Test Failure Analysis

Summary: The ty type checker fails on two new tests in tests/server/auth/providers/test_aws.py because get_token_verifier() is typed to return TokenVerifier, which doesn't have an audience attribute — even though the actual returned object (AWSCognitoTokenVerifier) does.

Root Cause: AWSCognitoProvider.get_token_verifier() has return type -> TokenVerifier (inherited from the parent class signature). The audience attribute is defined on JWTVerifier (a subclass of TokenVerifier), not on TokenVerifier itself. When the tests do verifier.audience, ty correctly flags this as an unresolved attribute on the declared type.

Suggested Solution: In tests/server/auth/providers/test_aws.py, add an isinstance assertion before accessing .audience. This narrows the type for the type checker and also adds a meaningful assertion:

# In test_token_verifier_defaults_audience_to_client_id
verifier = provider.get_token_verifier()
assert isinstance(verifier, AWSCognitoTokenVerifier)
assert verifier.audience == "test_client"

# In test_token_verifier_supports_audience_override
verifier = provider.get_token_verifier(audience="custom-audience")
assert isinstance(verifier, AWSCognitoTokenVerifier)
assert verifier.audience == "custom-audience"

Alternatively, update the return type annotation of get_token_verifier in src/fastmcp/server/auth/providers/aws.py to -> AWSCognitoTokenVerifier (covariant return types are valid in Python). Either fix resolves the type error.

error[unresolved-attribute]: Object of type `TokenVerifier` has no attribute `audience`
   --> tests/server/auth/providers/test_aws.py:118:20
    |
116 |             verifier = provider.get_token_verifier()
117 |
118 |             assert verifier.audience == "test_client"
    |                    ^^^^^^^^^^^^^^^^^

error[unresolved-attribute]: Object of type `TokenVerifier` has no attribute `audience`
   --> tests/server/auth/providers/test_aws.py:133:20
    |
131 |             verifier = provider.get_token_verifier(audience="custom-audience")
132 |
133 |             assert verifier.audience == "custom-audience"
    |                    ^^^^^^^^^^^^^^^^^

🤖 Analysis by marvin (Claude Sonnet 4.6)

Auto-reviewed and merging on behalf of @jlowin — CI is green (Windows OAuth proxy timeouts are pre-existing flaky tests).