Eliminate duplicate code in server HTTP endpoint registration

[Claude]

The server package contained ~20 lines of duplicated code across routed.go and transport.go for auth middleware application and common HTTP endpoint registration.

Changes

• Extract registerCommonEndpoints() helper (handlers.go:87-104)
  Consolidates OAuth discovery, health check, and close endpoint registration for both routed and unified modes. Previously duplicated across both server creation functions.

• Standardize on applyAuthIfConfigured() helper
  Replaced inline auth conditionals in routed.go with existing helper from transport.go. Both modes now use identical auth application logic.

Before

// routed.go - inline duplication
finalHandler := shutdownHandler
if apiKey != "" {
    finalHandler = authMiddleware(apiKey, shutdownHandler.ServeHTTP)
}

// Separate endpoint registration in both files
mux.Handle("/.well-known/oauth-authorization-server", withResponseLogging(handleOAuthDiscovery()))
mux.Handle("/health", withResponseLogging(HandleHealth(unifiedServer)))
// ... repeated in transport.go

After

// Both routed.go and transport.go
registerCommonEndpoints(mux, unifiedServer, apiKey)
finalHandler := applyAuthIfConfigured(apiKey, shutdownHandler.ServeHTTP)

Changes to shared endpoint behavior now only require updates in one location.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• example.com
  • Triggering command: /tmp/go-build1821963260/b275/launcher.test /tmp/go-build1821963260/b275/launcher.test -test.testlogfile=/tmp/go-build1821963260/b275/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true v0.12.18/builtin.go v0.12.18/code.go 64/pkg/tool/linux_amd64/compile go1.25.6 -c=4 -nolocalimports 64/pkg/tool/linux_amd64/compile -I g_.a -I cal/bin/as --gdwarf-5 ernal/sys -o ortcfg (dns block)
• invalid-host-that-does-not-exist-12345.com
  • Triggering command: /tmp/go-build1821963260/b260/config.test /tmp/go-build1821963260/b260/config.test -test.testlogfile=/tmp/go-build1821963260/b260/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true 64/src/net x5Bl6W7wQ 64/pkg/tool/linux_amd64/vet -p internal/fmtsortrev-parse -lang=go1.25 64/pkg/tool/linuHEAD ortc�� se httptrace/trace.go 64/pkg/tool/linux_amd64/vet -o /dev/null /tmp/cc13LNSQ.s 64/pkg/tool/linux_amd64/vet (dns block)
• nonexistent.local
  • Triggering command: /tmp/go-build1821963260/b275/launcher.test /tmp/go-build1821963260/b275/launcher.test -test.testlogfile=/tmp/go-build1821963260/b275/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true v0.12.18/builtin.go v0.12.18/code.go 64/pkg/tool/linux_amd64/compile go1.25.6 -c=4 -nolocalimports 64/pkg/tool/linux_amd64/compile -I g_.a -I cal/bin/as --gdwarf-5 ernal/sys -o ortcfg (dns block)
• slow.example.com
  • Triggering command: /tmp/go-build1821963260/b275/launcher.test /tmp/go-build1821963260/b275/launcher.test -test.testlogfile=/tmp/go-build1821963260/b275/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true v0.12.18/builtin.go v0.12.18/code.go 64/pkg/tool/linux_amd64/compile go1.25.6 -c=4 -nolocalimports 64/pkg/tool/linux_amd64/compile -I g_.a -I cal/bin/as --gdwarf-5 ernal/sys -o ortcfg (dns block)
• this-host-does-not-exist-12345.com
  • Triggering command: /tmp/go-build1821963260/b284/mcp.test /tmp/go-build1821963260/b284/mcp.test -test.testlogfile=/tmp/go-build1821963260/b284/testlog.txt -test.paniconexit0 -test.timeout=10m0s -test.v=true eutil.test 3538032/b048/vet.cfg ortcfg.link --gdwarf-5 --64 -o L8U9Qyx1I3DkwMKxtw/MSkguOXFE0oGgHEAD -uns�� submodules | head -n 10 /tmp/go-build3313538032/b012/vet.cfg g_.a show-toplevel --global (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[duplicate-code] Duplicate Code Analysis Report</issue_title>
<issue_description>## Summary

Analysis of internal/server/ Go files found 2 significant duplication patterns in the HTTP server creation code. Both affect routed.go and transport.go.

Detected Patterns

This analysis found 2 significant duplication patterns:

1. applyAuthIfConfigured helper not used in routed.go - Severity: Medium - See sub-issue [duplicate-code] Duplicate Code Pattern: applyAuthIfConfigured helper not reused in routed.go #1160
2. Common HTTP mux route registration duplicated - Severity: Medium - See sub-issue [duplicate-code] Duplicate Code Pattern: Common HTTP mux setup duplicated between routed.go and transport.go #1159

Overall Impact

• Total Duplicated Lines: ~20 lines of duplicated logic
• Affected Files: 2 files (internal/server/routed.go, internal/server/transport.go)
• Maintainability Risk: Medium — changes to auth or shared endpoint behavior require updates in two places
• Refactoring Priority: Low-Medium — straightforward consolidation with minimal risk

Next Steps

1. Review individual pattern sub-issues for detailed analysis
2. Prioritize refactoring based on severity and impact
3. Create implementation plan for highest priority patterns

Analysis Metadata

• Analyzed Files: 3 Go files (routed.go, transport.go, unified.go)
• Detection Method: Pattern search and semantic analysis
• Commit: 4cd522d
• Analysis Date: 2026-02-20</issue_description>

Comments on the Issue (you are @claude[agent] in this section)

• Fixes [duplicate-code] Duplicate Code Analysis Report #1158

[Copilot]

Pull request overview

This PR refactors internal/server HTTP server setup to remove duplicated endpoint registration and authentication-wrapping logic, keeping routed and unified (streamable HTTP) modes consistent and easier to maintain.

Changes:

• Centralized OAuth discovery, /health, and /close registration into a new registerCommonEndpoints() helper.
• Standardized conditional auth wrapping in routed mode by using the existing applyAuthIfConfigured() helper.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
internal/server/transport.go	Replaces inlined common endpoint registrations with registerCommonEndpoints() in unified mode.
internal/server/routed.go	Uses registerCommonEndpoints() and switches to applyAuthIfConfigured() for per-route auth wrapping.
internal/server/handlers.go	Adds registerCommonEndpoints() implementation to register OAuth discovery, health, and close endpoints consistently.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.