fix(oauth): parse spaced resource_metadata params

[Gujiassh]

Summary

This PR now keeps the OAuth protected-resource metadata change focused on one remaining regression test after the upstream OAuth discovery code was refreshed.

It adds coverage for a WWW-Authenticate parameter with optional whitespace around =:

Bearer resource_metadata = "https://example.com/prm"

The current extractResourceMetadataURLs implementation already handles the broader parser behavior on main; this PR just locks in that spaced-parameter case so it does not regress.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Validation

Ran locally:

• go test ./client/transport -run 'TestExtractResourceMetadataURLs|TestOAuthHandler_HandleUnauthorizedResponse'
• go test ./client/transport

Checklist

• Code reviewed locally
• Tests updated for the changed behavior
• Scope kept focused to the OAuth protected-resource metadata seam

[mark-iii-labs-huly]

Connected to Huly®: MCP_G-424

[coderabbitai]

Walkthrough

This PR adds a single test case to TestExtractResourceMetadataURLs that validates the extractor correctly parses resource_metadata parameters with whitespace around the = sign in WWW-Authenticate headers.

Changes

OAuth Protected-Resource Metadata Discovery

Layer / File(s)	Summary
Test case for whitespace-tolerant resource_metadata parsing client/transport/oauth_test.go	Extends TestExtractResourceMetadataURLs table-driven test with a new case asserting that resource_metadata = "..." (with spaces around =) is correctly extracted and returns the parsed URL.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• mark3labs/mcp-go#730: Both PRs are updating the same WWW-Authenticate resource_metadata parsing behavior—specifically handling whitespace around the = sign in extractResourceMetadataURL test cases.
• mark3labs/mcp-go#792: The main PR's update to TestExtractResourceMetadataURLs (whitespace-tolerant parsing of resource_metadata in WWW-Authenticate) is tied to the same RFC 8707/protected-resource parsing path used by #792 to capture handler.resourceURL and include the resource parameter in subsequent OAuth requests.

Suggested labels

type: bug

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: adding support for parsing resource_metadata parameters with spacing around the equals sign in OAuth headers.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description check	✅ Passed	The pull request description follows the repository template with all required sections completed, including a clear summary, type of change (bug fix), validation steps, and a comprehensive checklist.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@client/transport/oauth_test.go`:
- Around line 990-1088: Merge the two tests
TestOAuthHandler_GetServerMetadata_UsesResourceMetadataHeader and
TestOAuthHandler_GetServerMetadata_UsesResourceMetadataHeaderWithWhitespace into
a single table-driven test: create tests := []struct{name string, headerValue
string}{...} with three cases (resource_metadata="url", resource_metadata =
"url", and "Bearer resource_metadata=\"url\""), set up the httptest.Server and
handler (NewOAuthHandler/OAuthConfig, SetBaseURL) once, and in the loop write
the headerValue into the WWW-Authenticate response based on each case, call
handler.GetServerMetadata, and assert the same flags and metadata for each
iteration; keep the existing variables protectedResourceRequested,
headerResourceMetadataRequested, authServerRequested and the same assertions
inside the loop so behavior is identical.

In `@client/transport/oauth.go`:
- Around line 528-538: The extractor misses a directive when the header begins
with the auth-scheme (e.g., "Bearer resource_metadata=...") because the code
splits params directly and ends up with a key like "Bearer resource_metadata";
update extractResourceMetadataURL to strip the auth-scheme prefix (e.g., detect
and TrimPrefix "Bearer" or remove the first token before parsing params) or
otherwise normalize the header before splitting so keys are just the param
names, then continue the existing key/value logic for "resource_metadata"; also
add a regression unit test that passes a header string exactly like `Bearer
resource_metadata="https://..."` to ensure the URL is returned.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro

Run ID: fa9f3f9b-593c-4230-96d5-a175153b51c7

📥 Commits

Reviewing files that changed from the base of the PR and between f901ca7 and 6c05322.

📒 Files selected for processing (2)

• client/transport/oauth.go
• client/transport/oauth_test.go