chore: import upstream snapshot with attribution

tests/server/mcpserver/resources/test_file_resources.py

@@ -0,0 +1,116 @@
+import os
+from pathlib import Path
+from tempfile import NamedTemporaryFile
+
+import pytest
+
+from mcp.server.mcpserver.resources import FileResource
+
+
+@pytest.fixture
+def temp_file():
+    """Create a temporary file for testing.
+
+    File is automatically cleaned up after the test if it still exists.
+    """
+    content = "test content"
+    with NamedTemporaryFile(mode="w", delete=False) as f:
+        f.write(content)
+        path = Path(f.name).resolve()
+    yield path
+    try:  # pragma: lax no cover
+        path.unlink()
+    except FileNotFoundError:  # pragma: lax no cover
+        pass  # File was already deleted by the test
+
+
+class TestFileResource:
+    """Test FileResource functionality."""
+
+    def test_file_resource_creation(self, temp_file: Path):
+        """Test creating a FileResource."""
+        resource = FileResource(
+            uri=temp_file.as_uri(),
+            name="test",
+            description="test file",
+            path=temp_file,
+        )
+        assert str(resource.uri) == temp_file.as_uri()
+        assert resource.name == "test"
+        assert resource.description == "test file"
+        assert resource.mime_type == "text/plain"  # default
+        assert resource.path == temp_file
+        assert resource.is_binary is False  # default
+
+    def test_file_resource_str_path_conversion(self, temp_file: Path):
+        """Test FileResource handles string paths."""
+        resource = FileResource(
+            uri=f"file://{temp_file}",
+            name="test",
+            path=Path(str(temp_file)),
+        )
+        assert isinstance(resource.path, Path)
+        assert resource.path.is_absolute()
+
+    @pytest.mark.anyio
+    async def test_read_text_file(self, temp_file: Path):
+        """Test reading a text file."""
+        resource = FileResource(
+            uri=f"file://{temp_file}",
+            name="test",
+            path=temp_file,
+        )
+        content = await resource.read()
+        assert content == "test content"
+        assert resource.mime_type == "text/plain"
+
+    @pytest.mark.anyio
+    async def test_read_binary_file(self, temp_file: Path):
+        """Test reading a file as binary."""
+        resource = FileResource(
+            uri=f"file://{temp_file}",
+            name="test",
+            path=temp_file,
+            is_binary=True,
+        )
+        content = await resource.read()
+        assert isinstance(content, bytes)
+        assert content == b"test content"
+
+    def test_relative_path_error(self):
+        """Test error on relative path."""
+        with pytest.raises(ValueError, match="Path must be absolute"):
+            FileResource(
+                uri="file:///test.txt",
+                name="test",
+                path=Path("test.txt"),
+            )
+
+    @pytest.mark.anyio
+    async def test_missing_file_error(self, temp_file: Path):
+        """Test error when file doesn't exist."""
+        # Create path to non-existent file
+        missing = temp_file.parent / "missing.txt"
+        resource = FileResource(
+            uri="file:///missing.txt",
+            name="test",
+            path=missing,
+        )
+        with pytest.raises(ValueError, match="Error reading file"):
+            await resource.read()
+
+    @pytest.mark.skipif(os.name == "nt", reason="File permissions behave differently on Windows")
+    @pytest.mark.anyio
+    async def test_permission_error(self, temp_file: Path):  # pragma: lax no cover
+        """Test reading a file without permissions."""
+        temp_file.chmod(0o000)  # Remove all permissions
+        try:
+            resource = FileResource(
+                uri=temp_file.as_uri(),
+                name="test",
+                path=temp_file,
+            )
+            with pytest.raises(ValueError, match="Error reading file"):
+                await resource.read()
+        finally:
+            temp_file.chmod(0o644)  # Restore permissions

tests/server/mcpserver/resources/test_function_resources.py

@@ -0,0 +1,263 @@
+import threading
+
+import anyio
+import anyio.from_thread
+import pytest
+from inline_snapshot import snapshot
+from mcp_types import InputRequiredResult
+from pydantic import BaseModel
+
+from mcp.server.mcpserver.resources import FunctionResource
+
+
+class TestFunctionResource:
+    """Test FunctionResource functionality."""
+
+    def test_function_resource_creation(self):
+        """Test creating a FunctionResource."""
+
+        def my_func() -> str:  # pragma: no cover
+            return "test content"
+
+        resource = FunctionResource(
+            uri="fn://test",
+            name="test",
+            description="test function",
+            fn=my_func,
+        )
+        assert str(resource.uri) == "fn://test"
+        assert resource.name == "test"
+        assert resource.description == "test function"
+        assert resource.mime_type == "text/plain"  # default
+        assert resource.fn == my_func
+
+    @pytest.mark.anyio
+    async def test_read_text(self):
+        """Test reading text from a FunctionResource."""
+
+        def get_data() -> str:
+            return "Hello, world!"
+
+        resource = FunctionResource(
+            uri="function://test",
+            name="test",
+            fn=get_data,
+        )
+        content = await resource.read()
+        assert content == "Hello, world!"
+        assert resource.mime_type == "text/plain"
+
+    @pytest.mark.anyio
+    async def test_read_binary(self):
+        """Test reading binary data from a FunctionResource."""
+
+        def get_data() -> bytes:
+            return b"Hello, world!"
+
+        resource = FunctionResource(
+            uri="function://test",
+            name="test",
+            fn=get_data,
+        )
+        content = await resource.read()
+        assert content == b"Hello, world!"
+
+    @pytest.mark.anyio
+    async def test_json_conversion(self):
+        """Test automatic JSON conversion of non-string results."""
+
+        def get_data() -> dict[str, str]:
+            return {"key": "value"}
+
+        resource = FunctionResource(
+            uri="function://test",
+            name="test",
+            fn=get_data,
+        )
+        content = await resource.read()
+        assert isinstance(content, str)
+        assert '"key": "value"' in content
+
+    @pytest.mark.anyio
+    async def test_error_handling(self):
+        """Test error handling in FunctionResource."""
+
+        def failing_func() -> str:
+            raise ValueError("Test error")
+
+        resource = FunctionResource(
+            uri="function://test",
+            name="test",
+            fn=failing_func,
+        )
+        with pytest.raises(ValueError, match="Error reading resource function://test"):
+            await resource.read()
+
+    @pytest.mark.anyio
+    async def test_basemodel_conversion(self):
+        """Test handling of BaseModel types."""
+
+        class MyModel(BaseModel):
+            name: str
+
+        resource = FunctionResource(
+            uri="function://test",
+            name="test",
+            fn=lambda: MyModel(name="test"),
+        )
+        content = await resource.read()
+        assert content == '{\n  "name": "test"\n}'
+
+    @pytest.mark.anyio
+    async def test_custom_type_conversion(self):
+        """Test handling of custom types."""
+
+        class CustomData:
+            def __str__(self) -> str:
+                return "custom data"
+
+        def get_data() -> CustomData:
+            return CustomData()
+
+        resource = FunctionResource(
+            uri="function://test",
+            name="test",
+            fn=get_data,
+        )
+        content = await resource.read()
+        assert isinstance(content, str)
+
+    @pytest.mark.anyio
+    async def test_async_read_text(self):
+        """Test reading text from async FunctionResource."""
+
+        async def get_data() -> str:
+            return "Hello, world!"
+
+        resource = FunctionResource(
+            uri="function://test",
+            name="test",
+            fn=get_data,
+        )
+        content = await resource.read()
+        assert content == "Hello, world!"
+        assert resource.mime_type == "text/plain"
+
+    @pytest.mark.anyio
+    async def test_from_function(self):
+        """Test creating a FunctionResource from a function."""
+
+        async def get_data() -> str:  # pragma: no cover
+            """get_data returns a string"""
+            return "Hello, world!"
+
+        resource = FunctionResource.from_function(
+            fn=get_data,
+            uri="function://test",
+            name="test",
+        )
+
+        assert resource.description == "get_data returns a string"
+        assert resource.mime_type == "text/plain"
+        assert resource.name == "test"
+        assert resource.uri == "function://test"
+
+
+class TestFunctionResourceMetadata:
+    def test_from_function_with_metadata(self):
+        # from_function() accepts meta dict and stores it on the resource for static resources
+
+        def get_data() -> str:  # pragma: no cover
+            return "test data"
+
+        metadata = {"cache_ttl": 300, "tags": ["data", "readonly"]}
+
+        resource = FunctionResource.from_function(
+            fn=get_data,
+            uri="resource://data",
+            meta=metadata,
+        )
+
+        assert resource.meta is not None
+        assert resource.meta == metadata
+        assert resource.meta["cache_ttl"] == 300
+        assert "data" in resource.meta["tags"]
+        assert "readonly" in resource.meta["tags"]
+
+    def test_from_function_without_metadata(self):
+        # meta parameter is optional and defaults to None for backward compatibility
+
+        def get_data() -> str:  # pragma: no cover
+            return "test data"
+
+        resource = FunctionResource.from_function(
+            fn=get_data,
+            uri="resource://data",
+        )
+
+        assert resource.meta is None
+
+
+@pytest.mark.anyio
+async def test_sync_fn_runs_in_worker_thread():
+    """Sync resource functions must run in a worker thread, not the event loop."""
+
+    main_thread = threading.get_ident()
+    fn_thread: list[int] = []
+
+    def blocking_fn() -> str:
+        fn_thread.append(threading.get_ident())
+        return "data"
+
+    resource = FunctionResource(uri="resource://test", name="test", fn=blocking_fn)
+    result = await resource.read()
+
+    assert result == "data"
+    assert fn_thread[0] != main_thread
+
+
+@pytest.mark.anyio
+async def test_sync_fn_does_not_block_event_loop():
+    """A blocking sync resource function must not stall the event loop.
+
+    On regression (sync runs inline), anyio.from_thread.run_sync raises
+    RuntimeError because there is no worker-thread context, failing fast.
+    """
+    handler_entered = anyio.Event()
+    release = threading.Event()
+
+    def blocking_fn() -> str:
+        anyio.from_thread.run_sync(handler_entered.set)
+        release.wait()
+        return "done"
+
+    resource = FunctionResource(uri="resource://test", name="test", fn=blocking_fn)
+    result: list[str | bytes] = []
+
+    async def run() -> None:
+        result.append(await resource.read())
+
+    with anyio.fail_after(5):
+        async with anyio.create_task_group() as tg:
+            tg.start_soon(run)
+            await handler_entered.wait()
+            release.set()
+
+    assert result == ["done"]
+
+
+@pytest.mark.anyio
+async def test_read_rejects_an_input_required_result_from_a_static_function():
+    """A static resource function returning an InputRequiredResult is a mistake (it can
+    never read the retry's input_responses), so read() raises instead of JSON-dumping it."""
+
+    def ask() -> InputRequiredResult:
+        return InputRequiredResult(request_state="round-1")
+
+    resource = FunctionResource(uri="resource://ask", name="ask", fn=ask)
+    with pytest.raises(ValueError) as exc:
+        await resource.read()
+    assert str(exc.value) == snapshot(
+        "Error reading resource resource://ask: static resources cannot return "
+        "InputRequiredResult; only resource template functions participate in the multi-round-trip flow"
+    )

tests/server/mcpserver/resources/test_resource_manager.py

@@ -0,0 +1,142 @@
+import logging
+from pathlib import Path
+
+import pytest
+from pydantic import AnyUrl
+
+from mcp.server.mcpserver import Context
+from mcp.server.mcpserver.exceptions import ResourceNotFoundError
+from mcp.server.mcpserver.resources import FileResource, FunctionResource, ResourceManager, ResourceTemplate
+
+
+@pytest.fixture()
+def temp_file(tmp_path: Path):
+    """Create a temporary file for testing.
+
+    File is automatically cleaned up after the test if it still exists.
+    """
+    tmp_file = tmp_path / "file"
+    tmp_file.touch()
+    yield tmp_file
+
+
+def test_init_with_resources(temp_file: Path, caplog: pytest.LogCaptureFixture):
+    resource = FileResource(uri=f"file://{temp_file}", name="test", path=temp_file)
+    manager = ResourceManager(resources=[resource])
+    assert manager.list_resources() == [resource]
+
+    duplicate_resource = FileResource(uri=f"file://{temp_file}", name="duplicate", path=temp_file)
+
+    with caplog.at_level(logging.WARNING):
+        manager = ResourceManager(True, resources=[resource, duplicate_resource])
+
+    assert "Resource already exists" in caplog.text
+    assert manager.list_resources() == [resource]
+
+
+def test_add_resource(temp_file: Path):
+    """Test adding a resource."""
+    manager = ResourceManager()
+    resource = FileResource(uri=f"file://{temp_file}", name="test", path=temp_file)
+    added = manager.add_resource(resource)
+    assert added == resource
+    assert manager.list_resources() == [resource]
+
+
+def test_add_duplicate_resource(temp_file: Path):
+    """Test adding the same resource twice."""
+    manager = ResourceManager()
+    resource = FileResource(uri=f"file://{temp_file}", name="test", path=temp_file)
+    first = manager.add_resource(resource)
+    second = manager.add_resource(resource)
+    assert first == second
+    assert manager.list_resources() == [resource]
+
+
+def test_warn_on_duplicate_resources(temp_file: Path, caplog: pytest.LogCaptureFixture):
+    """Test warning on duplicate resources."""
+    manager = ResourceManager()
+    resource = FileResource(uri=f"file://{temp_file}", name="test", path=temp_file)
+    manager.add_resource(resource)
+    manager.add_resource(resource)
+    assert "Resource already exists" in caplog.text
+
+
+def test_disable_warn_on_duplicate_resources(temp_file: Path, caplog: pytest.LogCaptureFixture):
+    """Test disabling warning on duplicate resources."""
+    manager = ResourceManager(warn_on_duplicate_resources=False)
+    resource = FileResource(uri=f"file://{temp_file}", name="test", path=temp_file)
+    manager.add_resource(resource)
+    manager.add_resource(resource)
+    assert "Resource already exists" not in caplog.text
+
+
+@pytest.mark.anyio
+async def test_get_resource(temp_file: Path):
+    """Test getting a resource by URI."""
+    manager = ResourceManager()
+    resource = FileResource(uri=f"file://{temp_file}", name="test", path=temp_file)
+    manager.add_resource(resource)
+    retrieved = await manager.get_resource(resource.uri, Context())
+    assert retrieved == resource
+
+
+@pytest.mark.anyio
+async def test_get_resource_from_template():
+    """Test getting a resource through a template."""
+    manager = ResourceManager()
+
+    def greet(name: str) -> str:
+        return f"Hello, {name}!"
+
+    template = ResourceTemplate.from_function(fn=greet, uri_template="greet://{name}", name="greeter")
+    manager._templates[template.uri_template] = template
+
+    resource = await manager.get_resource(AnyUrl("greet://world"), Context())
+    assert isinstance(resource, FunctionResource)
+    content = await resource.read()
+    assert content == "Hello, world!"
+
+
+@pytest.mark.anyio
+async def test_get_unknown_resource():
+    """Test getting a non-existent resource."""
+    manager = ResourceManager()
+    with pytest.raises(ResourceNotFoundError, match="Unknown resource"):
+        await manager.get_resource(AnyUrl("unknown://test"), Context())
+
+
+def test_list_resources(temp_file: Path):
+    """Test listing all resources."""
+    manager = ResourceManager()
+    resource1 = FileResource(uri=f"file://{temp_file}", name="test1", path=temp_file)
+    resource2 = FileResource(uri=f"file://{temp_file}2", name="test2", path=temp_file)
+
+    manager.add_resource(resource1)
+    manager.add_resource(resource2)
+
+    resources = manager.list_resources()
+    assert len(resources) == 2
+    assert resources == [resource1, resource2]
+
+
+def get_item(id: str) -> str: ...
+
+
+def test_add_template_with_metadata():
+    """Test that ResourceManager.add_template() accepts and passes meta parameter."""
+    manager = ResourceManager()
+    metadata = {"source": "database", "cached": True}
+    template = manager.add_template(fn=get_item, uri_template="resource://items/{id}", meta=metadata)
+
+    assert template.meta is not None
+    assert template.meta == metadata
+    assert template.meta["source"] == "database"
+    assert template.meta["cached"] is True
+
+
+def test_add_template_without_metadata():
+    """Test that ResourceManager.add_template() works without meta parameter."""
+    manager = ResourceManager()
+    template = manager.add_template(fn=get_item, uri_template="resource://items/{id}")
+    assert template.meta is None

tests/server/mcpserver/resources/test_resource_template.py

@@ -0,0 +1,507 @@
+import json
+import threading
+from typing import Any
+
+import pytest
+from mcp_types import Annotations, ElicitRequest, ElicitRequestFormParams, InputRequiredResult
+from pydantic import BaseModel
+
+from mcp.server.mcpserver import Context, MCPServer
+from mcp.server.mcpserver.exceptions import ResourceError
+from mcp.server.mcpserver.resources import FunctionResource, ResourceTemplate
+from mcp.server.mcpserver.resources.templates import (
+    DEFAULT_RESOURCE_SECURITY,
+    ResourceSecurity,
+    ResourceSecurityError,
+)
+
+
+def _make(uri_template: str, security: ResourceSecurity = DEFAULT_RESOURCE_SECURITY) -> ResourceTemplate:
+    def handler(**kwargs: Any) -> str:
+        raise NotImplementedError  # these tests only exercise matches()
+
+    return ResourceTemplate.from_function(fn=handler, uri_template=uri_template, security=security)
+
+
+def test_matches_rfc6570_reserved_expansion():
+    # {+path} allows / — the feature the old regex implementation couldn't support
+    t = _make("file://docs/{+path}")
+    assert t.matches("file://docs/src/main.py") == {"path": "src/main.py"}
+
+
+def test_matches_rejects_encoded_slash_traversal():
+    # %2F decodes to / in UriTemplate.match(), giving "../../etc/passwd".
+    # ResourceSecurity's traversal check then rejects the '..' components.
+    t = _make("file://docs/{name}")
+    with pytest.raises(ResourceSecurityError, match="'name'"):
+        t.matches("file://docs/..%2F..%2Fetc%2Fpasswd")
+
+
+def test_matches_rejects_path_traversal_by_default():
+    t = _make("file://docs/{name}")
+    with pytest.raises(ResourceSecurityError):
+        t.matches("file://docs/..")
+
+
+def test_matches_rejects_path_traversal_in_reserved_var():
+    # Even {+path} gets the traversal check — it's semantic, not structural
+    t = _make("file://docs/{+path}")
+    with pytest.raises(ResourceSecurityError):
+        t.matches("file://docs/../../etc/passwd")
+
+
+def test_matches_rejects_absolute_path():
+    t = _make("file://docs/{+path}")
+    with pytest.raises(ResourceSecurityError):
+        t.matches("file://docs//etc/passwd")
+
+
+def test_matches_allows_dotdot_as_substring():
+    # .. is only dangerous as a path component
+    t = _make("git://refs/{range}")
+    assert t.matches("git://refs/v1.0..v2.0") == {"range": "v1.0..v2.0"}
+
+
+def test_matches_exempt_params_skip_security():
+    policy = ResourceSecurity(exempt_params={"range"})
+    t = _make("git://diff/{+range}", security=policy)
+    assert t.matches("git://diff/../foo") == {"range": "../foo"}
+
+
+def test_matches_disabled_policy_allows_traversal():
+    policy = ResourceSecurity(reject_path_traversal=False, reject_absolute_paths=False)
+    t = _make("file://docs/{name}", security=policy)
+    assert t.matches("file://docs/..") == {"name": ".."}
+
+
+def test_matches_rejects_null_byte_by_default():
+    # %00 decodes to \x00 which defeats string comparisons
+    # ("..\x00" != "..") and can truncate in C extensions.
+    t = _make("file://docs/{name}")
+    with pytest.raises(ResourceSecurityError):
+        t.matches("file://docs/key%00.txt")
+    # Null byte also defeats the traversal check's component comparison
+    with pytest.raises(ResourceSecurityError):
+        t.matches("file://docs/..%00%2Fsecret")
+
+
+def test_matches_null_byte_check_can_be_disabled():
+    policy = ResourceSecurity(reject_null_bytes=False)
+    t = _make("file://docs/{name}", security=policy)
+    assert t.matches("file://docs/key%00.txt") == {"name": "key\x00.txt"}
+
+
+def test_security_rejection_does_not_fall_through_to_next_template():
+    # A strict template's security rejection must halt iteration, not
+    # fall through to a later permissive template. Previously matches()
+    # returned None for both "no match" and "security failed", making
+    # registration order security-critical.
+    strict = _make("file://docs/{name}")
+    lax = _make(
+        "file://docs/{+path}",
+        security=ResourceSecurity(exempt_params={"path"}),
+    )
+    uri = "file://docs/..%2Fsecrets"
+    # Strict matches structurally then fails security -> raises.
+    with pytest.raises(ResourceSecurityError) as exc:
+        strict.matches(uri)
+    assert exc.value.param == "name"
+    # If this raised, the resource manager never reaches the lax
+    # template. Verify the lax template WOULD have accepted it.
+    assert lax.matches(uri) == {"path": "../secrets"}
+
+
+def test_matches_explode_checks_each_segment():
+    t = _make("api{/parts*}")
+    assert t.matches("api/a/b/c") == {"parts": ["a", "b", "c"]}
+    # Any segment with traversal rejects the whole match
+    with pytest.raises(ResourceSecurityError):
+        t.matches("api/a/../c")
+
+
+def test_matches_encoded_backslash_caught_by_traversal_check():
+    # %5C decodes to '\\'. The traversal check normalizes '\\' to '/'
+    # and catches the '..' components.
+    t = _make("file://docs/{name}")
+    with pytest.raises(ResourceSecurityError):
+        t.matches("file://docs/..%5C..%5Csecret")
+
+
+def test_matches_encoded_dots_caught_by_traversal_check():
+    # %2E%2E decodes to '..' which the traversal check rejects.
+    t = _make("file://docs/{name}")
+    with pytest.raises(ResourceSecurityError):
+        t.matches("file://docs/%2E%2E")
+
+
+def test_matches_mixed_encoded_and_literal_slash():
+    # The literal '/' stops the simple-var regex, so the URI doesn't
+    # match the template at all.
+    t = _make("file://docs/{name}")
+    assert t.matches("file://docs/..%2F../etc") is None
+
+
+def test_matches_encoded_slash_without_traversal_allowed():
+    # %2F decoding to '/' is fine when there's no traversal involved.
+    # UriTemplate accepts it; ResourceSecurity only blocks '..' and
+    # absolute paths. Handlers that need single-segment should use
+    # safe_join or validate explicitly.
+    t = _make("file://docs/{name}")
+    assert t.matches("file://docs/sub%2Ffile.txt") == {"name": "sub/file.txt"}
+
+
+def test_matches_escapes_template_literals():
+    # Regression: old impl treated . as regex wildcard
+    t = _make("data://v1.0/{id}")
+    assert t.matches("data://v1.0/42") == {"id": "42"}
+    assert t.matches("data://v1X0/42") is None
+
+
+class TestResourceTemplate:
+    """Test ResourceTemplate functionality."""
+
+    def test_template_creation(self):
+        """Test creating a template from a function."""
+
+        def my_func(key: str, value: int) -> dict[str, Any]:
+            return {"key": key, "value": value}
+
+        template = ResourceTemplate.from_function(
+            fn=my_func,
+            uri_template="test://{key}/{value}",
+            name="test",
+        )
+        assert template.uri_template == "test://{key}/{value}"
+        assert template.name == "test"
+        assert template.mime_type == "text/plain"  # default
+        assert template.fn(key="test", value=42) == my_func(key="test", value=42)
+
+    def test_template_matches(self):
+        """Test matching URIs against a template."""
+
+        def my_func(key: str, value: int) -> dict[str, Any]:  # pragma: no cover
+            return {"key": key, "value": value}
+
+        template = ResourceTemplate.from_function(
+            fn=my_func,
+            uri_template="test://{key}/{value}",
+            name="test",
+        )
+
+        # Valid match
+        params = template.matches("test://foo/123")
+        assert params == {"key": "foo", "value": "123"}
+
+        # No match
+        assert template.matches("test://foo") is None
+        assert template.matches("other://foo/123") is None
+
+    @pytest.mark.anyio
+    async def test_create_resource(self):
+        """Test creating a resource from a template."""
+
+        def my_func(key: str, value: int) -> dict[str, Any]:
+            return {"key": key, "value": value}
+
+        template = ResourceTemplate.from_function(
+            fn=my_func,
+            uri_template="test://{key}/{value}",
+            name="test",
+        )
+
+        resource = await template.create_resource(
+            "test://foo/123",
+            {"key": "foo", "value": 123},
+            Context(),
+        )
+
+        assert isinstance(resource, FunctionResource)
+        content = await resource.read()
+        assert isinstance(content, str)
+        data = json.loads(content)
+        assert data == {"key": "foo", "value": 123}
+
+    @pytest.mark.anyio
+    async def test_template_error(self):
+        """Test error handling in template resource creation."""
+
+        def failing_func(x: str) -> str:
+            raise ValueError("Test error")
+
+        template = ResourceTemplate.from_function(
+            fn=failing_func,
+            uri_template="fail://{x}",
+            name="fail",
+        )
+
+        with pytest.raises(ResourceError, match="Error creating resource from template"):
+            await template.create_resource("fail://test", {"x": "test"}, Context())
+
+    @pytest.mark.anyio
+    async def test_async_text_resource(self):
+        """Test creating a text resource from async function."""
+
+        async def greet(name: str) -> str:
+            return f"Hello, {name}!"
+
+        template = ResourceTemplate.from_function(
+            fn=greet,
+            uri_template="greet://{name}",
+            name="greeter",
+        )
+
+        resource = await template.create_resource(
+            "greet://world",
+            {"name": "world"},
+            Context(),
+        )
+
+        assert isinstance(resource, FunctionResource)
+        content = await resource.read()
+        assert content == "Hello, world!"
+
+    @pytest.mark.anyio
+    async def test_async_binary_resource(self):
+        """Test creating a binary resource from async function."""
+
+        async def get_bytes(value: str) -> bytes:
+            return value.encode()
+
+        template = ResourceTemplate.from_function(
+            fn=get_bytes,
+            uri_template="bytes://{value}",
+            name="bytes",
+        )
+
+        resource = await template.create_resource(
+            "bytes://test",
+            {"value": "test"},
+            Context(),
+        )
+
+        assert isinstance(resource, FunctionResource)
+        content = await resource.read()
+        assert content == b"test"
+
+    @pytest.mark.anyio
+    async def test_basemodel_conversion(self):
+        """Test handling of BaseModel types."""
+
+        class MyModel(BaseModel):
+            key: str
+            value: int
+
+        def get_data(key: str, value: int) -> MyModel:
+            return MyModel(key=key, value=value)
+
+        template = ResourceTemplate.from_function(
+            fn=get_data,
+            uri_template="test://{key}/{value}",
+            name="test",
+        )
+
+        resource = await template.create_resource(
+            "test://foo/123",
+            {"key": "foo", "value": 123},
+            Context(),
+        )
+
+        assert isinstance(resource, FunctionResource)
+        content = await resource.read()
+        assert isinstance(content, str)
+        data = json.loads(content)
+        assert data == {"key": "foo", "value": 123}
+
+    @pytest.mark.anyio
+    async def test_custom_type_conversion(self):
+        """Test handling of custom types."""
+
+        class CustomData:
+            def __init__(self, value: str):
+                self.value = value
+
+            def __str__(self) -> str:
+                return self.value
+
+        def get_data(value: str) -> CustomData:
+            return CustomData(value)
+
+        template = ResourceTemplate.from_function(
+            fn=get_data,
+            uri_template="test://{value}",
+            name="test",
+        )
+
+        resource = await template.create_resource(
+            "test://hello",
+            {"value": "hello"},
+            Context(),
+        )
+
+        assert isinstance(resource, FunctionResource)
+        content = await resource.read()
+        assert content == '"hello"'
+
+
+class TestResourceTemplateAnnotations:
+    """Test annotations on resource templates."""
+
+    def test_template_with_annotations(self):
+        """Test creating a template with annotations."""
+
+        def get_user_data(user_id: str) -> str:  # pragma: no cover
+            return f"User {user_id}"
+
+        annotations = Annotations(priority=0.9)
+
+        template = ResourceTemplate.from_function(
+            fn=get_user_data, uri_template="resource://users/{user_id}", annotations=annotations
+        )
+
+        assert template.annotations is not None
+        assert template.annotations.priority == 0.9
+
+    def test_template_without_annotations(self):
+        """Test that annotations are optional for templates."""
+
+        def get_user_data(user_id: str) -> str:  # pragma: no cover
+            return f"User {user_id}"
+
+        template = ResourceTemplate.from_function(fn=get_user_data, uri_template="resource://users/{user_id}")
+
+        assert template.annotations is None
+
+    @pytest.mark.anyio
+    async def test_template_annotations_in_mcpserver(self):
+        """Test template annotations via an MCPServer decorator."""
+
+        mcp = MCPServer()
+
+        @mcp.resource("resource://dynamic/{id}", annotations=Annotations(audience=["user"], priority=0.7))
+        def get_dynamic(id: str) -> str:  # pragma: no cover
+            """A dynamic annotated resource."""
+            return f"Data for {id}"
+
+        templates = await mcp.list_resource_templates()
+        assert len(templates) == 1
+        assert templates[0].annotations is not None
+        assert templates[0].annotations.audience == ["user"]
+        assert templates[0].annotations.priority == 0.7
+
+    @pytest.mark.anyio
+    async def test_template_created_resources_inherit_annotations(self):
+        """Test that resources created from templates inherit annotations."""
+
+        def get_item(item_id: str) -> str:
+            return f"Item {item_id}"
+
+        annotations = Annotations(priority=0.6)
+
+        template = ResourceTemplate.from_function(
+            fn=get_item, uri_template="resource://items/{item_id}", annotations=annotations
+        )
+
+        # Create a resource from the template
+        resource = await template.create_resource("resource://items/123", {"item_id": "123"}, Context())
+        assert not isinstance(resource, InputRequiredResult)
+
+        # The resource should inherit the template's annotations
+        assert resource.annotations is not None
+        assert resource.annotations.priority == 0.6
+
+        # Verify the resource works correctly
+        content = await resource.read()
+        assert content == "Item 123"
+
+
+class TestResourceTemplateMetadata:
+    """Test ResourceTemplate meta handling."""
+
+    def test_template_from_function_with_metadata(self):
+        """Test that ResourceTemplate.from_function() accepts and stores meta parameter."""
+
+        def get_user(user_id: str) -> str:  # pragma: no cover
+            return f"User {user_id}"
+
+        metadata = {"requires_auth": True, "rate_limit": 100}
+
+        template = ResourceTemplate.from_function(
+            fn=get_user,
+            uri_template="resource://users/{user_id}",
+            meta=metadata,
+        )
+
+        assert template.meta is not None
+        assert template.meta == metadata
+        assert template.meta["requires_auth"] is True
+        assert template.meta["rate_limit"] == 100
+
+    @pytest.mark.anyio
+    async def test_template_created_resources_inherit_metadata(self):
+        """Test that resources created from templates inherit meta from template."""
+
+        def get_item(item_id: str) -> str:
+            return f"Item {item_id}"
+
+        metadata = {"category": "inventory", "cacheable": True}
+
+        template = ResourceTemplate.from_function(
+            fn=get_item,
+            uri_template="resource://items/{item_id}",
+            meta=metadata,
+        )
+
+        # Create a resource from the template
+        resource = await template.create_resource("resource://items/123", {"item_id": "123"}, Context())
+
+        # The resource should inherit the template's metadata
+        assert resource.meta is not None
+        assert resource.meta == metadata
+        assert resource.meta["category"] == "inventory"
+        assert resource.meta["cacheable"] is True
+
+
+@pytest.mark.anyio
+async def test_sync_fn_runs_in_worker_thread():
+    """Sync template functions must run in a worker thread, not the event loop."""
+
+    main_thread = threading.get_ident()
+    fn_thread: list[int] = []
+
+    def blocking_fn(name: str) -> str:
+        fn_thread.append(threading.get_ident())
+        return f"hello {name}"
+
+    template = ResourceTemplate.from_function(fn=blocking_fn, uri_template="test://{name}")
+    resource = await template.create_resource("test://world", {"name": "world"}, Context())
+
+    assert isinstance(resource, FunctionResource)
+    assert await resource.read() == "hello world"
+    assert fn_thread[0] != main_thread
+
+
+@pytest.mark.anyio
+async def test_create_resource_passes_input_required_result_through_unchanged():
+    """create_resource returns the InputRequiredResult the template function returned
+    instead of wrapping it in a FunctionResource (SEP-2322 multi-round-trip pass-through)."""
+    sentinel = InputRequiredResult(
+        input_requests={
+            "who": ElicitRequest(
+                params=ElicitRequestFormParams(
+                    message="Who is this for?",
+                    requested_schema={
+                        "type": "object",
+                        "properties": {"name": {"type": "string"}},
+                        "required": ["name"],
+                    },
+                )
+            )
+        }
+    )
+
+    def ask(topic: str) -> InputRequiredResult:
+        return sentinel
+
+    template = ResourceTemplate.from_function(fn=ask, uri_template="ask://{topic}")
+    result = await template.create_resource("ask://databases", {"topic": "databases"}, Context())
+    assert result is sentinel

tests/server/mcpserver/resources/test_resources.py

@@ -0,0 +1,240 @@
+import pytest
+from mcp_types import Annotations
+
+from mcp.server.mcpserver import MCPServer
+from mcp.server.mcpserver.resources import FunctionResource, Resource
+
+
+class TestResourceValidation:
+    """Test base Resource validation."""
+
+    def test_resource_uri_accepts_any_string(self):
+        """Test that URI field accepts any string per MCP spec."""
+
+        def dummy_func() -> str:  # pragma: no cover
+            return "data"
+
+        # Valid URI
+        resource = FunctionResource(
+            uri="http://example.com/data",
+            name="test",
+            fn=dummy_func,
+        )
+        assert resource.uri == "http://example.com/data"
+
+        # Relative path - now accepted per MCP spec
+        resource = FunctionResource(
+            uri="users/me",
+            name="test",
+            fn=dummy_func,
+        )
+        assert resource.uri == "users/me"
+
+        # Custom scheme
+        resource = FunctionResource(
+            uri="custom://resource",
+            name="test",
+            fn=dummy_func,
+        )
+        assert resource.uri == "custom://resource"
+
+    def test_resource_name_from_uri(self):
+        """Test name is extracted from URI if not provided."""
+
+        def dummy_func() -> str:  # pragma: no cover
+            return "data"
+
+        resource = FunctionResource(
+            uri="resource://my-resource",
+            fn=dummy_func,
+        )
+        assert resource.name == "resource://my-resource"
+
+    def test_resource_name_validation(self):
+        """Test name validation."""
+
+        def dummy_func() -> str:  # pragma: no cover
+            return "data"
+
+        # Must provide either name or URI
+        with pytest.raises(ValueError, match="Either name or uri must be provided"):
+            FunctionResource(
+                fn=dummy_func,
+            )
+
+        # Explicit name takes precedence over URI
+        resource = FunctionResource(
+            uri="resource://uri-name",
+            name="explicit-name",
+            fn=dummy_func,
+        )
+        assert resource.name == "explicit-name"
+
+    def test_resource_mime_type(self):
+        """Test mime type handling."""
+
+        def dummy_func() -> str:  # pragma: no cover
+            return "data"
+
+        # Default mime type
+        resource = FunctionResource(
+            uri="resource://test",
+            fn=dummy_func,
+        )
+        assert resource.mime_type == "text/plain"
+
+        # Custom mime type
+        resource = FunctionResource(
+            uri="resource://test",
+            fn=dummy_func,
+            mime_type="application/json",
+        )
+        assert resource.mime_type == "application/json"
+
+        # RFC 2045 quoted parameter value (gh-1756)
+        resource = FunctionResource(
+            uri="resource://test",
+            fn=dummy_func,
+            mime_type='text/plain; charset="utf-8"',
+        )
+        assert resource.mime_type == 'text/plain; charset="utf-8"'
+
+    @pytest.mark.anyio
+    async def test_resource_read_abstract(self):
+        """Test that Resource.read() is abstract."""
+
+        class ConcreteResource(Resource):
+            pass
+
+        with pytest.raises(TypeError, match="abstract method"):
+            ConcreteResource(uri="test://test", name="test")  # type: ignore
+
+
+class TestResourceAnnotations:
+    """Test annotations on resources."""
+
+    def test_resource_with_annotations(self):
+        """Test creating a resource with annotations."""
+
+        def get_data() -> str:  # pragma: no cover
+            return "data"
+
+        annotations = Annotations(audience=["user"], priority=0.8)
+
+        resource = FunctionResource.from_function(fn=get_data, uri="resource://test", annotations=annotations)
+
+        assert resource.annotations is not None
+        assert resource.annotations.audience == ["user"]
+        assert resource.annotations.priority == 0.8
+
+    def test_resource_without_annotations(self):
+        """Test that annotations are optional."""
+
+        def get_data() -> str:  # pragma: no cover
+            return "data"
+
+        resource = FunctionResource.from_function(fn=get_data, uri="resource://test")
+
+        assert resource.annotations is None
+
+    @pytest.mark.anyio
+    async def test_resource_annotations_in_mcpserver(self):
+        """Test resource annotations via MCPServer decorator."""
+
+        mcp = MCPServer()
+
+        @mcp.resource("resource://annotated", annotations=Annotations(audience=["assistant"], priority=0.5))
+        def get_annotated() -> str:  # pragma: no cover
+            """An annotated resource."""
+            return "annotated data"
+
+        resources = await mcp.list_resources()
+        assert len(resources) == 1
+        assert resources[0].annotations is not None
+        assert resources[0].annotations.audience == ["assistant"]
+        assert resources[0].annotations.priority == 0.5
+
+    @pytest.mark.anyio
+    async def test_resource_annotations_with_both_audiences(self):
+        """Test resource with both user and assistant audience."""
+
+        mcp = MCPServer()
+
+        @mcp.resource("resource://both", annotations=Annotations(audience=["user", "assistant"], priority=1.0))
+        def get_both() -> str:  # pragma: no cover
+            return "for everyone"
+
+        resources = await mcp.list_resources()
+        assert resources[0].annotations is not None
+        assert resources[0].annotations.audience == ["user", "assistant"]
+        assert resources[0].annotations.priority == 1.0
+
+
+class TestAnnotationsValidation:
+    """Test validation of annotation values."""
+
+    def test_priority_validation(self):
+        """Test that priority is validated to be between 0.0 and 1.0."""
+
+        # Valid priorities
+        Annotations(priority=0.0)
+        Annotations(priority=0.5)
+        Annotations(priority=1.0)
+
+        # Invalid priorities should raise validation error
+        with pytest.raises(Exception):  # Pydantic validation error
+            Annotations(priority=-0.1)
+
+        with pytest.raises(Exception):
+            Annotations(priority=1.1)
+
+    def test_audience_validation(self):
+        """Test that audience only accepts valid roles."""
+
+        # Valid audiences
+        Annotations(audience=["user"])
+        Annotations(audience=["assistant"])
+        Annotations(audience=["user", "assistant"])
+        Annotations(audience=[])
+
+        # Invalid roles should raise validation error
+        with pytest.raises(Exception):  # Pydantic validation error
+            Annotations(audience=["invalid_role"])  # type: ignore
+
+
+class TestResourceMetadata:
+    """Test metadata field on base Resource class."""
+
+    def test_resource_with_metadata(self):
+        """Test that Resource base class accepts meta parameter."""
+
+        def dummy_func() -> str:  # pragma: no cover
+            return "data"
+
+        metadata = {"version": "1.0", "category": "test"}
+
+        resource = FunctionResource(
+            uri="resource://test",
+            name="test",
+            fn=dummy_func,
+            meta=metadata,
+        )
+
+        assert resource.meta is not None
+        assert resource.meta == metadata
+        assert resource.meta["version"] == "1.0"
+        assert resource.meta["category"] == "test"
+
+    def test_resource_without_metadata(self):
+        """Test that meta field defaults to None."""
+
+        def dummy_func() -> str:  # pragma: no cover
+            return "data"
+
+        resource = FunctionResource(
+            uri="resource://test",
+            name="test",
+            fn=dummy_func,
+        )
+
+        assert resource.meta is None