🤖 CoderMCPServer: require https for Coder's revocation URL in the consent check #334

Problem

The consent check of the CoderMCPServer disable path (#330, mcpServerConsentHolds in internal/controller/codermcpserver_disable.go) parses the OAuth2 revocation URL that Coder holds with the generic http-or-https parser. Coder accepts an http revocation URL for loopback hosts. The CRD and the controller require https for spec.auth.oauth2.revocationURL (mcpServerURLs).

If Coder holds an http loopback revocation URL (set in the dashboard), the Secret lists that exact origin, and a spec edit makes the normal credential read stall, the consent check passes and the config stays enabled. Coder can then send the OAuth2 client secret over http to that loopback origin when a user disconnects.

The Secret owner did list that origin, so no credential goes to an origin without consent. The gap is a mismatch with the https-only revocation rule. The kind is not registered, so no install is affected today.

Expected

Apply the revocation-specific https check to Coder's revocation URL in the consent check, and add one test. About 5 lines.

Found by the Codex review of #330 (thread 4267416958). Deferred after two fix rounds on an advisor's recommendation (low priority, not an M9 blocker).

Refs #155

Generated with xum • Model: anthropic:claude-opus-5-5 • Thinking: high • Cost: $127.81