Fall back to well-known URL in client if 401 response is missing resource_metadata parameter

[halter73]

• Automatically infer resource URI by default in McpAuthenticationHandler
• Fix matching absolute resource URI in McpAuthenticationHandler if specified
• Add MockLoggerProvider to LoggedTest.cs

Fixes #773

Replaces #937 @sr-auto
Replaces #1041 @ptrstr

[Copilot]

Pull request overview

This pull request implements a fallback mechanism for OAuth resource metadata discovery when the 401 response doesn't include a resource_metadata parameter in the WWW-Authenticate header. The client now automatically constructs a well-known URL based on the requested resource URI, and the server handler automatically infers the resource URI from the request path when serving the default metadata endpoint.

Key changes:

• Made ProtectedResourceMetadata.Resource nullable to support automatic inference
• Client falls back to /.well-known/oauth-protected-resource/<resource-path> when WWW-Authenticate header is missing or doesn't include resource_metadata
• Server handler now automatically derives resource URI from request path suffix when using the default metadata endpoint pattern
• Centralized MockLoggerProvider in LoggedTest base class for improved test infrastructure

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/ModelContextProtocol.Core/Authentication/ProtectedResourceMetadata.cs	Made Resource property nullable to support automatic inference by handler
src/ModelContextProtocol.Core/Authentication/ClientOAuthProvider.cs	Added fallback logic to build metadata URI from resource URI when WWW-Authenticate header missing/incomplete; added logging for fallback scenarios
src/ModelContextProtocol.AspNetCore/Authentication/McpAuthenticationOptions.cs	Made ResourceMetadataUri nullable to support automatic default endpoint pattern
src/ModelContextProtocol.AspNetCore/Authentication/McpAuthenticationHandler.cs	Implemented automatic resource URI inference from request path; added path base support; improved endpoint matching logic with host/scheme validation
tests/Common/Utils/LoggedTest.cs	Added MockLoggerProvider property to base class for centralized test logging infrastructure
tests/Common/Utils/MockLoggerProvider.cs	Removed unnecessary primary constructor syntax
tests/ModelContextProtocol.Tests/ClientServerTestBase.cs	Registered MockLoggerProvider in DI container
tests/ModelContextProtocol.Tests/Configuration/McpServerBuilderExtensionsToolsTests.cs	Updated to use inherited MockLoggerProvider property; removed manual instantiation
tests/ModelContextProtocol.Tests/Configuration/McpServerBuilderExtensionsFilterTests.cs	Updated to use inherited MockLoggerProvider property; removed manual instantiation
tests/ModelContextProtocol.AspNetCore.Tests/Utils/KestrelInMemoryTest.cs	Registered MockLoggerProvider and set minimum log level to Debug
tests/ModelContextProtocol.AspNetCore.Tests/OAuth/OAuthTestBase.cs	Removed explicit Resource setting from metadata; added support for path and auth scheme parameters
tests/ModelContextProtocol.AspNetCore.Tests/OAuth/McpAuthenticationHandlerTests.cs	New comprehensive test suite for authentication handler covering relative/absolute URIs, path base, host/scheme validation, and resource inference
tests/ModelContextProtocol.AspNetCore.Tests/OAuth/AuthTests.cs	Added tests for authentication without resource_metadata in header, with path suffix support
tests/ModelContextProtocol.AspNetCore.Tests/MapMcpTests.cs	Updated to use inherited MockLoggerProvider; simplified test setup
tests/ModelContextProtocol.AspNetCore.Tests/AuthorizeAttributeTests.cs	Updated to use inherited MockLoggerProvider; removed manual clearing calls
tests/ModelContextProtocol.TestOAuthServer/Program.cs	Added /mcp path to ValidResources for test support
samples/ProtectedMcpServer/Program.cs	Removed explicit Resource setting, relying on automatic inference