fix: place well-known discovery route per RFC 8414 3.1

The .well-known/oauth-authorization-server route was prefixed with the
issuer's base path *after* the well-known suffix (e.g.
/custom/path/.well-known/oauth-authorization-server), which RFC 8615 3
does not recognize as a well-known URI. RFC 8414 3.1 requires the
suffix to be inserted between the authority and the path component
instead: /.well-known/oauth-authorization-server/custom/path.

The /authorize, /token, /register, /revoke routes are unaffected -
they're plain URLs under the issuer's namespace, not well-known URIs.

Author: enjoykumawat

src/mcp/server/auth/routes.py

@@ -106,7 +106,10 @@ def create_auth_routes(
     # responses produced by inner layers (such as a 413) still carry CORS headers.
     routes = [
         Route(
-            issuer_path + "/.well-known/oauth-authorization-server",
+            # RFC 8414 3.1: the well-known suffix goes between the authority and
+            # the issuer's path component, not after it — "/custom/path/.well-known/..."
+            # is not a valid well-known URI per RFC 8615 3.
+            "/.well-known/oauth-authorization-server" + issuer_path,
             endpoint=cors_middleware(
                 MetadataHandler(metadata).handle,
                 ["GET", "OPTIONS"],

tests/server/auth/test_routes.py

@@ -91,7 +91,11 @@ def test_create_auth_routes_default_paths():
 
 
 def test_create_auth_routes_custom_base_path():
-    """Auth routes are prefixed with the issuer_url path for gateway deployments."""
+    """Auth routes are prefixed with the issuer_url path for gateway deployments.
+
+    Per RFC 8414 3.1 / RFC 8615 3, the well-known discovery URI is rooted at the
+    domain and inserted *before* the issuer's path component, not after it.
+    """
     provider = MockOAuthProvider()
     routes = create_auth_routes(
         provider,
@@ -100,7 +104,7 @@ def test_create_auth_routes_custom_base_path():
         revocation_options=RevocationOptions(enabled=True),
     )
     paths = [route.path for route in routes]
-    assert "/custom/path/.well-known/oauth-authorization-server" in paths
+    assert "/.well-known/oauth-authorization-server/custom/path" in paths
     assert "/custom/path/authorize" in paths
     assert "/custom/path/token" in paths
     assert "/custom/path/register" in paths
@@ -117,6 +121,6 @@ def test_create_auth_routes_trailing_slash_stripped():
         revocation_options=RevocationOptions(enabled=True),
     )
     paths = [route.path for route in routes]
-    assert "/base/.well-known/oauth-authorization-server" in paths
+    assert "/.well-known/oauth-authorization-server/base" in paths
     assert "/base/authorize" in paths
     assert "/base/token" in paths