fix(auth): strip trailing slashes from OAuth metadata URLs

[piyushbag]

Summary

• strip trailing slashes from issuer in build_metadata() before constructing OAuthMetadata
• strip trailing slashes from resource and each authorization_servers entry in create_protected_resource_routes()
• pass canonical URL strings so metadata models with url_preserve_empty_path serialize without a synthetic root slash
• add regression tests for AnyHttpUrl issuer inputs and root-level protected-resource metadata responses

Fixes #1919. Also fixes #1265.

Test plan

• uv run pytest tests/server/auth/test_routes.py -q
• uv run pytest tests/server/auth/test_protected_resource.py -q
• uv run pytest tests/server/auth/ -q
• uv run ruff check src/mcp/server/auth/routes.py tests/server/auth/test_routes.py tests/server/auth/test_protected_resource.py
• uv run pyright src/mcp/server/auth/routes.py

[cubic-dev-ai]

1 issue found across 3 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="src/mcp/server/auth/routes.py">

<violation number="1" location="src/mcp/server/auth/routes.py:172">
P2: Issuer canonicalization is over-broad: `rstrip('/')` also rewrites non-root path issuers (e.g. `/tenant/` -> `/tenant`), which can break exact issuer identifier matching.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P2: Issuer canonicalization is over-broad: rstrip('/') also rewrites non-root path issuers (e.g. /tenant/ -> /tenant), which can break exact issuer identifier matching.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At src/mcp/server/auth/routes.py, line 172:

<comment>Issuer canonicalization is over-broad: `rstrip('/')` also rewrites non-root path issuers (e.g. `/tenant/` -> `/tenant`), which can break exact issuer identifier matching.</comment>

<file context>
@@ -169,7 +169,7 @@ def build_metadata(
     # Create metadata
     metadata = OAuthMetadata(
-        issuer=issuer_url,
+        issuer=cast(AnyHttpUrl, str(issuer_url).rstrip("/")),
         authorization_endpoint=authorization_url,
         token_endpoint=token_url,
</file context>

[piyushbag]

Rebased onto current main. Updated client test_build_metadata expectations now that issuers are served without a synthetic trailing slash, and removed the obsolete Pydantic AnyUrl xfail.

Local: targeted auth route and metadata tests pass.

[piyushbag]

CI failures were issuer string mismatches after the metadata slash strip (iss / PRM authorization_servers still carried a trailing slash).

Aligned the interaction auth fixtures and assertions with the canonical slash-free issuer. Local: full tests/interaction/auth/ plus route/metadata unit tests pass (87).