fix(http): terminate unknown resource metadata routes

Prevent unrecognized protected-resource metadata paths from falling through to the MCP root mount and producing recursive authentication challenges.\n\nRefs #3095\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

pkg/http/oauth/oauth.go

@@ -100,6 +100,7 @@ func (h *AuthHandler) RegisterRoutes(r chi.Router) {
 			r.Handle(path, h.metadataHandler())
 		}
 	}
+	r.Handle(OAuthProtectedResourcePrefix+"/*", http.NotFoundHandler())
 }
 
 func (h *AuthHandler) metadataHandler() http.Handler {

pkg/http/oauth/oauth_test.go

@@ -573,6 +573,11 @@ func TestRegisterRoutes(t *testing.T) {
 			}
 		}
 	}
+
+	req := httptest.NewRequest(http.MethodGet, OAuthProtectedResourcePrefix+"/mcp/unknown", nil)
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	assert.Equal(t, http.StatusNotFound, rec.Code)
 }
 
 func TestSupportedScopes(t *testing.T) {

pkg/http/server_test.go

@@ -258,6 +258,18 @@ func TestOAuthChallengeMetadataRouteContracts(t *testing.T) {
 			assert.Equal(t, baseURL+expectedResourcePath, metadata["resource"])
 		})
 	}
+
+	req := httptest.NewRequest(
+		http.MethodGet,
+		oauth.OAuthProtectedResourcePrefix+"/mcp/unknown",
+		nil,
+	)
+	req.Header.Set("Origin", "https://confer.to")
+	rec := httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	assert.Equal(t, http.StatusNotFound, rec.Code)
+	assert.Equal(t, "*", rec.Header().Get("Access-Control-Allow-Origin"))
+	assert.Empty(t, rec.Header().Get("WWW-Authenticate"))
 }
 
 func TestInitGlobalToolScopeMapUsesHost(t *testing.T) {