address review: normalize the expected PRM path like the request path; point the resourceMetadataUrl JSDoc at this package

A resourceServerUrl with a trailing slash derived an expected well-known path
that kept the slash while incoming request paths had theirs stripped, so the
PRM route matched neither spelling. Both sides now share one normalization.

Author: felixweinberger

packages/server/src/server/middleware/bearerAuth.ts

@@ -48,8 +48,8 @@ export interface BearerAuthOptions {
      * `WWW-Authenticate` header on 401/403 responses, per
      * {@link https://datatracker.ietf.org/doc/html/rfc9728 | RFC 9728}.
      *
-     * Typically built with `getOAuthProtectedResourceMetadataUrl` from
-     * `@modelcontextprotocol/express`.
+     * Typically built with `getOAuthProtectedResourceMetadataUrl`, exported
+     * from this package.
      */
     resourceMetadataUrl?: string;
 }

packages/server/src/server/middleware/oauthMetadata.ts

@@ -94,10 +94,16 @@ export function getOAuthProtectedResourceMetadataUrl(serverUrl: URL): string {
 
 /** The RFC 9728 path-aware well-known path for a resource URL. */
 function protectedResourceMetadataPath(resourceServerUrl: URL): string {
-    const rsPath = resourceServerUrl.pathname;
+    // Normalized like the request path in `oauthMetadataResponse`: a resource
+    // URL with a trailing slash must not make its own PRM route unreachable.
+    const rsPath = stripTrailingSlash(resourceServerUrl.pathname);
     return `/.well-known/oauth-protected-resource${rsPath === '/' ? '' : rsPath}`;
 }
 
+function stripTrailingSlash(path: string): string {
+    return path.length > 1 && path.endsWith('/') ? path.slice(0, -1) : path;
+}
+
 const ALLOWED_METHODS = 'GET, HEAD, OPTIONS';
 
 function metadataDocumentResponse(request: Request, metadata: OAuthMetadata | OAuthProtectedResourceMetadata): Response {
@@ -161,9 +167,8 @@ export function oauthMetadataResponse(request: Request, options: AuthMetadataOpt
     // even when the options are misconfigured — a bad issuer surfaces on the
     // discovery routes (or at startup via buildOAuthProtectedResourceMetadata),
     // never on the host's own traffic.
-    const rawPath = new URL(request.url).pathname;
     // Tolerate a single trailing slash, as path-mounted routers do.
-    const requestPath = rawPath.length > 1 && rawPath.endsWith('/') ? rawPath.slice(0, -1) : rawPath;
+    const requestPath = stripTrailingSlash(new URL(request.url).pathname);
     if (requestPath === protectedResourceMetadataPath(options.resourceServerUrl)) {
         return metadataDocumentResponse(request, buildOAuthProtectedResourceMetadata(options));
     }

packages/server/test/server/oauthMetadata.test.ts

@@ -150,6 +150,14 @@ describe('review-hardened contracts', () => {
         ).toThrow('Issuer URL must be HTTPS');
     });
 
+    it('serves the PRM when the resource URL itself has a trailing slash', () => {
+        const slashOptions = { ...options, resourceServerUrl: new URL('https://api.example.com/mcp/') };
+        for (const path of ['/.well-known/oauth-protected-resource/mcp', '/.well-known/oauth-protected-resource/mcp/']) {
+            const response = oauthMetadataResponse(new Request(`https://api.example.com${path}`), slashOptions);
+            expect(response?.status).toBe(200);
+        }
+    });
+
     it('tolerates a single trailing slash like path-mounted routers', () => {
         const response = oauthMetadataResponse(new Request('https://api.example.com/.well-known/oauth-protected-resource/mcp/'), options);
         expect(response?.status).toBe(200);