Emit RFC 9207 iss on OAuth authorization responses

[aterga]

Summary

Name the issuer on every /oauth authorization-response redirect with an iss parameter (RFC 9207), and advertise support via authorization_response_iss_parameter_supported in the RFC 8414 authorization-server metadata.

RFC 9207 lets a client detect an authorization-server mix-up before it redeems a code: a client that sees the metadata flag compares the response iss against the issuer it started the flow with and rejects a mismatch. The value we emit is byte-for-byte the metadata issuer ({public_url}{mcp_path}), which clients compare by exact string. This is a natural fit for a path-issuer-per-instance server: a client that started at /mcp and is handed a code stamped for /mcp-beta can now catch it.

This surfaced in the MCP 2026-07-28 alignment review as a small, spec-independent OAuth hardening win, implemented here on its own so it can land ahead of the larger alignment work.

Related issues

Changes

• build_redirect gains an iss argument and appends the percent-encoded &iss=... after code and any state.
• connect_redeem binds let iss = store.issuer(); once and threads it through all three redirect call sites, including the two idempotent replays (existing-code and RedeemClaim::Existing).
• authorization_server_metadata (RFC 8414) now advertises authorization_response_iss_parameter_supported: true.
• Only success redirects carry iss; the OAuth error paths render pages or return JSON rather than redirecting to the client, so there is no error-redirect to stamp.
• Unit test build_redirect_encodes_code_state_and_iss covers ordering and encoding (with and without client state); the routers integration test asserts the new metadata flag.

Testing

• cargo build --locked --all-targets
• cargo test --locked --all-targets (165 tests: 151 lib + 6 main + 8 routers, all pass)
• cargo fmt --all / cargo clippy --all-targets (tree is warning-free) — repo tree has pre-existing rustfmt-version drift and clippy warnings in discover.rs; no CI fmt/clippy gate exists, and this change adds none
• npm test --prefix monitoring/mcp-status (if the dashboard changed) — dashboard unchanged

Checklist

• I have read the Contributing guidelines.
• Docs (README / comments) updated for any user-visible change.
• No secrets, credentials, or internal-only information are included.

🤖 Generated with Claude Code

https://claude.ai/code/session_014T9N8USDfNK5yzznPGg7Ym

---

Generated by Claude Code

[Copilot]

Pull request overview

Adds RFC 9207 issuer identification to OAuth authorization responses and advertises support through RFC 8414 metadata.

Changes:

• Appends encoded iss values to successful authorization redirects.
• Advertises issuer-parameter support in authorization-server metadata.
• Adds redirect encoding and metadata assertions.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/auth.rs	Emits iss, updates metadata, and tests redirect construction.
tests/routers.rs	Verifies the metadata support flag.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.