Fix metadata endpoint 500 with custom controllers outside the doorkeeper namespace

[55728]

Summary

The RFC 8414 metadata endpoint added in #1838 raises ActionController::UrlGenerationError (HTTP 500) for any application that customizes a controller through use_doorkeeper with a name whose namespace depth differs from doorkeeper/metadata:

Rails.application.routes.draw do
  use_doorkeeper do
    controllers tokens: "custom_tokens"
  end
end
GET /.well-known/oauth-authorization-server
=> ActionController::UrlGenerationError:
   No route matches {action: "create", controller: "doorkeeper/custom_tokens"}

Root cause

MetadataResponse#endpoint_for passes the routes mapping's controller name to url_for unanchored. Rails' URL generation (use_relative_controller!, present since Rails 3) resolves an unanchored controller relative to the current controller's namespace whenever the target has fewer path segments. Since the document is served from doorkeeper/metadata (2 segments), a top-level custom controller like custom_tokens (1 segment) is rewritten to doorkeeper/custom_tokens, which has no route. The inverse also holds: a metadata controller nested deeper than the defaults (e.g. metadata: "admin/oauth/metadata") breaks URL generation for every other endpoint.

The existing specs never hit this because custom_controller_routes_spec.rb gives all controllers (including metadata) names of the same depth, and only asserts route recognition — the metadata response body is never rendered there.

Fix

Prefix the controller name with a slash. The leading slash disables Rails' relative controller resolution and is stripped back out during generation, so default configurations are unaffected:

url_for(controller: "/#{mapping[:controllers]}", action: action)

[Copilot]

Pull request overview

This pull request fixes a Rails URL generation edge case in Doorkeeper’s RFC 8414 Authorization Server Metadata response, where custom controller mappings whose namespace depth differs from doorkeeper/metadata could trigger ActionController::UrlGenerationError (500) when rendering the metadata document.

Changes:

• Anchor controller names passed to url_for in Doorkeeper::OAuth::MetadataResponse#endpoint_for by prefixing with a leading slash to avoid Rails’ relative controller resolution.
• Add a request spec regression test covering a custom tokens controller outside the doorkeeper/* namespace.
• Document the user-visible fix in CHANGELOG.md.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

File	Description
lib/doorkeeper/oauth/metadata_response.rb	Anchors controller names in url_for to prevent namespace-relative controller resolution from breaking metadata URL generation.
spec/requests/endpoints/metadata_spec.rb	Adds regression coverage for custom controller namespace-depth mismatch; redraws routes for the example.
CHANGELOG.md	Adds an entry describing the fix for metadata endpoint 500s with custom controllers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated no new comments.

[nbulaj]

👍 thanks!