authproto 0.3.0.beta1 → 0.3.0.beta2

data/lib/authproto/state/token_set.rb

@@ -52,9 +52,9 @@ module AuthProto
         refresh_token: nil
       )
         validate_token_type(token_type)
-        validate_required("access_token", access_token)
-        validate_required("scope", scope)
-        validate_required("sub", sub)
+        validate_required('access_token', access_token)
+        validate_required('scope', scope)
+        validate_required('sub', sub)
         validate_expires_in(expires_in)
 
         @access_token = access_token
@@ -84,7 +84,7 @@ module AuthProto
       private
 
       def validate_token_type(type)
-        raise ArgumentError, "token_type must be DPoP" unless type == "DPoP"
+        raise ArgumentError, "token_type must be DPoP" unless type == 'DPoP'
       end
 
       def validate_required(name, value)

data/lib/authproto/state.rb

@@ -29,15 +29,15 @@ module AuthProto
   #   # Create a new session
   #   session = manager.create_session(
   #     client_id: "https://myapp.com/oauth-client-metadata.json",
-  #     scope: "atproto"
+  #     scope: 'atproto'
   #   )
   #
   #   # Update session with tokens
   #   tokens = AuthProto::State::TokenSet.new(
   #     access_token: "...",
-  #     token_type: "DPoP",
+  #     token_type: 'DPoP',
   #     expires_in: 3600,
-  #     scope: "atproto",
+  #     scope: 'atproto',
   #     sub: "did:plc:abcdef123"
   #   )
   #   session.tokens = tokens

data/lib/authproto/token/refresh.rb

@@ -65,7 +65,7 @@ module AuthProto
         super(
           "Token has expired",
           token_type: token_type,
-          error_code: "token_expired",
+          error_code: 'token_expired',
           retry_possible: true
         )
       end
@@ -84,7 +84,7 @@ module AuthProto
         super(
           "Token is invalid",
           token_type: token_type,
-          error_code: "token_invalid",
+          error_code: 'token_invalid',
           retry_possible: false
         )
       end
@@ -104,8 +104,8 @@ module AuthProto
       def initialize(message, retry_possible: true)
         super(
           message,
-          token_type: "refresh",
-          error_code: "refresh_failed",
+          token_type: 'refresh',
+          error_code: 'refresh_failed',
           retry_possible: retry_possible
         )
       end
@@ -139,27 +139,30 @@ module AuthProto
       attr_reader :dpop_client
 
       # Server providing the token endpoint.
-      # @return [ServerMetadata::AuthorizationServer]
+      # @return [Metadata::AuthorizationServer]
       attr_reader :auth_server
 
       # Client metadata used for optional confidential-client assertions.
-      # @return [ClientMetadata]
+      # @return [Metadata::ClientMetadata]
       attr_reader :client_metadata
 
       # Creates a synchronized refresh operation for an existing OAuth session.
       #
       # @param session [State::Session] session with an access and refresh token
       # @param dpop_client [DPoP::Client] proof signer and nonce tracker
-      # @param auth_server [ServerMetadata::AuthorizationServer] server with a token endpoint
-      # @param client_metadata [ClientMetadata] client ID and authentication key configuration
+      # @param auth_server [Metadata::AuthorizationServer] server with a token endpoint
+      # @param client_metadata [Metadata::ClientMetadata] client ID and authentication key configuration
+      # @param signing_key [Hash, JOSE::JWK, nil] private ES256 client-authentication key
       #
-      def initialize(session:, dpop_client:, auth_server:, client_metadata:)
+      def initialize(session:, dpop_client:, auth_server:, client_metadata:, signing_key: nil)
         super() # Initialize MonitorMixin
+
         @session = session
         @dpop_client = dpop_client
         @auth_server = auth_server
         @attempt_count = 0
         @client_metadata = client_metadata
+        @signing_key = signing_key
       end
 
       # Exchanges a refresh token for a replacement token set.
@@ -171,7 +174,7 @@ module AuthProto
       # @return [State::TokenSet] validated replacement tokens
       # @raise [RefreshError] if the session is not renewable, refresh fails, or retries are exhausted
       #
-      def perform
+      def perform_refresh
         synchronize do
           raise RefreshError.new("No refresh token available", retry_possible: false) unless session.renewable?
           raise RefreshError.new("No access token to refresh", retry_possible: false) if session.tokens.nil?
@@ -203,7 +206,6 @@ module AuthProto
           end
         end
 
-        # Reached max retries
         raise RefreshError.new(
           "Token refresh failed after #{MAX_RETRIES} attempts: #{last_error.message}",
           retry_possible: false
@@ -234,20 +236,15 @@ module AuthProto
       end
 
       def make_token_request(session)
-        # Generate proof
-        proof = dpop_client.generate_proof(
-          http_method: "POST",
-          http_uri: auth_server.token_endpoint
-        )
+        dpop_proof = dpop_client.generate_proof(method: 'POST', uri: auth_server.token_endpoint)
 
         body = {
-          grant_type: "refresh_token",
+          grant_type: 'refresh_token',
           refresh_token: session.tokens.refresh_token,
           scope: session.scope,
           client_id: client_metadata.client_id
         }
 
-        # Add client authentication if available
         add_client_authentication(body) if client_metadata.confidential?
 
         AuthProto.configuration.http_client.post(
@@ -255,7 +252,7 @@ module AuthProto
           body: body,
           headers: {
             "Content-Type" => "application/x-www-form-urlencoded",
-            "DPoP" => proof
+            "DPoP" => dpop_proof
           }
         )
       end
@@ -265,13 +262,13 @@ module AuthProto
         return false if response[:body].nil?
 
         error_data = JSON.parse(response[:body])
-        error_data.is_a?(Hash) && error_data["error"] == "use_dpop_nonce"
+        error_data.is_a?(Hash) && error_data['error'] == DPoP::ERROR_USE_NONCE
       rescue JSON::ParserError
         false
       end
 
       def extract_dpop_nonce(response)
-        nonce = (response[:headers] || {}).detect { |k, v| k.downcase == "dpop-nonce" }&.last
+        nonce = (response[:headers] || {}).detect { |k, v| k.downcase == 'dpop-nonce' }&.last
 
         unless nonce.is_a?(String) && !nonce.empty?
           raise RefreshError.new("No DPoP nonce provided in error response", retry_possible: false)
@@ -281,19 +278,14 @@ module AuthProto
       end
 
       def add_client_authentication(body)
-        return unless client_metadata.jwks && !client_metadata.jwks["keys"].empty?
-
-        signing_key = JOSE::JWK.from_map(client_metadata.jwks["keys"].first)
         client_assertion = PAR::ClientAssertion.new(
           client_id: client_metadata.client_id,
-          signing_key: signing_key
+          signing_key: @signing_key
         )
 
         body.merge!(
           client_assertion_type: PAR::CLIENT_ASSERTION_TYPE,
-          client_assertion: client_assertion.generate_jwt(
-            audience: auth_server.issuer
-          )
+          client_assertion: client_assertion.generate_jwt(audience: auth_server.issuer)
         )
       end
 
@@ -319,12 +311,12 @@ module AuthProto
         validate_refresh_response(data)
 
         AuthProto::State::TokenSet.new(
-          access_token: data["access_token"],
-          token_type: data["token_type"],
-          expires_in: data["expires_in"],
-          refresh_token: data["refresh_token"],
-          scope: data["scope"],
-          sub: data["sub"]
+          access_token: data['access_token'],
+          token_type: data['token_type'],
+          expires_in: data['expires_in'],
+          refresh_token: data['refresh_token'],
+          scope: data['scope'],
+          sub: data['sub']
         )
       rescue JSON::ParserError => e
         raise RefreshError.new("Invalid response format: #{e.message}", retry_possible: false)
@@ -339,10 +331,10 @@ module AuthProto
           raise RefreshError.new("Invalid error response format", retry_possible: false)
         end
 
-        error_description = error_data["error_description"] || error_data["error"]
+        error_description = error_data['error_description'] || error_data['error']
 
-        case error_data["error"]
-        when "use_dpop_nonce"
+        case error_data['error']
+        when DPoP::ERROR_USE_NONCE
           extract_dpop_nonce(response)
           dpop_client.process_response(response[:headers], auth_server.issuer)
           raise RefreshError.new("Retry with DPoP nonce", retry_possible: true)
@@ -384,28 +376,28 @@ module AuthProto
           end
         end
 
-        unless data["expires_in"].is_a?(Integer)
+        unless data['expires_in'].is_a?(Integer)
           raise RefreshError.new("Invalid expires_in in response", retry_possible: false)
         end
 
-        unless data["refresh_token"].nil? || data["refresh_token"].is_a?(String)
+        unless data['refresh_token'].nil? || data['refresh_token'].is_a?(String)
           raise RefreshError.new("Invalid refresh_token in response", retry_possible: false)
         end
 
         # Token type must be DPoP
-        unless data["token_type"] == "DPoP"
-          raise RefreshError.new("Invalid token_type: #{data["token_type"]}", retry_possible: false)
+        unless data['token_type'] == 'DPoP'
+          raise RefreshError.new("Invalid token_type: #{data['token_type']}", retry_possible: false)
         end
 
         # Scope must include original scopes
         original_scopes = session.scope.split
-        response_scopes = data["scope"].split
+        response_scopes = data['scope'].split
         unless (original_scopes - response_scopes).empty?
           raise RefreshError.new("Invalid scope in response", retry_possible: false)
         end
 
         # Subject must match
-        return if data["sub"] == session.tokens.sub
+        return if data['sub'] == session.tokens.sub
 
         raise RefreshError.new("Subject mismatch in response", retry_possible: false)
       end

data/lib/authproto/validated_uri.rb

@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require 'forwardable'
+require 'uri'
+
+module AuthProto
+
+  #
+  # An HTTP(S) URI with a required host and preserved source components.
+  #
+  # Unlike URI::HTTP, port is the explicit port string (or nil when omitted),
+  # userinfo preserves an empty component, and path treats "/" as empty.
+  # Other readers and string conversion delegate to the parsed URI.
+  #
+
+  class ValidatedURI
+    extend Forwardable
+
+    attr_reader :port, :userinfo, :path
+
+    def_delegators :@uri, :scheme, :host, :hostname, :query, :fragment,
+                   :user, :password, :registry, :opaque, :default_port,
+                   :request_uri, :origin, :absolute?, :relative?, :hierarchical?,
+                   :to_s, :to_str
+
+    # @param url [String, URI::Generic] URL to parse; URI inputs use their serialized form
+    # @raise [URI::InvalidURIError] if the URL is malformed, not HTTP(S), or has no host
+    #
+    def initialize(url)
+      unless url.is_a?(String) || url.is_a?(URI::Generic)
+        raise URI::InvalidURIError, "URL must be a string or URI"
+      end
+
+      source = url.to_s
+      @uri = URI.parse(source)
+
+      unless @uri.is_a?(URI::HTTP) && @uri.host && !@uri.host.empty?
+        raise URI::InvalidURIError, "URL must use HTTP or HTTPS and include a host"
+      end
+
+      @userinfo, @port = URI.split(source).values_at(1, 3)
+      @path = (@uri.path == '/') ? '' : @uri.path
+    end
+
+    def specified_port
+      port
+    end
+
+    def effective_port
+      @uri.port
+    end
+
+    def to_uri
+      @uri
+    end
+  end
+end

data/lib/authproto/version.rb

@@ -4,5 +4,5 @@ module AuthProto
 
   # Current gem version.
   # @return [String]
-  VERSION = "0.3.0.beta1"
+  VERSION = "0.3.0.beta2"
 end

data/lib/authproto.rb

@@ -6,6 +6,7 @@ require_relative 'authproto/http_client'
 require_relative 'authproto/insecure_http_client'
 require_relative 'authproto/localhost_server'
 require_relative 'authproto/serialization/dpop_key'
+require_relative 'authproto/validated_uri'
 require_relative 'authproto/version'
 
 #

data/misc/yard_attributes.rb

@@ -0,0 +1,34 @@
+require 'yard'
+
+YARD::Parser::SourceParser.after_parse_list do
+  fields = YARD::Registry.at('AuthProto::PAR::Request::Fields').attributes[:instance]
+
+  {
+    'AuthProto::PAR::Request' => false,
+    'AuthProto::PAR::Request::Configuration' => true
+  }.each do |path, writable|
+    target = YARD::Registry.at(path)
+
+    fields.each do |name, attribute|
+      original = attribute[:read]
+
+      reader = YARD::CodeObjects::MethodObject.new(target, name, :instance)
+      reader.docstring = original.docstring.to_raw
+      reader.signature = "def #{name}"
+
+      target.attributes[:instance][name] = { read: reader, write: nil }
+
+      next unless writable
+
+      return_tag = reader.tag(:return)
+      return_tag.types = (return_tag.types + ['nil']).uniq
+
+      writer = YARD::CodeObjects::MethodObject.new(target, "#{name}=", :instance)
+      writer.docstring = original.docstring.to_raw
+      writer.parameters = [['value', nil]]
+      writer.signature = "def #{name}=(value)"
+
+      target.attributes[:instance][name][:write] = writer
+    end
+  end
+end

data/sig/authproto/client.rbs

@@ -11,29 +11,28 @@ module AuthProto
 
     attr_reader client_id: String
     attr_reader redirect_uri: String
-    attr_reader client_metadata: ClientMetadata
+    attr_reader client_metadata: Metadata::ClientMetadata
     attr_reader session_manager: State::SessionManager
     attr_reader dpop_client: DPoP::Client
 
-    def initialize: (client_id: String, redirect_uri: String, ?metadata: json_object?, ?dpop_key: (json_object | JOSE::Map)?) -> void
-    def authorize: (?handle: String?, ?pds_url: String?, ?scope: String) -> authorization_result
+    def initialize: (client_id: String, redirect_uri: String, ?metadata: json_object?, ?dpop_key: (json_object | JOSE::Map)?, ?signing_key: (json_object | JOSE::JWK)?) -> void
+    def authorize: (?handle: String?, ?pds: String?, ?scope: String) -> authorization_result
     def handle_callback: (code: String, state: String, iss: String) -> callback_result
     def get_tokens: (String session_id) -> token_info?
     def refresh_token: (String session_id) -> refreshed_tokens
     def authorized?: (String session_id) -> bool
     def auth_headers: (session_id: String, method: String, url: String) -> Hash[String, String]
-    def remove_session: (String session_id) -> void
+    def delete_session: (String session_id) -> void
     def cleanup_expired_sessions: () -> void
 
     private
-    def load_client_metadata: (json_object? metadata) -> ClientMetadata
+    def load_client_metadata: (json_object? metadata) -> Metadata::ClientMetadata
     def validate_redirect_uri: () -> void
+    def initialize_signing_key: ((json_object | JOSE::JWK)? key) -> JOSE::JWK?
     def initialize_dpop: ((json_object | JOSE::Map)? key) -> DPoP::Client
-    def validate_auth_params!: (String? handle, String? pds_url, String scope) -> void
-    def resolve_from_handle: (String handle, State::Session session) -> { server: ServerMetadata::AuthorizationServer, pds: String }
-    def resolve_from_pds: (String pds_url, State::Session session) -> { server: ServerMetadata::AuthorizationServer, pds: String }
-    def resolve_auth_server: (String pds_url) -> ServerMetadata::AuthorizationServer
-    def generate_authorization_url: (ServerMetadata::AuthorizationServer auth_server, State::Session session, ?login_hint: String?) -> String
+    def validate_auth_params: (String? handle, String? pds, String scope) -> void
+    def resolve_auth_server: (String pds) -> Metadata::AuthorizationServer
+    def submit_authorization_par: (Metadata::AuthorizationServer authorization_server, State::Session session, ?login_hint: String?) -> String
     def exchange_code: (code: String, session: State::Session) -> json_object
     def make_token_request: (String code, State::Session session) -> http_response
     def requires_dpop_nonce?: (http_response response) -> bool

data/sig/authproto/dpop/client.rbs

@@ -9,15 +9,8 @@ module AuthProto
       attr_reader nonce_manager: NonceManager
 
       def initialize: (?key_manager: KeyManager?, ?nonce_ttl: Integer?) -> void
-      def generate_proof: (http_method: String, http_uri: String, ?access_token: String?, ?nonce: String?) -> JOSE::SignedBinary
+      def generate_proof: (method: String, uri: String, ?access_token: String?, ?nonce: String?) -> JOSE::SignedBinary
       def process_response: (Hash[String, String]? response_headers, String server_url) -> void
-      def request_headers: (String proof) -> { "DPoP" => String }
-      def public_key: () -> json_object
-      def export_key: (?include_private: bool) -> JOSE::Map
-
-      private
-      def extract_nonce: (Hash[String | Symbol, String] headers) -> String?
-      def origin_for_uri: (URI::HTTP uri) -> String
     end
   end
 end

data/sig/authproto/dpop/nonce_manager.rbs

@@ -12,7 +12,6 @@ module AuthProto
       def update: (nonce: String, server_url: String) -> void
       def get: (String server_url) -> String?
       def clear: (String server_url) -> bool
-      def valid_nonce?: (String server_url) -> bool
 
       private
       def normalize_server_url: (String url) -> String

data/sig/authproto/dpop/proof_generator.rbs

@@ -11,8 +11,8 @@ module AuthProto
       def initialize: (AuthProto::DPoP::KeyManager key_manager) -> void
 
       def generate: (
-          http_method: String,
-          http_uri: String,
+          method: String,
+          uri: String,
           ?nonce: String?,
           ?access_token: String?,
           ?ath: bool?
@@ -20,13 +20,13 @@ module AuthProto
 
       private
 
-      def validate_inputs: (String http_method, String http_uri) -> void
+      def validate_inputs: (String method, String uri) -> void
 
       def build_header: () -> { typ: "dpop+jwt", alg: "ES256", jwk: Hash[String, untyped] }
 
       def build_payload: (
-          http_method: String,
-          http_uri: String,
+          method: String,
+          uri: String,
           ?nonce: String?,
           ?access_token: String?,
           ?include_ath: bool?

data/sig/authproto/http_client.rbs

@@ -34,10 +34,10 @@ module AuthProto
     def validate_ip: (URI::HTTP uri) -> void
     def forbidden_ip?: (IPAddr ip) -> bool
     def make_request: (URI::HTTP uri, ?Hash[String, String] headers, ?Integer redirect_count, ?follow_redirects: bool) -> Net::HTTPResponse
-    def make_post_request: (URI::HTTP uri, http_body body, ?Hash[String, String] headers, ?Integer redirect_count) -> Net::HTTPResponse
+    def make_post_request: (URI::HTTP uri, http_body body, ?Hash[String, String] headers) -> Net::HTTPResponse
     def configure_http_client: (Net::HTTP http, ?ssl: bool) -> void
     def add_security_headers: (Net::HTTPRequest request, Hash[String, String] headers) -> void
-    def handle_redirect: (original_uri: URI::HTTP, response: Net::HTTPResponse, headers: Hash[String, String], redirect_count: Integer, ?method: Symbol, ?body: http_body) -> Net::HTTPResponse
+    def handle_redirect: (original_uri: URI::HTTP, response: Net::HTTPResponse, headers: Hash[String, String], redirect_count: Integer) -> Net::HTTPResponse
     def validate_response: (Net::HTTPResponse response) -> void
     def check_success_status: (Net::HTTPResponse response) -> void
     def check_content_length: (Net::HTTPResponse response) -> void

data/sig/authproto/{server_metadata → metadata}/authorization_server.rbs

@@ -1,5 +1,5 @@
 module AuthProto
-  module ServerMetadata
+  module Metadata
     class AuthorizationServer
       @issuer: String
       @authorization_endpoint: String
@@ -30,10 +30,10 @@ module AuthProto
       def initialize: (Hash[String, untyped] metadata) -> void
 
       # Fetches and validates Authorization Server metadata from an issuer URL
-      # @param issuer [String] Authorization Server issuer URL
+      # @param url [String] Authorization Server issuer URL
       # @return [AuthorizationServer] new instance with fetched metadata
       # @raise [InvalidAuthorizationServer] if metadata is invalid
-      def self.from_issuer: (String issuer) -> AuthorizationServer
+      def self.from_url: (String url) -> AuthorizationServer
 
       def to_h: () -> Hash[Symbol, untyped]
 
@@ -45,27 +45,33 @@ module AuthProto
 
       def validate_https_url: (String url) -> String
 
-      def validate_response_types: (Array[String] types) -> void
+      def validate_response_types: () -> void
 
-      def validate_grant_types: (Array[String] types) -> void
+      def validate_grant_types: () -> void
 
-      def validate_code_challenge_methods: (Array[String] methods) -> void
+      def validate_code_challenge_methods: () -> void
 
-      def validate_token_endpoint_auth_methods: (Array[String] methods) -> void
+      def validate_token_endpoint_auth_methods: () -> void
 
-      def validate_token_endpoint_auth_signing_algs: (Array[String] algs) -> void
+      def validate_token_endpoint_auth_signing_algs: () -> void
 
-      def validate_dpop_signing_algs: (Array[String] algs) -> void
+      def validate_dpop_signing_algs: () -> void
 
-      def validate_scopes: (Array[String] scopes) -> void
+      def validate_scopes: () -> void
+
+      def validate_string_array: (untyped values, String field) -> void
 
       def validate_boolean_field: (Hash[String, untyped] metadata, String field, bool required_value) -> void
 
       private def self.fetch_metadata: (String issuer) -> http_response
 
-      private def self.parse_metadata: (String body) -> Hash[String, untyped]
+      private def self.validate_source_url: (String issuer) -> void
+
+      private def self.validate_response: (http_response response) -> void
+
+      private def self.parse_metadata: (String? body) -> Hash[String, untyped]
 
-      private def self.validate_issuer: (String metadata_issuer, String request_issuer) -> void
+      private def self.validate_issuer_matches: (String metadata_issuer, String request_issuer) -> void
     end
   end
 end

data/sig/authproto/metadata/client_metadata.rbs

@@ -0,0 +1,118 @@
+module AuthProto
+  module Metadata
+    # Handles and validates AT Protocol OAuth client metadata.
+    class ClientMetadata
+      AUTH_METHOD_PRIVATE_KEY_JWT: String
+      AUTH_METHOD_NONE: String
+      SCOPE_PATTERN: Regexp
+
+      @client_id: String
+
+      @grant_types: Array[String]
+
+      @response_types: Array[String]
+
+      @redirect_uris: Array[String]
+
+      @scope: String
+
+      @client_name: String?
+
+      @application_type: String
+
+      @client_uri: String?
+
+      @logo_uri: String?
+
+      @tos_uri: String?
+
+      @policy_uri: String?
+
+      @token_endpoint_auth_method: String
+
+      @token_endpoint_auth_signing_alg: String?
+
+      @jwks: Hash[String, untyped]?
+
+      @jwks_uri: String?
+
+      attr_reader client_id: String
+      attr_reader grant_types: Array[String]
+      attr_reader response_types: Array[String]
+      attr_reader redirect_uris: Array[String]
+      attr_reader scope: String
+      attr_reader client_name: String?
+      attr_reader client_uri: String?
+      attr_reader logo_uri: String?
+      attr_reader tos_uri: String?
+      attr_reader policy_uri: String?
+      attr_reader token_endpoint_auth_method: String
+      attr_reader jwks: Hash[String, untyped]?
+      attr_reader jwks_uri: String?
+      attr_reader application_type: String
+
+      def initialize: (Hash[String, untyped] metadata) -> void
+
+      def self.from_url: (String url) -> ClientMetadata
+
+      def self.from_localhost_url: (String url) -> ClientMetadata
+
+      def confidential?: () -> bool
+
+      private
+
+      def validate_and_set_metadata: (Hash[String, untyped] metadata) -> void
+
+      def validate_client_id: (String client_id) -> String
+
+      def valid_https_client_id?: (String client_id) -> bool
+
+      def valid_localhost_client_id?: (String client_id) -> bool
+
+      def validate_grant_types: (Array[String] grant_types) -> Array[String]
+
+      def validate_response_types: (Array[String] response_types) -> Array[String]
+
+      def validate_redirect_uris: (Array[String] uris) -> Array[String]
+
+      def validate_redirect_uri: (String value) -> void
+
+      def validate_https_redirect_uri: (String url) -> void
+
+      def validate_redirect_uri_origin: (String url) -> void
+
+      def validate_native_redirect_uri: (String url) -> void
+
+      def validate_custom_scheme: (URI::Generic uri) -> void
+
+      def validate_scope: (String scope) -> String
+
+      def validate_application_type: (String? type) -> String
+
+      def validate_client_name: (String? name) -> String?
+
+      def validate_client_uri: (String? uri) -> String?
+
+      def validate_https_uri: (String? uri) -> String?
+
+      def validate_jwks: (Hash[String, untyped] jwks) -> void
+
+      def validate_auth_methods: (Hash[String, untyped] metadata) -> void
+
+      def validate_auth_public: (Hash[String, untyped] metadata) -> void
+
+      def validate_auth_confidential: (Hash[String, untyped] metadata) -> void
+
+      def validate_dpop: (Hash[String, untyped] metadata) -> void
+
+    end
+  end
+end
+
+module AuthProto
+  module ApplicationType
+    WEB: String
+    NATIVE: String
+    ALL: Array[String]
+  end
+end