[v1.x] fix: canonicalize root protected resource URIs

[lawrence3699]

Summary

Fixes #1265.

ProtectedResourceMetadata was serializing host-only resource and authorization_servers values with Pydantic's implicit trailing /, so a response like:

{"resource":"https://example.com/","authorization_servers":["https://auth.example.com/"]}

was emitted for root-level servers.

This change keeps route registration and path-bearing URLs unchanged, and only canonicalizes those host-only server URIs in the JSON response.

Test plan

• uv run --frozen pytest tests/server/auth/test_protected_resource.py -q
• uv run --frozen pytest tests/client/test_auth.py -q -k 'validate_resource_accepts_root_url_with_trailing_slash or protected_resource_metadata'
• uv run --frozen ruff check src/mcp/shared/auth.py tests/server/auth/test_protected_resource.py
• uv run --frozen pyright src/mcp/shared/auth.py

[Copilot]

Pull request overview

This PR fixes the .well-known/oauth-protected-resource JSON response for root-level resource and authorization_servers values by removing Pydantic’s implicit trailing /, aligning the output with the “Canonical Server URI” expectation in the spec (Fixes #1265).

Changes:

• Added a small canonicalization helper to remove the synthetic trailing / only for host-only (root) server URIs.
• Added Pydantic field_serializers on ProtectedResourceMetadata.resource and .authorization_servers to apply this canonicalization in JSON output.
• Updated the protected resource server integration test snapshot to expect the canonical (no trailing slash) URIs.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/mcp/shared/auth.py	Adds JSON-only serialization logic to canonicalize root server URIs (strip implicit trailing /).
tests/server/auth/test_protected_resource.py	Updates snapshot expectation for root resource metadata response to omit trailing /.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.