test(http): cover authorization server override wiring

Verify the HTTP-only configuration surface, unchanged host-derived default, and explicit override propagation through OAuth metadata.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

cmd/github-mcp-server/main_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/github/github-mcp-server/pkg/inventory"
 	"github.com/google/jsonschema-go/jsonschema"
 	"github.com/modelcontextprotocol/go-sdk/mcp"
+	"github.com/spf13/viper"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -41,6 +42,20 @@ func TestGitHubAppFlagsAreStdioOnly(t *testing.T) {
 	assert.Nil(t, httpCmd.Flags().Lookup("app-id"))
 }
 
+func TestAuthorizationServerConfigurationIsHTTPOnly(t *testing.T) {
+	flag := httpCmd.Flags().Lookup("authorization-server")
+	require.NotNil(t, flag)
+	assert.Empty(t, flag.DefValue)
+	assert.Nil(t, stdioCmd.Flags().Lookup("authorization-server"))
+
+	t.Setenv("GITHUB_AUTHORIZATION_SERVER", "")
+	initConfig()
+	assert.Empty(t, viper.GetString("authorization-server"))
+
+	t.Setenv("GITHUB_AUTHORIZATION_SERVER", "https://oauth-proxy.example.com")
+	assert.Equal(t, "https://oauth-proxy.example.com", viper.GetString("authorization-server"))
+}
+
 func TestWriteToolDocScopeSemantics(t *testing.T) {
 	tests := []struct {
 		name string

docs/streamable-http.md

@@ -117,6 +117,8 @@ The `authorization_servers` field in the protected resource metadata will then p
 
 Equivalent environment variable: `GITHUB_AUTHORIZATION_SERVER=https://mcp.example.com/oauth-proxy`.
 
+When neither the flag nor environment variable is set, the server preserves the existing behavior and derives the authorization server from `--gh-host`. The override only changes the URL advertised in OAuth protected resource metadata; it does not change token validation or the GitHub API host.
+
 ## Client Configuration
 
 ### Using OAuth Authentication

pkg/http/oauth/oauth_test.go

@@ -1,10 +1,12 @@
 package oauth
 
 import (
+	"context"
 	"crypto/tls"
 	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"net/url"
 	"testing"
 
 	"github.com/github/github-mcp-server/pkg/http/headers"
@@ -18,6 +20,16 @@ var (
 	defaultAuthorizationServer = "https://github.com/login/oauth"
 )
 
+type countingAPIHostResolver struct {
+	utils.APIHostResolver
+	authorizationServerURLCalls int
+}
+
+func (r *countingAPIHostResolver) AuthorizationServerURL(ctx context.Context) (*url.URL, error) {
+	r.authorizationServerURLCalls++
+	return r.APIHostResolver.AuthorizationServerURL(ctx)
+}
+
 func TestNewAuthHandler(t *testing.T) {
 	t.Parallel()
 
@@ -729,14 +741,15 @@ func TestAPIHostResolver_AuthorizationServerURL(t *testing.T) {
 				return
 			}
 			require.NoError(t, err)
+			countingAPIHost := &countingAPIHostResolver{APIHostResolver: apiHost}
 
 			config := tc.oauthConfig
 			if config == nil {
 				config = &Config{}
 			}
 			config.BaseURL = tc.host
 
-			handler, err := NewAuthHandler(config, apiHost)
+			handler, err := NewAuthHandler(config, countingAPIHost)
 			require.NoError(t, err)
 
 			router := chi.NewRouter()
@@ -767,6 +780,11 @@ func TestAPIHostResolver_AuthorizationServerURL(t *testing.T) {
 			require.True(t, ok)
 			require.Len(t, responseAuthServers, 1)
 			assert.Equal(t, tc.expectedURL, responseAuthServers[0])
+			if config.AuthorizationServer == "" {
+				assert.Equal(t, 1, countingAPIHost.authorizationServerURLCalls)
+			} else {
+				assert.Zero(t, countingAPIHost.authorizationServerURLCalls)
+			}
 		})
 	}
 }

pkg/http/server.go

@@ -197,12 +197,7 @@ func RunHTTPServer(cfg ServerConfig) error {
 	}
 
 	// Register OAuth protected resource metadata endpoints
-	oauthCfg := &oauth.Config{
-		BaseURL:             cfg.BaseURL,
-		ResourcePath:        cfg.ResourcePath,
-		TrustProxyHeaders:   cfg.TrustProxyHeaders,
-		AuthorizationServer: cfg.AuthorizationServer,
-	}
+	oauthCfg := newOAuthConfig(cfg)
 
 	serverOptions := []HandlerOption{
 		WithInventoryFactory(inventoryFactory),
@@ -264,6 +259,15 @@ func RunHTTPServer(cfg ServerConfig) error {
 	return nil
 }
 
+func newOAuthConfig(cfg ServerConfig) *oauth.Config {
+	return &oauth.Config{
+		BaseURL:             cfg.BaseURL,
+		ResourcePath:        cfg.ResourcePath,
+		TrustProxyHeaders:   cfg.TrustProxyHeaders,
+		AuthorizationServer: cfg.AuthorizationServer,
+	}
+}
+
 // resolveListenAddress returns the address string passed to http.Server.
 // When host is empty the server binds to all interfaces on the given port;
 // otherwise host and port are joined into a single address.

pkg/http/server_test.go

@@ -9,6 +9,7 @@ import (
 
 	ghcontext "github.com/github/github-mcp-server/pkg/context"
 	"github.com/github/github-mcp-server/pkg/github"
+	"github.com/github/github-mcp-server/pkg/http/oauth"
 	"github.com/github/github-mcp-server/pkg/inventory"
 	"github.com/github/github-mcp-server/pkg/utils"
 	"github.com/stretchr/testify/assert"
@@ -44,6 +45,39 @@ func TestRunHTTPServerRejectsInvalidStaticTools(t *testing.T) {
 	}
 }
 
+func TestNewOAuthConfig(t *testing.T) {
+	tests := []struct {
+		name                string
+		authorizationServer string
+	}{
+		{
+			name: "unset preserves host-derived authorization server",
+		},
+		{
+			name:                "explicit override is propagated",
+			authorizationServer: "https://oauth-proxy.example.com",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := newOAuthConfig(ServerConfig{
+				BaseURL:             "https://mcp.example.com",
+				ResourcePath:        "/mcp",
+				TrustProxyHeaders:   true,
+				AuthorizationServer: tt.authorizationServer,
+			})
+
+			assert.Equal(t, &oauth.Config{
+				BaseURL:             "https://mcp.example.com",
+				ResourcePath:        "/mcp",
+				TrustProxyHeaders:   true,
+				AuthorizationServer: tt.authorizationServer,
+			}, cfg)
+		})
+	}
+}
+
 func TestInitGlobalToolScopeMapUsesHost(t *testing.T) {
 	tests := []struct {
 		name     string