimization (GEO) platform. Exposes 74 tools that let AI assistants like Claude manage businesses, run GEO audits, generate recommendations, work a prioritized action plan, verify fixes via the Validation Engine, and create solutions — all through the [Model Context Protocol](https://modelcontextprotocol.io/).
 
 ## Install
 
@@ -146,6 +146,7 @@ Cited adds new tools regularly. To access new tools after a release, **disconnec
 ### Audits
 | Tool | Description |
 |------|-------------|
+| `free_audit` | Free GEO audit of any website, no login needed. Call again with the same URL for progress and the full report |
 | `start_audit` | Run a GEO audit using a template |
 | `get_audit_status` | Check audit job status |
 | `get_audit_result` | Get completed audit results |
@@ -231,9 +232,9 @@ Tools are gated by subscription tier. All tiers can read data; write operations
 
 | Tier | Tools Available |
 |------|----------------|
-| **Growth** (entry) | Auth, list/get businesses, crawl, health scores, audits (start/status/result/list), all recommendation tools, action-plan reads (get_action_plan, get_quick_wins), Validation Engine reads, job status — **22 tools** |
-| **Scale** | Everything in Growth + create/update/delete businesses, create/update/delete audit templates, all solution tools, batch solutions, export audit, cancel job, action-plan writes (mark_action_done, dismiss_action, get_action_progress) — **38 tools** |
-| **Pro** | Everything in Scale + usage stats, HQ dashboard, analytics, agent API — **56 tools** |
+| **Growth** (entry) | Auth, list/get businesses, crawl, health scores, audits (start/status/result/list), all recommendation tools, action-plan reads (get_action_plan, get_quick_wins), Validation Engine reads, job status, free audit — **32 tools** |
+| **Scale** | Everything in Growth + create/update/delete businesses, create/update/delete audit templates, all solution tools, batch solutions, export audit, cancel job, action-plan writes (mark_action_done, dismiss_action, get_action_progress) — **63 tools** |
+| **Pro** | Everything in Scale + usage stats, HQ dashboard, analytics, agent API — **74 tools** |
 
 When a user calls a tool above their plan, the server returns a structured error with an upgrade link:
 

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/mcp/SKILL.md

@@ -19,6 +19,7 @@ The typical flow is: **Business Setup → Audit → Recommendations → Solution
 
 ### 2. Run an Audit
 - `create_audit_template` — Define what questions to audit (e.g., "What is [business]?", "Best [industry] tools")
+- `free_audit` — Free GEO audit of any website, no login or plan needed. Use it when the user has no Cited account yet. Call again with the same `url` every ~30 seconds until `status` is `completed` (2-4 minutes).
 - `start_audit` — Launch the audit using a template (2-4 minutes). Poll `get_audit_status` every 30-60 seconds.
 - `get_audit_result` — Returns a summary by default (aggregate KPIs, competitor leaderboard, question IDs). Use `full=True` for detailed per-question citations — warning: full results can be very large.
 
@@ -50,9 +51,9 @@ The typical flow is: **Business Setup → Audit → Recommendations → Solution
 
 Tools are gated by subscription tier. If a tool is above the user's plan, it returns an upgrade message with a billing link.
 
-- **Growth** (entry tier): Read-only — list/get businesses, run audits, view recommendations (19 tools)
-- **Scale**: Full write access — create/update/delete, solutions, export, cancel (32 tools)
-- **Pro**: Everything + HQ dashboard, analytics, agent API (42 tools)
+- **Growth** (entry tier): Read-only — list/get businesses, run audits, view recommendations (32 tools)
+- **Scale**: Full write access — create/update/delete, solutions, export, cancel (63 tools)
+- **Pro**: Everything + HQ dashboard, analytics, agent API (74 tools)
 
 Always call `check_auth_status` first — it shows the user's plan and remaining limits.
 

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/mcp/pyproject.toml

@@ -4,15 +4,15 @@ build-backend = "hatchling.build"
 
 [project]
 name = "cited-mcp"
-version = "0.5.0"
+version = "0.5.2"
 description = "MCP server for the Cited GEO platform"
 readme = "README.md"
 license = "LicenseRef-Proprietary"
 requires-python = ">=3.11"
 authors = [{ name = "Cited", email = "support@youcited.com" }]
 dependencies = [
-    "cited-core>=0.5.0",
-    "mcp>=1.27.0",
+    "cited-core>=0.5.2",
+    "mcp>=1.27.0,<2",
     "PyJWT>=2.8.0",
     "PyYAML>=6.0",
 ]

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/mcp/src/cited_mcp/plan_gating.py

@@ -165,6 +165,7 @@ _BASE_TOOLS: set[str] = {
     "get_pricing",
     "upgrade_plan",
     "whats_new",
+    "free_audit",
     "list_businesses",
     "get_business",
     "crawl_business",

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/mcp/src/cited_mcp/remote.py

@@ -204,6 +204,56 @@ class _OAuthEventLogMiddleware:
             logger.info("[oauth-event] %s", kv)
 
 
+class _RequestContextMiddleware:
+    """ASGI middleware that captures the request's source IP and User-Agent
+    into contextvars consumed by the tool-call decorator.
+
+    Why: ``tool_call`` log lines previously carried no source-identifying
+    metadata beyond the (possibly absent) decoded user JWT. When a probe
+    came in with a non-standard token — logged as user=``unknown`` — there
+    was no way to trace the source. Threading an HTTP request object
+    through every tool function is invasive; contextvars stay scoped to
+    the request's async task without touching tool signatures.
+
+    For stdio transport this middleware is not in the chain, so the
+    contextvars stay None and the log fields render as null.
+
+    We prefer the leftmost value of ``X-Forwarded-For`` when present
+    because the ALB inserts the original client IP there and the immediate
+    ``scope["client"]`` is the ALB's internal address. Trusting X-F-F is
+    only safe behind a known proxy — which is the deploy topology here.
+    """
+
+    def __init__(self, app: ASGIApp) -> None:
+        self.app = app
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+
+        from cited_mcp.tools._helpers import _request_ip, _request_ua
+
+        headers = {k: v for k, v in scope.get("headers", [])}
+        xff = headers.get(b"x-forwarded-for", b"").decode("latin-1", errors="replace")
+        if xff:
+            ip: str | None = xff.split(",")[0].strip() or None
+        else:
+            client = scope.get("client") or ("?", 0)
+            ip = client[0] if client and client[0] != "?" else None
+
+        ua_bytes = headers.get(b"user-agent", b"")
+        ua = ua_bytes.decode("latin-1", errors="replace")[:120] if ua_bytes else None
+
+        token_ip = _request_ip.set(ip)
+        token_ua = _request_ua.set(ua)
+        try:
+            await self.app(scope, receive, send)
+        finally:
+            _request_ip.reset(token_ip)
+            _request_ua.reset(token_ua)
+
+
 @asynccontextmanager
 async def cited_remote_lifespan(server: FastMCP) -> AsyncIterator[CitedContext]:
     """Lifespan for the remote MCP server.
@@ -403,9 +453,13 @@ def run_remote_server() -> None:
     starlette_app = server.streamable_http_app()
     # Order: oauth-event log on the OUTSIDE of the registration patcher so
     # patcher-rejected /register calls (400 invalid_redirect_uri) still
-    # produce an event line.
+    # produce an event line. RequestContextMiddleware sits innermost so
+    # its contextvars (ip, user_agent) are set in the same task that
+    # dispatches the tool call.
     patched_app = _OAuthEventLogMiddleware(
-        _PatchRegistrationMiddleware(starlette_app)
+        _PatchRegistrationMiddleware(
+            _RequestContextMiddleware(starlette_app)
+        )
     )
 
     config = uvicorn.Config(

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/mcp/src/cited_mcp/tool_changelog.yaml

@@ -21,6 +21,34 @@
 #      this file.
 
 versions:
+  - version: "0.5.2"
+    released: "2026-10-14"
+    # Adds free_audit: the no-login GEO audit behind the youcited.com homepage
+    # prompt, so agents can audit a site before the user has an account.
+    fingerprint: "8e42f3842abe"
+    tools_added:
+      - name: free_audit
+        description: |
+          Free GEO visibility audit of any website, no login or plan needed.
+          The first call starts it; call again with the same url for progress
+          and the full report (questions, whether the site was cited, which
+          domains AI cited instead). Requires the cited backend with
+          GET /free-audit (YouCited/cited#132).
+    tools_changed: []
+    tools_removed: []
+
+  - version: "0.5.1"
+    released: "2026-05-18"
+    # Telemetry-only release: tool surface is unchanged (fingerprint matches
+    # 0.5.0). Adds forensic fields to every tool_call log line — ip,
+    # user_agent, and a new auth_kind discriminator (anonymous / agent_key /
+    # oauth_email / oauth_no_email / oauth_malformed / stdio_email /
+    # stdio_no_email / stdio_malformed). Also fixes client_id extraction
+    # which was reading from user_jwt claims (always null in prod) instead
+    # of the OAuth access token. Motivated by a 2026-05-02 dev probe that
+    # logged user=unknown with no traceable source.
+    fingerprint: "5bef45100c53"
+
   - version: "0.5.0"
     released: "2026-05-11"
     # Three new read-only list_* tools to enable persona/product/buyer-intent

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/mcp/src/cited_mcp/tools/_helpers.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import contextlib
+import contextvars
 import functools
 import hashlib
 import json
@@ -22,6 +23,20 @@ from cited_mcp.context import CitedContext
 
 logger = logging.getLogger("cited_mcp.usage")
 
+# ---------------------------------------------------------------------------
+# Per-request forensic context (set by remote.py _RequestContextMiddleware).
+#
+# These let tool_call log lines carry the request's source IP and User-Agent
+# without threading an HTTP request object through every tool function. For
+# stdio transport (no HTTP) they remain None and are emitted as null in logs.
+# ---------------------------------------------------------------------------
+_request_ip: contextvars.ContextVar[str | None] = contextvars.ContextVar(
+    "cited_mcp_request_ip", default=None
+)
+_request_ua: contextvars.ContextVar[str | None] = contextvars.ContextVar(
+    "cited_mcp_request_ua", default=None
+)
+
 # ---------------------------------------------------------------------------
 # Response size guardrails
 # ---------------------------------------------------------------------------
@@ -244,18 +259,84 @@ def _extract_user(token: str | None) -> str:
         return "unknown"
 
 
-def _extract_client_id(token: str | None) -> str | None:
-    """Decode OAuth client_id from a JWT (for connector-mix analytics)."""
-    if not token:
+def _extract_client_id_from_oauth() -> str | None:
+    """Return the OAuth client_id from the current access token, truncated.
+
+    The MCP server's client_id is itself a signed JWT (RFC 7591 dynamic
+    registration encoded into the id), so we truncate to a 12-char prefix
+    sufficient to group connector traffic without bloating log lines.
+
+    Returns None for stdio transport (no OAuth context), or whenever the
+    access-token contextvar is unset.
+
+    Note: this used to decode the user_jwt looking for client_id/aud/azp
+    claims, but backend session JWTs do not carry OAuth-client identity —
+    so the field was always empty in production logs. This implementation
+    reads from the OAuth access token instead.
+    """
+    try:
+        from mcp.server.auth.middleware.auth_context import get_access_token
+    except ImportError:
         return None
     try:
-        payload = pyjwt.decode(token, options={"verify_signature": False})
-        cid = payload.get("client_id") or payload.get("aud") or payload.get("azp")
-        if isinstance(cid, list):
-            cid = cid[0] if cid else None
-        return str(cid) if cid else None
+        access_token = get_access_token()
     except Exception:
         return None
+    if not access_token:
+        return None
+    cid = getattr(access_token, "client_id", None)
+    if not cid:
+        return None
+    return str(cid)[:12]
+
+
+def _extract_auth_kind(
+    ctx: Context[Any, CitedContext, Any], token: str | None
+) -> str:
+    """Categorize the auth path for forensic logging.
+
+    Returns one of:
+      - ``anonymous`` — no token, no agent key
+      - ``agent_key`` — CitedClient has agent_api_key set (stdio mode)
+      - ``oauth_email`` — OAuth flow, user_jwt has email claim
+      - ``oauth_no_email`` — OAuth flow, user_jwt decoded but no email
+      - ``oauth_malformed`` — OAuth flow, user_jwt couldn't be decoded
+      - ``stdio_email`` — stdio mode, token is a JWT with email claim
+      - ``stdio_no_email`` — stdio mode, token decoded but no email
+      - ``stdio_malformed`` — stdio mode, token isn't a parseable JWT
+
+    Lets us tell apart the practical cases — including the case where
+    ``_extract_user`` returns ``"unknown"`` because the token was not a
+    JWT at all versus because the JWT had no email/sub claim. Without
+    this, the ``<unknown>`` bucket in usage reports is unactionable.
+    """
+    try:
+        lc = ctx.request_context.lifespan_context
+        if getattr(lc.client, "agent_api_key", None):
+            return "agent_key"
+    except Exception:
+        pass
+
+    method = "stdio"
+    try:
+        from mcp.server.auth.middleware.auth_context import get_access_token
+
+        if get_access_token() is not None:
+            method = "oauth"
+    except Exception:
+        pass
+
+    if not token:
+        return "anonymous" if method == "stdio" else "oauth_no_token"
+
+    try:
+        payload = pyjwt.decode(token, options={"verify_signature": False})
+    except Exception:
+        return f"{method}_malformed"
+
+    if payload.get("email"):
+        return f"{method}_email"
+    return f"{method}_no_email"
 
 
 # ---------------------------------------------------------------------------
@@ -384,7 +465,8 @@ def log_tool_call(
         token = _resolve_token(ctx)
         rl_key = _rate_limit_key(token)
         user = _extract_user(token)
-        client_id = _extract_client_id(token)
+        auth_kind = _extract_auth_kind(ctx, token)
+        client_id = _extract_client_id_from_oauth()
         request_id = uuid.uuid4().hex[:12]
         start = time.monotonic()
         build = _get_build_identity()
@@ -399,7 +481,10 @@ def log_tool_call(
                 "request_id": request_id,
                 "tool": tool_name,
                 "user": user,
+                "auth_kind": auth_kind,
                 "client_id": client_id,
+                "ip": _request_ip.get(),
+                "user_agent": _request_ua.get(),
                 "server_version": build["server_version"],
                 "tools_fingerprint": build["tools_fingerprint"],
                 "deployment_id": build["deployment_id"],
@@ -407,7 +492,15 @@ def log_tool_call(
             if resources:
                 payload["resources"] = resources
             payload.update(extra)
-            logger.info(json.dumps(payload, default=str))
+            # CodeQL flags this as clear-text logging of sensitive data because
+            # `user` is sourced from a JWT email claim. This is by design —
+            # operator usage reports (scripts/mcp_usage_report.py) attribute
+            # tool calls to users by email, which is necessary for forensics
+            # and abuse investigation. Logs flow to a private CloudWatch group
+            # with restricted IAM access. Email is not transmitted anywhere
+            # else from this line. If we later move to hashed identifiers,
+            # the suppression can be removed.
+            logger.info(json.dumps(payload, default=str))  # noqa: E501 lgtm[py/clear-text-logging-sensitive-data]
 
         # Rate limit check
         if rl_err := _check_rate_limit(rl_key):

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/mcp/src/cited_mcp/tools/audit.py

@@ -1,12 +1,15 @@
 from __future__ import annotations
 
+import os
 from typing import Any
 
 from mcp.server.fastmcp import Context
 from mcp.types import ToolAnnotations
 
 from cited_core.api import endpoints
+from cited_core.api.client import CitedClient
 from cited_core.errors import CitedAPIError
+from cited_core.free_audit import check_free_audit, is_finished
 from cited_mcp.context import CitedContext
 from cited_mcp.server import mcp
 from cited_mcp.tools._helpers import (
@@ -366,3 +369,37 @@ async def list_audits(
         return cited_ctx.client.get(endpoints.AUDIT_HISTORY, params=params)
     except CitedAPIError as e:
         return _api_error_response(e)
+
+
+@mcp.tool(
+    title="Free Audit",
+    annotations=ToolAnnotations(readOnlyHint=False, destructiveHint=False, idempotentHint=True, openWorldHint=True),  # noqa: E501
+)
+@log_tool_call
+async def free_audit(ctx: Context[Any, CitedContext, Any], url: str) -> Any:
+    """Run a free GEO visibility audit for any website. No login or plan needed.
+
+    Checks how often AI assistants cite the site for a handful of buyer
+    questions and which sites they cite instead. The first call starts the
+    audit (2-4 minutes); call again with the same url to get progress, and the
+    full report once status is "completed". Re-running a domain within 24 hours
+    returns the same audit.
+
+    Args:
+        ctx: MCP context
+        url: Website to audit, e.g. "example.com"
+    """
+    cited_ctx = _get_ctx(ctx)
+    # Anonymous client: no user cookie. The hosted server's agent key (when set)
+    # exempts it from the backend's per-IP limit, which all its users share.
+    agent_key = os.environ.get("CITED_AGENT_API_KEY") or cited_ctx.client.agent_api_key
+    client = CitedClient(base_url=cited_ctx.api_url, agent_api_key=agent_key)
+    try:
+        report = check_free_audit(client, url)
+    except CitedAPIError as e:
+        return _api_error_response(e)
+    finally:
+        client.close()
+    if not is_finished(report):
+        report["hint"] = "Audit still running. Call free_audit again with the same url in ~30s."
+    return _truncate_response(report)

{cited_cli-0.5.0 → cited_cli-0.5.2}/packages/mcp/tests/test_auth_provider.py

@@ -1,4 +1,5 @@
 """Tests for the CitedOAuthProvider — specifically JWT expiry handling."""
+
 from __future__ import annotations
 
 import asyncio
@@ -59,14 +60,16 @@ class TestLoadAccessToken:
     def test_rejects_expired_user_jwt(self):
         provider = _make_provider()
         now = int(time.time())
-        token = provider._encode_token({
-            "typ": "access",
-            "sub": "client-123",
-            "scopes": ["cited"],
-            "user_jwt": _make_jwt(-60),  # expired backend JWT
-            "exp": now + 3600,
-            "iat": now,
-        })
+        token = provider._encode_token(
+            {
+                "typ": "access",
+                "sub": "client-123",
+                "scopes": ["cited"],
+                "user_jwt": _make_jwt(-60),  # expired backend JWT
+                "exp": now + 3600,
+                "iat": now,
+            }
+        )
 
         result = run(provider.load_access_token(token))
         assert result is None
@@ -75,14 +78,16 @@ class TestLoadAccessToken:
         provider = _make_provider()
         valid_jwt = _make_jwt(3600)
         now = int(time.time())
-        token = provider._encode_token({
-            "typ": "access",
-            "sub": "client-123",
-            "scopes": ["cited"],
-            "user_jwt": valid_jwt,
-            "exp": now + 3600,
-            "iat": now,
-        })
+        token = provider._encode_token(
+            {
+                "typ": "access",
+                "sub": "client-123",
+                "scopes": ["cited"],
+                "user_jwt": valid_jwt,
+                "exp": now + 3600,
+                "iat": now,
+            }
+        )
 
         result = run(provider.load_access_token(token))
         assert result is not None
@@ -94,14 +99,16 @@ class TestLoadRefreshToken:
         provider = _make_provider()
         client = _make_client()
         now = int(time.time())
-        token = provider._encode_token({
-            "typ": "refresh",
-            "sub": client.client_id,
-            "scopes": ["cited"],
-            "user_jwt": _make_jwt(-60),  # expired backend JWT
-            "exp": now + 86400,
-            "iat": now,
-        })
+        token = provider._encode_token(
+            {
+                "typ": "refresh",
+                "sub": client.client_id,
+                "scopes": ["cited"],
+                "user_jwt": _make_jwt(-60),  # expired backend JWT
+                "exp": now + 86400,
+                "iat": now,
+            }
+        )
 
         result = run(provider.load_refresh_token(client, token))
         assert result is None
@@ -111,14 +118,16 @@ class TestLoadRefreshToken:
         client = _make_client()
         valid_jwt = _make_jwt(3600)
         now = int(time.time())
-        token = provider._encode_token({
-            "typ": "refresh",
-            "sub": client.client_id,
-            "scopes": ["cited"],
-            "user_jwt": valid_jwt,
-            "exp": now + 86400,
-            "iat": now,
-        })
+        token = provider._encode_token(
+            {
+                "typ": "refresh",
+                "sub": client.client_id,
+                "scopes": ["cited"],
+                "user_jwt": valid_jwt,
+                "exp": now + 86400,
+                "iat": now,
+            }
+        )
 
         result = run(provider.load_refresh_token(client, token))
         assert result is not None