refactor(server): standardize URL path handling with normalizeURLPath

Replace manual path manipulation with a dedicated normalizeURLPath function
that properly handles path joining while ensuring consistent formatting.
The function:

- Always starts paths with a leading slash
- Never ends paths with a trailing slash (except for root path "/")
- Uses path.Join internally for proper path normalization
- Handles edge cases like empty segments, double slashes, and parent references

This eliminates duplicated code and creates a more consistent approach to
URL path handling throughout the SSE server implementation. Comprehensive
tests were added to validate the function's behavior.

Author: rwjblue-glean

server/sse.go

@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"path"
 	"strings"
 	"sync"
 	"sync/atomic"
@@ -109,11 +110,7 @@ func WithBaseURL(baseURL string) SSEOption {
 // WithBasePath adds a new option for setting a static base path
 func WithBasePath(basePath string) SSEOption {
 	return func(s *SSEServer) {
-		// Ensure the path starts with / and doesn't end with /
-		if !strings.HasPrefix(basePath, "/") {
-			basePath = "/" + basePath
-		}
-		s.basePath = strings.TrimSuffix(basePath, "/")
+		s.basePath = normalizeURLPath(basePath)
 	}
 }
 
@@ -126,10 +123,7 @@ func WithDynamicBasePath(fn DynamicBasePathFunc) SSEOption {
 		if fn != nil {
 			s.dynamicBasePathFunc = func(r *http.Request, sid string) string {
 				bp := fn(r, sid)
-				if !strings.HasPrefix(bp, "/") {
-					bp = "/" + bp
-				}
-				return strings.TrimSuffix(bp, "/")
+				return normalizeURLPath(bp)
 			}
 		}
 	}
@@ -388,7 +382,7 @@ func (s *SSEServer) GetMessageEndpointForClient(r *http.Request, sessionID strin
 		basePath = s.dynamicBasePathFunc(r, sessionID)
 	}
 
-	endpointPath := basePath + s.messageEndpoint
+	endpointPath := normalizeURLPath(basePath, s.messageEndpoint)
 	if s.useFullURLForMessageEndpoint && s.baseURL != "" {
 		endpointPath = s.baseURL + endpointPath
 	}
@@ -515,17 +509,19 @@ func (s *SSEServer) CompleteSseEndpoint() (string, error) {
 	if s.dynamicBasePathFunc != nil {
 		return "", &ErrDynamicPathConfig{Method: "CompleteSseEndpoint"}
 	}
-	return s.baseURL + s.basePath + s.sseEndpoint, nil
+
+	path := normalizeURLPath(s.basePath, s.sseEndpoint)
+	return s.baseURL + path, nil
 }
 
 func (s *SSEServer) CompleteSsePath() string {
 	path, err := s.CompleteSseEndpoint()
 	if err != nil {
-		return s.basePath + s.sseEndpoint
+		return normalizeURLPath(s.basePath, s.sseEndpoint)
 	}
 	urlPath, err := s.GetUrlPath(path)
 	if err != nil {
-		return s.basePath + s.sseEndpoint
+		return normalizeURLPath(s.basePath, s.sseEndpoint)
 	}
 	return urlPath
 }
@@ -534,17 +530,18 @@ func (s *SSEServer) CompleteMessageEndpoint() (string, error) {
 	if s.dynamicBasePathFunc != nil {
 		return "", &ErrDynamicPathConfig{Method: "CompleteMessageEndpoint"}
 	}
-	return s.baseURL + s.basePath + s.messageEndpoint, nil
+	path := normalizeURLPath(s.basePath, s.messageEndpoint)
+	return s.baseURL + path, nil
 }
 
 func (s *SSEServer) CompleteMessagePath() string {
 	path, err := s.CompleteMessageEndpoint()
 	if err != nil {
-		return s.basePath + s.messageEndpoint
+		return normalizeURLPath(s.basePath, s.messageEndpoint)
 	}
 	urlPath, err := s.GetUrlPath(path)
 	if err != nil {
-		return s.basePath + s.messageEndpoint
+		return normalizeURLPath(s.basePath, s.messageEndpoint)
 	}
 	return urlPath
 }
@@ -628,3 +625,21 @@ func (s *SSEServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 
 	http.NotFound(w, r)
 }
+
+// normalizeURLPath joins path elements like path.Join but ensures the
+// result always starts with a leading slash and never ends with a slash
+func normalizeURLPath(elem ...string) string {
+	joined := path.Join(elem...)
+
+	// Ensure leading slash
+	if !strings.HasPrefix(joined, "/") {
+		joined = "/" + joined
+	}
+
+	// Remove trailing slash if not just "/"
+	if len(joined) > 1 && strings.HasSuffix(joined, "/") {
+		joined = joined[:len(joined)-1]
+	}
+
+	return joined
+}

server/sse_test.go

@@ -1031,6 +1031,104 @@ func TestSSEServer(t *testing.T) {
 		messagePath := sseServer.CompleteMessagePath()
 		require.Equal(t, sseServer.basePath+sseServer.messageEndpoint, messagePath)
 	})
+
+	t.Run("TestNormalizeURLPath", func(t *testing.T) {
+		tests := []struct {
+			name     string
+			inputs   []string
+			expected string
+		}{
+			// Basic path joining
+			{
+				name:     "empty inputs",
+				inputs:   []string{"", ""},
+				expected: "/",
+			},
+			{
+				name:     "single path segment",
+				inputs:   []string{"mcp"},
+				expected: "/mcp",
+			},
+			{
+				name:     "multiple path segments",
+				inputs:   []string{"mcp", "api", "message"},
+				expected: "/mcp/api/message",
+			},
+
+			// Leading slash handling
+			{
+				name:     "already has leading slash",
+				inputs:   []string{"/mcp", "message"},
+				expected: "/mcp/message",
+			},
+			{
+				name:     "mixed leading slashes",
+				inputs:   []string{"/mcp", "/message"},
+				expected: "/mcp/message",
+			},
+
+			// Trailing slash handling
+			{
+				name:     "with trailing slashes",
+				inputs:   []string{"mcp/", "message/"},
+				expected: "/mcp/message",
+			},
+			{
+				name:     "mixed trailing slashes",
+				inputs:   []string{"mcp", "message/"},
+				expected: "/mcp/message",
+			},
+			{
+				name:     "root path",
+				inputs:   []string{"/"},
+				expected: "/",
+			},
+
+			// Path normalization
+			{
+				name:     "normalize double slashes",
+				inputs:   []string{"mcp//api", "//message"},
+				expected: "/mcp/api/message",
+			},
+			{
+				name:     "normalize parent directory",
+				inputs:   []string{"mcp/parent/../child", "message"},
+				expected: "/mcp/child/message",
+			},
+			{
+				name:     "normalize current directory",
+				inputs:   []string{"mcp/./api", "./message"},
+				expected: "/mcp/api/message",
+			},
+
+			// Complex cases
+			{
+				name:     "complex mixed case",
+				inputs:   []string{"/mcp/", "/api//", "message/"},
+				expected: "/mcp/api/message",
+			},
+			{
+				name:     "absolute path in second segment",
+				inputs:   []string{"tenant", "/message"},
+				expected: "/tenant/message",
+			},
+			{
+				name:     "URL pattern with parameters",
+				inputs:   []string{"/mcp/{tenant}", "message"},
+				expected: "/mcp/{tenant}/message",
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				result := normalizeURLPath(tt.inputs...)
+				if result != tt.expected {
+					t.Errorf("normalizeURLPath(%q) = %q, want %q",
+						tt.inputs, result, tt.expected)
+				}
+			})
+		}
+	})
 }
 
 func readSeeEvent(sseResp *http.Response) (string, error) {