server: make the router method-aware, dropping in-handler method guards

[youdie006]

What

Implements #4907 as its own PR (per @nabokihms's note that this cross-cutting change is best done standalone): make router.Mux method-aware so per-handler r.Method guards can be dropped in favor of route-level matching and a uniform 405.

Changes

• server/router/router.go: Handle / HandleFunc / HandleCORS gained an optional variadic methods ...string. When methods are given the route only matches those; passing none leaves it open to all (so existing unrestricted mounts compile and behave unchanged). HandlePrefix is left as-is (subtree static mounts don't method-match).
• server/server.go: the routeMux adapter forwards the methods; the handle / handleFunc / handleWithCORS closures chain gorilla's route.Methods(...). A shared MethodNotAllowedHandler — wired to the existing ErrMsgMethodNotAllowed / renderError HTML page and wrapped in handlerWithHeaders so configured headers still apply — answers wrong-method requests with a uniform 405. handleWithCORS also allows OPTIONS through so CORS preflight still reaches the middleware.
• Mount call-sites now declare their method and drop the in-handler guard: /device (GET), /device/auth/verify_code (POST), /device/code (POST), /device/callback (GET), /token (POST), /token/introspect (POST).

Behavior

Correct-method requests are unchanged. Wrong-method requests now get a uniform 405 instead of each endpoint's former 400 (device/token previously returned 400 JSON) — the intended consolidation. When CORS isn't configured, an OPTIONS / GET to /token now yields 405 rather than 400.

Tests

Updated the three wrong-method tests to the new router-level 405 (TestHandleDeviceCode GET, TestDeviceCallbackMethodError PUT, and the introspection helper's dropped GET sub-case). go build ./..., go vet ./server/..., go test ./server/..., and gofmt all pass; I also caught and fixed a TestHeaders regression (the 405 handler needed handlerWithHeaders so HSTS still applies to wrong-method responses).

Refs #4907.

---

AI disclosure: this PR was drafted with Claude Code (AI-assisted). Verified with the full ./server/... test suite (including the updated wrong-method tests); DCO sign-off included.

[Copilot]

Pull request overview

This PR makes the server’s router.Mux method-aware so HTTP method matching happens at route registration time (via gorilla/mux), allowing per-handler r.Method guards to be removed and consolidating wrong-method responses to a uniform 405 Method Not Allowed.

Changes:

• Extend router.Mux’s Handle/HandleFunc/HandleCORS APIs with an optional methods ...string variadic parameter.
• Wire method restrictions into the server’s gorilla/mux routes and add a shared MethodNotAllowedHandler that renders the standard error page while still applying configured headers.
• Update device, token, and introspection mounts to declare explicit methods and remove in-handler method checks; adjust tests for the new 405 behavior.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
server/server.go	Makes route registration method-aware and installs a uniform 405 handler wrapped with configured headers.
server/router/router.go	Updates the Mux interface to accept optional HTTP methods for route-level matching.
server/introspection/introspection.go	Mounts introspection as POST-only and removes the internal method guard.
server/introspection/introspection_test.go	Updates tests to reflect router-level method enforcement.
server/grants/grants.go	Mounts /token as POST-only and removes the internal method guard.
server/errors_test.go	Updates the device callback wrong-method test to expect 405.
server/device/device.go	Mounts device endpoints with explicit methods and removes per-handler guards.
server/device_authorize_test.go	Updates /device/code wrong-method test to expect router-level 405 behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.