fix(oauth): keep the server's path in the fallback authorization-server URL

When RFC 9728 protected-resource metadata names no authorization server, the
MCP server URL stands in as one. `getAuthorizationServerUrl` built that with
`new URL("/", serverUrl)`, which discards the path — exactly the part discovery
needs when the server is not hosted at the domain root. The SDK's
`buildDiscoveryUrls` derives the path-scoped well-known locations from that
pathname, so an origin-only value could only ever probe the domain root, which
404s for a server like `https://example.com/mod/minilesson/mcp.php`.

Keep the path (and strip query/fragment, which an RFC 8414 issuer never
carries). A straight swap would regress the case the origin-only value did
serve — a server that merely lives under a path while publishing its metadata
at the root — so the URL becomes the first of two candidates:
`getAuthorizationServerUrlCandidates` yields the path-scoped form then the bare
origin, and `discoverAuthorizationServerMetadataForServer` walks them, treating
a candidate's failure as non-fatal while another remains and rethrowing the
first error only when all of them fail.

`discoverScopes` and the CIMD pre-registration probe both go through the walk.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013hzwzS8UvBsr4yZm7o7sev
Signed-off-by: cliffhall <cliff@futurescale.com>

clients/web/src/test/integration/auth/discovery.test.ts

@@ -1,7 +1,9 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import {
+  discoverAuthorizationServerMetadataForServer,
   discoverScopes,
   getAuthorizationServerUrl,
+  getAuthorizationServerUrlCandidates,
 } from "@inspector/core/auth/discovery.js";
 import type { OAuthProtectedResourceMetadata } from "@modelcontextprotocol/client";
 
@@ -335,3 +337,172 @@ describe("getAuthorizationServerUrl", () => {
     expect(captured?.message).toMatch(/Invalid MCP server URL: "" \(.+\)/);
   });
 });
+
+// #2110: an MCP server hosted under a path (Moodle, a WordPress plugin, any
+// PHP endpoint) publishes its OAuth metadata under that same path. Reducing the
+// fallback authorization-server URL to the origin threw that path away, so
+// discovery could only ever probe the domain root and 404'd.
+describe("path-hosted MCP servers (#2110)", () => {
+  const pathServerUrl = "https://misc.example.com/mod/minilesson/mcp.php";
+
+  describe("getAuthorizationServerUrl", () => {
+    it("keeps the server's path in the fallback URL", () => {
+      expect(getAuthorizationServerUrl(pathServerUrl)).toEqual(
+        new URL(pathServerUrl),
+      );
+    });
+
+    it("strips query and fragment, which an RFC 8414 issuer never carries", () => {
+      expect(
+        getAuthorizationServerUrl(`${pathServerUrl}?session=abc#frag`),
+      ).toEqual(new URL(pathServerUrl));
+    });
+  });
+
+  describe("getAuthorizationServerUrlCandidates", () => {
+    it("tries the path-scoped URL before the bare origin", () => {
+      expect(getAuthorizationServerUrlCandidates(pathServerUrl)).toEqual([
+        new URL(pathServerUrl),
+        new URL("https://misc.example.com/"),
+      ]);
+    });
+
+    it("offers a single candidate for a root-hosted server", () => {
+      expect(
+        getAuthorizationServerUrlCandidates("https://mcp.example.com"),
+      ).toEqual([new URL("https://mcp.example.com/")]);
+    });
+
+    it("does not probe past an authorization server named by resource metadata", () => {
+      const resourceMetadata: OAuthProtectedResourceMetadata = {
+        resource: pathServerUrl,
+        authorization_servers: ["https://auth.example.com/realms/r"],
+      };
+      expect(
+        getAuthorizationServerUrlCandidates(pathServerUrl, resourceMetadata),
+      ).toEqual([new URL("https://auth.example.com/realms/r")]);
+    });
+  });
+
+  describe("discoverAuthorizationServerMetadataForServer", () => {
+    const metadata = {
+      issuer: pathServerUrl,
+      authorization_endpoint: "https://misc.example.com/mod/authorize.php",
+      token_endpoint: "https://misc.example.com/mod/token.php",
+      response_types_supported: ["code"],
+    };
+
+    beforeEach(() => {
+      vi.clearAllMocks();
+    });
+
+    it("returns the path-scoped result without probing the origin", async () => {
+      const { discoverAuthorizationServerMetadata } =
+        await import("@modelcontextprotocol/client");
+      vi.mocked(discoverAuthorizationServerMetadata).mockResolvedValue(
+        metadata,
+      );
+
+      await expect(
+        discoverAuthorizationServerMetadataForServer(pathServerUrl),
+      ).resolves.toEqual(metadata);
+      expect(discoverAuthorizationServerMetadata).toHaveBeenCalledTimes(1);
+      expect(discoverAuthorizationServerMetadata).toHaveBeenCalledWith(
+        new URL(pathServerUrl),
+        { fetchFn: undefined },
+      );
+    });
+
+    it("falls back to the origin when the path-scoped candidate has no metadata", async () => {
+      const { discoverAuthorizationServerMetadata } =
+        await import("@modelcontextprotocol/client");
+      vi.mocked(discoverAuthorizationServerMetadata)
+        .mockResolvedValueOnce(undefined)
+        .mockResolvedValueOnce(metadata);
+
+      await expect(
+        discoverAuthorizationServerMetadataForServer(pathServerUrl),
+      ).resolves.toEqual(metadata);
+      expect(discoverAuthorizationServerMetadata).toHaveBeenNthCalledWith(
+        2,
+        new URL("https://misc.example.com/"),
+        { fetchFn: undefined },
+      );
+    });
+
+    it("survives a throwing candidate while another remains", async () => {
+      const { discoverAuthorizationServerMetadata } =
+        await import("@modelcontextprotocol/client");
+      vi.mocked(discoverAuthorizationServerMetadata)
+        .mockRejectedValueOnce(new Error("issuer mismatch"))
+        .mockResolvedValueOnce(metadata);
+
+      await expect(
+        discoverAuthorizationServerMetadataForServer(pathServerUrl),
+      ).resolves.toEqual(metadata);
+    });
+
+    it("rethrows the first error when every candidate fails", async () => {
+      const { discoverAuthorizationServerMetadata } =
+        await import("@modelcontextprotocol/client");
+      vi.mocked(discoverAuthorizationServerMetadata)
+        .mockRejectedValueOnce(new Error("path-scoped failed"))
+        .mockRejectedValueOnce(new Error("origin failed"));
+
+      await expect(
+        discoverAuthorizationServerMetadataForServer(pathServerUrl),
+      ).rejects.toThrow("path-scoped failed");
+    });
+
+    it("resolves undefined when every candidate answers with no metadata", async () => {
+      const { discoverAuthorizationServerMetadata } =
+        await import("@modelcontextprotocol/client");
+      vi.mocked(discoverAuthorizationServerMetadata).mockResolvedValue(
+        undefined,
+      );
+
+      await expect(
+        discoverAuthorizationServerMetadataForServer(pathServerUrl),
+      ).resolves.toBeUndefined();
+      expect(discoverAuthorizationServerMetadata).toHaveBeenCalledTimes(2);
+    });
+
+    it("passes the caller's fetch through to every candidate", async () => {
+      const { discoverAuthorizationServerMetadata } =
+        await import("@modelcontextprotocol/client");
+      vi.mocked(discoverAuthorizationServerMetadata).mockResolvedValue(
+        undefined,
+      );
+      const fetchFn = vi.fn();
+
+      await discoverAuthorizationServerMetadataForServer(
+        pathServerUrl,
+        undefined,
+        fetchFn as unknown as typeof fetch,
+      );
+
+      expect(discoverAuthorizationServerMetadata).toHaveBeenCalledWith(
+        new URL(pathServerUrl),
+        { fetchFn },
+      );
+    });
+  });
+
+  it("discoverScopes reaches a path-hosted authorization server", async () => {
+    const { discoverAuthorizationServerMetadata } =
+      await import("@modelcontextprotocol/client");
+    vi.mocked(discoverAuthorizationServerMetadata).mockResolvedValue({
+      issuer: pathServerUrl,
+      authorization_endpoint: "https://misc.example.com/mod/authorize.php",
+      token_endpoint: "https://misc.example.com/mod/token.php",
+      response_types_supported: ["code"],
+      scopes_supported: ["read"],
+    });
+
+    await expect(discoverScopes(pathServerUrl)).resolves.toBe("read");
+    expect(discoverAuthorizationServerMetadata).toHaveBeenCalledWith(
+      new URL(pathServerUrl),
+      { fetchFn: undefined },
+    );
+  });
+});