fix(oauth): use POST for resource auto-detection per MCP spec

MCP spec only requires POST support for the main endpoint. Use POST
directly for the preflight request to get WWW-Authenticate header
with resource_metadata URL.

Updated all tests to use POST method in mock handlers.

Author: technicalpickles

internal/oauth/config.go

@@ -357,8 +357,8 @@ func CreateOAuthConfigWithExtraParams(serverConfig *config.ServerConfig, storage
 // autoDetectResource attempts to discover the RFC 8707 resource parameter.
 // Returns the detected resource URL, or server URL as fallback, or empty string on failure.
 func autoDetectResource(serverConfig *config.ServerConfig, logger *zap.Logger) string {
-	// Make a preflight HEAD request to get WWW-Authenticate header
-	resp, err := http.Head(serverConfig.URL)
+	// POST is the only method guaranteed by MCP spec for the main endpoint
+	resp, err := http.Post(serverConfig.URL, "application/json", strings.NewReader("{}"))
 	if err != nil {
 		logger.Debug("Failed to make preflight request for resource detection",
 			zap.String("server", serverConfig.Name),

internal/oauth/config_test.go

@@ -310,7 +310,7 @@ func TestCreateOAuthConfig_AutoDetectsResource(t *testing.T) {
 			return
 		}
 		// Return 401 with resource_metadata link in WWW-Authenticate header
-		if r.Method == "HEAD" {
+		if r.Method == "POST" {
 			w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Bearer error="invalid_request", resource_metadata="%s/.well-known/oauth-protected-resource"`, serverURL))
 			w.WriteHeader(http.StatusUnauthorized)
 			return
@@ -359,7 +359,7 @@ func TestCreateOAuthConfig_ManualOverride(t *testing.T) {
 			return
 		}
 		// Return 401 with resource_metadata link in WWW-Authenticate header
-		if r.Method == "HEAD" {
+		if r.Method == "POST" {
 			w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Bearer error="invalid_request", resource_metadata="%s/.well-known/oauth-protected-resource"`, serverURL))
 			w.WriteHeader(http.StatusUnauthorized)
 			return
@@ -411,7 +411,7 @@ func TestCreateOAuthConfig_MergesExtraParams(t *testing.T) {
 			}`))
 			return
 		}
-		if r.Method == "HEAD" {
+		if r.Method == "POST" {
 			w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Bearer error="invalid_request", resource_metadata="%s/.well-known/oauth-protected-resource"`, serverURL))
 			w.WriteHeader(http.StatusUnauthorized)
 			return
@@ -469,7 +469,7 @@ func TestCreateOAuthConfig_FallsBackToServerURL(t *testing.T) {
 			return
 		}
 		// Return 401 with resource_metadata link in WWW-Authenticate header
-		if r.Method == "HEAD" {
+		if r.Method == "POST" {
 			w.Header().Set("WWW-Authenticate", fmt.Sprintf(`Bearer error="invalid_request", resource_metadata="%s/.well-known/oauth-protected-resource"`, serverURL))
 			w.WriteHeader(http.StatusUnauthorized)
 			return