backport: phase-5 fixup — port roots:list-changed (audit-1), scope warning filter, ASGIApp note

Author: maxisbey

tests/interaction/_connect.py

@@ -21,6 +21,7 @@
 from starlette.requests import Request
 from starlette.responses import Response
 from starlette.routing import Mount, Route
+from starlette.types import Receive, Scope, Send
 
 from mcp.client.session import ClientSession, ElicitationFnT, ListRootsFnT, LoggingFnT, MessageHandlerFnT, SamplingFnT
 from mcp.client.sse import sse_client
@@ -32,7 +33,6 @@
 from mcp.server.auth.routes import build_resource_metadata_url, create_auth_routes, create_protected_resource_routes
 from mcp.server.auth.settings import AuthSettings
 from mcp.server.fastmcp import FastMCP
-from mcp.server.fastmcp.server import StreamableHTTPASGIApp
 from mcp.server.sse import SseServerTransport
 from mcp.server.streamable_http import EventStore
 from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
@@ -59,6 +59,23 @@
 NO_DNS_REBINDING_PROTECTION = TransportSecuritySettings(enable_dns_rebinding_protection=False)
 
 
+class StreamableHTTPASGIApp:
+    """Thin ASGI wrapper around `StreamableHTTPSessionManager.handle_request`.
+
+    Starlette's `Route(path, endpoint=...)` treats a *class instance* as a raw ASGI callable
+    (matching all HTTP verbs), whereas a coroutine function is wrapped via `request_response`
+    and defaults to GET/HEAD only. v1's `FastMCP.streamable_http_app()` relies on this same
+    distinction; we inline the wrapper here rather than deep-importing the (non-`__all__`)
+    `mcp.server.fastmcp.server.StreamableHTTPASGIApp`.
+    """
+
+    def __init__(self, session_manager: StreamableHTTPSessionManager) -> None:
+        self.session_manager = session_manager
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        await self.session_manager.handle_request(scope, receive, send)
+
+
 def _lowlevel(server: Server[Any] | FastMCP) -> Server[Any]:
     """Return the lowlevel `Server` for either flavour.
 

tests/interaction/_requirements.py

@@ -1450,10 +1450,6 @@ def __post_init__(self) -> None:
     "roots:list-changed": Requirement(
         source=f"{SPEC_BASE_URL}/client/roots#root-list-changes",
         behavior="A roots/list_changed notification sent by the client is delivered to the server's handler.",
-        deferred=(
-            "Not expressible via the v1 public API: the low-level Server exposes no decorator for "
-            "notifications/roots/list_changed, so a server handler cannot be registered to observe delivery."
-        ),
     ),
     "roots:list-changed:client-emits": Requirement(
         source=f"{SPEC_BASE_URL}/client/roots#root-list-changes",

tests/interaction/auth/_harness.py

@@ -34,10 +34,9 @@
 from mcp.server.auth.provider import AccessToken, ProviderTokenVerifier
 from mcp.server.auth.routes import build_resource_metadata_url, create_auth_routes, create_protected_resource_routes
 from mcp.server.auth.settings import AuthSettings, ClientRegistrationOptions, RevocationOptions
-from mcp.server.fastmcp.server import StreamableHTTPASGIApp
 from mcp.server.streamable_http_manager import StreamableHTTPSessionManager
 from mcp.shared.auth import OAuthClientInformationFull, OAuthClientMetadata, OAuthToken
-from tests.interaction._connect import BASE_URL, NO_DNS_REBINDING_PROTECTION
+from tests.interaction._connect import BASE_URL, NO_DNS_REBINDING_PROTECTION, StreamableHTTPASGIApp
 from tests.interaction.auth._provider import InMemoryAuthorizationServerProvider
 from tests.interaction.transports._bridge import StreamingASGITransport
 

tests/interaction/conftest.py

@@ -14,9 +14,13 @@ def pytest_configure(config: pytest.Config) -> None:
     # session manager's per-session task-group cancel can race the per-request cleanup). v1's own
     # tests run the transport in a separate process and so never observe these `__del__`-time
     # ResourceWarnings; running in-process via the streaming bridge does. The fixes live in `src/`
-    # on `main` and are out of scope for this tests-only backport, so suppress here.
-    config.addinivalue_line("filterwarnings", "ignore::pytest.PytestUnraisableExceptionWarning")
-    config.addinivalue_line("filterwarnings", "ignore::ResourceWarning")
+    # on `main` and are out of scope for this tests-only backport — tracked in
+    # `notes/backport/issues.md`. The filters below are scoped to anyio's `MemoryObject*Stream`
+    # leak signature so an unrelated leak still fails the suite.
+    config.addinivalue_line(
+        "filterwarnings", "ignore:.*MemoryObject(Send|Receive)Stream:pytest.PytestUnraisableExceptionWarning"
+    )
+    config.addinivalue_line("filterwarnings", "ignore:.*MemoryObject(Send|Receive)Stream:ResourceWarning")
 
 
 _FACTORIES: dict[str, Connect] = {

tests/interaction/lowlevel/test_roots.py

@@ -2,6 +2,7 @@
 
 from typing import Any
 
+import anyio
 import pytest
 from inline_snapshot import snapshot
 from pydantic import FileUrl
@@ -140,3 +141,38 @@ async def list_roots(context: RequestContext[ClientSession, Any]) -> ListRootsRe
         result = await client.call_tool("show_roots", {})
 
     assert result == snapshot(CallToolResult(content=[TextContent(type="text", text="-32603: roots provider crashed")]))
+
+
+@requirement("roots:list-changed")
+async def test_roots_list_changed_reaches_server_handler(connect: Connect) -> None:
+    """A roots/list_changed notification from the client is delivered to the server's handler.
+
+    v1's low-level `Server` exposes no decorator for this notification; the public path is direct
+    assignment into `Server.notification_handlers` (a public, typed dict that the server's dispatch
+    loop consults for every incoming client notification). The handler receives the notification
+    object itself.
+
+    Unlike a request, a notification has no response to await: the handler sets an event and the
+    test waits on it, which is the only synchronisation point proving delivery.
+    """
+    delivered = anyio.Event()
+    received: list[types.RootsListChangedNotification] = []
+
+    async def on_roots_changed(notify: types.RootsListChangedNotification) -> None:
+        received.append(notify)
+        delivered.set()
+
+    server = Server("rooted")
+    server.notification_handlers[types.RootsListChangedNotification] = on_roots_changed
+
+    async def list_roots(context: RequestContext[ClientSession, Any]) -> ListRootsResult | ErrorData:
+        """Registered so the client declares the roots capability; the server never asks for roots."""
+        raise NotImplementedError
+
+    async with connect(server, list_roots_callback=list_roots) as client:
+        await client.send_roots_list_changed()
+        with anyio.fail_after(5):
+            await delivered.wait()
+
+    assert len(received) == 1
+    assert received[0].method == "notifications/roots/list_changed"