fix: use exact match for root apiHandler route

[mattzcarey]

Summary

When apiHandler is set to '/', the library incorrectly matches all routes instead of just the root path, breaking OAuth endpoints like /authorize.

Problem

The matchApiRoute() method uses startsWith(route) to check if a URL matches the API handler route. When route is '/', every pathname starts with '/', so all requests are treated as API requests - including the default handler's OAuth UI pages.

This causes an infinite loop or auth failure because:

1. User visits /authorize to see login UI
2. Request matches '/' apiHandler (everything starts with /)
3. Request goes to API handler instead of default handler
4. Auth flow breaks

Solution

Add a special case for '/' to use exact pathname matching:

if (route === '/') {
  return url.pathname === '/';
}
return url.pathname.startsWith(route);

This makes '/' match only the root path, while other routes like /api continue to use prefix matching as expected.

Test plan

• All existing tests pass (142 tests)
• Formatting passes

Fixes #53

[changeset-bot]

🦋 Changeset detected

Latest commit: 4253d69

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@cloudflare/workers-oauth-provider	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/workers-oauth-provider/@cloudflare/workers-oauth-provider@140

commit: 4253d69