fix: cover redirect URI collection inputs

Author: he-yufeng

src/mcp/shared/auth.py

@@ -73,8 +73,8 @@ def _coerce_redirect_uris_to_any_url(cls, v: object) -> object:
         # Pydantic v2 keeps AnyUrl subclasses such as AnyHttpUrl as-is, while
         # AnyUrl equality is type-strict. Store the declared base type so later
         # redirect_uri membership checks compare URLs, not URL wrapper classes.
-        if isinstance(v, list | tuple):
-            items = cast("list[object] | tuple[object, ...]", v)
+        if isinstance(v, list | tuple | set | frozenset):
+            items = cast("list[object] | tuple[object, ...] | set[object] | frozenset[object]", v)
             return [str(item) if isinstance(item, AnyUrl) else item for item in items]
         return v
 

tests/shared/test_auth.py

@@ -1,5 +1,7 @@
 """Tests for OAuth 2.0 shared code."""
 
+from typing import Any
+
 import pytest
 from pydantic import AnyHttpUrl, AnyUrl, ValidationError
 
@@ -130,10 +132,19 @@ def test_information_full_inherits_coercion():
     assert info.jwks_uri is None
 
 
-def test_redirect_uris_normalize_any_url_subtypes():
+@pytest.mark.parametrize(
+    "redirect_uris",
+    [
+        [AnyHttpUrl("https://example.com/callback")],
+        (AnyHttpUrl("https://example.com/callback"),),
+        {AnyHttpUrl("https://example.com/callback")},
+        frozenset({AnyHttpUrl("https://example.com/callback")}),
+    ],
+)
+def test_redirect_uris_normalize_any_url_subtypes(redirect_uris: Any):
     info = OAuthClientInformationFull(
         client_id="abc123",
-        redirect_uris=[AnyHttpUrl("https://example.com/callback")],
+        redirect_uris=redirect_uris,
     )
 
     assert info.validate_redirect_uri(AnyUrl("https://example.com/callback")) == AnyUrl("https://example.com/callback")