3 commits

Author	SHA1	Message	Date
Jeremiah Lowin	9cade6c8c8	Fix RFC 8414 path-aware authorization server metadata discovery (#2533) ... * Fix RFC 8414 path-aware authorization server metadata discovery Override get_well_known_routes() in OAuthProvider to rewrite the authorization server metadata route to be path-aware based on issuer_url, matching how protected resource metadata already works. Closes #2527 * Update readme	2025-12-03 19:16:59 -05:00
Jeremiah Lowin	5747cb6237	Fix OAuth metadata endpoint URLs when base_url differs from issuer_url (#2353) ... * Fix OAuth metadata endpoint URLs when base_url differs from issuer_url OAuth operational endpoints (/authorize, /token) are mounted at base_url, but metadata was incorrectly declaring them at issuer_url. This caused clients following the documented mounting pattern to receive incorrect endpoint URLs in /.well-known/oauth-authorization-server. Fixes #2287 * Update auth.py * Remove unnecessary assertion from OAuthProvider init * Add info log when issuer_url differs from base_url	2025-11-04 10:38:41 -05:00
Jeremiah Lowin	d472e30765	Support mounting OAuth-protected servers under path prefixes (#2119) ... * Add issuer_url parameter to OAuth providers for mounting scenarios * Add get_well_known_routes * Update docs * Improve docs and tests * Trigger CI * Fix conditional test execution for Windows	2025-10-17 11:44:49 -04:00