restore mcp path specific logic

Author: mattdholloway

pkg/http/oauth/oauth.go

@@ -132,10 +132,13 @@ func (h *AuthHandler) routesForPattern(pattern string) []string {
 }
 
 // GetEffectiveResourcePath returns the resource path for OAuth protected resource URLs.
-// It uses the request's URL path directly. For deployments where a prefix like /mcp
-// is stripped by a proxy, the proxy should set the BaseURL config appropriately.
+// Since proxies may strip the /mcp prefix before forwarding requests, this function
+// restores the prefix for the external-facing URL.
 func GetEffectiveResourcePath(r *http.Request) string {
-	return r.URL.Path
+	if r.URL.Path == "/" {
+		return "/mcp"
+	}
+	return "/mcp" + r.URL.Path
 }
 
 // GetProtectedResourceData builds the OAuth protected resource data for a request.

pkg/http/oauth/oauth_test.go

@@ -185,30 +185,23 @@ func TestGetEffectiveResourcePath(t *testing.T) {
 		expectedPath string
 	}{
 		{
-			name: "root path",
+			name: "root path restores /mcp prefix",
 			setupRequest: func() *http.Request {
 				return httptest.NewRequest(http.MethodGet, "/", nil)
 			},
-			expectedPath: "/",
-		},
-		{
-			name: "mcp path",
-			setupRequest: func() *http.Request {
-				return httptest.NewRequest(http.MethodGet, "/mcp", nil)
-			},
 			expectedPath: "/mcp",
 		},
 		{
-			name: "readonly path",
+			name: "non-root path adds /mcp prefix",
 			setupRequest: func() *http.Request {
 				return httptest.NewRequest(http.MethodGet, "/readonly", nil)
 			},
-			expectedPath: "/readonly",
+			expectedPath: "/mcp/readonly",
 		},
 		{
-			name: "nested path",
+			name: "nested path adds /mcp prefix",
 			setupRequest: func() *http.Request {
-				return httptest.NewRequest(http.MethodGet, "/mcp/x/repos", nil)
+				return httptest.NewRequest(http.MethodGet, "/x/repos", nil)
 			},
 			expectedPath: "/mcp/x/repos",
 		},