AuthRoot.token() passes an absolute URL to client.post() — CampusRequest double-prefixes it, so every token() call 404s against real deployments

[nycomp]

Symptom (verified live 2026-10-02)

With the correct dev credentials, Campus.with_app_session() → auth.token(grant_type="client_credentials") fails with NotFoundError (HTTP 404) — even though the same request made directly with curl succeeds (200).

Cause

AuthRoot.token() (campus_python/auth/v1/init.py) builds an absolute URL and passes it to the JSON client:

base_url = self.base_url + self.url_prefix + "/oauth/token"   # e.g. https://campusauth-development.up.railway.app/auth/v1/oauth/token
resp = self.client.post(base_url, json=json_body)

But CampusRequest._build_url() always prepends the client's base_url (it expects a relative path, like every other resource method):

POST https://campusauth-development.up.railway.app/https://campusauth-development.up.railway.app/auth/v1/oauth/token  → 404

This predates #61 (the original self.base_url + self.url_prefix + "/token" had the same shape) and is the real root cause of the long-standing "with_app_session 404s" observation in campus-classroom#24. It went undetected because campus's Flask test transport (TestCampusRequest) routes absolute URLs leniently, so all in-repo tests pass.

Repro

import campus_python
c = campus_python.Campus(timeout=60)
c.auth.token(grant_type="client_credentials")   # NotFoundError; dumped URL above

Fix

Pass a relative path: token_path = self.url_prefix + "/oauth/token" — the same call shape as every other resource method (e.g. oauth.poll_for_token's "/oauth/token").