[rudycelekli]

Bug

ExtractResourceMetadataURL (internal/oauth/discovery.go) finds the PRM URL by splitting the header on the literal resource_metadata=". RFC 7235 section 2.1 allows a case-insensitive parameter name and whitespace around =, so a valid challenge can be missed and discovery falls back to a constructed URL. A plain substring split also misreads other parameters:

• x_resource_metadata="…" is taken as resource_metadata.
• An escaped mention inside another parameter's quoted value, such as error_description, is taken as the real one.

Trigger

All of these headers return "" or the wrong URL today:

• Bearer Resource_Metadata="https://…/oauth-protected-resource"
• Bearer error="invalid_token", resource_metadata = "https://…"
• Bearer x_resource_metadata="https://wrong", resource_metadata="https://…"

Fix

The function now runs a small auth-param scanner:

• parameter names are case-insensitive tokens;
• whitespace is allowed around =;
• quoted strings are unescaped;
• other parameters' quoted values are skipped, not searched.

Token-form (unquoted) values are still rejected, matching the existing "missing opening quote" case.

Verification

• go test -count=1 -run TestExtractResourceMetadataURL ./internal/oauth/ passes. That covers the new cases and the existing TestExtractResourceMetadataURL table.
• With discovery.go reverted (git stash push internal/oauth/discovery.go), the new test fails on 4 of its 5 subtests: case-insensitive name, whitespace around =, similar-suffix parameter, and lookalike-only.
• gofmt -l is clean on both files.
• I haven't run the full go test -count=1 ./internal/oauth/ locally. Work stopped because free disk fell below 1 GB.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 93.02326% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/oauth/discovery.go	93.02%	2 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[Dumbris]

Verified: the PR test fails on main for the reason described and passes on this branch merged with main; race tests for the touched packages and CI lint (bare and server tags) are clean. Also built and tested together with the rest of this batch, independently reviewed, and cross-reviewed with a second model.

[Dumbris]

Merged. Thank you, @rudycelekli! resource_metadata is parsed per RFC 7235 auth-param rules, case-insensitive and robust to look-alike params.