authlete_ruby_sdk 0.0.2.beta → 0.0.3.pre.beta

data/lib/authlete/models/components/client_limited_authorization.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class ClientLimitedAuthorization
         extend T::Sig
@@ -74,9 +73,192 @@ module Authlete
         # If the client application has different policy pages for different languages, this property can be used to register the URLs.
         # 
         field :policy_uris, Crystalline::Nilable.new(Crystalline::Array.new(Models::Components::TaggedValue)), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('policyUris') } }
+        # The sequential number of the service of the client application. The value of this property is
+        # assigned by Authlete.
+        # 
+        field :service_number, Crystalline::Nilable.new(::Integer), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('serviceNumber') } }
+        # The default maximum authentication age in seconds. This value is used when an authorization request from the client application does not have `max_age` request parameter.
+        # 
+        # This property corresponds to `default_max_age` in
+        # [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata).
+        # 
+        field :default_max_age, Crystalline::Nilable.new(::Integer), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('defaultMaxAge') } }
+        # The flag to indicate whether this client requires `auth_time` claim to be embedded in the ID token.
+        # 
+        # This property corresponds to `require_auth_time` in
+        # [OpenID Connect Dynamic Client Registration 1.0, 2. Client Metadata](https://openid.net/specs/openid-connect-registration-1_0.html#ClientMetadata).
+        # 
+        field :auth_time_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('authTimeRequired') } }
+        # The time at which this client was created. The value is represented as milliseconds since the UNIX epoch (1970-01-01).
+        field :created_at, Crystalline::Nilable.new(::Integer), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('createdAt') } }
+        # The time at which this client was last modified. The value is represented as milliseconds since the UNIX epoch (1970-01-01).
+        field :modified_at, Crystalline::Nilable.new(::Integer), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('modifiedAt') } }
+        # The flag to indicate whether this client use TLS client certificate bound access tokens.
+        # 
+        field :tls_client_certificate_bound_access_tokens, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('tlsClientCertificateBoundAccessTokens') } }
+        # The boolean flag to indicate whether a user code is required when this client makes a backchannel
+        # authentication request.
+        # 
+        # This property corresponds to the `backchannel_user_code_parameter` metadata.
+        # 
+        field :bc_user_code_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('bcUserCodeRequired') } }
+        # The flag to indicate whether this client has been registered dynamically.
+        # For more details, see [RFC 7591](https://datatracker.ietf.org/doc/html/rfc7591).
+        # 
+        field :dynamically_registered, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('dynamicallyRegistered') } }
+        # The flag to indicate whether this client is required to use the pushed authorization request endpoint.
+        # This property corresponds to the `require_pushed_authorization_requests` client metadata defined
+        # in "OAuth 2.0 Pushed Authorization Requests".
+        # 
+        field :par_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('parRequired') } }
+        # The flag to indicate whether authorization requests from this client are always required to
+        # utilize a request object by using either `request` or `request_uri` request parameter.
+        # 
+        # If this flag is set to `true` and the service's `traditionalRequestObjectProcessingApplied` is
+        # set to `false`, authorization requests from this client are processed as if `require_signed_request_object`
+        # client metadata of this client is `true`. The metadata is defined in "JAR (JWT Secured Authorization Request)".
+        # 
+        field :request_object_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('requestObjectRequired') } }
+        # The flag indicating whether encryption of request object is required when the request object
+        # is passed through the front channel.
+        # 
+        # This flag does not affect the processing of request objects at the Pushed Authorization Request
+        # Endpoint, which is defined in [OAuth 2.0 Pushed Authorization Requests](https://datatracker.ietf.org/doc/rfc9126/).
+        # Unecrypted request objects are accepted at the endpoint even if this flag is `true`.
+        # 
+        # This flag does not indicate whether a request object is always required. There is a different
+        # flag, `requestObjectRequired`, for the purpose.
+        # 
+        # Even if this flag is `false`, encryption of request object is required if the `frontChannelRequestObjectEncryptionRequired`
+        # flag of the service is `true`.
+        # 
+        field :front_channel_request_object_encryption_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('frontChannelRequestObjectEncryptionRequired') } }
+        # The flag indicating whether the JWE alg of encrypted request object must match the `request_object_encryption_alg`
+        # client metadata.
+        # 
+        # The `request_object_encryption_alg` client metadata itself is defined in [OpenID Connect Dynamic
+        # Client Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html) as follows.
+        # 
+        # > request_object_encryption_alg
+        # >
+        # > OPTIONAL. JWE [JWE] alg algorithm [JWA] the RP is declaring that it may use for encrypting Request
+        #   Objects sent to the OP. This parameter SHOULD be included when symmetric encryption will be used,
+        #   since this signals to the OP that a client_secret value needs to be returned from which the
+        #   symmetric key will be derived, that might not otherwise be returned. The RP MAY still use other
+        #   supported encryption algorithms or send unencrypted Request Objects, even when this parameter
+        #   is present. If both signing and encryption are requested, the Request Object will be signed
+        #   then encrypted, with the result being a Nested JWT, as defined in [JWT]. The default, if omitted,
+        #   is that the RP is not declaring whether it might encrypt any Request Objects.
+        # 
+        # The point here is "The RP MAY still use other supported encryption algorithms or send unencrypted
+        # Request Objects, even when this parameter is present."
+        # 
+        # The property that represents the client metadata is `requestEncryptionAlg`. See the description
+        # of `requestEncryptionAlg` for details.
+        # 
+        # Even if this flag is `false`, the match is required if the `requestObjectEncryptionAlgMatchRequired`
+        # flag of the service is `true`.
+        # 
+        field :request_object_encryption_alg_match_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('requestObjectEncryptionAlgMatchRequired') } }
+        # The flag indicating whether the JWE enc of encrypted request object must match the `request_object_encryption_enc`
+        # client metadata.
+        # 
+        # The `request_object_encryption_enc` client metadata itself is defined in [OpenID Connect Dynamic
+        # Client Registration 1.0](https://openid.net/specs/openid-connect-registration-1_0.html) as follows.
+        # 
+        # > request_object_encryption_enc
+        # >
+        # > OPTIONAL. JWE enc algorithm [JWA] the RP is declaring that it may use for encrypting Request
+        #   Objects sent to the OP. If request_object_encryption_alg is specified, the default for this
+        #   value is A128CBC-HS256. When request_object_encryption_enc is included, request_object_encryption_alg
+        #   MUST also be provided.
+        # 
+        # The property that represents the client metadata is `requestEncryptionEnc`. See the description
+        # of `requestEncryptionEnc`  for details.
+        # 
+        # Even if this flag is `false`, the match is required if the `requestObjectEncryptionEncMatchRequired`
+        # flag of the service is `true`.
+        # 
+        field :request_object_encryption_enc_match_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('requestObjectEncryptionEncMatchRequired') } }
+        # If `Enabled` is selected, an attempt to issue a new access token invalidates existing access tokens that are associated with the same combination of subject and client.
+        # 
+        # Note that, however, attempts by Client Credentials Flow do not invalidate existing access tokens because access tokens issued by Client Credentials Flow are not associated with any end-user's subject.
+        # 
+        # Even if `Disabled` is selected here, single access token per subject is effective if `singleAccessTokenPerSubject` of the `Service` this client belongs to is Enabled.
+        # 
+        field :single_access_token_per_subject, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('singleAccessTokenPerSubject') } }
+        # The flag to indicate whether the use of Proof Key for Code Exchange (PKCE) is always required for authorization requests by Authorization Code Flow.
+        # 
+        # If `true`, `code_challenge` request parameter is always required for authorization requests using Authorization Code Flow.
+        # 
+        # See [RFC 7636](https://tools.ietf.org/html/rfc7636) (Proof Key for Code Exchange by OAuth Public Clients) for details about `code_challenge` request parameter.
+        # 
+        field :pkce_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('pkceRequired') } }
+        # The flag to indicate whether `S256` is always required as the code challenge method whenever [PKCE (RFC 7636)](https://tools.ietf.org/html/rfc7636) is used.
+        # 
+        # If this flag is set to `true`, `code_challenge_method=S256` must be included in the authorization request
+        # whenever it includes the `code_challenge` request parameter.
+        # Neither omission of the `code_challenge_method` request parameter nor use of plain (`code_challenge_method=plain`) is allowed.
+        # 
+        field :pkce_s256_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('pkceS256Required') } }
+        # The flag indicating whether this service signs responses from the resource server.
+        # 
+        field :rs_request_signed, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('rsRequestSigned') } }
+        # If the DPoP is required for this client
+        # 
+        field :dpop_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('dpopRequired') } }
+        # The flag which indicates whether this client is locked.
+        # 
+        field :locked, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('locked') } }
+        # The flag indicating whether the client intends to prefer mutual TLS endpoints over non-MTLS endpoints.
+        # 
+        # This property corresponds to the `use_mtls_endpoint_aliases` client metadata that is defined in
+        # [FAPI 2.0 Security Profile, 8.1.1. use_mtls_endpoint_aliases](https://openid.bitbucket.io/fapi/fapi-2_0-security-profile.html#section-8.1.1).
+        # 
+        field :mtls_endpoint_aliases_used, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('mtlsEndpointAliasesUsed') } }
+        # The flag indicating whether this client is in scope for token migration 
+        # operations.
+        # 
+        field :in_scope_for_token_migration, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('inScopeForTokenMigration') } }
+        # the expiration time of the trust chain that was used when this client was registered or updated by the mechanism
+        # defined in OpenID Connect Federation 1.0. The value is represented as milliseconds elapsed since the Unix epoch (1970-01-01).
+        # 
+        field :trust_chain_expires_at, Crystalline::Nilable.new(::Integer), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('trustChainExpiresAt') } }
+        # the time at which the trust chain was updated by the mechanism defined in OpenID Connect Federation 1.0
+        # 
+        field :trust_chain_updated_at, Crystalline::Nilable.new(::Integer), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('trustChainUpdatedAt') } }
+        # The flag indicating whether this client was registered by the
+        # "automatic" client registration of OIDC Federation.
+        # 
+        field :automatically_registered, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('automaticallyRegistered') } }
+        # The flag indicating whether this client was registered by the
+        # "explicit" client registration of OIDC Federation.
+        # 
+        field :explicitly_registered, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('explicitlyRegistered') } }
+        # True if credential responses to this client must be always encrypted.
+        field :credential_response_encryption_required, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('credentialResponseEncryptionRequired') } }
+        # Location of the Client ID Metadata Document that was used for this client.
+        # This property is set when client metadata was retrieved via the OAuth Client ID Metadata Document (CIMD) mechanism.
+        # 
+        field :metadata_document_location, Crystalline::Nilable.new(::String), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('metadataDocumentLocation') } }
+        # Expiration time of the metadata document (UNIX time in milliseconds).
+        # 
+        field :metadata_document_expires_at, Crystalline::Nilable.new(::Integer), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('metadataDocumentExpiresAt') } }
+        # Last-updated time of the metadata document (UNIX time in milliseconds).
+        # 
+        field :metadata_document_updated_at, Crystalline::Nilable.new(::Integer), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('metadataDocumentUpdatedAt') } }
+        # Indicates whether this client was discovered via a Client ID Metadata Document.
+        # 
+        field :discovered_by_metadata_document, Crystalline::Nilable.new(Crystalline::Boolean.new), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('discoveredByMetadataDocument') } }
+        # Source of this client record.
+        # 
+        field :client_source, Crystalline::Nilable.new(Models::Components::ClientLimitedAuthorizationClientSource), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('clientSource'), 'decoder': Utils.enum_from_string(Models::Components::ClientLimitedAuthorizationClientSource, true) } }
+        # the entity ID of this client.
+        # 
+        field :entity_id, Crystalline::Nilable.new(::String), { 'format_json': { 'letter_case': ::Authlete::Utils.field_name('entityId') } }
 
-        sig { params(number: T.nilable(::Integer), client_name: T.nilable(::String), client_names: T.nilable(T::Array[Models::Components::TaggedValue]), description: T.nilable(::String), descriptions: T.nilable(T::Array[Models::Components::TaggedValue]), client_id: T.nilable(::Integer), client_id_alias: T.nilable(::String), client_id_alias_enabled: T.nilable(T::Boolean), client_type: T.nilable(Models::Components::ClientType), logo_uri: T.nilable(::String), logo_uris: T.nilable(T::Array[Models::Components::TaggedValue]), tos_uri: T.nilable(::String), tos_uris: T.nilable(T::Array[Models::Components::TaggedValue]), policy_uri: T.nilable(::String), policy_uris: T.nilable(T::Array[Models::Components::TaggedValue])).void }
-        def initialize(number: nil, client_name: nil, client_names: nil, description: nil, descriptions: nil, client_id: nil, client_id_alias: nil, client_id_alias_enabled: nil, client_type: nil, logo_uri: nil, logo_uris: nil, tos_uri: nil, tos_uris: nil, policy_uri: nil, policy_uris: nil)
+        sig { params(number: T.nilable(::Integer), client_name: T.nilable(::String), client_names: T.nilable(T::Array[Models::Components::TaggedValue]), description: T.nilable(::String), descriptions: T.nilable(T::Array[Models::Components::TaggedValue]), client_id: T.nilable(::Integer), client_id_alias: T.nilable(::String), client_id_alias_enabled: T.nilable(T::Boolean), client_type: T.nilable(Models::Components::ClientType), logo_uri: T.nilable(::String), logo_uris: T.nilable(T::Array[Models::Components::TaggedValue]), tos_uri: T.nilable(::String), tos_uris: T.nilable(T::Array[Models::Components::TaggedValue]), policy_uri: T.nilable(::String), policy_uris: T.nilable(T::Array[Models::Components::TaggedValue]), service_number: T.nilable(::Integer), default_max_age: T.nilable(::Integer), auth_time_required: T.nilable(T::Boolean), created_at: T.nilable(::Integer), modified_at: T.nilable(::Integer), tls_client_certificate_bound_access_tokens: T.nilable(T::Boolean), bc_user_code_required: T.nilable(T::Boolean), dynamically_registered: T.nilable(T::Boolean), par_required: T.nilable(T::Boolean), request_object_required: T.nilable(T::Boolean), front_channel_request_object_encryption_required: T.nilable(T::Boolean), request_object_encryption_alg_match_required: T.nilable(T::Boolean), request_object_encryption_enc_match_required: T.nilable(T::Boolean), single_access_token_per_subject: T.nilable(T::Boolean), pkce_required: T.nilable(T::Boolean), pkce_s256_required: T.nilable(T::Boolean), rs_request_signed: T.nilable(T::Boolean), dpop_required: T.nilable(T::Boolean), locked: T.nilable(T::Boolean), mtls_endpoint_aliases_used: T.nilable(T::Boolean), in_scope_for_token_migration: T.nilable(T::Boolean), trust_chain_expires_at: T.nilable(::Integer), trust_chain_updated_at: T.nilable(::Integer), automatically_registered: T.nilable(T::Boolean), explicitly_registered: T.nilable(T::Boolean), credential_response_encryption_required: T.nilable(T::Boolean), metadata_document_location: T.nilable(::String), metadata_document_expires_at: T.nilable(::Integer), metadata_document_updated_at: T.nilable(::Integer), discovered_by_metadata_document: T.nilable(T::Boolean), client_source: T.nilable(Models::Components::ClientLimitedAuthorizationClientSource), entity_id: T.nilable(::String)).void }
+        def initialize(number: nil, client_name: nil, client_names: nil, description: nil, descriptions: nil, client_id: nil, client_id_alias: nil, client_id_alias_enabled: nil, client_type: nil, logo_uri: nil, logo_uris: nil, tos_uri: nil, tos_uris: nil, policy_uri: nil, policy_uris: nil, service_number: nil, default_max_age: nil, auth_time_required: nil, created_at: nil, modified_at: nil, tls_client_certificate_bound_access_tokens: nil, bc_user_code_required: nil, dynamically_registered: nil, par_required: nil, request_object_required: nil, front_channel_request_object_encryption_required: nil, request_object_encryption_alg_match_required: nil, request_object_encryption_enc_match_required: nil, single_access_token_per_subject: nil, pkce_required: nil, pkce_s256_required: nil, rs_request_signed: nil, dpop_required: nil, locked: nil, mtls_endpoint_aliases_used: nil, in_scope_for_token_migration: nil, trust_chain_expires_at: nil, trust_chain_updated_at: nil, automatically_registered: nil, explicitly_registered: nil, credential_response_encryption_required: nil, metadata_document_location: nil, metadata_document_expires_at: nil, metadata_document_updated_at: nil, discovered_by_metadata_document: nil, client_source: nil, entity_id: nil)
           @number = number
           @client_name = client_name
           @client_names = client_names
@@ -92,6 +274,38 @@ module Authlete
           @tos_uris = tos_uris
           @policy_uri = policy_uri
           @policy_uris = policy_uris
+          @service_number = service_number
+          @default_max_age = default_max_age
+          @auth_time_required = auth_time_required
+          @created_at = created_at
+          @modified_at = modified_at
+          @tls_client_certificate_bound_access_tokens = tls_client_certificate_bound_access_tokens
+          @bc_user_code_required = bc_user_code_required
+          @dynamically_registered = dynamically_registered
+          @par_required = par_required
+          @request_object_required = request_object_required
+          @front_channel_request_object_encryption_required = front_channel_request_object_encryption_required
+          @request_object_encryption_alg_match_required = request_object_encryption_alg_match_required
+          @request_object_encryption_enc_match_required = request_object_encryption_enc_match_required
+          @single_access_token_per_subject = single_access_token_per_subject
+          @pkce_required = pkce_required
+          @pkce_s256_required = pkce_s256_required
+          @rs_request_signed = rs_request_signed
+          @dpop_required = dpop_required
+          @locked = locked
+          @mtls_endpoint_aliases_used = mtls_endpoint_aliases_used
+          @in_scope_for_token_migration = in_scope_for_token_migration
+          @trust_chain_expires_at = trust_chain_expires_at
+          @trust_chain_updated_at = trust_chain_updated_at
+          @automatically_registered = automatically_registered
+          @explicitly_registered = explicitly_registered
+          @credential_response_encryption_required = credential_response_encryption_required
+          @metadata_document_location = metadata_document_location
+          @metadata_document_expires_at = metadata_document_expires_at
+          @metadata_document_updated_at = metadata_document_updated_at
+          @discovered_by_metadata_document = discovered_by_metadata_document
+          @client_source = client_source
+          @entity_id = entity_id
         end
 
         sig { params(other: T.untyped).returns(T::Boolean) }
@@ -112,6 +326,38 @@ module Authlete
           return false unless @tos_uris == other.tos_uris
           return false unless @policy_uri == other.policy_uri
           return false unless @policy_uris == other.policy_uris
+          return false unless @service_number == other.service_number
+          return false unless @default_max_age == other.default_max_age
+          return false unless @auth_time_required == other.auth_time_required
+          return false unless @created_at == other.created_at
+          return false unless @modified_at == other.modified_at
+          return false unless @tls_client_certificate_bound_access_tokens == other.tls_client_certificate_bound_access_tokens
+          return false unless @bc_user_code_required == other.bc_user_code_required
+          return false unless @dynamically_registered == other.dynamically_registered
+          return false unless @par_required == other.par_required
+          return false unless @request_object_required == other.request_object_required
+          return false unless @front_channel_request_object_encryption_required == other.front_channel_request_object_encryption_required
+          return false unless @request_object_encryption_alg_match_required == other.request_object_encryption_alg_match_required
+          return false unless @request_object_encryption_enc_match_required == other.request_object_encryption_enc_match_required
+          return false unless @single_access_token_per_subject == other.single_access_token_per_subject
+          return false unless @pkce_required == other.pkce_required
+          return false unless @pkce_s256_required == other.pkce_s256_required
+          return false unless @rs_request_signed == other.rs_request_signed
+          return false unless @dpop_required == other.dpop_required
+          return false unless @locked == other.locked
+          return false unless @mtls_endpoint_aliases_used == other.mtls_endpoint_aliases_used
+          return false unless @in_scope_for_token_migration == other.in_scope_for_token_migration
+          return false unless @trust_chain_expires_at == other.trust_chain_expires_at
+          return false unless @trust_chain_updated_at == other.trust_chain_updated_at
+          return false unless @automatically_registered == other.automatically_registered
+          return false unless @explicitly_registered == other.explicitly_registered
+          return false unless @credential_response_encryption_required == other.credential_response_encryption_required
+          return false unless @metadata_document_location == other.metadata_document_location
+          return false unless @metadata_document_expires_at == other.metadata_document_expires_at
+          return false unless @metadata_document_updated_at == other.metadata_document_updated_at
+          return false unless @discovered_by_metadata_document == other.discovered_by_metadata_document
+          return false unless @client_source == other.client_source
+          return false unless @entity_id == other.entity_id
           true
         end
       end

data/lib/authlete/models/components/client_limited_authorization.rbi

@@ -38,4 +38,68 @@ class Authlete::Models::Components::ClientLimitedAuthorization
   def policy_uri=(str_); end
   def policy_uris(); end
   def policy_uris=(str_); end
+  def service_number(); end
+  def service_number=(str_); end
+  def default_max_age(); end
+  def default_max_age=(str_); end
+  def auth_time_required(); end
+  def auth_time_required=(str_); end
+  def created_at(); end
+  def created_at=(str_); end
+  def modified_at(); end
+  def modified_at=(str_); end
+  def tls_client_certificate_bound_access_tokens(); end
+  def tls_client_certificate_bound_access_tokens=(str_); end
+  def bc_user_code_required(); end
+  def bc_user_code_required=(str_); end
+  def dynamically_registered(); end
+  def dynamically_registered=(str_); end
+  def par_required(); end
+  def par_required=(str_); end
+  def request_object_required(); end
+  def request_object_required=(str_); end
+  def front_channel_request_object_encryption_required(); end
+  def front_channel_request_object_encryption_required=(str_); end
+  def request_object_encryption_alg_match_required(); end
+  def request_object_encryption_alg_match_required=(str_); end
+  def request_object_encryption_enc_match_required(); end
+  def request_object_encryption_enc_match_required=(str_); end
+  def single_access_token_per_subject(); end
+  def single_access_token_per_subject=(str_); end
+  def pkce_required(); end
+  def pkce_required=(str_); end
+  def pkce_s256_required(); end
+  def pkce_s256_required=(str_); end
+  def rs_request_signed(); end
+  def rs_request_signed=(str_); end
+  def dpop_required(); end
+  def dpop_required=(str_); end
+  def locked(); end
+  def locked=(str_); end
+  def mtls_endpoint_aliases_used(); end
+  def mtls_endpoint_aliases_used=(str_); end
+  def in_scope_for_token_migration(); end
+  def in_scope_for_token_migration=(str_); end
+  def trust_chain_expires_at(); end
+  def trust_chain_expires_at=(str_); end
+  def trust_chain_updated_at(); end
+  def trust_chain_updated_at=(str_); end
+  def automatically_registered(); end
+  def automatically_registered=(str_); end
+  def explicitly_registered(); end
+  def explicitly_registered=(str_); end
+  def credential_response_encryption_required(); end
+  def credential_response_encryption_required=(str_); end
+  def metadata_document_location(); end
+  def metadata_document_location=(str_); end
+  def metadata_document_expires_at(); end
+  def metadata_document_expires_at=(str_); end
+  def metadata_document_updated_at(); end
+  def metadata_document_updated_at=(str_); end
+  def discovered_by_metadata_document(); end
+  def discovered_by_metadata_document=(str_); end
+  def client_source(); end
+  def client_source=(str_); end
+  def entity_id(); end
+  def entity_id=(str_); end
 end

data/lib/authlete/models/components/client_limited_authorization_clientsource.rb

@@ -0,0 +1,23 @@
+# Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+
+# typed: true
+# frozen_string_literal: true
+
+
+module Authlete
+  module Models
+    module Components
+      # ClientLimitedAuthorizationClientSource - Source of this client record.
+      # 
+      class ClientLimitedAuthorizationClientSource < T::Enum
+        enums do
+          DYNAMIC_REGISTRATION = new('DYNAMIC_REGISTRATION')
+          AUTOMATIC_REGISTRATION = new('AUTOMATIC_REGISTRATION')
+          EXPLICIT_REGISTRATION = new('EXPLICIT_REGISTRATION')
+          METADATA_DOCUMENT = new('METADATA_DOCUMENT')
+          STATIC_REGISTRATION = new('STATIC_REGISTRATION')
+        end
+      end
+    end
+  end
+end

data/lib/authlete/models/components/client_limited_authorization_clientsource.rbi

@@ -0,0 +1,11 @@
+# typed: true
+# frozen_string_literal: true
+
+
+class Authlete::Models::Components::ClientLimitedAuthorizationClientSource
+  extend ::Crystalline::MetadataFields::ClassMethods
+end
+
+
+class Authlete::Models::Components::ClientLimitedAuthorizationClientSource
+end

data/lib/authlete/models/components/client_registration_response.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class ClientRegistrationResponse
         extend T::Sig

data/lib/authlete/models/components/client_registration_response_action.rb

@@ -7,12 +7,9 @@
 module Authlete
   module Models
     module Components
-    
       # ClientRegistrationResponseAction - The next action that the authorization server implementation should take.
       # 
       class ClientRegistrationResponseAction < T::Enum
-
-
         enums do
           BAD_REQUEST = new('BAD_REQUEST')
           CREATED = new('CREATED')

data/lib/authlete/models/components/client_registration_type.rb

@@ -7,14 +7,11 @@
 module Authlete
   module Models
     module Components
-    
       # ClientRegistrationType - Values for the `client_registration_types` RP metadata and the
       #  `client_registration_types_supported` OP metadata that are defined in
       #  [OpenID Connect Federation 1.0](https://openid.net/specs/openid-connect-federation-1_0.html).
       # 
       class ClientRegistrationType < T::Enum
-
-
         enums do
           AUTOMATIC = new('AUTOMATIC')
           EXPLICIT = new('EXPLICIT')

data/lib/authlete/models/components/client_secret_refresh_response.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class ClientSecretRefreshResponse
         extend T::Sig

data/lib/authlete/models/components/client_secret_update_request.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class ClientSecretUpdateRequest
         extend T::Sig

data/lib/authlete/models/components/client_secret_update_response.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class ClientSecretUpdateResponse
         extend T::Sig

data/lib/authlete/models/components/client_type.rb

@@ -7,13 +7,10 @@
 module Authlete
   module Models
     module Components
-    
       # ClientType - The client type, either `CONFIDENTIAL` or `PUBLIC`. See [RFC 6749, 2.1. Client Types](https://datatracker.ietf.org/doc/html/rfc6749#section-2.1)
       # for details.
       # 
       class ClientType < T::Enum
-
-
         enums do
           PUBLIC = new('PUBLIC')
           CONFIDENTIAL = new('CONFIDENTIAL')

data/lib/authlete/models/components/credential_issuance_order.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class CredentialIssuanceOrder
         extend T::Sig

data/lib/authlete/models/components/credential_issuer_metadata.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class CredentialIssuerMetadata
         extend T::Sig

data/lib/authlete/models/components/credential_offer_info.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class CredentialOfferInfo
         extend T::Sig

data/lib/authlete/models/components/credential_request_info.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class CredentialRequestInfo
         extend T::Sig

data/lib/authlete/models/components/delivery_mode.rb

@@ -7,11 +7,8 @@
 module Authlete
   module Models
     module Components
-    
 
       class DeliveryMode < T::Enum
-
-
         enums do
           PING = new('PING')
           POLL = new('POLL')

data/lib/authlete/models/components/device_authorization_request.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class DeviceAuthorizationRequest
         extend T::Sig

data/lib/authlete/models/components/device_authorization_response.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class DeviceAuthorizationResponse
         extend T::Sig

data/lib/authlete/models/components/device_authorization_response_action.rb

@@ -7,11 +7,8 @@
 module Authlete
   module Models
     module Components
-    
       # DeviceAuthorizationResponseAction - The next action that the authorization server implementation should take.
       class DeviceAuthorizationResponseAction < T::Enum
-
-
         enums do
           INTERNAL_SERVER_ERROR = new('INTERNAL_SERVER_ERROR')
           BAD_REQUEST = new('BAD_REQUEST')

data/lib/authlete/models/components/device_complete_request.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class DeviceCompleteRequest
         extend T::Sig

data/lib/authlete/models/components/device_complete_request_result.rb

@@ -7,13 +7,10 @@
 module Authlete
   module Models
     module Components
-    
       # DeviceCompleteRequestResult - The result of the end-user authentication and authorization. One of the following. Details are
       # described in the description.
       # 
       class DeviceCompleteRequestResult < T::Enum
-
-
         enums do
           TRANSACTION_FAILED = new('TRANSACTION_FAILED')
           ACCESS_DENIED = new('ACCESS_DENIED')

data/lib/authlete/models/components/device_complete_response.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class DeviceCompleteResponse
         extend T::Sig

data/lib/authlete/models/components/device_complete_response_action.rb

@@ -7,12 +7,9 @@
 module Authlete
   module Models
     module Components
-    
       # DeviceCompleteResponseAction - The next action that the authorization server implementation should take.
       # 
       class DeviceCompleteResponseAction < T::Enum
-
-
         enums do
           SERVER_ERROR = new('SERVER_ERROR')
           USER_CODE_NOT_EXIST = new('USER_CODE_NOT_EXIST')

data/lib/authlete/models/components/device_verification_request.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class DeviceVerificationRequest
         extend T::Sig

data/lib/authlete/models/components/device_verification_response.rb

@@ -7,7 +7,6 @@
 module Authlete
   module Models
     module Components
-    
 
       class DeviceVerificationResponse
         extend T::Sig

data/lib/authlete/models/components/device_verification_response_action.rb

@@ -7,11 +7,8 @@
 module Authlete
   module Models
     module Components
-    
       # DeviceVerificationResponseAction - The next action that the authorization server implementation should take.
       class DeviceVerificationResponseAction < T::Enum
-
-
         enums do
           INTERNAL_SERVER_ERROR = new('INTERNAL_SERVER_ERROR')
           NOT_EXIST = new('NOT_EXIST')