fix(oauth): use POST fallback when HEAD returns 405 for resource detection

MCP servers often only allow POST requests, returning 405 Method Not Allowed
for HEAD. This fix adds fallback logic to try POST with empty JSON body when
HEAD is rejected, enabling proper WWW-Authenticate header retrieval for
servers like AnySource/Runlayer.

Added test: TestCreateOAuthConfig_FallsBackToPostWhenHeadNotAllowed

Author: technicalpickles

internal/oauth/config.go

@@ -357,7 +357,7 @@ func CreateOAuthConfigWithExtraParams(serverConfig *config.ServerConfig, storage
 // autoDetectResource attempts to discover the RFC 8707 resource parameter.
 // Returns the detected resource URL, or server URL as fallback, or empty string on failure.
 func autoDetectResource(serverConfig *config.ServerConfig, logger *zap.Logger) string {
-	// Make a preflight HEAD request to get WWW-Authenticate header
+	// Try to get WWW-Authenticate header - first with HEAD, then POST if HEAD not allowed
 	resp, err := http.Head(serverConfig.URL)
 	if err != nil {
 		logger.Debug("Failed to make preflight request for resource detection",
@@ -366,6 +366,23 @@ func autoDetectResource(serverConfig *config.ServerConfig, logger *zap.Logger) s
 		// Fallback to server URL
 		return serverConfig.URL
 	}
+
+	// If HEAD returns 405 Method Not Allowed, try POST (MCP servers often only allow POST)
+	if resp.StatusCode == http.StatusMethodNotAllowed {
+		resp.Body.Close()
+		logger.Debug("HEAD not allowed, trying POST for resource detection",
+			zap.String("server", serverConfig.Name))
+
+		// Try POST with empty JSON body (minimal MCP request)
+		postResp, err := http.Post(serverConfig.URL, "application/json", strings.NewReader("{}"))
+		if err != nil {
+			logger.Debug("Failed to make POST preflight request for resource detection",
+				zap.String("server", serverConfig.Name),
+				zap.Error(err))
+			return serverConfig.URL
+		}
+		resp = postResp
+	}
 	defer resp.Body.Close()
 
 	// Check for 401 with WWW-Authenticate header containing resource_metadata

internal/oauth/config_test.go

@@ -499,3 +499,58 @@ func TestCreateOAuthConfig_FallsBackToServerURL(t *testing.T) {
 	assert.True(t, hasResource, "extraParams should contain 'resource' key (fallback)")
 	assert.Equal(t, mockMetadataServer.URL+"/mcp", resource, "Resource should fall back to server URL")
 }
+
+// Test CreateOAuthConfig auto-detects resource when HEAD returns 405 and POST is needed
+func TestCreateOAuthConfig_FallsBackToPostWhenHeadNotAllowed(t *testing.T) {
+	// Variable to hold server URL for use in handler
+	var serverURL string
+
+	// Create a mock server that returns 405 for HEAD but 401 with WWW-Authenticate for POST
+	mockMetadataServer := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == "/.well-known/oauth-protected-resource" {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+			w.Write([]byte(`{
+				"resource": "https://api.example.com/mcp/v1",
+				"authorization_servers": ["https://auth.example.com"],
+				"scopes_supported": ["mcp"]
+			}`))
+			return
+		}
+		// HEAD returns 405 Method Not Allowed (like MCP servers)
+		if r.Method == "HEAD" {
+			w.Header().Set("Allow", "POST")
+			w.WriteHeader(http.StatusMethodNotAllowed)
+			return
+		}
+		// POST returns 401 with WWW-Authenticate header
+		if r.Method == "POST" {
+			w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Bearer error="invalid_token", resource_metadata="%s/.well-known/oauth-protected-resource"`, serverURL))
+			w.WriteHeader(http.StatusUnauthorized)
+			return
+		}
+		w.WriteHeader(http.StatusNotFound)
+	}))
+	defer mockMetadataServer.Close()
+
+	// Assign server URL after server is created
+	serverURL = mockMetadataServer.URL
+
+	testStorage := setupTestStorage(t)
+	serverConfig := &config.ServerConfig{
+		Name: "test-post-fallback",
+		URL:  mockMetadataServer.URL + "/mcp",
+		// No OAuth config - should auto-detect via POST fallback
+	}
+
+	// Call CreateOAuthConfigWithExtraParams to get both config and extraParams
+	oauthConfig, extraParams := CreateOAuthConfigWithExtraParams(serverConfig, testStorage)
+
+	require.NotNil(t, oauthConfig, "OAuth config should be created")
+	require.NotNil(t, extraParams, "Extra params should be returned")
+
+	// Verify resource was auto-detected via POST fallback
+	resource, hasResource := extraParams["resource"]
+	assert.True(t, hasResource, "extraParams should contain 'resource' key")
+	assert.Equal(t, "https://api.example.com/mcp/v1", resource, "Resource should be auto-detected via POST fallback")
+}