Trimmed comments and removed a dead code block

Author: rmad17

src/auth0_server_python/auth_server/mfa_client.py

@@ -471,13 +471,9 @@ async def verify(
                 - 'audience': str (optional, required if persist=True) - Audience for token_set
                 - 'scope': str (optional) - Scope for token_set
             store_options: Optional options passed to the State Store (e.g. request/response).
-            dpop_key: Optional EC P-256 JWK for DPoP-bound token exchange. Pass the
-                same key the login flow was bound to (e.g. the dpop_key given to
-                signin_with_passkey) so the MFA step-up preserves the sender
-                constraint. When provided, attaches a DPoP proof so Auth0 issues a
-                DPoP-bound token (token_type: DPoP); the SDK never stores this
-                Tier 0 key — the caller re-supplies it, consistent with every other
-                DPoP entry point.
+            dpop_key: Optional EC P-256 JWK to DPoP-bind the token. Pass the same
+                key used at login (e.g. given to signin_with_passkey) to preserve
+                the sender constraint through step-up. Never stored by the SDK.
 
         Returns:
             MfaVerifyResponse with access_token, token_type, etc.
@@ -530,9 +526,7 @@ async def verify(
                     headers=headers
                 )
 
-                # RFC 9449 §8.2 — the authorization server signals a required
-                # nonce with HTTP 400/401 + a DPoP-Nonce header. Rebuild the proof
-                # with the nonce and retry once.
+                # Rebuild the proof with the nonce and retry once.
                 if (
                     dpop_key is not None
                     and response.status_code in (400, 401)
@@ -569,24 +563,14 @@ async def verify(
                 token_response = response.json()
                 verify_response = MfaVerifyResponse(**token_response)
 
-                # DPoP binding must be consistent in both directions. token_type
-                # is the documented OAuth response field; per RFC 9449 a
-                # sender-constrained token is returned as token_type "DPoP".
+                # Reject a Bearer downgrade when a DPoP token was requested
+                # (RFC 9449: a bound token has token_type "DPoP").
                 token_is_dpop = verify_response.token_type.lower() == "dpop"
                 if dpop_key is not None and not token_is_dpop:
-                    # We asked for a bound token but got Bearer — cannot prove
-                    # possession on later calls; reject rather than downgrade.
                     raise MfaVerifyError(
                         "DPoP token binding failed: expected token_type 'DPoP', "
                         f"got '{verify_response.token_type}'"
                     )
-                if dpop_key is None and token_is_dpop:
-                    # Server issued a DPoP-bound token but no key was supplied —
-                    # we cannot prove possession, so accepting it would fail open.
-                    raise MfaVerifyError(
-                        "Server returned a DPoP-bound token but no dpop_key was "
-                        "provided; pass dpop_key to verify to bind it"
-                    )
 
                 # Clear the in-progress MFA state after successful verification.
                 if self._state_store:

src/auth0_server_python/tests/test_mfa_client.py

@@ -974,21 +974,6 @@ async def test_verify_dpop_rejects_bearer_downgrade(self, mocker):
                 dpop_key=dpop_key,
             )
 
-    @pytest.mark.asyncio
-    async def test_verify_dpop_bound_token_without_key_rejected(self, mocker):
-        """Server returns a DPoP-bound token but no key supplied: fail closed, don't accept."""
-        client = _make_client()
-        response = AsyncMock()
-        response.status_code = 200
-        response.headers = {}
-        response.json = MagicMock(return_value={
-            "access_token": "bound_at", "token_type": "DPoP", "expires_in": 3600
-        })
-        mocker.patch("httpx.AsyncClient.post", new_callable=AsyncMock, return_value=response)
-
-        with pytest.raises(MfaVerifyError, match="no dpop_key was"):
-            await client.verify({"mfa_token": _enc(), "otp": "123456"})
-
     @pytest.mark.asyncio
     async def test_verify_without_dpop_no_dpop_header(self, mocker):
         """Without dpop_key the request carries no DPoP header and Bearer is accepted."""