test: close coverage gaps in lenient-query branch and test handlers

Adds two no-match cases for the lenient-query code path in
UriTemplate.match(): path regex failing when query vars are present,
and ; explode name mismatch in the path portion before a {?...}
expression.

Adds a passing case to test_resource_security_default_rejects_traversal
so the handler body executes (the test previously only sent rejected
URIs, leaving the handler uncovered).

Replaces the _make helper's unreachable return with
raise NotImplementedError since those tests only exercise matches().

Author: maxisbey

tests/server/mcpserver/resources/test_resource_template.py

@@ -15,7 +15,7 @@
 
 def _make(uri_template: str, security: ResourceSecurity = DEFAULT_RESOURCE_SECURITY) -> ResourceTemplate:
     def handler(**kwargs: Any) -> str:
-        return "ok"
+        raise NotImplementedError  # these tests only exercise matches()
 
     return ResourceTemplate.from_function(fn=handler, uri_template=uri_template, security=security)
 

tests/server/mcpserver/test_server.py

@@ -197,6 +197,11 @@ def get_item(name: str) -> str:
             return f"item:{name}"
 
         async with Client(mcp) as client:
+            # Safe value passes through to the handler
+            r = await client.read_resource("data://items/widget")
+            assert isinstance(r.contents[0], TextResourceContents)
+            assert r.contents[0].text == "item:widget"
+
             # ".." as a path component is rejected by default policy
             with pytest.raises(MCPError, match="Unknown resource"):
                 await client.read_resource("data://items/..")

tests/shared/test_uri_template.py

@@ -475,6 +475,10 @@ def test_match(template: str, uri: str, expected: dict[str, str | list[str]]):
         # ; explode: wrong parameter name in any segment rejects the match
         ("item{;keys*}", "item;admin=true"),
         ("item{;keys*}", "item;keys=a;admin=true"),
+        # Lenient-query branch: path portion fails to match
+        ("api/{name}{?q}", "wrong/path?q=x"),
+        # Lenient-query branch: ; explode name mismatch in path portion
+        ("item{;keys*}{?q}", "item;wrong=x?q=1"),
     ],
 )
 def test_match_no_match(template: str, uri: str):