Apply the current request's auth context while handling a request (#1250)

Author: Ptraaah

src/mcp/server/lowlevel/server.py

@@ -83,6 +83,8 @@ async def main():
 from typing_extensions import TypeVar, deprecated
 
 import mcp.types as types
+from mcp.server.auth.middleware.auth_context import auth_context_var
+from mcp.server.auth.middleware.bearer_auth import AuthenticatedUser
 from mcp.server.experimental.request_context import Experimental
 from mcp.server.lowlevel.experimental import ExperimentalHandlers
 from mcp.server.lowlevel.func_inspection import create_call_wrapper
@@ -736,6 +738,7 @@ async def _handle_request(
             logger.debug("Dispatching request of type %s", type(req).__name__)
 
             token = None
+            auth_token: contextvars.Token[AuthenticatedUser | None] | None = None
             try:
                 # Extract request context and close_sse_stream from message metadata
                 request_data = None
@@ -756,6 +759,18 @@ async def _handle_request(
                 task_metadata = None
                 if hasattr(req, "params") and req.params is not None:
                     task_metadata = getattr(req.params, "task", None)
+                # The HTTP transports attach the current request, and its scope
+                # carries the user authenticated for this request. Handlers run
+                # in the session's long-lived task, where the auth_context_var
+                # set by AuthContextMiddleware still holds the session-opening
+                # request's user, so a refreshed token never reaches the handler
+                # (#1250). Apply this request's user for the handler's duration.
+                if request_data is not None:
+                    scope = getattr(request_data, "scope", None)
+                    if isinstance(scope, dict):
+                        user = cast(dict[str, Any], scope).get("user")
+                        if isinstance(user, AuthenticatedUser):
+                            auth_token = auth_context_var.set(user)
                 token = request_ctx.set(
                     RequestContext(
                         message.request_id,
@@ -794,6 +809,8 @@ async def _handle_request(
                 response = types.ErrorData(code=0, message=str(err), data=None)
             finally:
                 # Reset the global state after we are done
+                if auth_token is not None:
+                    auth_context_var.reset(auth_token)
                 if token is not None:  # pragma: no branch
                     request_ctx.reset(token)
         else:  # pragma: no cover