Advertise protected resource metadata correctly under a base path

[jviotti]

Signed-off-by: Juan Cruz Viotti jv@jviotti.com

[github-actions]

Benchmark Index (enterprise)

Details

Benchmark suite	Current: 73e3537	Previous: 77e37ed	Ratio
Add one schema (0 existing)	253 ms	400 ms	0.63
Add one schema (100 existing)	72 ms	106 ms	0.68
Add one schema (1000 existing)	118 ms	166 ms	0.71
Add one schema (10000 existing)	755 ms	889 ms	0.85
Update one schema (1 existing)	69 ms	97 ms	0.71
Update one schema (101 existing)	70 ms	103 ms	0.68
Update one schema (1001 existing)	115 ms	165 ms	0.70
Update one schema (10001 existing)	739 ms	846 ms	0.87
Cached rebuild (1 existing)	5 ms	9 ms	0.56
Cached rebuild (101 existing)	5 ms	12 ms	0.42
Cached rebuild (1001 existing)	19 ms	38 ms	0.50
Cached rebuild (10001 existing)	191 ms	325 ms	0.59
Index 100 schemas	413 ms	694 ms	0.60
Index 1000 schemas	958 ms	1605 ms	0.60
Index 10000 schemas	8893 ms	13968 ms	0.64
Index 10000 schemas (custom meta-schema)	11600 ms	17237 ms	0.67
Index 10000 schemas ($ref fan-out)	11808 ms	17171 ms	0.69

This comment was automatically generated by workflow using github-action-benchmark.

[github-actions]

Benchmark Index (community)

Details

Benchmark suite	Current: 73e3537	Previous: 77e37ed	Ratio
Add one schema (0 existing)	311 ms	334 ms	0.93
Add one schema (100 existing)	31 ms	31 ms	1
Add one schema (1000 existing)	101 ms	98 ms	1.03
Add one schema (10000 existing)	887 ms	1171 ms	0.76
Update one schema (1 existing)	22 ms	22 ms	1
Update one schema (101 existing)	32 ms	32 ms	1
Update one schema (1001 existing)	103 ms	99 ms	1.04
Update one schema (10001 existing)	873 ms	852 ms	1.02
Cached rebuild (1 existing)	8 ms	8 ms	1
Cached rebuild (101 existing)	11 ms	11 ms	1
Cached rebuild (1001 existing)	41 ms	38 ms	1.08
Cached rebuild (10001 existing)	367 ms	338 ms	1.09
Index 100 schemas	424 ms	633 ms	0.67
Index 1000 schemas	1481 ms	1532 ms	0.97
Index 10000 schemas	13707 ms	14113 ms	0.97
Index 10000 schemas (custom meta-schema)	16200 ms	17226 ms	0.94
Index 10000 schemas ($ref fan-out)	16034 ms	17165 ms	0.93

This comment was automatically generated by workflow using github-action-benchmark.

[cubic-dev-ai]

No issues found across 8 files

_{Re-trigger cubic}

[augmentcode]

🤖 Augment PR Summary

Summary: This PR adds an enterprise E2E regression sandbox to ensure OAuth Protected Resource Metadata (RFC 9728) is advertised correctly when the registry is served under a non-root base path.

Changes:

• Introduces a new enterprise E2E suite (enterprise/e2e/auth-mcp-path) that runs the MCP endpoint behind JWT auth under the /registry base path.
• Adds Hurl coverage asserting the WWW-Authenticate challenge’s resource_metadata URL contains the base path exactly once and resolves to an actual document.
• Verifies both metadata URLs (with/without trailing slash) return valid JSON and validate against the described schema.
• Ensures the spec-derived “above base path” well-known location returns 404 in this deployment mode.
• Confirms non-gated public catalog content remains accessible without WWW-Authenticate.
• Wires the new E2E suite into CI and local Makefile targets for enterprise runs.

Technical Notes: The sandbox uses a JWT policy only to trigger the discovery/challenge behavior (no identity provider is started), and exercises the base-path-specific discovery mechanism via WWW-Authenticate rather than derivation.

_{🤖 Was this summary useful? React with 👍 or 👎}

[augmentcode]

Review completed. No suggestions at this time.

Comment augment review to trigger a new review at any time.