Fix building auth metadata paths

src/mcp/server/auth/routes.py

@@ -1,3 +1,5 @@
+import posixpath
+import urllib.parse
 from collections.abc import Awaitable, Callable
 from typing import Any
 
@@ -166,12 +168,28 @@ def build_metadata(
     client_registration_options: ClientRegistrationOptions,
     revocation_options: RevocationOptions,
 ) -> OAuthMetadata:
+
+    def append_path(issuer_url: str, endpoint_path: str) -> str:
+        parsed = urllib.parse.urlparse(issuer_url)
+
+        base_path = parsed.path.rstrip("/")
+        endpoint_path = endpoint_path.lstrip("/")
+        new_path = posixpath.join(base_path, endpoint_path)
+
+        if not new_path.startswith("/"):
+            new_path = "/" + new_path
+
+        new_url = urllib.parse.urlunparse(parsed._replace(path=new_path))
+
+        if new_url.startswith("/"):
+            new_url = new_url[1:]
+        return new_url
+
     authorization_url = modify_url_path(
-        issuer_url, lambda path: path.rstrip("/") + AUTHORIZATION_PATH.lstrip("/")
-    )
-    token_url = modify_url_path(
-        issuer_url, lambda path: path.rstrip("/") + TOKEN_PATH.lstrip("/")
+        issuer_url, lambda path: append_path(path, AUTHORIZATION_PATH)
     )
+    token_url = modify_url_path(issuer_url, lambda path: append_path(path, TOKEN_PATH))
+
     # Create metadata
     metadata = OAuthMetadata(
         issuer=issuer_url,
@@ -194,14 +212,14 @@ def build_metadata(
     # Add registration endpoint if supported
     if client_registration_options.enabled:
         metadata.registration_endpoint = modify_url_path(
-            issuer_url, lambda path: path.rstrip("/") + REGISTRATION_PATH.lstrip("/")
+            issuer_url, lambda path: append_path(path, REGISTRATION_PATH)
         )
 
     # Add revocation endpoint if supported
     if revocation_options.enabled:
         metadata.revocation_endpoint = modify_url_path(
-            issuer_url, lambda path: path.rstrip("/") + REVOCATION_PATH.lstrip("/")
+            issuer_url, lambda path: append_path(path, REVOCATION_PATH)
         )
         metadata.revocation_endpoint_auth_methods_supported = ["client_secret_post"]
 
-    return metadata
+    return metadata