fix: preserve query component of discovered token endpoint

exchange_token_for_api_key() posted to only the path of the discovered
token_endpoint, dropping any params/query. If a server advertises a token
endpoint with a query component, the exchange would hit the wrong URL.
Reconstruct the full request target (path, params, query) via urlunparse.

Found by roborev review (job 65).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: nealrichardson

rsconnect/oauth.py

@@ -15,7 +15,7 @@
 import webbrowser
 from http.server import BaseHTTPRequestHandler, HTTPServer as _HTTPServer
 from typing import Any, Dict, Optional, Tuple, cast
-from urllib.parse import parse_qs, urlencode, urlparse
+from urllib.parse import parse_qs, urlencode, urlparse, urlunparse
 
 import click
 
@@ -489,7 +489,9 @@ def exchange_token_for_api_key(
     token_endpoint = str(metadata["token_endpoint"])
     parsed = urlparse(token_endpoint)
     base = f"{parsed.scheme}://{parsed.netloc}"
-    path = parsed.path
+    # Preserve the full request target (path, params, and query) from the
+    # discovered endpoint, not just the path.
+    request_target = urlunparse(("", "", parsed.path, parsed.params, parsed.query, ""))
 
     body = urlencode(
         {
@@ -504,7 +506,7 @@ def exchange_token_for_api_key(
     with server:
         response = server.request(
             "POST",
-            path,
+            request_target,
             body=body,
             headers={"Content-Type": "application/x-www-form-urlencoded"},
         )

tests/test_oauth.py

@@ -143,6 +143,15 @@ def test_uses_discovered_token_endpoint_with_prefix(self, mock_http_server: Magi
         assert result == "minted-key"
         assert mock_http_server.request.call_args.args[1] == "/connect/oauth/v1/token"
 
+    def test_preserves_token_endpoint_query(self, mock_http_server: MagicMock):
+        # A discovered token endpoint with a query component must be posted to verbatim.
+        metadata = {**FAKE_METADATA, "token_endpoint": "https://host.example.com/connect/oauth/v1/token?tenant=acme"}
+        self._set_metadata(mock_http_server, metadata)
+        mock_http_server.request.return_value = _make_response(200, {"access_token": "minted-key"})
+        result = exchange_token_for_api_key("https://host.example.com/connect", "oidc-token")
+        assert result == "minted-key"
+        assert mock_http_server.request.call_args.args[1] == "/connect/oauth/v1/token?tenant=acme"
+
     def test_grant_type_not_supported(self, mock_http_server: MagicMock):
         # Preflight: the server advertises grants but not token exchange.
         metadata = {**FAKE_METADATA, "grant_types_supported": ["authorization_code", "refresh_token"]}