test: verify eager refresh is skipped when oauth_metadata is None

Regression test for #3240. When oauth_metadata is None (metadata not yet
discovered), the eager refresh at the top of async_auth_flow must be skipped
to avoid hitting the wrong token endpoint (urljoin strips non-root paths).

The test sets up expired tokens + refresh_token but no oauth_metadata, then
verifies the first yield is the original request (not a refresh request) and
the tokens are preserved for the 401→discovery→refresh path.

Author: zsxh1990

tests/client/test_auth.py

@@ -1290,6 +1290,53 @@ async def test_token_exchange_accepts_201_status(
             request=discovery_request,
         )
 
+
+    @pytest.mark.anyio
+    async def test_auth_flow_skips_eager_refresh_when_metadata_missing(
+        self, oauth_provider: OAuthClientProvider, mock_storage: MockTokenStorage
+    ):
+        """When oauth_metadata is None the eager refresh must be skipped.
+
+        Without metadata the token endpoint is unknown; the fallback
+        urljoin(base_url, '/token') strips the path when the AS lives under a
+        non-root path (e.g. /oauth2/api/v1/token).  The fix guards the eager
+        refresh on ``oauth_metadata is not None`` so the stale-token request
+        proceeds, gets a 401, and runs full metadata discovery instead.
+        """
+        # Set up expired tokens with a refresh token but NO oauth_metadata.
+        expired_tokens = OAuthToken(
+            access_token="expired_access_token",
+            token_type="Bearer",
+            expires_in=0,
+            refresh_token="test_refresh_token",
+            scope="read write",
+        )
+        await mock_storage.set_tokens(expired_tokens)
+        oauth_provider.context.current_tokens = expired_tokens
+        oauth_provider.context.token_expiry_time = time.time() - 100  # Expired
+        oauth_provider._initialized = True
+        oauth_provider.context.client_info = OAuthClientInformationFull(
+            client_id="test_client",
+            redirect_uris=[AnyUrl("http://localhost:3030/callback")],
+        )
+        # oauth_metadata is None (default) — this is the key condition.
+
+        test_request = httpx2.Request("GET", "https://api.example.com/v1/mcp")
+        auth_flow = oauth_provider.async_auth_flow(test_request)
+
+        # The first yield should be the original request WITHOUT an auth header,
+        # NOT a refresh request to the wrong endpoint.
+        request = await auth_flow.__anext__()
+        assert "Authorization" not in request.headers
+        assert str(request.url) == "https://api.example.com/v1/mcp"
+        assert request.method == "GET"
+
+        # The token was not consumed by a failed refresh.
+        assert oauth_provider.context.current_tokens is not None
+        assert oauth_provider.context.current_tokens.refresh_token == "test_refresh_token"
+
+        # Close the generator to avoid warnings.
+        await auth_flow.aclose()
         # Next request should be to discover OAuth metadata
         oauth_metadata_request = await auth_flow.asend(discovery_response)
         assert oauth_metadata_request.method == "GET"