ha-mcp-dev 8.2.0.dev2305__tar.gz → 8.2.0.dev2307__tar.gz

{ha_mcp_dev-8.2.0.dev2305/src/ha_mcp_dev.egg-info → ha_mcp_dev-8.2.0.dev2307}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.2.0.dev2305
+Version: 8.2.0.dev2307
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT
@@ -117,7 +117,7 @@ These run the server outside Home Assistant — useful for **Container** / **Cor
 - **Docker (HTTP server):** run `ghcr.io/homeassistant-ai/ha-mcp` in HTTP mode, pointed at your Home Assistant URL and a long-lived token, and connect your client to its secret URL. See the [Setup Wizard](https://homeassistant-ai.github.io/ha-mcp/setup/) for the full command and per-client config.
 - **PyPI / uvx (HTTP server):** run the published `ha-mcp` package with `uvx ha-mcp@latest` (or pip) as a streamable-HTTP server the same way. Details in the [Setup Wizard](https://homeassistant-ai.github.io/ha-mcp/setup/).
 - **Local stdio (not recommended):** runs ha-mcp on your own machine over stdio. The one-command installers in the **Demo server** section below use this path; the [Setup Wizard](https://homeassistant-ai.github.io/ha-mcp/setup/) covers connecting it to your own Home Assistant.
-- **OIDC authentication:** gate remote access behind an external identity provider (Authentik, Keycloak, Auth0, Google, etc.) instead of a secret URL — all authenticated users share the server's Home Assistant credentials. See [OIDC Mode](docs/oidc.md).
+- **OIDC authentication:** gate remote access behind an external identity provider (Authentik, Keycloak, Auth0, etc.) instead of a secret URL — all authenticated users share the server's Home Assistant credentials. See [OIDC Mode](docs/oidc.md).
 
   > ⚠️ **stdio has known transport issues.** The stdio transport has connection problems that streamable HTTP does not ([#1713](https://github.com/homeassistant-ai/ha-mcp/issues/1713)). It is recommended only for demo/testing tinkering — for a real setup, use the custom component or an HTTP method above.
 

{ha_mcp_dev-8.2.0.dev2305 → ha_mcp_dev-8.2.0.dev2307}/README.md

@@ -85,7 +85,7 @@ These run the server outside Home Assistant — useful for **Container** / **Cor
 - **Docker (HTTP server):** run `ghcr.io/homeassistant-ai/ha-mcp` in HTTP mode, pointed at your Home Assistant URL and a long-lived token, and connect your client to its secret URL. See the [Setup Wizard](https://homeassistant-ai.github.io/ha-mcp/setup/) for the full command and per-client config.
 - **PyPI / uvx (HTTP server):** run the published `ha-mcp` package with `uvx ha-mcp@latest` (or pip) as a streamable-HTTP server the same way. Details in the [Setup Wizard](https://homeassistant-ai.github.io/ha-mcp/setup/).
 - **Local stdio (not recommended):** runs ha-mcp on your own machine over stdio. The one-command installers in the **Demo server** section below use this path; the [Setup Wizard](https://homeassistant-ai.github.io/ha-mcp/setup/) covers connecting it to your own Home Assistant.
-- **OIDC authentication:** gate remote access behind an external identity provider (Authentik, Keycloak, Auth0, Google, etc.) instead of a secret URL — all authenticated users share the server's Home Assistant credentials. See [OIDC Mode](docs/oidc.md).
+- **OIDC authentication:** gate remote access behind an external identity provider (Authentik, Keycloak, Auth0, etc.) instead of a secret URL — all authenticated users share the server's Home Assistant credentials. See [OIDC Mode](docs/oidc.md).
 
   > ⚠️ **stdio has known transport issues.** The stdio transport has connection problems that streamable HTTP does not ([#1713](https://github.com/homeassistant-ai/ha-mcp/issues/1713)). It is recommended only for demo/testing tinkering — for a real setup, use the custom component or an HTTP method above.
 

{ha_mcp_dev-8.2.0.dev2305 → ha_mcp_dev-8.2.0.dev2307}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "ha-mcp-dev"
-version = "8.2.0.dev2305"
+version = "8.2.0.dev2307"
 description = "Home Assistant MCP Server - Complete control of Home Assistant through MCP"
 readme = "README.md"
 # Upper bound widened to <3.15 so the package installs on Home Assistant's

{ha_mcp_dev-8.2.0.dev2305 → ha_mcp_dev-8.2.0.dev2307}/src/ha_mcp/__main__.py

@@ -503,15 +503,31 @@ def _setup_logging(log_level_str: str, force: bool = True) -> None:
     of the sweep ``force`` performs (which removes *and closes* every root
     handler) so ``ha_report_issue`` keeps its startup diagnostics.
     """
+    log_level = getattr(logging, log_level_str)
+
+    import fastmcp
+
     from ha_mcp.utils.usage_logger import preserve_startup_collector
 
     with preserve_startup_collector():
         logging.basicConfig(
-            level=getattr(logging, log_level_str),
+            level=log_level,
             format="%(asctime)s %(name)s %(levelname)s: %(message)s",
             datefmt=_LOG_DATE_FORMAT,
             force=force,
         )
+
+    fastmcp_logger = logging.getLogger("fastmcp")
+    if fastmcp.settings.log_enabled:
+        # FastMCP configures its own handler and disables propagation, so the root
+        # level above does not control its OIDC diagnostics. Preserve that handler
+        # and formatting while honoring ha-mcp's LOG_LEVEL setting.
+        fastmcp_logger.setLevel(log_level)
+    else:
+        # FastMCP deliberately leaves its logger unconfigured when logging is
+        # disabled. Prevent that NOTSET namespace from inheriting our root handler.
+        fastmcp_logger.setLevel(logging.CRITICAL + 1)
+
     logging.getLogger("mcp.server.streamable_http").addFilter(
         StatelessSessionLogFilter()
     )
@@ -1159,7 +1175,7 @@ def _oidc_verify_id_token_enabled() -> bool:
 
     Off by default: FastMCP's OIDCProxy verifies the access token as a JWT,
     which works for providers like Authentik and Keycloak. Providers that
-    issue opaque access tokens (Google always; Auth0 without an API
+    issue opaque access tokens (such as Authelia, or Auth0 without an API
     audience) need ``verify_id_token=True`` so FastMCP verifies the ID token
     instead.
     """
@@ -1599,7 +1615,7 @@ def main_oidc() -> None:
     """Run server with OIDC authentication over HTTP.
 
     This mode enables authentication via an external OIDC provider
-    (Authentik, Keycloak, Auth0, Google, etc.). All authenticated users
+    (Authentik, Keycloak, Auth0, etc.). All authenticated users
     share the same Home Assistant instance via the configured credentials.
 
     Unlike OAuth mode which collects per-user HA credentials via a consent form,
@@ -1621,7 +1637,7 @@ def main_oidc() -> None:
       patterns accepted from dynamically-registered clients. Strongly recommended for
       internet-facing deployments.
     - OIDC_VERIFY_ID_TOKEN (optional, default: false): Set true for providers that issue
-      opaque access tokens (e.g. Google, or Auth0 without an API audience).
+      opaque access tokens (e.g. Authelia, or Auth0 without an API audience).
     - OIDC_AUDIENCE (optional): Expected `aud` claim for IdP-issued access tokens.
       Without it (and with OIDC_VERIFY_ID_TOKEN off), FastMCP's JWT verifier checks
       issuer, signature, and expiry but not audience. With OIDC_VERIFY_ID_TOKEN=true,
@@ -1638,6 +1654,8 @@ def main_oidc() -> None:
     - HA_MCP_DISABLE_SETTINGS_UI (optional): set truthy to not serve the
       settings UI at all
     - LOG_LEVEL (optional, default: INFO)
+    - FASTMCP_LOG_ENABLED (optional, default: true): Set false to suppress
+      FastMCP framework logs while leaving ha-mcp logs at LOG_LEVEL.
     """
     # Configure logging for OIDC mode (force=True needed since logging may already be configured)
     log_level = os.getenv("LOG_LEVEL", "INFO").upper()
@@ -1723,8 +1741,7 @@ async def _run_oidc_server(
         port: Port to listen on
         path: MCP endpoint path
     """
-    from fastmcp.server.auth.oidc_proxy import OIDCProxy
-
+    from ha_mcp.auth.oidc_compat import HaMcpOIDCProxy
     from ha_mcp.server import HomeAssistantSmartMCPServer
     from ha_mcp.transport_security import ensure_host_origin_guard_default_off
 
@@ -1742,6 +1759,11 @@ async def _run_oidc_server(
         # IdP (Authentik, Keycloak, etc.) -- unlike `False`, this does not
         # log a security warning at startup that consent is disabled.
         "require_authorization_consent": "external",
+        # This entrypoint provides OIDC, so request the protocol-level scope
+        # that makes upstream providers return an ID token. FastMCP also
+        # advertises this scope through protected resource metadata so MCP
+        # clients include it in the authorization flow.
+        "required_scopes": ["openid"],
         # Preserve `or None`: an empty-but-set env var must not bypass
         # FastMCP's derive-from-client-secret default for jwt_signing_key.
         "jwt_signing_key": os.getenv("OIDC_JWT_SIGNING_KEY") or None,
@@ -1765,7 +1787,8 @@ async def _run_oidc_server(
         proxy_kwargs["audience"] = audience
 
     # Create OIDC auth provider — auto-discovers endpoints from config_url
-    auth = OIDCProxy(**proxy_kwargs)
+    auth = HaMcpOIDCProxy(**proxy_kwargs)
+    auth.setup_scope_compatibility()
 
     # Standard server with shared credentials (no proxy client needed)
     global _server

ha_mcp_dev-8.2.0.dev2307/src/ha_mcp/auth/oidc_compat.py

@@ -0,0 +1,106 @@
+"""FastMCP OIDC compatibility behavior scoped to ha-mcp's OIDC entrypoint."""
+
+from __future__ import annotations
+
+import logging
+from typing import override
+
+from fastmcp.server.auth.oauth_proxy.models import ProxyDCRClient
+from fastmcp.server.auth.oidc_proxy import OIDCProxy
+from mcp.server.auth.provider import AuthorizationParams, RefreshToken
+from mcp.shared.auth import OAuthClientInformationFull
+
+logger = logging.getLogger(__name__)
+
+
+class HaMcpOIDCProxy(OIDCProxy):
+    """OIDC proxy with ha-mcp's FastMCP 3.4.6 compatibility behavior."""
+
+    def _add_required_scopes(self, scopes: list[str]) -> list[str]:
+        """Prepend any configured required scopes missing from ``scopes``."""
+        missing_scopes = [
+            scope for scope in self.required_scopes if scope not in scopes
+        ]
+        return [*missing_scopes, *scopes]
+
+    def setup_scope_compatibility(self) -> None:
+        """Allow optional DCR scopes without advertising them as requirements.
+
+        FastMCP 3.4.6 copies ``required_scopes`` into both the DCR default and
+        valid-scope allow-list.  The MCP SDK then rejects clients that add
+        ordinary optional OIDC scopes.  ``None`` restores upstream IdP scope
+        validation while FastMCP continues to default, advertise, and enforce
+        ha-mcp's required ``openid`` scope.
+        """
+        if self.required_scopes != ["openid"]:
+            raise RuntimeError(
+                "HaMcpOIDCProxy requires exactly the openid scope before setup"
+            )
+        options = self.client_registration_options
+        if options is None:
+            raise RuntimeError("FastMCP OIDCProxy did not enable client registration")
+        if options.default_scopes != ["openid"] or self._default_scope_str != "openid":
+            raise RuntimeError("FastMCP OIDCProxy did not preserve the openid default")
+        options.valid_scopes = None
+
+    @override
+    async def register_client(self, client_info: OAuthClientInformationFull) -> None:
+        """Persist DCR clients with every required scope included."""
+        current_scopes = client_info.scope.split() if client_info.scope else []
+        normalized_scopes = self._add_required_scopes(current_scopes)
+        if normalized_scopes != current_scopes:
+            client_info.scope = " ".join(normalized_scopes)
+        await super().register_client(client_info)
+
+    @override
+    async def authorize(
+        self,
+        client: OAuthClientInformationFull,
+        params: AuthorizationParams,
+    ) -> str:
+        """Forward every authorization with required scopes included."""
+        current_scopes = params.scopes or []
+        normalized_scopes = self._add_required_scopes(current_scopes)
+        if normalized_scopes != current_scopes:
+            params = params.model_copy(update={"scopes": normalized_scopes})
+        return await super().authorize(client, params)
+
+    @override
+    async def get_client(self, client_id: str) -> OAuthClientInformationFull | None:
+        """Load a client, adding required scopes to persisted legacy records once."""
+        was_persisted = await self._client_store.get(key=client_id) is not None
+        client = await super().get_client(client_id)
+        if client is None or not was_persisted:
+            return client
+        if not isinstance(client, ProxyDCRClient):
+            raise RuntimeError("FastMCP returned an unexpected persisted client type")
+
+        current_scopes = client.scope.split() if client.scope else []
+        normalized_scopes = self._add_required_scopes(current_scopes)
+        if normalized_scopes == current_scopes:
+            return client
+
+        migrated = client.model_copy(update={"scope": " ".join(normalized_scopes)})
+        await self._client_store.put(key=client_id, value=migrated)
+        return migrated
+
+    @override
+    async def load_refresh_token(
+        self,
+        client: OAuthClientInformationFull,
+        refresh_token: str,
+    ) -> RefreshToken | None:
+        """Reject legacy refresh tokens that predate required OIDC scopes."""
+        loaded = await super().load_refresh_token(client, refresh_token)
+        if loaded is None:
+            return None
+        missing_scopes = set(self.required_scopes) - set(loaded.scopes)
+        if missing_scopes:
+            logger.debug(
+                "Rejecting legacy refresh token for client_id=%s: "
+                "missing required scopes %s",
+                client.client_id,
+                sorted(missing_scopes),
+            )
+            return None
+        return loaded

{ha_mcp_dev-8.2.0.dev2305 → ha_mcp_dev-8.2.0.dev2307/src/ha_mcp_dev.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ha-mcp-dev
-Version: 8.2.0.dev2305
+Version: 8.2.0.dev2307
 Summary: Home Assistant MCP Server - Complete control of Home Assistant through MCP
 Author-email: Julien <github@qc-h.net>
 License: MIT
@@ -117,7 +117,7 @@ These run the server outside Home Assistant — useful for **Container** / **Cor
 - **Docker (HTTP server):** run `ghcr.io/homeassistant-ai/ha-mcp` in HTTP mode, pointed at your Home Assistant URL and a long-lived token, and connect your client to its secret URL. See the [Setup Wizard](https://homeassistant-ai.github.io/ha-mcp/setup/) for the full command and per-client config.
 - **PyPI / uvx (HTTP server):** run the published `ha-mcp` package with `uvx ha-mcp@latest` (or pip) as a streamable-HTTP server the same way. Details in the [Setup Wizard](https://homeassistant-ai.github.io/ha-mcp/setup/).
 - **Local stdio (not recommended):** runs ha-mcp on your own machine over stdio. The one-command installers in the **Demo server** section below use this path; the [Setup Wizard](https://homeassistant-ai.github.io/ha-mcp/setup/) covers connecting it to your own Home Assistant.
-- **OIDC authentication:** gate remote access behind an external identity provider (Authentik, Keycloak, Auth0, Google, etc.) instead of a secret URL — all authenticated users share the server's Home Assistant credentials. See [OIDC Mode](docs/oidc.md).
+- **OIDC authentication:** gate remote access behind an external identity provider (Authentik, Keycloak, Auth0, etc.) instead of a secret URL — all authenticated users share the server's Home Assistant credentials. See [OIDC Mode](docs/oidc.md).
 
   > ⚠️ **stdio has known transport issues.** The stdio transport has connection problems that streamable HTTP does not ([#1713](https://github.com/homeassistant-ai/ha-mcp/issues/1713)). It is recommended only for demo/testing tinkering — for a real setup, use the custom component or an HTTP method above.
 

{ha_mcp_dev-8.2.0.dev2305 → ha_mcp_dev-8.2.0.dev2307}/src/ha_mcp_dev.egg-info/SOURCES.txt

@@ -82,6 +82,7 @@ src/ha_mcp/_vendor/websockets/trio/server.py
 src/ha_mcp/_vendor/websockets/trio/utils.py
 src/ha_mcp/auth/__init__.py
 src/ha_mcp/auth/consent_form.py
+src/ha_mcp/auth/oidc_compat.py
 src/ha_mcp/auth/provider.py
 src/ha_mcp/client/__init__.py
 src/ha_mcp/client/rest_client.py