Fallback to .well-known/oauth-protected-resource on 401s without WWW-Authenticate

[TylerLeonhardt]

Fixes #268210

[Copilot]

Pull Request Overview

This PR refactors OAuth protected resource metadata fetching logic by extracting it from the MCP HTTP client into a reusable function in the OAuth base module. The change encapsulates the resource metadata retrieval logic in preparation for increased complexity.

Key Changes

• Created a new fetchResourceMetadata function in the OAuth base module with proper validation and origin-based header handling
• Replaced the private _getResourceMetadata method in McpHTTPHandle with a call to the new centralized function
• Added comprehensive test coverage for the new function including edge cases and error scenarios

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
src/vs/base/common/oauth.ts	Added fetchResourceMetadata function with origin detection, validation, and error handling
src/vs/workbench/api/common/extHostMcp.ts	Replaced private method with call to new centralized function and removed duplicate logic
src/vs/base/test/common/oauth.test.ts	Added comprehensive test suite covering success cases, error handling, and edge cases

[Copilot]

The fallback logic assumes that response might have a statusText property, but the CommonResponse interface doesn't include this property. Consider using a more specific fallback or updating the interface to include statusText if it's expected to be available.

Suggested change

	errorText = 'statusText' in response ? response.statusText : 'Unknown error';
	errorText = 'Unknown error';