pomerium / pomerium / 23268795626

52%

Build Type

push

github

Committed by web-flow

Commit Message

fix(mcp): include request path in upstream_auth PRM URL and normalize trailing slash (#6202)

## Summary

Follow-up to #6200. The `upstream_auth.go` `handle401` path had the same
bug: when Pomerium returns a 401 to tell the MCP client to
re-authenticate, the `resource_metadata` URI in `WWW-Authenticate` was
missing the request path, causing a resource mismatch for path-based MCP
routes.

Additionally, `ProtectedResourceMetadataURL` now normalizes trailing
slashes (stripping `/` from root paths) to match the behavior of
`BuildProtectedResourceMetadataURLs` in `upstream_discovery.go`, which
already does this normalization.

## Related issues

- #6199
- #6200

## User Explanation

MCP clients connecting to path-based MCP servers through Pomerium's
upstream auth flow will no longer fail OAuth discovery due to a resource
mismatch in the `WWW-Authenticate` header.

## Checklist

- [x] reference any related issues
- [x] updated unit tests
- [ ] add appropriate label (`enhancement`, `bug`, `breaking`,
`dependencies`, `ci`)
- [ ] ready for review

Coverage Stats

6 of 6 new or added lines in 2 files covered. (100.0%)

24 existing lines in 6 files now uncovered.

34932 of 76715 relevant lines covered (45.53%)

115.36 hits per line