@atproto/oauth-types 0.7.3 → 0.7.5

package/src/atproto-loopback-client-id.ts

@@ -1,78 +0,0 @@
-import { DEFAULT_LOOPBACK_CLIENT_REDIRECT_URIS } from './atproto-loopback-client-redirect-uris.js'
-import {
-  AtprotoOAuthScope,
-  DEFAULT_ATPROTO_OAUTH_SCOPE,
-  asAtprotoOAuthScope,
-  isAtprotoOAuthScope,
-} from './atproto-oauth-scope.js'
-import {
-  LOOPBACK_CLIENT_ID_ORIGIN,
-  OAuthClientIdLoopback,
-  parseOAuthLoopbackClientId,
-} from './oauth-client-id-loopback.js'
-import {
-  OAuthLoopbackRedirectURI,
-  oauthLoopbackClientRedirectUriSchema,
-} from './oauth-redirect-uri.js'
-import { arrayEquivalent, asArray } from './util.js'
-
-export type OAuthLoopbackClientIdConfig = {
-  scope?: string
-  redirect_uris?: Iterable<string>
-}
-
-export function buildAtprotoLoopbackClientId(
-  config?: OAuthLoopbackClientIdConfig,
-): OAuthClientIdLoopback {
-  if (config) {
-    const params = new URLSearchParams()
-
-    const { scope } = config
-    if (scope != null && scope !== DEFAULT_ATPROTO_OAUTH_SCOPE) {
-      params.set('scope', asAtprotoOAuthScope(scope))
-    }
-
-    const redirectUris = asArray(config.redirect_uris)
-    if (
-      redirectUris &&
-      !arrayEquivalent(redirectUris, DEFAULT_LOOPBACK_CLIENT_REDIRECT_URIS)
-    ) {
-      if (!redirectUris.length) {
-        throw new TypeError(`Unexpected empty "redirect_uris" config`)
-      }
-      for (const uri of redirectUris) {
-        params.append(
-          'redirect_uri',
-          oauthLoopbackClientRedirectUriSchema.parse(uri),
-        )
-      }
-    }
-
-    if (params.size) {
-      return `${LOOPBACK_CLIENT_ID_ORIGIN}?${params.toString()}`
-    }
-  }
-
-  return LOOPBACK_CLIENT_ID_ORIGIN
-}
-
-export type AtprotoLoopbackClientIdParams = {
-  scope: AtprotoOAuthScope
-  redirect_uris: [OAuthLoopbackRedirectURI, ...OAuthLoopbackRedirectURI[]]
-}
-
-export function parseAtprotoLoopbackClientId(
-  clientId: string,
-): AtprotoLoopbackClientIdParams {
-  const { scope = DEFAULT_ATPROTO_OAUTH_SCOPE, redirect_uris } =
-    parseOAuthLoopbackClientId(clientId)
-  if (!isAtprotoOAuthScope(scope)) {
-    throw new TypeError(
-      'ATProto Loopback ClientID must include "atproto" scope',
-    )
-  }
-  return {
-    scope,
-    redirect_uris: redirect_uris ?? [...DEFAULT_LOOPBACK_CLIENT_REDIRECT_URIS],
-  }
-}

package/src/atproto-loopback-client-metadata.ts

@@ -1,47 +0,0 @@
-import {
-  AtprotoLoopbackClientIdParams,
-  OAuthLoopbackClientIdConfig,
-  buildAtprotoLoopbackClientId,
-  parseAtprotoLoopbackClientId,
-} from './atproto-loopback-client-id.js'
-import { AtprotoOAuthScope } from './atproto-oauth-scope.js'
-import { OAuthClientIdLoopback } from './oauth-client-id-loopback.js'
-import { OAuthClientMetadataInput } from './oauth-client-metadata.js'
-import { OAuthLoopbackRedirectURI } from './oauth-redirect-uri.js'
-
-export type AtprotoLoopbackClientMetadata = OAuthClientMetadataInput & {
-  client_id: OAuthClientIdLoopback
-  scope: AtprotoOAuthScope
-  redirect_uris: [OAuthLoopbackRedirectURI, ...OAuthLoopbackRedirectURI[]]
-}
-
-export function atprotoLoopbackClientMetadata(
-  clientId: string,
-): AtprotoLoopbackClientMetadata {
-  const params = parseAtprotoLoopbackClientId(clientId)
-  // Safe to cast because parseAtprotoLoopbackClientId ensures it's a loopback ID
-  return buildMetadataInternal(clientId as OAuthClientIdLoopback, params)
-}
-
-export function buildAtprotoLoopbackClientMetadata(
-  config: OAuthLoopbackClientIdConfig,
-): AtprotoLoopbackClientMetadata {
-  const clientId = buildAtprotoLoopbackClientId(config)
-  return buildMetadataInternal(clientId, parseAtprotoLoopbackClientId(clientId))
-}
-
-function buildMetadataInternal(
-  clientId: OAuthClientIdLoopback,
-  clientParams: AtprotoLoopbackClientIdParams,
-): AtprotoLoopbackClientMetadata {
-  return {
-    client_id: clientId,
-    scope: clientParams.scope,
-    redirect_uris: clientParams.redirect_uris,
-    response_types: ['code'],
-    grant_types: ['authorization_code', 'refresh_token'],
-    token_endpoint_auth_method: 'none',
-    application_type: 'native',
-    dpop_bound_access_tokens: true,
-  }
-}

package/src/atproto-loopback-client-redirect-uris.ts

@@ -1,4 +0,0 @@
-export const DEFAULT_LOOPBACK_CLIENT_REDIRECT_URIS = Object.freeze([
-  `http://127.0.0.1/`,
-  `http://[::1]/`,
-] as const)

package/src/atproto-oauth-scope.ts

@@ -1,34 +0,0 @@
-import { z } from 'zod'
-import { OAuthScope, isOAuthScope } from './oauth-scope.js'
-import { SpaceSeparatedValue, isSpaceSeparatedValue } from './util.js'
-
-export const ATPROTO_SCOPE_VALUE = 'atproto'
-export type AtprotoScopeValue = typeof ATPROTO_SCOPE_VALUE
-
-export type AtprotoOAuthScope = OAuthScope &
-  SpaceSeparatedValue<AtprotoScopeValue>
-
-export function isAtprotoOAuthScope(input: string): input is AtprotoOAuthScope {
-  return (
-    isOAuthScope(input) && isSpaceSeparatedValue(ATPROTO_SCOPE_VALUE, input)
-  )
-}
-
-export function asAtprotoOAuthScope<I extends string>(input: I) {
-  if (isAtprotoOAuthScope(input)) return input
-  throw new TypeError(`Value must contain "${ATPROTO_SCOPE_VALUE}" scope value`)
-}
-
-export function assertAtprotoOAuthScope(
-  input: string,
-): asserts input is AtprotoOAuthScope {
-  void asAtprotoOAuthScope(input)
-}
-
-export const atprotoOAuthScopeSchema = z.string().refine(isAtprotoOAuthScope, {
-  message: 'Invalid ATProto OAuth scope',
-})
-
-// Default scope is for reading identity (did) only
-export const DEFAULT_ATPROTO_OAUTH_SCOPE =
-  ATPROTO_SCOPE_VALUE satisfies AtprotoOAuthScope

package/src/atproto-oauth-token-response.ts

@@ -1,16 +0,0 @@
-import { TypeOf, z } from 'zod'
-import { atprotoDidSchema } from '@atproto/did'
-import { atprotoOAuthScopeSchema } from './atproto-oauth-scope.js'
-import { oauthTokenResponseSchema } from './oauth-token-response.js'
-
-export const atprotoOAuthTokenResponseSchema = oauthTokenResponseSchema.extend({
-  token_type: z.literal('DPoP'),
-  sub: atprotoDidSchema,
-  scope: atprotoOAuthScopeSchema,
-  // OpenID is not compatible with atproto identities
-  id_token: z.never().optional(),
-})
-
-export type AtprotoOAuthTokenResponse = TypeOf<
-  typeof atprotoOAuthTokenResponseSchema
->

package/src/constants.ts

@@ -1,2 +0,0 @@
-export const CLIENT_ASSERTION_TYPE_JWT_BEARER =
-  'urn:ietf:params:oauth:client-assertion-type:jwt-bearer'

package/src/index.ts

@@ -1,50 +0,0 @@
-export * from './constants.js'
-export * from './uri.js'
-export * from './util.js'
-
-export * from './atproto-loopback-client-id.js'
-export * from './atproto-loopback-client-metadata.js'
-export * from './atproto-loopback-client-redirect-uris.js'
-export * from './atproto-oauth-scope.js'
-export * from './atproto-oauth-token-response.js'
-export * from './oauth-access-token.js'
-export * from './oauth-authorization-code-grant-token-request.js'
-export * from './oauth-authorization-details.js'
-export * from './oauth-authorization-request-jar.js'
-export * from './oauth-authorization-request-par.js'
-export * from './oauth-authorization-request-parameters.js'
-export * from './oauth-authorization-request-query.js'
-export * from './oauth-authorization-request-uri.js'
-export * from './oauth-authorization-response-error.js'
-export * from './oauth-authorization-server-metadata.js'
-export * from './oauth-client-credentials-grant-token-request.js'
-export * from './oauth-client-credentials.js'
-export * from './oauth-client-id-discoverable.js'
-export * from './oauth-client-id-loopback.js'
-export * from './oauth-client-id.js'
-export * from './oauth-client-metadata.js'
-export * from './oauth-endpoint-auth-method.js'
-export * from './oauth-endpoint-name.js'
-export * from './oauth-grant-type.js'
-export * from './oauth-introspection-response.js'
-export * from './oauth-issuer-identifier.js'
-export * from './oauth-par-response.js'
-export * from './oauth-password-grant-token-request.js'
-export * from './oauth-prompt-mode.js'
-export * from './oauth-protected-resource-metadata.js'
-export * from './oauth-redirect-uri.js'
-export * from './oauth-refresh-token-grant-token-request.js'
-export * from './oauth-refresh-token.js'
-export * from './oauth-request-uri.js'
-export * from './oauth-response-mode.js'
-export * from './oauth-response-type.js'
-export * from './oauth-scope.js'
-export * from './oauth-token-identification.js'
-export * from './oauth-token-request.js'
-export * from './oauth-token-response.js'
-export * from './oauth-token-type.js'
-export * from './oidc-authorization-error-response.js'
-export * from './oidc-claims-parameter.js'
-export * from './oidc-claims-properties.js'
-export * from './oidc-entity-type.js'
-export * from './oidc-userinfo.js'

package/src/oauth-access-token.ts

@@ -1,4 +0,0 @@
-import { z } from 'zod'
-
-export const oauthAccessTokenSchema = z.string().min(1)
-export type OAuthAccessToken = z.infer<typeof oauthAccessTokenSchema>

package/src/oauth-authorization-code-grant-token-request.ts

@@ -1,19 +0,0 @@
-import { z } from 'zod'
-import { oauthRedirectUriSchema } from './oauth-redirect-uri.js'
-
-export const oauthAuthorizationCodeGrantTokenRequestSchema = z.object({
-  grant_type: z.literal('authorization_code'),
-  code: z.string().min(1),
-  redirect_uri: oauthRedirectUriSchema,
-  /** @see {@link https://datatracker.ietf.org/doc/html/rfc7636#section-4.1} */
-  code_verifier: z
-    .string()
-    .min(43)
-    .max(128)
-    .regex(/^[a-zA-Z0-9-._~]+$/)
-    .optional(),
-})
-
-export type OAuthAuthorizationCodeGrantTokenRequest = z.infer<
-  typeof oauthAuthorizationCodeGrantTokenRequestSchema
->

package/src/oauth-authorization-details.ts

@@ -1,48 +0,0 @@
-import { z } from 'zod'
-import { dangerousUriSchema } from './uri.js'
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/rfc9396#section-2 | RFC 9396, Section 2}
- */
-export const oauthAuthorizationDetailSchema = z.object({
-  type: z.string(),
-  /**
-   * An array of strings representing the location of the resource or RS. These
-   * strings are typically URIs identifying the location of the RS.
-   */
-  locations: z.array(dangerousUriSchema).optional(),
-  /**
-   * An array of strings representing the kinds of actions to be taken at the
-   * resource.
-   */
-  actions: z.array(z.string()).optional(),
-  /**
-   * An array of strings representing the kinds of data being requested from the
-   * resource.
-   */
-  datatypes: z.array(z.string()).optional(),
-  /**
-   * A string identifier indicating a specific resource available at the API.
-   */
-  identifier: z.string().optional(),
-  /**
-   * An array of strings representing the types or levels of privilege being
-   * requested at the resource.
-   */
-  privileges: z.array(z.string()).optional(),
-})
-
-export type OAuthAuthorizationDetail = z.infer<
-  typeof oauthAuthorizationDetailSchema
->
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/rfc9396#section-2 | RFC 9396, Section 2}
- */
-export const oauthAuthorizationDetailsSchema = z.array(
-  oauthAuthorizationDetailSchema,
-)
-
-export type OAuthAuthorizationDetails = z.infer<
-  typeof oauthAuthorizationDetailsSchema
->

package/src/oauth-authorization-request-jar.ts

@@ -1,16 +0,0 @@
-import { z } from 'zod'
-import { signedJwtSchema, unsignedJwtSchema } from '@atproto/jwk'
-
-export const oauthAuthorizationRequestJarSchema = z.object({
-  /**
-   * AuthorizationRequest inside a JWT:
-   * - "iat" is required and **MUST** be less than one minute
-   *
-   * @see {@link https://datatracker.ietf.org/doc/html/rfc9101}
-   */
-  request: z.union([signedJwtSchema, unsignedJwtSchema]),
-})
-
-export type OAuthAuthorizationRequestJar = z.infer<
-  typeof oauthAuthorizationRequestJarSchema
->

package/src/oauth-authorization-request-par.ts

@@ -1,12 +0,0 @@
-import { z } from 'zod'
-import { oauthAuthorizationRequestJarSchema } from './oauth-authorization-request-jar.js'
-import { oauthAuthorizationRequestParametersSchema } from './oauth-authorization-request-parameters.js'
-
-export const oauthAuthorizationRequestParSchema = z.union([
-  oauthAuthorizationRequestParametersSchema,
-  oauthAuthorizationRequestJarSchema,
-])
-
-export type OAuthAuthorizationRequestPar = z.infer<
-  typeof oauthAuthorizationRequestParSchema
->

package/src/oauth-authorization-request-parameters.ts

@@ -1,100 +0,0 @@
-import { z } from 'zod'
-import { signedJwtSchema } from '@atproto/jwk'
-import { oauthAuthorizationDetailsSchema } from './oauth-authorization-details.js'
-import { oauthClientIdSchema } from './oauth-client-id.js'
-import { oauthCodeChallengeMethodSchema } from './oauth-code-challenge-method.js'
-import { oauthPromptModeSchema } from './oauth-prompt-mode.js'
-import { oauthRedirectUriSchema } from './oauth-redirect-uri.js'
-import { oauthResponseModeSchema } from './oauth-response-mode.js'
-import { oauthResponseTypeSchema } from './oauth-response-type.js'
-import { oauthScopeSchema } from './oauth-scope.js'
-import { oidcClaimsParameterSchema } from './oidc-claims-parameter.js'
-import { oidcClaimsPropertiesSchema } from './oidc-claims-properties.js'
-import { oidcEntityTypeSchema } from './oidc-entity-type.js'
-import { jsonObjectPreprocess, numberPreprocess } from './util.js'
-
-/**
- * @note non string parameters will be converted from their string
- * representation since oauth request parameters are typically sent as URL
- * encoded form data or URL encoded query string.
- * @see {@link https://openid.net/specs/openid-connect-core-1_0.html#AuthRequest | OIDC}
- */
-export const oauthAuthorizationRequestParametersSchema = z.object({
-  client_id: oauthClientIdSchema,
-  state: z.string().optional(),
-  redirect_uri: oauthRedirectUriSchema.optional(),
-  scope: oauthScopeSchema.optional(),
-  response_type: oauthResponseTypeSchema,
-
-  // PKCE
-
-  // https://datatracker.ietf.org/doc/html/rfc7636#section-4.3
-  code_challenge: z.string().optional(),
-  code_challenge_method: oauthCodeChallengeMethodSchema.optional(),
-
-  // DPOP
-
-  // https://datatracker.ietf.org/doc/html/rfc9449#section-12.3
-  dpop_jkt: z.string().optional(),
-
-  // OIDC
-
-  // Default depend on response_type
-  response_mode: oauthResponseModeSchema.optional(),
-
-  nonce: z.string().optional(),
-
-  // Specifies the allowable elapsed time in seconds since the last time the
-  // End-User was actively authenticated by the OP. If the elapsed time is
-  // greater than this value, the OP MUST attempt to actively re-authenticate
-  // the End-User. (The max_age request parameter corresponds to the OpenID 2.0
-  // PAPE [OpenID.PAPE] max_auth_age request parameter.) When max_age is used,
-  // the ID Token returned MUST include an auth_time Claim Value. Note that
-  // max_age=0 is equivalent to prompt=login.
-  max_age: z.preprocess(numberPreprocess, z.number().int().min(0)).optional(),
-
-  claims: z
-    .preprocess(
-      jsonObjectPreprocess,
-      z.record(
-        oidcEntityTypeSchema,
-        z.record(
-          oidcClaimsParameterSchema,
-          z.union([z.literal(null), oidcClaimsPropertiesSchema]),
-        ),
-      ),
-    )
-    .optional(),
-
-  // https://openid.net/specs/openid-connect-core-1_0.html#RegistrationParameter
-  // Not supported by this library (yet?)
-  // registration: clientMetadataSchema.optional(),
-
-  login_hint: z.string().min(1).optional(),
-
-  ui_locales: z
-    .string()
-    .regex(/^[a-z]{2,3}(-[A-Z]{2})?( [a-z]{2,3}(-[A-Z]{2})?)*$/) // fr-CA fr en
-    .optional(),
-
-  // Previous ID Token, should be provided when prompt=none is used
-  id_token_hint: signedJwtSchema.optional(),
-
-  // Type of UI the AS is displayed on
-  display: z.enum(['page', 'popup', 'touch', 'wap']).optional(),
-
-  // How the AS should prompt the user for authorization:
-  prompt: oauthPromptModeSchema.optional(),
-
-  // https://datatracker.ietf.org/doc/html/rfc9396
-  authorization_details: z
-    .preprocess(jsonObjectPreprocess, oauthAuthorizationDetailsSchema)
-    .optional(),
-})
-
-/**
- * @see {oauthAuthorizationRequestParametersSchema}
- */
-export type OAuthAuthorizationRequestParameters = z.infer<
-  typeof oauthAuthorizationRequestParametersSchema
->

package/src/oauth-authorization-request-query.ts

@@ -1,21 +0,0 @@
-import { z } from 'zod'
-import { oauthAuthorizationRequestJarSchema } from './oauth-authorization-request-jar.js'
-import { oauthAuthorizationRequestParametersSchema } from './oauth-authorization-request-parameters.js'
-import { oauthAuthorizationRequestUriSchema } from './oauth-authorization-request-uri.js'
-import { oauthClientIdSchema } from './oauth-client-id.js'
-
-export const oauthAuthorizationRequestQuerySchema = z.intersection(
-  z.object({
-    // REQUIRED. OAuth 2.0 [RFC6749] client_id.
-    client_id: oauthClientIdSchema,
-  }),
-  z.union([
-    oauthAuthorizationRequestParametersSchema,
-    oauthAuthorizationRequestJarSchema,
-    oauthAuthorizationRequestUriSchema,
-  ]),
-)
-
-export type OAuthAuthorizationRequestQuery = z.infer<
-  typeof oauthAuthorizationRequestQuerySchema
->

package/src/oauth-authorization-request-uri.ts

@@ -1,10 +0,0 @@
-import { z } from 'zod'
-import { oauthRequestUriSchema } from './oauth-request-uri.js'
-
-export const oauthAuthorizationRequestUriSchema = z.object({
-  request_uri: oauthRequestUriSchema,
-})
-
-export type OAuthAuthorizationRequestUri = z.infer<
-  typeof oauthAuthorizationRequestUriSchema
->

package/src/oauth-authorization-response-error.ts

@@ -1,25 +0,0 @@
-import { z } from 'zod'
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-1-12#name-error-response-2}
- */
-export const oauthAuthorizationResponseErrorSchema = z.enum([
-  // The request is missing a required parameter, includes an invalid parameter value, includes a parameter more than once, or is otherwise malformed.
-  'invalid_request',
-  // The client is not authorized to request an authorization code using this method.
-  'unauthorized_client',
-  // The resource owner or authorization server denied the request.
-  'access_denied',
-  // The authorization server does not support obtaining an authorization code using this method.
-  'unsupported_response_type',
-  // The requested scope is invalid, unknown, or malformed.
-  'invalid_scope',
-  // The authorization server encountered an unexpected condition that prevented it from fulfilling the request. (This error code is needed because a 500 Internal Server Error HTTP status code cannot be returned to the client via an HTTP redirect.)
-  'server_error',
-  // The authorization server is currently unable to handle the request due to a temporary overloading or maintenance of the server. (This error code is needed because a 503 Service Unavailable HTTP status code cannot be returned to the client via an HTTP redirect.)
-  'temporarily_unavailable',
-])
-
-export type OAuthAuthorizationResponseError = z.infer<
-  typeof oauthAuthorizationResponseErrorSchema
->

package/src/oauth-authorization-server-metadata.ts

@@ -1,120 +0,0 @@
-import { z } from 'zod'
-import { oauthCodeChallengeMethodSchema } from './oauth-code-challenge-method.js'
-import { oauthIssuerIdentifierSchema } from './oauth-issuer-identifier.js'
-import { oauthPromptModeSchema } from './oauth-prompt-mode.js'
-import { webUriSchema } from './uri.js'
-
-/**
- * @see {@link https://datatracker.ietf.org/doc/html/rfc8414}
- * @note we do not enforce https: scheme in URIs to support development
- * environments. Make sure to validate the URIs before using it in a production
- * environment.
- */
-export const oauthAuthorizationServerMetadataSchema = z.object({
-  issuer: oauthIssuerIdentifierSchema,
-
-  claims_supported: z.array(z.string()).optional(),
-  claims_locales_supported: z.array(z.string()).optional(),
-  claims_parameter_supported: z.boolean().optional(),
-  request_parameter_supported: z.boolean().optional(),
-  request_uri_parameter_supported: z.boolean().optional(),
-  require_request_uri_registration: z.boolean().optional(),
-  scopes_supported: z.array(z.string()).optional(),
-  subject_types_supported: z.array(z.string()).optional(),
-  response_types_supported: z.array(z.string()).optional(),
-  response_modes_supported: z.array(z.string()).optional(),
-  grant_types_supported: z.array(z.string()).optional(),
-  code_challenge_methods_supported: z
-    .array(oauthCodeChallengeMethodSchema)
-    .min(1)
-    .optional(),
-  ui_locales_supported: z.array(z.string()).optional(),
-  id_token_signing_alg_values_supported: z.array(z.string()).optional(),
-  display_values_supported: z.array(z.string()).optional(),
-  request_object_signing_alg_values_supported: z.array(z.string()).optional(),
-  authorization_response_iss_parameter_supported: z.boolean().optional(),
-  authorization_details_types_supported: z.array(z.string()).optional(),
-  request_object_encryption_alg_values_supported: z
-    .array(z.string())
-    .optional(),
-  request_object_encryption_enc_values_supported: z
-    .array(z.string())
-    .optional(),
-
-  jwks_uri: webUriSchema.optional(),
-
-  authorization_endpoint: webUriSchema, // .optional(),
-
-  token_endpoint: webUriSchema, // .optional(),
-  // https://www.rfc-editor.org/rfc/rfc8414.html#section-2
-  token_endpoint_auth_methods_supported: z
-    .array(z.string())
-    // > If omitted, the default is "client_secret_basic" [...].
-    .default(['client_secret_basic']),
-  token_endpoint_auth_signing_alg_values_supported: z
-    .array(z.string())
-    .optional(),
-
-  revocation_endpoint: webUriSchema.optional(),
-  introspection_endpoint: webUriSchema.optional(),
-  pushed_authorization_request_endpoint: webUriSchema.optional(),
-
-  require_pushed_authorization_requests: z.boolean().optional(),
-
-  userinfo_endpoint: webUriSchema.optional(),
-  end_session_endpoint: webUriSchema.optional(),
-  registration_endpoint: webUriSchema.optional(),
-
-  // https://datatracker.ietf.org/doc/html/rfc9449#section-5.1
-  dpop_signing_alg_values_supported: z.array(z.string()).optional(),
-
-  // https://www.rfc-editor.org/rfc/rfc9728.html#section-4
-  protected_resources: z.array(webUriSchema).optional(),
-
-  // https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html
-  client_id_metadata_document_supported: z.boolean().optional(),
-
-  // https://openid.net/specs/openid-connect-prompt-create-1_0.html#section-4.2
-  prompt_values_supported: z.array(oauthPromptModeSchema).optional(),
-})
-
-export type OAuthAuthorizationServerMetadata = z.infer<
-  typeof oauthAuthorizationServerMetadataSchema
->
-
-export const oauthAuthorizationServerMetadataValidator =
-  oauthAuthorizationServerMetadataSchema
-    .superRefine((data, ctx) => {
-      if (
-        data.require_pushed_authorization_requests &&
-        !data.pushed_authorization_request_endpoint
-      ) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message:
-            '"pushed_authorization_request_endpoint" required when "require_pushed_authorization_requests" is true',
-        })
-      }
-    })
-    .superRefine((data, ctx) => {
-      if (data.response_types_supported) {
-        if (!data.response_types_supported.includes('code')) {
-          ctx.addIssue({
-            code: z.ZodIssueCode.custom,
-            message: 'Response type "code" is required',
-          })
-        }
-      }
-    })
-    .superRefine((data, ctx) => {
-      if (
-        data.token_endpoint_auth_signing_alg_values_supported?.includes('none')
-      ) {
-        // https://openid.net/specs/openid-connect-discovery-1_0.html#rfc.section.3
-        // > The value `none` MUST NOT be used.
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'Client authentication method "none" is not allowed',
-        })
-      }
-    })

package/src/oauth-client-credentials-grant-token-request.ts

@@ -1,9 +0,0 @@
-import { z } from 'zod'
-
-export const oauthClientCredentialsGrantTokenRequestSchema = z.object({
-  grant_type: z.literal('client_credentials'),
-})
-
-export type OAuthClientCredentialsGrantTokenRequest = z.infer<
-  typeof oauthClientCredentialsGrantTokenRequestSchema
->