@atproto/oauth-provider 0.19.6 → 0.19.8

package/src/client/client-store.ts

@@ -1,35 +0,0 @@
-import { OAuthClientMetadata } from '@atproto/oauth-types'
-import { Awaitable, buildInterfaceChecker } from '../lib/util/type.js'
-import { ClientId } from './client-id.js'
-
-// Export all types needed to implement the ClientStore interface
-export * from './client-data.js'
-export * from './client-id.js'
-export type { Awaitable, OAuthClientMetadata }
-
-export interface ClientStore {
-  findClient(clientId: ClientId): Awaitable<OAuthClientMetadata>
-}
-
-export const isClientStore = buildInterfaceChecker<ClientStore>([
-  'findClient', //
-])
-
-export function ifClientStore<V extends Partial<ClientStore>>(
-  implementation?: V,
-): (V & ClientStore) | undefined {
-  if (implementation && isClientStore(implementation)) {
-    return implementation
-  }
-
-  return undefined
-}
-
-export function asClientStore<V extends Partial<ClientStore>>(
-  implementation?: V,
-): V & ClientStore {
-  const store = ifClientStore(implementation)
-  if (store) return store
-
-  throw new Error('Invalid ClientStore implementation')
-}

package/src/client/client-utils.ts

@@ -1,37 +0,0 @@
-import {
-  OAuthClientIdDiscoverable,
-  isLocalHostname,
-  parseOAuthDiscoverableClientId,
-} from '@atproto/oauth-types'
-import { InvalidClientIdError } from '../errors/invalid-client-id-error.js'
-import { InvalidRedirectUriError } from '../errors/invalid-redirect-uri-error.js'
-
-export function parseRedirectUri(redirectUri: string): URL {
-  try {
-    return new URL(redirectUri)
-  } catch (err) {
-    throw InvalidRedirectUriError.from(err)
-  }
-}
-
-export function parseDiscoverableClientId(
-  clientId: OAuthClientIdDiscoverable,
-): URL {
-  try {
-    const url = parseOAuthDiscoverableClientId(clientId)
-
-    // Extra validation, prevent usage of invalid internet domain names.
-    if (isLocalHostname(url.hostname)) {
-      throw new InvalidClientIdError(
-        "The client_id's TLD must not be a local hostname",
-      )
-    }
-
-    return url
-  } catch (err) {
-    throw InvalidClientIdError.from(
-      err,
-      'Invalid discoverable client identifier',
-    )
-  }
-}

package/src/client/client.ts

@@ -1,394 +0,0 @@
-import {
-  JWTClaimVerificationOptions,
-  type JWTHeaderParameters,
-  type JWTPayload,
-  type JWTVerifyOptions,
-  type JWTVerifyResult,
-  type KeyLike,
-  type ResolvedKey,
-  UnsecuredJWT,
-  type UnsecuredResult,
-  calculateJwkThumbprint,
-  createLocalJWKSet,
-  createRemoteJWKSet,
-  errors,
-  exportJWK,
-  jwtVerify,
-} from 'jose'
-import { Jwks, SignedJwt, UnsignedJwt } from '@atproto/jwk'
-import {
-  CLIENT_ASSERTION_TYPE_JWT_BEARER,
-  OAuthAuthorizationRequestParameters,
-  OAuthClientCredentials,
-  OAuthClientMetadata,
-  OAuthRedirectUri,
-} from '@atproto/oauth-types'
-import { CLIENT_ASSERTION_MAX_AGE, JAR_MAX_AGE } from '../constants.js'
-import { AuthorizationError } from '../errors/authorization-error.js'
-import { InvalidAuthorizationDetailsError } from '../errors/invalid-authorization-details-error.js'
-import { InvalidClientError } from '../errors/invalid-client-error.js'
-import { InvalidClientMetadataError } from '../errors/invalid-client-metadata-error.js'
-import { InvalidRequestError } from '../errors/invalid-request-error.js'
-import { InvalidScopeError } from '../errors/invalid-scope-error.js'
-import { asArray } from '../lib/util/cast.js'
-import { compareRedirectUri } from '../lib/util/redirect-uri.js'
-import { Awaitable } from '../lib/util/type.js'
-import { ClientAuth } from './client-auth.js'
-import { ClientId } from './client-id.js'
-import { ClientInfo } from './client-info.js'
-
-const { JOSEError } = errors
-
-export class Client {
-  /**
-   * @see {@link https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method}
-   */
-  static readonly AUTH_METHODS_SUPPORTED = ['none', 'private_key_jwt'] as const
-
-  private readonly keyGetter: (
-    protectedHeader: JWTHeaderParameters,
-  ) => Awaitable<KeyLike | Uint8Array>
-
-  constructor(
-    public readonly id: ClientId,
-    public readonly metadata: OAuthClientMetadata,
-    public readonly jwks: undefined | Jwks = metadata.jwks,
-    public readonly info: ClientInfo,
-  ) {
-    // If the remote JWKS content is provided, we don't need to fetch it again.
-    this.keyGetter =
-      jwks || !metadata.jwks_uri
-        ? createLocalJWKSet(jwks || { keys: [] })
-        : createRemoteJWKSet(new URL(metadata.jwks_uri), {})
-  }
-
-  /**
-   * @see {@link https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2}
-   */
-  public async decodeRequestObject(
-    jar: SignedJwt | UnsignedJwt,
-    audience: string,
-  ) {
-    // https://www.rfc-editor.org/rfc/rfc9101.html#name-request-object-2
-    // > If signed, the Authorization Request Object SHOULD contain the Claims
-    // > iss (issuer) and aud (audience) as members with their semantics being
-    // > the same as defined in the JWT [RFC7519] specification. The value of
-    // > aud should be the value of the authorization server (AS) issuer, as
-    // > defined in RFC 8414 [RFC8414].
-    try {
-      // We need to special case the "none" algorithm, as the validation method
-      // is different for signed and unsigned JWTs.
-      if (this.metadata.request_object_signing_alg === 'none') {
-        return await this.jwtVerifyUnsecured(jar, {
-          audience,
-          maxTokenAge: JAR_MAX_AGE / 1e3,
-          allowMissingAudience: true,
-          allowMissingIssuer: true,
-        })
-      }
-
-      return await this.jwtVerify(jar, {
-        audience,
-        maxTokenAge: JAR_MAX_AGE / 1e3,
-        algorithms: this.metadata.request_object_signing_alg
-          ? [this.metadata.request_object_signing_alg]
-          : // https://openid.net/specs/openid-connect-registration-1_0.html#rfc.section.2
-            //
-            // > The default, if omitted, is that any algorithm supported by the OP
-            // > and the RP MAY be used.
-            undefined,
-      })
-    } catch (err) {
-      const message =
-        err instanceof JOSEError
-          ? `Invalid "request" object: ${err.message}`
-          : `Invalid "request" object`
-
-      throw new InvalidRequestError(message, err)
-    }
-  }
-
-  protected async jwtVerifyUnsecured<PayloadType = JWTPayload>(
-    token: string,
-    {
-      audience,
-      allowMissingAudience = false,
-      allowMissingIssuer = false,
-      ...options
-    }: Omit<JWTClaimVerificationOptions, 'issuer'> & {
-      allowMissingIssuer?: boolean
-      allowMissingAudience?: boolean
-    } = {},
-  ): Promise<UnsecuredResult<PayloadType>> {
-    // jose does not support `allowMissingAudience` and `allowMissingIssuer`
-    // options, so we need to handle audience and issuer checks manually (see
-    // bellow).
-
-    const result = UnsecuredJWT.decode<PayloadType>(token, options)
-
-    if (!allowMissingIssuer || result.payload.iss != null) {
-      if (result.payload.iss !== this.id) {
-        throw new JOSEError(`Invalid "iss" claim "${result.payload.iss}"`)
-      }
-    }
-
-    if (!allowMissingAudience || result.payload.aud != null) {
-      if (audience != null) {
-        const payloadAud = asArray(result.payload.aud)
-        if (!asArray(audience).some((aud) => payloadAud.includes(aud))) {
-          throw new JOSEError(`Invalid "aud" claim "${result.payload.aud}"`)
-        }
-      }
-    }
-
-    return result
-  }
-
-  protected async jwtVerify<PayloadType = JWTPayload>(
-    token: string,
-    options?: Omit<JWTVerifyOptions, 'issuer'>,
-  ): Promise<JWTVerifyResult<PayloadType> & ResolvedKey<KeyLike>> {
-    return jwtVerify<PayloadType>(token, this.keyGetter, {
-      ...options,
-      issuer: this.id,
-    })
-  }
-
-  /**
-   * @see {@link https://datatracker.ietf.org/doc/html/rfc6749#section-2.3.1}
-   * @see {@link https://datatracker.ietf.org/doc/html/rfc7523#section-3}
-   * @see {@link https://www.iana.org/assignments/oauth-parameters/oauth-parameters.xhtml#token-endpoint-auth-method}
-   */
-  public async authenticate(
-    input: OAuthClientCredentials,
-    checks: {
-      authorizationServerIdentifier: string
-    },
-  ): Promise<ClientAuth> {
-    const method = this.metadata.token_endpoint_auth_method
-
-    if (method === 'none') {
-      return { method: 'none' }
-    }
-
-    if (method === 'private_key_jwt') {
-      if (!('client_assertion' in input)) {
-        throw new InvalidRequestError(
-          `client authentication method "${method}" required a "client_assertion"`,
-        )
-      }
-
-      if (input.client_assertion_type === CLIENT_ASSERTION_TYPE_JWT_BEARER) {
-        // https://www.rfc-editor.org/rfc/rfc7523.html#section-3
-
-        const result = await this.jwtVerify<{
-          jti: string
-          exp?: number
-        }>(input.client_assertion, {
-          // > 1. The JWT MUST contain an "iss" (issuer) claim that contains a
-          // >    unique identifier for the entity that issued the JWT.
-          //
-          // The "issuer" is already checked by jwtVerify()
-
-          // > 2. The JWT MUST contain a "sub" (subject) claim identifying the
-          // >    principal that is the subject of the JWT. Two cases need to be
-          // >    differentiated: [...] For client authentication, the subject
-          // >    MUST be the "client_id" of the OAuth client.
-          subject: this.id,
-
-          // > 3. The JWT MUST contain an "aud" (audience) claim containing a
-          // >    value that identifies the authorization server as an intended
-          // >    audience. The token endpoint URL of the authorization server
-          // >    MAY be used as a value for an "aud" element to identify the
-          // >    authorization server as an intended audience of the JWT.
-          audience: checks.authorizationServerIdentifier,
-
-          requiredClaims: [
-            // > 4. The JWT MUST contain an "exp" (expiration time) claim that
-            // >    limits the time window during which the JWT can be used.
-            //
-            // @TODO The presence of "exp" didn't use to be enforced by this
-            // implementation (or provided by the oauth-client). This is mostly
-            // fine because "iat" *is* required, but this makes this
-            // implementation non compliant with RFC7523. We can't just make it
-            // required as it might break existing clients.
-
-            // 'exp',
-
-            // > 7. The JWT MAY contain a "jti" (JWT ID) claim that provides a
-            // >    unique identifier for the token. The authorization server
-            // >    MAY ensure that JWTs are not replayed by maintaining the set
-            // >    of used "jti" values for the length of time for which the
-            // >    JWT would be considered valid based on the applicable "exp"
-            // >    instant.
-            'jti',
-          ],
-
-          // > 5. The JWT MAY contain an "nbf" (not before) claim that
-          // >    identifies the time before which the token MUST NOT be
-          // >    accepted for processing.
-          //
-          // This is already enforced by jose
-
-          // > 6. The JWT MAY contain an "iat" (issued at) claim that identifies
-          // >    the time at which the JWT was issued.  Note that the
-          // >    authorization server may reject JWTs with an "iat" claim value
-          // >    that is unreasonably far in the past.
-          maxTokenAge: CLIENT_ASSERTION_MAX_AGE / 1000,
-        }).catch((err) => {
-          const msg =
-            err instanceof JOSEError
-              ? `Validation of "client_assertion" failed: ${err.message}`
-              : `Unable to verify "client_assertion" JWT`
-
-          throw new InvalidClientError(msg, err)
-        })
-
-        if (!result.protectedHeader.kid) {
-          throw new InvalidClientError(`"kid" required in client_assertion`)
-        }
-
-        return {
-          method: 'private_key_jwt',
-          jti: result.payload.jti,
-          exp: result.payload.exp,
-          jkt: await authJwkThumbprint(result.key),
-          alg: result.protectedHeader.alg,
-          kid: result.protectedHeader.kid,
-        }
-      }
-
-      throw new InvalidClientError(
-        `Unsupported client_assertion_type "${input.client_assertion_type}"`,
-      )
-    }
-
-    // @ts-expect-error Ensure to keep Client.AUTH_METHODS_SUPPORTED in sync
-    // with the implementation of this function.
-    if (Client.AUTH_METHODS_SUPPORTED.includes(method)) {
-      throw new Error(
-        `verifyCredentials() should implement all of ${[
-          Client.AUTH_METHODS_SUPPORTED,
-        ]}`,
-      )
-    }
-
-    throw new InvalidClientMetadataError(
-      `Unsupported token_endpoint_auth_method "${method}"`,
-    )
-  }
-
-  /**
-   * Validates the request parameters against the client metadata.
-   */
-  public validateRequest(
-    parameters: Readonly<OAuthAuthorizationRequestParameters>,
-  ): Readonly<OAuthAuthorizationRequestParameters> {
-    if (parameters.client_id !== this.id) {
-      throw new AuthorizationError(
-        parameters,
-        'The "client_id" parameter field does not match the value used to authenticate the client',
-      )
-    }
-
-    if (parameters.scope !== undefined) {
-      // Any scope requested by the client must be registered in the client
-      // metadata.
-      const declaredScopes = this.metadata.scope?.split(' ')
-
-      if (!declaredScopes) {
-        throw new InvalidScopeError(
-          parameters,
-          'Client has no declared scopes in its metadata',
-        )
-      }
-
-      for (const scope of parameters.scope.split(' ')) {
-        if (!declaredScopes.includes(scope)) {
-          throw new InvalidScopeError(
-            parameters,
-            `Scope "${scope}" is not declared in the client metadata`,
-          )
-        }
-      }
-    }
-
-    if (!this.metadata.response_types.includes(parameters.response_type)) {
-      throw new AuthorizationError(
-        parameters,
-        `Invalid response_type "${parameters.response_type}" requested by the client`,
-      )
-    }
-
-    if (parameters.response_type.includes('code')) {
-      if (!this.metadata.grant_types.includes('authorization_code')) {
-        throw new AuthorizationError(
-          parameters,
-          `This client is not allowed to use the "authorization_code" grant type`,
-        )
-      }
-    }
-
-    const { redirect_uri } = parameters
-    if (redirect_uri) {
-      if (
-        !this.metadata.redirect_uris.some((uri) =>
-          compareRedirectUri(uri, redirect_uri),
-        )
-      ) {
-        throw new AuthorizationError(
-          parameters,
-          `Invalid redirect_uri ${redirect_uri}`,
-        )
-      }
-    } else {
-      const { defaultRedirectUri } = this
-      if (defaultRedirectUri) {
-        parameters = { ...parameters, redirect_uri: defaultRedirectUri }
-      } else {
-        // https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-10#authorization-request
-        //
-        // > "redirect_uri": OPTIONAL if only one redirect URI is registered for
-        // > this client. REQUIRED if multiple redirect URIs are registered for this
-        // > client.
-        throw new AuthorizationError(parameters, 'redirect_uri is required')
-      }
-    }
-
-    if (parameters.authorization_details) {
-      const { authorization_details_types } = this.metadata
-      if (!authorization_details_types) {
-        throw new InvalidAuthorizationDetailsError(
-          parameters,
-          'Client Metadata does not declare any "authorization_details"',
-        )
-      }
-
-      for (const detail of parameters.authorization_details) {
-        if (!authorization_details_types?.includes(detail.type)) {
-          throw new InvalidAuthorizationDetailsError(
-            parameters,
-            `Client Metadata does not declare any "authorization_details" of type "${detail.type}"`,
-          )
-        }
-      }
-    }
-
-    return parameters
-  }
-
-  get defaultRedirectUri(): OAuthRedirectUri | undefined {
-    const { redirect_uris } = this.metadata
-    return redirect_uris.length === 1 ? redirect_uris[0] : undefined
-  }
-}
-
-export async function authJwkThumbprint(
-  key: Uint8Array | KeyLike,
-): Promise<string> {
-  try {
-    return await calculateJwkThumbprint(await exportJWK(key), 'sha512')
-  } catch (err) {
-    throw new InvalidClientError('Unable to compute JWK thumbprint', err)
-  }
-}

package/src/constants.ts

@@ -1,80 +0,0 @@
-// The purpose of the prefix is to provide type safety
-
-export const DEVICE_ID_PREFIX = 'dev-'
-export const DEVICE_ID_BYTES_LENGTH = 16 // 128 bits
-
-export const SESSION_ID_PREFIX = 'ses-'
-export const SESSION_ID_BYTES_LENGTH = 16 // 128 bits - only valid if device id is valid
-
-export const REFRESH_TOKEN_PREFIX = 'ref-'
-export const REFRESH_TOKEN_BYTES_LENGTH = 32 // 256 bits
-
-export const TOKEN_ID_PREFIX = 'tok-'
-export const TOKEN_ID_BYTES_LENGTH = 16 // 128 bits - used as `jti` in JWTs (cannot be forged)
-
-export const REQUEST_ID_PREFIX = 'req-'
-export const REQUEST_ID_BYTES_LENGTH = 16 // 128 bits
-
-export const CODE_PREFIX = 'cod-'
-export const CODE_BYTES_LENGTH = 32
-
-const SECOND = 1e3
-const MINUTE = 60 * SECOND
-const HOUR = 60 * MINUTE
-const DAY = 24 * HOUR
-const WEEK = 7 * DAY
-const YEAR = 365.25 * DAY
-const MONTH = YEAR / 12
-
-/** 7 days */
-export const AUTHENTICATION_MAX_AGE = 7 * DAY
-
-/** 15 minutes */
-export const EPHEMERAL_SESSION_MAX_AGE = 15 * MINUTE
-
-/** 60 minutes */
-export const TOKEN_MAX_AGE = 60 * MINUTE
-
-/** 5 minutes */
-export const AUTHORIZATION_INACTIVITY_TIMEOUT = 5 * MINUTE
-
-/** 2 week */
-export const PUBLIC_CLIENT_SESSION_LIFETIME = 2 * WEEK
-
-/** @see {@link PUBLIC_CLIENT_SESSION_LIFETIME} */
-export const PUBLIC_CLIENT_REFRESH_LIFETIME = PUBLIC_CLIENT_SESSION_LIFETIME
-
-/** 2 years */
-export const CONFIDENTIAL_CLIENT_SESSION_LIFETIME = 2 * YEAR
-
-/** 3 months */
-export const CONFIDENTIAL_CLIENT_REFRESH_LIFETIME = 3 * MONTH
-
-/** 5 minutes */
-export const PAR_EXPIRES_IN = 5 * MINUTE
-
-/**
- * 59 seconds (should be less than a minute)
- *
- * > "A general guidance for the validity time would be less than a minute."
- *
- * @see {@link https://datatracker.ietf.org/doc/html/rfc9101#section-10.2 | JWT-Secured Authorization Request (JAR) - Section 10.2 (d)}
- */
-export const JAR_MAX_AGE = 59 * SECOND
-
-/** 1 minute */
-export const CLIENT_ASSERTION_MAX_AGE = 1 * MINUTE
-
-/** 3 minutes */
-export const DPOP_NONCE_MAX_AGE = 3 * MINUTE
-
-/** 5 seconds */
-export const SESSION_FIXATION_MAX_AGE = 5 * SECOND
-
-/** 1 day */
-export const CODE_CHALLENGE_REPLAY_TIMEFRAME = 1 * DAY
-
-/** 5 minutes */
-export const LEXICON_REFRESH_FREQUENCY = 5 * MINUTE
-
-export const NODE_ENV = process.env.NODE_ENV || 'production'

package/src/customization/branding.ts

@@ -1,12 +0,0 @@
-import { z } from 'zod'
-import { colorsSchema } from './colors.js'
-import { linksSchema } from './links.js'
-
-export const brandingSchema = z.object({
-  name: z.string().optional(),
-  logo: z.string().url().optional(),
-  colors: colorsSchema.optional(),
-  links: z.array(linksSchema).optional(),
-})
-export type BrandingInput = z.input<typeof brandingSchema>
-export type Branding = z.infer<typeof brandingSchema>

package/src/customization/build-customization-css.ts

@@ -1,55 +0,0 @@
-import {
-  RgbColor,
-  extractHue,
-  hslToRgb,
-  pickContrastColor,
-} from '../lib/util/color.js'
-import { Branding } from './branding.js'
-import { COLOR_NAMES } from './colors.js'
-import { Customization } from './customization.js'
-
-export function buildCustomizationCss({
-  branding,
-}: Customization): undefined | string {
-  const vars = Array.from(buildCustomizationVars(branding))
-  if (vars.length) return `:root { ${vars.join(' ')} }`
-}
-
-function* buildCustomizationVars(branding?: Branding): Generator<string> {
-  if (branding?.colors) {
-    const contrastSaturation = branding.colors.contrastSaturation ?? 30
-    yield `--contrast-sat: ${contrastSaturation.toFixed(2)}%;`
-
-    const contrastLight: RgbColor =
-      branding.colors.light ??
-      // Corresponds to color-contrast-975
-      hslToRgb({
-        h: branding.colors.primaryHue ?? 0,
-        s: contrastSaturation / 100,
-        l: 0.07,
-      })
-    const contrastDark: RgbColor =
-      branding.colors.dark ??
-      // Corresponds to color-contrast-25
-      hslToRgb({
-        h: branding.colors.primaryHue ?? 0,
-        s: contrastSaturation / 100,
-        l: 0.953,
-      })
-
-    for (const name of COLOR_NAMES) {
-      const value = branding.colors[name]
-      if (!value) continue // Skip missing colors
-
-      const contrast =
-        branding.colors[`${name}Contrast`] ??
-        pickContrastColor(value, contrastLight, contrastDark)
-
-      const hue = branding.colors[`${name}Hue`] ?? extractHue(value)
-
-      yield `--branding-color-${name}: ${value.r} ${value.g} ${value.b};`
-      yield `--branding-color-${name}-contrast: ${contrast.r} ${contrast.g} ${contrast.b};`
-      yield `--branding-color-${name}-hue: ${hue};`
-    }
-  }
-}

package/src/customization/build-customization-data.ts

@@ -1,24 +0,0 @@
-import type { CustomizationData } from '@atproto/oauth-provider-api'
-import type { Customization } from './customization.js'
-
-export function buildCustomizationData({
-  branding,
-  availableUserDomains,
-  inviteCodeRequired,
-  show2FaWarningOnEmailUpdate,
-  hcaptcha,
-}: Customization): CustomizationData {
-  // @NOTE the front end does not need colors here as they will be injected as
-  // CSS variables.
-  // @NOTE We only copy the values explicitly needed to avoid leaking sensitive
-  // data (in case the caller passed more than what we expect).
-  return {
-    availableUserDomains,
-    inviteCodeRequired,
-    show2FaWarningOnEmailUpdate,
-    hcaptchaSiteKey: hcaptcha?.siteKey,
-    name: branding?.name,
-    logo: branding?.logo,
-    links: branding?.links,
-  }
-}

package/src/customization/colors.ts

@@ -1,48 +0,0 @@
-import { z } from 'zod'
-import { colorHueSchema } from '../types/color-hue.js'
-import { rgbColorSchema } from '../types/rgb-color.js'
-
-export const COLOR_NAMES = [
-  'primary',
-  'error',
-  'warning',
-  'info',
-  'success',
-] as const
-export type ColorName = (typeof COLOR_NAMES)[number]
-
-export const colorsSchema = z
-  .object({
-    // The "light" and "dark" colors are used as default for unspecified
-    // contrast colors. The color that has the highest contrast ratio with the
-    // color base will be used. e.G. If "primary" is specified but
-    // "primaryContrast" is not, then the contrast color will be either "light"
-    // or "dark" depending on which one has the highest contrast ratio with
-    // "primary".
-    light: rgbColorSchema.optional(),
-    dark: rgbColorSchema.optional(),
-
-    // The "contrastSaturation" is used to compute the saturation of the
-    // "contrast" color. The "contrast" color is a (dynamic) color derived from
-    // the "primaryHue" color with the specified saturation and a variable
-    // lightness. "color-contrast-900" is used for default text, while
-    // "color-contrast-0" is used for the page background.
-    contrastSaturation: z.number().min(0).max(100).optional(),
-  })
-  .extend(
-    Object.fromEntries(
-      COLOR_NAMES.map((name) => [name, rgbColorSchema.optional()]),
-    ) as Record<ColorName, z.ZodOptional<typeof rgbColorSchema>>,
-  )
-  .extend(
-    Object.fromEntries(
-      COLOR_NAMES.map((name) => [`${name}Contrast`, rgbColorSchema.optional()]),
-    ) as Record<`${ColorName}Contrast`, z.ZodOptional<typeof rgbColorSchema>>,
-  )
-  .extend(
-    Object.fromEntries(
-      COLOR_NAMES.map((name) => [`${name}Hue`, colorHueSchema.optional()]),
-    ) as Record<`${ColorName}Hue`, z.ZodOptional<typeof colorHueSchema>>,
-  )
-
-export type Colors = z.infer<typeof colorsSchema>