@_mustachio/openauth 0.10.0 → 0.11.0

package/src/http/handlers/end-session.ts

@@ -0,0 +1,106 @@
+/**
+ * `GET|POST /end_session` — OIDC RP-Initiated Logout 1.0 §2.
+ *
+ * Per spec, both GET (query) and POST (form body) are supported. The
+ * tenant is resolved via the standard `tenantMiddleware`; the issuer URL
+ * is taken from the per-request context.
+ *
+ * Outputs follow `domain/logout.ts`:
+ *  - `redirect` → 302 to the validated `post_logout_redirect_uri` with
+ *    `state` echoed when present.
+ *  - `ok` → 200 with a minimal plain-text body. Hosts that need a styled
+ *    "logged out" page can layer their own handler over `/end_session`.
+ *  - errors → 400 with a JSON OAuth-style body (never 302; an unregistered
+ *    `post_logout_redirect_uri` would otherwise be an open redirector).
+ */
+import { endSession } from "../../domain/logout"
+import { authError } from "../../types/error"
+import { isErr } from "../../types/result"
+
+import { applyResponsePolicy } from "../cookies"
+import type { HttpContext, HttpDeps } from "../context"
+import { tokenEndpointErrorResponse } from "../errors"
+import { endSessionParamsSchema } from "../schemas/end-session"
+
+export function makeEndSessionHandler(deps: HttpDeps) {
+  return async (c: HttpContext): Promise<Response> => {
+    const tenant = c.get("tenant")
+    if (!tenant) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest("tenant unresolved"),
+      )
+    }
+
+    // GET → query; POST → form body. Anything else → 400.
+    let raw: Record<string, string>
+    const httpMethod = c.req.method.toUpperCase()
+    if (httpMethod === "GET") {
+      raw = Object.fromEntries(new URL(c.req.url).searchParams.entries())
+    } else if (httpMethod === "POST") {
+      const ct = (c.req.header("content-type") ?? "").toLowerCase()
+      if (!ct.startsWith("application/x-www-form-urlencoded")) {
+        return tokenEndpointErrorResponse(
+          authError.invalidRequest(
+            "POST /end_session requires application/x-www-form-urlencoded body",
+          ),
+        )
+      }
+      raw = Object.fromEntries(new URLSearchParams(await c.req.raw.text()))
+    } else {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(`unsupported method "${httpMethod}"`),
+      )
+    }
+
+    const parsed = endSessionParamsSchema.safeParse(raw)
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(
+          parsed.error.issues[0]?.message ?? "invalid request",
+        ),
+      )
+    }
+    const q = parsed.data
+
+    const res = await endSession(
+      {
+        ...(q.id_token_hint !== undefined
+          ? { idTokenHint: q.id_token_hint }
+          : {}),
+        ...(q.client_id !== undefined ? { clientId: q.client_id } : {}),
+        ...(q.post_logout_redirect_uri !== undefined
+          ? { postLogoutRedirectUri: q.post_logout_redirect_uri }
+          : {}),
+        ...(q.state !== undefined ? { state: q.state } : {}),
+      },
+      tenant,
+      {
+        configStore: deps.configStore,
+        tokenStore: deps.tokenStore,
+        keyStore: deps.keyStore,
+        ...(deps.auditLog ? { auditLog: deps.auditLog } : {}),
+        issuerUrl: c.get("issuerUrl"),
+        clock: deps.clock,
+      },
+    )
+
+    if (isErr(res)) return tokenEndpointErrorResponse(res.error)
+
+    if (res.value.kind === "redirect") {
+      return applyResponsePolicy(
+        new Response(null, {
+          status: 302,
+          headers: { location: res.value.url },
+        }),
+        { setCookies: [], cookieDefaults: deps.cookieDefaults },
+      )
+    }
+    return new Response("Logged out.", {
+      status: 200,
+      headers: {
+        "content-type": "text/plain; charset=utf-8",
+        "cache-control": "no-store",
+      },
+    })
+  }
+}

package/src/http/handlers/metadata.ts

@@ -16,9 +16,14 @@ import { isErr } from "../../types/result"
 import type { HttpContext, HttpDeps } from "../context"
 import { tokenEndpointErrorResponse } from "../errors"
 
-export function makeDiscoveryHandler(_deps: HttpDeps) {
+export function makeDiscoveryHandler(deps: HttpDeps) {
   return async (c: HttpContext): Promise<Response> => {
-    const doc = buildDiscoveryDocument({ issuerUrl: c.get("issuerUrl") })
+    const doc = buildDiscoveryDocument({
+      issuerUrl: c.get("issuerUrl"),
+      ...(deps.customScopeClaims !== undefined
+        ? { customScopeClaims: deps.customScopeClaims }
+        : {}),
+    })
     return new Response(JSON.stringify(doc), {
       status: 200,
       headers: {

package/src/http/handlers/par.ts

@@ -0,0 +1,84 @@
+/**
+ * `POST /par` — Pushed Authorization Requests (RFC 9126 §2).
+ *
+ * Body: `application/x-www-form-urlencoded` carrying the same parameter
+ * set the RP would otherwise put on `GET /authorize`, plus `client_id`
+ * and optionally `client_secret`. Client credentials may alternatively
+ * ride in `Authorization: Basic` (RFC 6749 §2.3.1).
+ *
+ * Response: HTTP 201, JSON `{request_uri, expires_in}` on success.
+ */
+import { resolveClientCredentials } from "../../domain/client-auth"
+import { pushAuthorizationRequest } from "../../domain/par"
+import { authError } from "../../types/error"
+import { isErr } from "../../types/result"
+
+import type { HttpContext, HttpDeps } from "../context"
+import { tokenEndpointErrorResponse } from "../errors"
+import { parBodySchema } from "../schemas/par"
+
+export function makeParHandler(deps: HttpDeps) {
+  return async (c: HttpContext): Promise<Response> => {
+    const tenant = c.get("tenant")
+    if (!tenant) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest("tenant unresolved"),
+      )
+    }
+    const ct = (c.req.header("content-type") ?? "").toLowerCase()
+    if (!ct.startsWith("application/x-www-form-urlencoded")) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(
+          "body must be application/x-www-form-urlencoded",
+        ),
+      )
+    }
+    const raw = Object.fromEntries(
+      new URLSearchParams(await c.req.raw.text()).entries(),
+    )
+    const parsed = parBodySchema.safeParse(raw)
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(
+          parsed.error.issues[0]?.message ?? "invalid request",
+        ),
+      )
+    }
+    const creds = resolveClientCredentials({
+      authorizationHeader: c.req.header("authorization") ?? null,
+      bodyClientId: parsed.data.client_id,
+      bodyClientSecret: parsed.data.client_secret,
+    })
+    const clientId = creds?.clientId ?? parsed.data.client_id
+
+    // Strip auth-only fields from the param record we persist — they
+    // belong to `/par`, not to the rehydrated `/authorize` request.
+    const { client_secret: _strip, ...paramsForAuthorize } = parsed.data
+    void _strip
+
+    const res = await pushAuthorizationRequest(
+      {
+        clientId,
+        ...(creds?.clientSecret !== undefined
+          ? { clientSecret: creds.clientSecret }
+          : {}),
+        params: paramsForAuthorize,
+      },
+      tenant,
+      {
+        configStore: deps.configStore,
+        sessionStore: deps.sessionStore,
+        ...(deps.auditLog ? { auditLog: deps.auditLog } : {}),
+        clock: deps.clock,
+      },
+    )
+    if (isErr(res)) return tokenEndpointErrorResponse(res.error)
+    return new Response(JSON.stringify(res.value), {
+      status: 201,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store",
+      },
+    })
+  }
+}

package/src/http/handlers/register.ts

@@ -0,0 +1,70 @@
+/**
+ * `POST /register` — RFC 7591 Dynamic Client Registration.
+ *
+ * Body: `application/json`. Tenant resolved via the standard middleware.
+ * The framework validates structure here and defers persistence to the
+ * `IdPOptions.registerClient` hook (in `domain/register.ts`).
+ *
+ * Per RFC 7591 §3.2.1, success returns HTTP 201 with JSON body.
+ */
+import { registerNewClient } from "../../domain/register"
+import { authError } from "../../types/error"
+import type { RegisterClientRequest } from "../../types/idp"
+import { isErr } from "../../types/result"
+
+import type { HttpContext, HttpDeps } from "../context"
+import { tokenEndpointErrorResponse } from "../errors"
+import { registerBodySchema } from "../schemas/register"
+
+export function makeRegisterHandler(deps: HttpDeps) {
+  return async (c: HttpContext): Promise<Response> => {
+    const tenant = c.get("tenant")
+    if (!tenant) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest("tenant unresolved"),
+      )
+    }
+    const ct = (c.req.header("content-type") ?? "").toLowerCase()
+    if (!ct.startsWith("application/json")) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest("body must be application/json"),
+      )
+    }
+    let raw: unknown
+    try {
+      raw = await c.req.raw.json()
+    } catch (e) {
+      const reason = e instanceof Error ? e.message : String(e)
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(`malformed JSON: ${reason}`),
+      )
+    }
+    const parsed = registerBodySchema.safeParse(raw)
+    if (!parsed.success) {
+      return tokenEndpointErrorResponse(
+        authError.invalidRequest(
+          parsed.error.issues[0]?.message ?? "invalid request",
+        ),
+      )
+    }
+    // Schema is `.passthrough()` (RFC 7591 allows extension metadata
+    // fields); the declared `RegisterClientRequest` fields are all
+    // statically present in `parsed.data`. This cast just drops the
+    // passthrough's `[k: string]: unknown` index signature so the
+    // downstream domain function sees the typed contract.
+    const request = parsed.data as RegisterClientRequest
+
+    const res = await registerNewClient(request, tenant, {
+      ...(deps.registerClient ? { registerClient: deps.registerClient } : {}),
+      clock: deps.clock,
+    })
+    if (isErr(res)) return tokenEndpointErrorResponse(res.error)
+    return new Response(JSON.stringify(res.value), {
+      status: 201,
+      headers: {
+        "content-type": "application/json",
+        "cache-control": "no-store",
+      },
+    })
+  }
+}

package/src/http/handlers/token.ts

@@ -17,6 +17,7 @@
  * refresh-token snapshot is authoritative.
  */
 import { clientCredentialsGrant } from "../../domain/client-credentials"
+import { canonicalHtu, verifyDpopProof } from "../../domain/dpop"
 import { exchangeCode } from "../../domain/token"
 import { exchangeToken } from "../../domain/token-exchange"
 import { refreshTokens } from "../../domain/refresh"
@@ -39,12 +40,53 @@ export function makeTokenHandler(deps: HttpDeps) {
       )
     }
 
+    // `Authorization` carries Basic client auth on /token. DPoP travels in
+    // its own `DPoP:` header (RFC 9449 §5) — never inside `Authorization`.
+    // Parsing Basic first lets a confidential client present its secret
+    // alongside a DPoP proof.
     const basic = parseBasicAuth(c.req.header("authorization") ?? null)
     if (basic) {
       body.set("client_id", basic.id)
       body.set("client_secret", basic.secret)
     }
 
+    // RFC 9449 §5.1 — verify any presented DPoP proof against this
+    // request's actual method + URI. Absent header is fine here (the
+    // grant-specific path enforces `dpopRequired`).
+    const dpopHeader = c.req.header("dpop") ?? null
+    let dpopJkt: string | undefined
+    if (dpopHeader) {
+      const dpopRes = await verifyDpopProof(
+        {
+          proofJwt: dpopHeader,
+          htu: canonicalHtu(c.req.url),
+          htm: "POST",
+          nowSec: Math.floor(deps.clock() / 1000),
+        },
+        { tokenStore: deps.tokenStore },
+      )
+      if (isErr(dpopRes)) {
+        // RFC 9449 §11.1 replay → first-class audit event so operators /
+        // SIEM can spot stolen-key probing distinct from generic proof
+        // verification failures.
+        const errVal = dpopRes.error
+        if (
+          errVal.code === "invalid_dpop_proof" &&
+          errVal.replaySignal &&
+          deps.auditLog
+        ) {
+          await deps.auditLog.log({
+            kind: "dpop_replay_detected",
+            tenantId: null,
+            jtiPrefix: errVal.replaySignal.jti.slice(0, 16),
+            timestamp: deps.clock(),
+          })
+        }
+        return tokenEndpointErrorResponse(errVal)
+      }
+      dpopJkt = dpopRes.value.jkt
+    }
+
     const parsed = tokenRequestSchema.safeParse(
       Object.fromEntries(body.entries()),
     )
@@ -77,6 +119,7 @@ export function makeTokenHandler(deps: HttpDeps) {
           ...(req.code_verifier !== undefined
             ? { codeVerifier: req.code_verifier }
             : {}),
+          ...(dpopJkt !== undefined ? { dpopJkt } : {}),
         },
         {
           configStore: deps.configStore,
@@ -89,6 +132,9 @@ export function makeTokenHandler(deps: HttpDeps) {
             : {}),
           issuerUrl: c.get("issuerUrl"),
           clock: deps.clock,
+          ...(deps.customScopeClaims !== undefined
+            ? { customScopeClaims: deps.customScopeClaims }
+            : {}),
         },
       )
       if (isErr(result)) return tokenEndpointErrorResponse(result.error)
@@ -133,6 +179,9 @@ export function makeTokenHandler(deps: HttpDeps) {
             : {}),
           issuerUrl: c.get("issuerUrl"),
           clock: deps.clock,
+          ...(deps.customScopeClaims !== undefined
+            ? { customScopeClaims: deps.customScopeClaims }
+            : {}),
         },
         tenantRes.value,
       )
@@ -150,6 +199,7 @@ export function makeTokenHandler(deps: HttpDeps) {
           ...(req.client_secret !== undefined
             ? { clientSecret: req.client_secret }
             : {}),
+          ...(dpopJkt !== undefined ? { dpopJkt } : {}),
         },
         {
           configStore: deps.configStore,
@@ -158,6 +208,9 @@ export function makeTokenHandler(deps: HttpDeps) {
           ...(deps.auditLog ? { auditLog: deps.auditLog } : {}),
           issuerUrl: c.get("issuerUrl"),
           clock: deps.clock,
+          ...(deps.customScopeClaims !== undefined
+            ? { customScopeClaims: deps.customScopeClaims }
+            : {}),
         },
       )
       if (isErr(refreshResult))
@@ -195,6 +248,9 @@ export function makeTokenHandler(deps: HttpDeps) {
           : {}),
         issuerUrl: c.get("issuerUrl"),
         clock: deps.clock,
+        ...(deps.customScopeClaims !== undefined
+          ? { customScopeClaims: deps.customScopeClaims }
+          : {}),
       },
     )
     if (isErr(exchangeResult)) {

package/src/http/handlers/userinfo.ts

@@ -1,7 +1,10 @@
 /**
  * OIDC `/userinfo` handler (OIDC Core §5.3). Accepts `GET` or `POST` per
- * the spec.
+ * the spec. Supports both `Authorization: Bearer ...` (RFC 6750) and
+ * `Authorization: DPoP ...` (RFC 9449) — the domain layer enforces the
+ * proof match against the access token's `cnf.jkt` when bound.
  */
+import { canonicalHtu } from "../../domain/dpop"
 import { userinfo } from "../../domain/userinfo"
 import { isErr } from "../../types/result"
 
@@ -9,44 +12,43 @@ import type { HttpContext, HttpDeps } from "../context"
 
 export function makeUserinfoHandler(deps: HttpDeps) {
   return async (c: HttpContext): Promise<Response> => {
-    const bearer = extractBearer(c.req.header("authorization") ?? null)
-    if (!bearer) {
-      const r = new Response(
-        JSON.stringify({
-          error: "invalid_token",
-          error_description: "missing bearer token",
-        }),
-        {
-          status: 401,
-          headers: {
-            "content-type": "application/json",
-            "www-authenticate": 'Bearer realm="userinfo"',
-          },
-        },
+    const auth = extractAuthorization(c.req.header("authorization") ?? null)
+    if (!auth) {
+      return wwwAuthenticateResponse(
+        "Bearer",
+        "invalid_token",
+        "missing bearer / DPoP token",
+        401,
       )
-      return r
     }
 
-    const res = await userinfo(bearer, {
-      keyStore: deps.keyStore,
-      issuerUrl: c.get("issuerUrl"),
-    })
+    const dpopProof = c.req.header("dpop") ?? undefined
+    const res = await userinfo(
+      {
+        accessToken: auth.token,
+        scheme: auth.scheme,
+        ...(dpopProof !== undefined ? { dpopProof } : {}),
+        htu: canonicalHtu(c.req.url),
+        htm: c.req.method.toUpperCase(),
+        nowSec: Math.floor(deps.clock() / 1000),
+      },
+      {
+        keyStore: deps.keyStore,
+        tokenStore: deps.tokenStore,
+        issuerUrl: c.get("issuerUrl"),
+        ...(deps.customScopeClaims !== undefined
+          ? { customScopeClaims: deps.customScopeClaims }
+          : {}),
+      },
+    )
     if (isErr(res)) {
-      // OIDC userinfo returns 401 on invalid token (vs. 400 elsewhere).
-      const err = res.error
-      return new Response(
-        JSON.stringify({
-          error: "invalid_token",
-          error_description: err.description,
-        }),
-        {
-          status: 401,
-          headers: {
-            "content-type": "application/json",
-            "www-authenticate": `Bearer error="invalid_token"`,
-          },
-        },
-      )
+      const error = res.error
+      const scheme = auth.scheme
+      const wireError =
+        error.code === "invalid_dpop_proof"
+          ? "invalid_dpop_proof"
+          : "invalid_token"
+      return wwwAuthenticateResponse(scheme, wireError, error.description, 401)
     }
 
     return new Response(JSON.stringify(res.value), {
@@ -59,8 +61,30 @@ export function makeUserinfoHandler(deps: HttpDeps) {
   }
 }
 
-function extractBearer(header: string | null): string | null {
+function extractAuthorization(
+  header: string | null,
+): { scheme: "Bearer" | "DPoP"; token: string } | null {
   if (!header) return null
-  const m = /^Bearer\s+(.+)$/i.exec(header)
-  return m?.[1] ?? null
+  const m = /^(Bearer|DPoP)\s+(.+)$/i.exec(header)
+  if (!m || !m[1] || !m[2]) return null
+  const scheme = m[1].toLowerCase() === "dpop" ? "DPoP" : "Bearer"
+  return { scheme, token: m[2] }
+}
+
+function wwwAuthenticateResponse(
+  scheme: "Bearer" | "DPoP",
+  error: string,
+  description: string,
+  status: number,
+): Response {
+  return new Response(
+    JSON.stringify({ error, error_description: description }),
+    {
+      status,
+      headers: {
+        "content-type": "application/json",
+        "www-authenticate": `${scheme} error="${error}"`,
+      },
+    },
+  )
 }

package/src/http/router.ts

@@ -19,8 +19,11 @@ import { Hono } from "hono"
 
 import { makeAuthorizeHandler } from "./handlers/authorize"
 import { makeCallbackHandler } from "./handlers/callback"
+import { makeEndSessionHandler } from "./handlers/end-session"
 import { makeDiscoveryHandler, makeJwksHandler } from "./handlers/metadata"
 import { makeMethodRouteHandler } from "./handlers/method-route"
+import { makeParHandler } from "./handlers/par"
+import { makeRegisterHandler } from "./handlers/register"
 import { makeIntrospectHandler, makeRevokeHandler } from "./handlers/revocation"
 import { makeTokenHandler } from "./handlers/token"
 import { makeUserinfoHandler } from "./handlers/userinfo"
@@ -62,5 +65,21 @@ export function buildRouter(deps: HttpDeps): Hono<HttpEnv> {
   app.post("/revoke", makeRevokeHandler(deps))
   app.post("/introspect", makeIntrospectHandler(deps))
 
+  // OIDC RP-Initiated Logout 1.0. Tenant resolved via the standard
+  // middleware — same partitioning rules as `/authorize`.
+  app.use("/end_session", tenantMiddleware(deps))
+  app.get("/end_session", makeEndSessionHandler(deps))
+  app.post("/end_session", makeEndSessionHandler(deps))
+
+  // RFC 9126 Pushed Authorization Requests.
+  app.use("/par", tenantMiddleware(deps))
+  app.post("/par", makeParHandler(deps))
+
+  // RFC 7591 Dynamic Client Registration. Tenant resolution uses the
+  // standard middleware — partitioned hosts may carve out per-tenant
+  // registration endpoints transparently.
+  app.use("/register", tenantMiddleware(deps))
+  app.post("/register", makeRegisterHandler(deps))
+
   return app
 }

package/src/http/schemas/authorize.ts

@@ -32,6 +32,12 @@ const scopeParam = z
   )
   .pipe(z.array(z.string().regex(SCOPE_TOKEN, "invalid scope token")))
 
+/**
+ * Standard `/authorize` query schema. Used both for direct calls and as
+ * the validation target after a PAR record is rehydrated — the PAR'd
+ * params are passed through this same parser so semantic checks stay in
+ * a single place.
+ */
 export const authorizeQuerySchema = z
   .object({
     response_type: z.string({
@@ -52,6 +58,27 @@ export const authorizeQuerySchema = z
     prompt: csv.optional(),
     ui_locales: csv.optional(),
     nonce: z.string().optional(),
+    /**
+     * OIDC Core §5.5 — JSON-encoded claims request. Parsing + structural
+     * validation happens in the domain layer; here we just accept any
+     * non-empty string and let the handler parse + reject malformed.
+     */
+    claims: z.string().min(1).optional(),
+  })
+  .passthrough()
+
+/**
+ * RFC 9126 §4: when `request_uri` is presented, the user-agent's
+ * `/authorize` URL is allowed to carry only `client_id` and
+ * `request_uri`; the rest of the parameter set must come from the
+ * stored PAR record.
+ */
+export const authorizeRequestUriQuerySchema = z
+  .object({
+    client_id: z
+      .string({ required_error: "missing client_id" })
+      .min(1, "empty client_id"),
+    request_uri: z.string({ required_error: "missing request_uri" }).min(1),
   })
   .passthrough()
 

package/src/http/schemas/end-session.ts

@@ -0,0 +1,23 @@
+/**
+ * Zod schema for `/end_session` (OIDC RP-Initiated Logout 1.0 §2).
+ *
+ * Every parameter is optional per spec. The domain layer enforces the
+ * "needs identifying client to honor post_logout_redirect_uri" rule.
+ */
+import { z } from "zod"
+
+export const endSessionParamsSchema = z
+  .object({
+    id_token_hint: z.string().optional(),
+    client_id: z.string().min(1).optional(),
+    post_logout_redirect_uri: z
+      .string()
+      .url("post_logout_redirect_uri must be a valid URL")
+      .optional(),
+    state: z.string().optional(),
+    logout_hint: z.string().optional(),
+    ui_locales: z.string().optional(),
+  })
+  .passthrough()
+
+export type EndSessionParams = z.infer<typeof endSessionParamsSchema>

package/src/http/schemas/par.ts

@@ -0,0 +1,23 @@
+/**
+ * Zod schema for the `POST /par` body (RFC 9126 §2).
+ *
+ * The shape is identical to `/authorize` query parameters; we just need
+ * `client_id` to identify the authenticating client. `client_secret` is
+ * accepted in-body for `client_secret_post` auth.
+ */
+import { z } from "zod"
+
+export const parBodySchema = z
+  .object({
+    client_id: z
+      .string({ required_error: "missing client_id" })
+      .min(1, "empty client_id"),
+    client_secret: z.string().optional(),
+  })
+  // `.catchall(z.string())` validates AND types passthrough keys as
+  // strings — `application/x-www-form-urlencoded` values are always
+  // strings at the wire level, so this also rejects malformed bodies
+  // where a key somehow carries a non-string value.
+  .catchall(z.string())
+
+export type ParBody = z.infer<typeof parBodySchema>

package/src/http/schemas/register.ts

@@ -0,0 +1,29 @@
+/**
+ * Zod schema for `POST /register` (RFC 7591 §2).
+ *
+ * The body is `application/json`. We surface invalid structure as
+ * `invalid_request` rather than the spec's `invalid_client_metadata` /
+ * `invalid_redirect_uri` codes — the library collapses all wire-format
+ * problems to the OAuth-2.0 `invalid_request` family for consistency.
+ */
+import { z } from "zod"
+
+export const registerBodySchema = z
+  .object({
+    client_name: z.string().min(1).optional(),
+    redirect_uris: z
+      .array(z.string().url("redirect_uri must be a valid URL"))
+      .min(1, "redirect_uris must be a non-empty array"),
+    grant_types: z.array(z.string()).optional(),
+    response_types: z.array(z.string()).optional(),
+    token_endpoint_auth_method: z
+      .enum(["none", "client_secret_basic", "client_secret_post"])
+      .optional(),
+    scope: z.string().optional(),
+    post_logout_redirect_uris: z.array(z.string().url()).optional(),
+    sector_identifier_uri: z.string().url().optional(),
+    contacts: z.array(z.string()).optional(),
+  })
+  .passthrough()
+
+export type RegisterBody = z.infer<typeof registerBodySchema>