Issue #9 follow-up

[kentcdodds]

Strip resource from OAuth request params before completeAuthorization to avoid local audience mismatch failures on /db-api.

Closes #9

---

  

---

Note

Medium Risk
Touches OAuth authorization/token request handling; while small, it changes how audiences may be derived and relies on request cloning semantics that could affect compatibility with some clients.

Overview
Prevents audience-bound tokens from being created from MCP clients’ resource parameter by stripping resource before calling completeAuthorization in app/routes/oauth/authorize.tsx.

Fixes token endpoint compatibility by reading the /oauth/token form body via request.clone() before removing resource, avoiding consuming the original request body in workers/app.ts.

^{Written by Cursor Bugbot for commit 5557ea9. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Agent can help with this pull request. Just @cursor in comments and I'll start working on changes in this branch.
_{Learn more about Cursor Agents}