fix(transport): include app_root_path in enforced OAuth audience

mcpgateway/transports/streamablehttp_transport.py

@@ -909,7 +909,15 @@ def _build_server_resource_url(scope: Scope, server_id: str) -> str:
         return ""
     if not raw:
         return ""
-    return f"{raw}/servers/{server_id}/mcp"
+    # Include app_root_path so the enforced audience matches the advertised
+    # Protected Resource Metadata URL on path-prefixed deployments (e.g. when
+    # the gateway is mounted under /gw behind a reverse proxy). Without this,
+    # the enforced aud is {app_domain}/servers/{id}/mcp while the advertised
+    # resource is {scheme}://{host}{root_path}/servers/{id}/mcp — see #5172.
+    root_path = str(getattr(settings, "app_root_path", "") or "").strip().rstrip("/")
+    if root_path and not root_path.startswith("/"):
+        root_path = "/" + root_path
+    return f"{raw}{root_path}/servers/{server_id}/mcp"
 
 
 def _build_resource_metadata_url(scope: Scope, server_id: str) -> str:

tests/unit/mcpgateway/transports/test_streamablehttp_transport.py

@@ -17321,3 +17321,35 @@ async def dummy_db():
     await list_tools()
 
     assert called["args"] == (None, None)
+
+
+def test_build_server_resource_url_includes_app_root_path(monkeypatch):
+    """#5172: enforced audience includes app_root_path on path-prefixed deployments."""
+    from mcpgateway.transports.streamablehttp_transport import _build_server_resource_url
+
+    monkeypatch.setattr(
+        "mcpgateway.transports.streamablehttp_transport.settings.app_domain",
+        "https://gateway.example.com",
+    )
+    monkeypatch.setattr(
+        "mcpgateway.transports.streamablehttp_transport.settings.app_root_path",
+        "/gw",
+    )
+    url = _build_server_resource_url(scope={}, server_id="srv-1")
+    assert url == "https://gateway.example.com/gw/servers/srv-1/mcp"
+
+
+def test_build_server_resource_url_no_root_path_unchanged(monkeypatch):
+    """Without app_root_path the resource URL is unchanged (backward compatible)."""
+    from mcpgateway.transports.streamablehttp_transport import _build_server_resource_url
+
+    monkeypatch.setattr(
+        "mcpgateway.transports.streamablehttp_transport.settings.app_domain",
+        "https://gateway.example.com",
+    )
+    monkeypatch.setattr(
+        "mcpgateway.transports.streamablehttp_transport.settings.app_root_path",
+        "",
+    )
+    url = _build_server_resource_url(scope={}, server_id="srv-1")
+    assert url == "https://gateway.example.com/servers/srv-1/mcp"