fix(server): preserve resource metadata queries

Keep RFC 9728 query components when deriving metadata URLs and omit the fallback for abstract RFC 8707 resource identifiers.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

.changeset/scope-challenge-server.md

@@ -18,5 +18,5 @@ bearer-auth 401/403 answers, and its `resource_metadata` parameter is derived
 from the verified `AuthInfo`: `requireBearerAuth` / `verifyBearerToken` now
 stamp their configured `resourceMetadataUrl` onto the `AuthInfo` they return
 (new optional `AuthInfo.resourceMetadataUrl` field), with a fallback to the
-well-known location for the token's RFC 8707 `resource` identifier; the
+well-known location for an HTTP(S) RFC 8707 `resource` identifier; the
 parameter is omitted when neither is available.

packages/server/src/server/middleware/oauthMetadata.ts

@@ -89,7 +89,10 @@ export function buildOAuthProtectedResourceMetadata(options: AuthMetadataOptions
  * ```
  */
 export function getOAuthProtectedResourceMetadataUrl(serverUrl: URL): string {
-    return new URL(protectedResourceMetadataPath(serverUrl), serverUrl).href;
+    const metadataUrl = new URL(serverUrl);
+    metadataUrl.pathname = protectedResourceMetadataPath(serverUrl);
+    metadataUrl.hash = '';
+    return metadataUrl.href;
 }
 
 /** The RFC 9728 path-aware well-known path for a resource URL. */

packages/server/src/server/scopeChallenge.ts

@@ -92,17 +92,17 @@ export async function findScopeChallenge(
  * challenge, derived from the verified {@link AuthInfo}: the URL the
  * authentication gate stamped (`authInfo.resourceMetadataUrl`, set by the
  * bearer-auth helpers from their `resourceMetadataUrl` option), falling back
- * to the well-known location for the token's RFC 8707 `resource` identifier,
- * or `undefined` when neither is available (the `resource_metadata` parameter
- * is then omitted, matching the bearer-auth challenges).
+ * to the well-known location for an HTTP(S) RFC 8707 `resource` identifier, or
+ * `undefined` when neither is available (the `resource_metadata` parameter is
+ * then omitted, matching the bearer-auth challenges).
  *
  * @internal
  */
 export function scopeChallengeResourceMetadataUrl(authInfo: AuthInfo | undefined): string | undefined {
     if (authInfo?.resourceMetadataUrl !== undefined) {
         return authInfo.resourceMetadataUrl;
     }
-    if (authInfo?.resource !== undefined) {
+    if (authInfo?.resource?.protocol === 'https:' || authInfo?.resource?.protocol === 'http:') {
         return getOAuthProtectedResourceMetadataUrl(authInfo.resource);
     }
     return undefined;

packages/server/test/server/oauthMetadata.test.ts

@@ -82,6 +82,12 @@ describe('getOAuthProtectedResourceMetadataUrl', () => {
             'https://api.example.com/.well-known/oauth-protected-resource'
         );
     });
+
+    it('preserves the resource identifier query', () => {
+        expect(getOAuthProtectedResourceMetadataUrl(new URL('https://api.example.com/mcp?tenant=acme'))).toBe(
+            'https://api.example.com/.well-known/oauth-protected-resource/mcp?tenant=acme'
+        );
+    });
 });
 
 describe('oauthMetadataResponse', () => {

packages/server/test/server/scopeChallenge.test.ts

@@ -246,13 +246,25 @@ describe('legacy Streamable HTTP scope preflight', () => {
         const harness = await createLegacyHarness(requireScopes('repo:write'));
         const sessionId = await initializeLegacy(harness.transport);
         const response = await harness.transport.handleRequest(legacyRequest(toolCall(), sessionId), {
-            authInfo: { ...auth(['repo:read']), resource: new URL('https://api.example.com/mcp') }
+            authInfo: { ...auth(['repo:read']), resource: new URL('https://api.example.com/mcp?tenant=acme') }
         });
 
         expect(response.status).toBe(403);
         expect(response.headers.get('WWW-Authenticate')).toContain(
-            'resource_metadata="https://api.example.com/.well-known/oauth-protected-resource/mcp"'
+            'resource_metadata="https://api.example.com/.well-known/oauth-protected-resource/mcp?tenant=acme"'
         );
         await harness.transport.close();
     });
+
+    it('omits resource_metadata when an abstract RFC 8707 resource identifier cannot locate an RFC 9728 document', async () => {
+        const harness = await createLegacyHarness(requireScopes('repo:write'));
+        const sessionId = await initializeLegacy(harness.transport);
+        const response = await harness.transport.handleRequest(legacyRequest(toolCall(), sessionId), {
+            authInfo: { ...auth(['repo:read']), resource: new URL('urn:example:mcp') }
+        });
+
+        expect(response.status).toBe(403);
+        expect(response.headers.get('WWW-Authenticate')).not.toContain('resource_metadata');
+        await harness.transport.close();
+    });
 });