Allow subpaths in MAS endpoints

changelog.d/19186.bugfix

@@ -0,0 +1 @@
+Fix regression preventing subpaths in MAS endpoints.

synapse/api/auth/mas.py

@@ -154,7 +154,8 @@ def _metadata_url(self) -> str:
                 password=self._config.endpoint.password,
                 host=self._config.endpoint.host or "",
                 port=self._config.endpoint.port,
-                path=".well-known/openid-configuration",
+                path=(self._config.endpoint.path or "").strip("/")
+                + "/.well-known/openid-configuration",
                 query=None,
                 fragment=None,
             )
@@ -169,7 +170,8 @@ def _introspection_endpoint(self) -> str:
                 password=self._config.endpoint.password,
                 host=self._config.endpoint.host or "",
                 port=self._config.endpoint.port,
-                path="oauth2/introspect",
+                path=(self._config.endpoint.path or "").strip("/")
+                + "/oauth2/introspect",
                 query=None,
                 fragment=None,
             )

tests/handlers/test_oauth_delegation.py

@@ -1057,6 +1057,32 @@ def test_cached_expired_introspection(self) -> None:
         self.assertEqual(self.server.calls, 1)
 
 
+class MasAuthDelegationWithSubpath(MasAuthDelegation):
+    """Test MAS delegation when the MAS server is hosted on a subpath."""
+
+    def default_config(self) -> dict[str, Any]:
+        config = super().default_config()
+        # Override the endpoint to include a subpath
+        config["matrix_authentication_service"]["endpoint"] = (
+            self.server.endpoint + "auth/path/"
+        )
+        return config
+
+    def test_introspection_endpoint_uses_subpath(self) -> None:
+        """Test that the introspection endpoint correctly uses the configured subpath."""
+        expected_introspection_url = (
+            self.server.endpoint + "auth/path/oauth2/introspect"
+        )
+        self.assertEqual(self._auth._introspection_endpoint, expected_introspection_url)
+
+    def test_metadata_url_uses_subpath(self) -> None:
+        """Test that the metadata URL correctly uses the configured subpath."""
+        expected_metadata_url = (
+            self.server.endpoint + "auth/path/.well-known/openid-configuration"
+        )
+        self.assertEqual(self._auth._metadata_url, expected_metadata_url)
+
+
 @parameterized_class(
     ("config",),
     [