refactor: fall back to default grant types for config validation

[gao-sun]

Summary

When validating the server's config, grant_type_supported should fall back to ["authorization_code", "implicit"] if the value is not present in the provided data. This behavior aligns with the specifications described in mcp-auth/js#27.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

📢 Thoughts on this report? Let us know!

[Copilot]

Pull Request Overview

This PR adds a fallback to default grant types during server config validation and updates tests to cover scenarios when no or invalid grant types are provided.

• Introduce AuthorizationServerMetadataDefaults with default grant and response mode lists.
• Update validate_server_config to use defaults when grant_types_supported is missing.
• Add and rename tests for no grant types and invalid grant types.

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
tests/utils/validate_server_config_test.py	Added tests for missing and invalid grant types, renamed existing test for clarity
mcpauth/utils/_validate_server_config.py	Updated validation to fallback to default grant types
mcpauth/config.py	Defined new AuthorizationServerMetadataDefaults enum with defaults

Comments suppressed due to low confidence (2)

mcpauth/config.py:121

• [nitpick] Enum members should follow constant naming conventions (e.g., GRANT_TYPES_SUPPORTED) to align with PEP8 and make them easily distinguishable from instance attributes.

grant_types_supported = ["authorization_code", "implicit"]

mcpauth/config.py:122

• [nitpick] You’ve defined a default for response_modes_supported but haven’t applied it in validate_server_config. Either implement the fallback logic there or remove this default to avoid confusion.

response_modes_supported = ["query", "fragment"]