Robert Helewka 6a4fecf488 fix(mcp): disable audience verification in resolve_mcp_jwt ...

Team JWTs include `aud=mnemosyne` while per-turn JWTs omit `aud`
entirely. Since `iss` + `typ` already partition the two token
populations, explicitly skip audience verification to avoid rejecting
valid tokens.

Also expand test coverage for the MCP auth surface to exercise all
three credential types (opaque MCPToken, per-turn JWT, team JWT),
including replay cache behavior and Neo4j-backed library resolution
via mocked cypher queries.

2026-05-10 12:32:58 -04:00

4.0 KiB

Executable File

Raw Blame History

View Raw