fix: use optional SOLID_RESOURCE_URL for authenticated fetch example

[Copilot]

Fetching the WebID profile document as the example authenticated request is an anti-pattern — it's a public resource, not a protected one, and isn't defined as a Solid resource in all server implementations (e.g. ESS).

Changes

• SOLID_RESOURCE_URL env var: added as an optional input for the target resource URL; falls back to session.info.webId if unset
• Code example: fetch now uses RESOURCE_URL ?? session.info.webId instead of always fetching the WebID profile
• Run commands (Bash + PowerShell): updated to include SOLID_RESOURCE_URL
• Narrative text: clarifies that SOLID_RESOURCE_URL is optional and describes the fallback behaviour

const RESOURCE_URL = process.env.SOLID_RESOURCE_URL; // URL of the protected resource to fetch (optional)

// ...
const resourceUrl = RESOURCE_URL ?? session.info.webId;
const response = await session.fetch(resourceUrl);

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[Copilot]

Pull request overview

Updates the Node.js client-credentials authentication guide to demonstrate an authenticated fetch against an optional, user-provided Solid resource URL (instead of always fetching the WebID profile), while documenting the fallback behavior.

Changes:

• Add optional SOLID_RESOURCE_URL env var to target a specific resource for the authenticated fetch.
• Update the example request to use SOLID_RESOURCE_URL when set, otherwise fall back to session.info.webId.
• Update Bash/PowerShell run instructions and narrative text to mention the new optional env var and fallback.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The comment says this is a "protected resource" URL, but the code explicitly falls back to fetching the WebID profile document (which is often public). Consider updating the inline comment to reflect the actual behavior (e.g., optional resource URL that defaults to the WebID profile) so the example isn’t self-contradictory.

Suggested change

	const RESOURCE_URL = process.env.SOLID_RESOURCE_URL; // URL of the protected resource to fetch (optional)
	const RESOURCE_URL = process.env.SOLID_RESOURCE_URL; // Optional resource URL to fetch; defaults to your WebID profile if not set

[Copilot]

Using the nullish coalescing operator here means an empty-string SOLID_RESOURCE_URL (e.g., set but blank in a .env) will be treated as a valid URL and passed to fetch, which will throw. If the intent is “use env var when it’s a non-empty string”, prefer a check that also treats '' as unset (e.g., using || or trimming/validating before selecting the URL).

Suggested change

	const resourceUrl = RESOURCE_URL ?? session.info.webId;
	const resourceUrl =
	RESOURCE_URL && RESOURCE_URL.trim()
	? RESOURCE_URL
	: session.info.webId;

[Copilot]

This instruction suggests replacing http://localhost:3000 with the authorization server URL, but the example now uses the same placeholder host for both SOLID_OIDC_ISSUER (auth server) and SOLID_RESOURCE_URL (resource/POD server). For many setups (e.g., Inrupt), these are different hosts; consider rewording to explicitly say “set SOLID_OIDC_ISSUER to your authorization server” and “set SOLID_RESOURCE_URL to the resource URL on your Pod/server”, rather than a single replacement step.

Suggested change

	Replace `http://localhost:3000` with the URL of your authorization server (for example, `https://solidcommunity.net` or `https://login.inrupt.com`), and set `SOLID_RESOURCE_URL` to the URL of the private resource you want to access. If `SOLID_RESOURCE_URL` is omitted, the script falls back to fetching your WebID profile document.
	Set `SOLID_OIDC_ISSUER` to the URL of your authorization server (for example, `https://solidcommunity.net` or `https://login.inrupt.com`), and set `SOLID_RESOURCE_URL` to the URL of the private resource you want to access on your Pod/server. If `SOLID_RESOURCE_URL` is omitted, the script falls back to fetching your WebID profile document.