Allow parent protected resource metadata

Author: mayankbohradev

src/mcp/client/auth/oauth2.py

@@ -564,7 +564,7 @@ async def _handle_oauth_metadata_response(self, response: httpx2.Response) -> No
         self.context.oauth_metadata = metadata
 
     async def _validate_resource_match(self, prm: ProtectedResourceMetadata) -> None:
-        """Validate that the PRM resource matches the server URL per RFC 9728."""
+        """Validate that the PRM resource permits the server URL."""
         prm_resource = str(prm.resource) if prm.resource else None
 
         if self._validate_resource_url_callback is not None:
@@ -574,10 +574,7 @@ async def _validate_resource_match(self, prm: ProtectedResourceMetadata) -> None
         if not prm_resource:
             return  # pragma: no cover
         default_resource = resource_url_from_server_url(self.context.server_url)
-        if not (
-            check_resource_allowed(requested_resource=default_resource, configured_resource=prm_resource)
-            and check_resource_allowed(requested_resource=prm_resource, configured_resource=default_resource)
-        ):
+        if not check_resource_allowed(requested_resource=default_resource, configured_resource=prm_resource):
             raise OAuthFlowError(f"Protected resource {prm_resource} does not match expected {default_resource}")
 
     async def async_auth_flow(self, request: httpx2.Request) -> AsyncGenerator[httpx2.Request, httpx2.Response]:

tests/client/test_auth.py

@@ -863,10 +863,10 @@ async def test_validate_resource_rejects_mismatched_resource(
 
 
 @pytest.mark.anyio
-async def test_validate_resource_rejects_parent_path_resource(
+async def test_validate_resource_accepts_parent_path_resource(
     client_metadata: OAuthClientMetadata, mock_storage: MockTokenStorage
 ) -> None:
-    """Client rejects PRM resources that are a parent of the server URL."""
+    """Client accepts PRM resources that are a parent of the server URL."""
     provider = OAuthClientProvider(
         server_url="https://api.example.com/v1/mcp",
         client_metadata=client_metadata,
@@ -878,8 +878,7 @@ async def test_validate_resource_rejects_parent_path_resource(
         resource=AnyHttpUrl("https://api.example.com/v1"),
         authorization_servers=[AnyHttpUrl("https://auth.example.com")],
     )
-    with pytest.raises(OAuthFlowError, match="does not match expected"):
-        await provider._validate_resource_match(prm)
+    await provider._validate_resource_match(prm)
 
 
 @pytest.mark.anyio