update

bookstack_mcp/server.py

@@ -389,17 +389,33 @@ def _build_auth(settings: Settings):
             if settings.required_groups:
                 scopes.insert(3, settings.oidc_groups_claim)
 
+        # Two different things that are easy to conflate:
+        #   scopes           -> what we ASK the IdP for
+        #   required_scopes  -> what must be present on every incoming token
+        # FastMCP's issued token only carries the scopes the IdP echoes back in
+        # its token response. If a requested scope isn't echoed (Authelia does
+        # not always echo offline_access), enforcing the full request list
+        # rejects every call with invalid_token, and the client loops
+        # refreshing. So validation defaults to nothing unless explicitly set.
+        required = settings.oidc_required_scopes or []
+
         oauth = OIDCProxy(
             config_url=settings.oidc_config_url,
+            extra_authorize_params={"scope": " ".join(scopes)},
             client_id=settings.oidc_client_id,
             client_secret=settings.oidc_client_secret,
             base_url=settings.public_url,
             redirect_path="/auth/callback",
-            required_scopes=scopes,
+            required_scopes=required,
             # Some providers (Authelia, Okta) issue opaque access tokens that
             # can't be validated as JWTs. Setting OIDC_VERIFY_ID_TOKEN=true
             # verifies the ID token instead, which is always a signed JWT.
             verify_id_token=settings.oidc_verify_id_token,
+            # RFC 8707 resource indicators. Authelia validates the forwarded
+            # 'resource' against the client's audience whitelist and returns
+            # invalid_target if it isn't listed. Either whitelist it there or
+            # set OIDC_FORWARD_RESOURCE=false to stop sending it.
+            forward_resource=settings.oidc_forward_resource,
         )
 
     if oauth is None: