Add stricter mypy options

mypy.ini

@@ -11,6 +11,7 @@ no_implicit_optional = True
 
 # Strict checks, see mypy --help
 warn_unused_configs = True
+disallow_subclassing_any = True
 disallow_untyped_defs = True
 warn_redundant_casts = True
 warn_unused_ignores = True

synapse/api/auth/msc3861_delegated.py

@@ -59,7 +59,7 @@ def scope_to_list(scope: str) -> List[str]:
     return scope.strip().split(" ")
 
 
-class PrivateKeyJWTWithKid(PrivateKeyJWT):
+class PrivateKeyJWTWithKid(PrivateKeyJWT):  # type: ignore[misc]
     """An implementation of the private_key_jwt client auth method that includes a kid header.
 
     This is needed because some providers (Keycloak) require the kid header to figure

synapse/handlers/oidc.py

@@ -1354,7 +1354,7 @@ async def handle_backchannel_logout(
         finish_request(request)
 
 
-class LogoutToken(JWTClaims):
+class LogoutToken(JWTClaims):  # type: ignore[misc]
     """
     Holds and verify claims of a logout token, as per
     https://openid.net/specs/openid-connect-backchannel-1_0.html#LogoutToken