Fix: avoid uncessary retries in OAuth authenticated requests

[keurcien]

Motivation and Context

Tried to connect an MCP client to Notion's MCP client (more info here: #1204)

How Has This Been Tested?

Using a local script wrapping this code snippet:

async with streamablehttp_client("https://mcp.notion.com/mcp", auth=oauth_auth) as (read, write, _):

    async with ClientSession(read, write) as session:
        await session.initialize()
        tools = await session.list_tools()
        print(f"Available tools: {[tool.name for tool in tools.tools]}")
        resources = await session.list_resources()
        print(f"Available resources: {[r.uri for r in resources.resources]}")

        tool_result = await session.call_tool(name="search", arguments={"query": "John Doe"})

Now list_tools(), list_resources() and call_tool() run instantly.

Breaking Changes

No

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

[ochafik]

Hi @keurcien, thanks for this PR!

I wonder if you could add a test case, maybe in tests/client/test_auth.py, based on your snippet? (if it's not too involved)

[keurcien]

Sure, will do this week if I find some time

Added regression test

[felixweinberger]

These tests were inadvertently tuned to the buggy behavior where requests were being unconditionally retried after every response. The indentation fix ensures retries only happen after OAuth completion (401 responses), not after successful responses. This exposed that the tests weren't properly closing the auth flow generator after the legitimate OAuth retry, causing lock release errors.

[felixweinberger]

@keurcien @ochafik went ahead and added some test coverage here + fixed failing CI which was tuned to the original behavior.

[ochafik]

Thanks @felixweinberger for the test updates!

[eyalzh]

This fix also resolves a timeout issue when using stored access tokens in SSE auth flow (happened as soon as I replaced InMemoryTokenStorage with a keychain-based token storage).