test(auth): align interaction fixtures with slash-free issuers

build_metadata now serves path-less issuers without a trailing slash.
Update authorize iss defaults, PRM/ASM overrides, and assertions so RFC
9207 string compares match the canonical metadata form.

Author: piyushbag

tests/interaction/auth/_provider.py

@@ -63,10 +63,10 @@ def __init__(
     ) -> None:
         self._default_scopes = list(default_scopes) if default_scopes is not None else ["mcp"]
         # The authorization-response iss must equal the AS metadata issuer the client recorded
-        # (RFC 9207 simple string comparison). `real_asm` builds the issuer from an AnyHttpUrl
-        # object, so it carries the trailing slash; the redirect iss matches it. Path-issuer
-        # tests pass the recorded issuer explicitly.
-        self._issuer = issuer if issuer is not None else f"{BASE_URL}/"
+        # (RFC 9207 simple string comparison). `build_metadata` serves path-less issuers without a
+        # trailing slash, so the redirect iss matches that canonical form. Path-issuer tests pass
+        # the recorded issuer explicitly.
+        self._issuer = issuer if issuer is not None else BASE_URL
         self._deny_authorize = deny_authorize
         self._issue_expired_first = issue_expired_first
         self._fail_next_refresh = fail_next_refresh

tests/interaction/auth/test_authorize_token.py

@@ -17,6 +17,7 @@
 import re
 from collections.abc import AsyncIterator
 from dataclasses import dataclass
+from typing import cast
 from urllib.parse import parse_qsl, quote, urlsplit
 
 import anyio
@@ -297,7 +298,7 @@ async def test_the_registered_auth_method_is_used_regardless_of_as_metadata_adve
     server = Server("guarded", on_list_tools=list_tools)
 
     override = OAuthMetadata(
-        issuer=AnyHttpUrl(f"{BASE_URL}/"),
+        issuer=cast(AnyHttpUrl, BASE_URL),
         authorization_endpoint=AnyHttpUrl(f"{BASE_URL}/authorize"),
         token_endpoint=AnyHttpUrl(f"{BASE_URL}/token"),
         registration_endpoint=AnyHttpUrl(f"{BASE_URL}/register"),
@@ -367,7 +368,7 @@ async def test_pkce_is_still_sent_when_as_metadata_omits_code_challenge_methods_
     completes. See the divergence on the requirement.
     """
     override = OAuthMetadata(
-        issuer=AnyHttpUrl(f"{BASE_URL}/"),
+        issuer=cast(AnyHttpUrl, BASE_URL),
         authorization_endpoint=AnyHttpUrl(f"{BASE_URL}/authorize"),
         token_endpoint=AnyHttpUrl(f"{BASE_URL}/token"),
         registration_endpoint=AnyHttpUrl(f"{BASE_URL}/register"),

tests/interaction/auth/test_discovery.py

@@ -11,6 +11,7 @@
 """
 
 import json
+from typing import cast
 
 import anyio
 import mcp_types as types
@@ -54,7 +55,7 @@ def discovery_gets(recorded: list[RecordedRequest]) -> list[str]:
 def real_asm() -> OAuthMetadata:
     """Build an authorization-server metadata document pointing at the real co-hosted endpoints."""
     return OAuthMetadata(
-        issuer=AnyHttpUrl(BASE_URL),
+        issuer=cast(AnyHttpUrl, BASE_URL),
         authorization_endpoint=AnyHttpUrl(f"{BASE_URL}/authorize"),
         token_endpoint=AnyHttpUrl(f"{BASE_URL}/token"),
         registration_endpoint=AnyHttpUrl(f"{BASE_URL}/register"),
@@ -100,7 +101,7 @@ async def test_prm_discovery_falls_back_from_path_well_known_to_root_on_404() ->
     server = Server("guarded", on_list_tools=list_tools)
 
     prm = ProtectedResourceMetadata(
-        resource=AnyHttpUrl(f"{BASE_URL}/mcp"), authorization_servers=[AnyHttpUrl(BASE_URL)]
+        resource=AnyHttpUrl(f"{BASE_URL}/mcp"), authorization_servers=[cast(AnyHttpUrl, BASE_URL)]
     )
     app_shim = shim(
         not_found=frozenset({PRM_PATH_SUFFIXED}),
@@ -188,7 +189,7 @@ async def test_prm_with_a_mismatched_resource_aborts_the_flow_before_authorize()
     server = Server("guarded", on_list_tools=list_tools)
 
     prm = ProtectedResourceMetadata(
-        resource=AnyHttpUrl(f"{BASE_URL}/other"), authorization_servers=[AnyHttpUrl(BASE_URL)]
+        resource=AnyHttpUrl(f"{BASE_URL}/other"), authorization_servers=[cast(AnyHttpUrl, BASE_URL)]
     )
     app_shim = shim(serve={PRM_PATH_SUFFIXED: metadata_body(prm)})
 

tests/interaction/auth/test_flow.py

@@ -237,4 +237,4 @@ async def test_shimmed_app_serves_overrides_404s_and_otherwise_forwards_to_the_w
 
             forwarded = await http.get("/.well-known/oauth-authorization-server")
             assert forwarded.status_code == 200
-            assert forwarded.json()["issuer"] == "http://127.0.0.1:8000/"
+            assert forwarded.json()["issuer"] == "http://127.0.0.1:8000"

tests/interaction/auth/test_identity_assertion.py

@@ -40,9 +40,9 @@
 ID_JAG_GRANT_PROFILE = "urn:ietf:params:oauth:grant-profile:id-jag"
 CLIENT_ID = "enterprise-mcp-client"
 CLIENT_SECRET = "enterprise-secret"
-# The AS metadata issuer carries a trailing slash (built from an AnyHttpUrl object); the client
+# The AS metadata issuer is path-less and slash-free (matches build_metadata); the client
 # pins against exactly that.
-EXPECTED_ISSUER = f"{BASE_URL}/"
+EXPECTED_ISSUER = BASE_URL
 
 
 async def list_tools(ctx: ServerRequestContext, params: types.PaginatedRequestParams | None) -> ListToolsResult:
@@ -215,7 +215,7 @@ async def test_unexpected_issuer_aborts_before_sending_credentials() -> None:
     provider = InMemoryAuthorizationServerProvider()
     preregister_confidential_client(provider)
     server = Server("guarded", on_list_tools=list_tools)
-    # The served AS metadata has issuer BASE_URL/, but the client is configured for a different one.
+    # The served AS metadata has issuer BASE_URL, but the client is configured for a different one.
     auth = identity_assertion_provider(InMemoryTokenStorage(), issuer="https://corp-as.example/", record=record)
 
     with anyio.fail_after(5):

tests/interaction/auth/test_lifecycle.py

@@ -8,6 +8,7 @@
 
 import base64
 from collections import Counter
+from typing import cast
 from urllib.parse import parse_qsl, urlsplit
 
 import anyio
@@ -69,7 +70,7 @@ def path_counts(recorded: list[RecordedRequest]) -> Counter[tuple[str, str]]:
 def cimd_supported_metadata() -> bytes:
     """AS metadata advertising `client_id_metadata_document_supported: true` (the SDK server never sets it)."""
     metadata = OAuthMetadata(
-        issuer=AnyHttpUrl(f"{BASE_URL}/"),
+        issuer=cast(AnyHttpUrl, BASE_URL),
         authorization_endpoint=AnyHttpUrl(f"{BASE_URL}/authorize"),
         token_endpoint=AnyHttpUrl(f"{BASE_URL}/token"),
         registration_endpoint=AnyHttpUrl(f"{BASE_URL}/register"),
@@ -239,7 +240,7 @@ async def test_credentials_bound_to_a_different_issuer_are_discarded_and_the_cli
     # The persisted client is now bound to the current AS.
     assert storage.client_info is not None
     assert storage.client_info.client_id != "stale-as-client"
-    assert storage.client_info.issuer == f"{BASE_URL}/"
+    assert storage.client_info.issuer == BASE_URL
 
 
 @requirement("client-auth:401-after-auth-throws")
@@ -437,7 +438,7 @@ async def assertion_provider(audience: str) -> str:
             result = await client.list_tools()
 
     assert result.tools[0].name == "echo"
-    assert audiences == [f"{BASE_URL}/"]
+    assert audiences == [BASE_URL]
 
     [token_req] = find(recorded, "POST", "/token")
     body = form_body(token_req)