use URL for resource throughout

src/server/auth/handlers/token.test.ts

@@ -303,7 +303,7 @@ describe('Token Handler', () => {
         'valid_code',
         undefined, // code_verifier is undefined after PKCE validation
         undefined, // redirect_uri
-        'https://api.example.com/resource' // resource parameter
+        new URL('https://api.example.com/resource') // resource parameter
       );
     });
 
@@ -371,7 +371,7 @@ describe('Token Handler', () => {
         'valid_code',
         undefined, // code_verifier is undefined after PKCE validation
         'https://example.com/callback', // redirect_uri
-        'https://api.example.com/resource' // resource parameter
+        new URL('https://api.example.com/resource') // resource parameter
       );
     });
 
@@ -585,7 +585,7 @@ describe('Token Handler', () => {
         validClient,
         'valid_refresh_token',
         undefined, // scopes
-        'https://api.example.com/resource' // resource parameter
+        new URL('https://api.example.com/resource') // resource parameter
       );
     });
 
@@ -648,7 +648,7 @@ describe('Token Handler', () => {
         validClient,
         'valid_refresh_token',
         ['profile', 'email'], // scopes
-        'https://api.example.com/resource' // resource parameter
+        new URL('https://api.example.com/resource') // resource parameter
       );
     });
   });

src/server/auth/handlers/token.ts

@@ -113,7 +113,7 @@ export function tokenHandler({ provider, rateLimit: rateLimitConfig }: TokenHand
             code, 
             skipLocalPkceValidation ? code_verifier : undefined,
             redirect_uri,
-            resource
+            resource ? new URL(resource) : undefined
           );
           res.status(200).json(tokens);
           break;
@@ -131,7 +131,7 @@ export function tokenHandler({ provider, rateLimit: rateLimitConfig }: TokenHand
           // The provider can decide how to validate it
 
           const scopes = scope?.split(" ");
-          const tokens = await provider.exchangeRefreshToken(client, refresh_token, scopes, resource);
+          const tokens = await provider.exchangeRefreshToken(client, refresh_token, scopes, resource ? new URL(resource) : undefined);
           res.status(200).json(tokens);
           break;
         }

src/server/auth/providers/proxyProvider.test.ts

@@ -213,7 +213,7 @@ describe("Proxy OAuth Server Provider", () => {
         'test-code',
         'test-verifier',
         'https://example.com/callback',
-        'https://api.example.com/resource'
+        new URL('https://api.example.com/resource')
       );
 
       expect(global.fetch).toHaveBeenCalledWith(
@@ -267,7 +267,7 @@ describe("Proxy OAuth Server Provider", () => {
         validClient,
         'test-refresh-token',
         ['read', 'write'],
-        'https://api.example.com/resource'
+        new URL('https://api.example.com/resource')
       );
 
       expect(global.fetch).toHaveBeenCalledWith(
@@ -301,7 +301,7 @@ describe("Proxy OAuth Server Provider", () => {
         validClient,
         'test-refresh-token',
         ['profile', 'email'],
-        'https://api.example.com/resource'
+        new URL('https://api.example.com/resource')
       );
 
       const fetchCall = (global.fetch as jest.Mock).mock.calls[0];

src/server/auth/providers/proxyProvider.ts

@@ -175,7 +175,7 @@ export class ProxyOAuthServerProvider implements OAuthServerProvider {
     }
 
     if (resource) {
-      params.append("resource", resource);
+      params.append("resource", resource.href);
     }
 
     const response = await fetch(this._endpoints.tokenUrl, {
@@ -217,7 +217,7 @@ export class ProxyOAuthServerProvider implements OAuthServerProvider {
     }
 
     if (resource) {
-      params.set("resource", resource);
+      params.set("resource", resource.href);
     }
 
     const response = await fetch(this._endpoints.tokenUrl, {