stacklok / toolhive / 18522127868

push

github

Correctly construct resource_metadata per RFC 9728 Section 3.1 (#2203)

The resource_metadata parameter in WWW-Authenticate header must
contain the full URL to the metadata endpoint, formed by inserting
/.well-known/oauth-protected-resource between the host and path.

Examples:
- Resource: http://localhost:8080
Metadata: http://localhost:8080/.well-known/oauth-protected-resource

- Resource: http://localhost:9090/mcp
Metadata: http://localhost:9090/.well-known/oauth-protected-resource/mcp

This enables clients to discover OAuth metadata for the protected resource.

Fixes #2202

12 of 12 new or added lines in 1 file covered. (100.0%)

17703 of 37804 relevant lines covered (46.83%)

15.98 hits per line