@atproto/oauth-types 0.7.3 → 0.7.5

package/src/oauth-client-credentials.ts

@@ -1,53 +0,0 @@
-import { z } from 'zod'
-import { signedJwtSchema } from '@atproto/jwk'
-import { CLIENT_ASSERTION_TYPE_JWT_BEARER } from './constants.js'
-import { oauthClientIdSchema } from './oauth-client-id.js'
-
-export const oauthClientCredentialsJwtBearerSchema = z.object({
-  client_id: oauthClientIdSchema,
-  client_assertion_type: z.literal(CLIENT_ASSERTION_TYPE_JWT_BEARER),
-  /**
-   * - "sub" the subject MUST be the "client_id" of the OAuth client
-   * - "iat" is required and MUST be less than one minute
-   * - "aud" must containing a value that identifies the authorization server
-   * - The JWT MAY contain a "jti" (JWT ID) claim that provides a unique identifier for the token.
-   * - Note that the authorization server may reject JWTs with an "exp" claim value that is unreasonably far in the future.
-   *
-   * @see {@link https://datatracker.ietf.org/doc/html/rfc7523#section-3}
-   */
-  client_assertion: signedJwtSchema,
-})
-
-export type OAuthClientCredentialsJwtBearer = z.infer<
-  typeof oauthClientCredentialsJwtBearerSchema
->
-
-export const oauthClientCredentialsSecretPostSchema = z.object({
-  client_id: oauthClientIdSchema,
-  client_secret: z.string(),
-})
-
-export type OAuthClientCredentialsSecretPost = z.infer<
-  typeof oauthClientCredentialsSecretPostSchema
->
-
-export const oauthClientCredentialsNoneSchema = z.object({
-  client_id: oauthClientIdSchema,
-})
-
-export type OAuthClientCredentialsNone = z.infer<
-  typeof oauthClientCredentialsNoneSchema
->
-
-//
-
-export const oauthClientCredentialsSchema = z.union([
-  oauthClientCredentialsJwtBearerSchema,
-  oauthClientCredentialsSecretPostSchema,
-  // Must be last since it is less specific
-  oauthClientCredentialsNoneSchema,
-])
-
-export type OAuthClientCredentials = z.infer<
-  typeof oauthClientCredentialsSchema
->

package/src/oauth-client-id-discoverable.ts

@@ -1,130 +0,0 @@
-import { TypeOf, z } from 'zod'
-import { oauthClientIdSchema } from './oauth-client-id.js'
-import { httpsUriSchema } from './uri.js'
-import { extractUrlPath, isHostnameIP } from './util.js'
-
-/**
- * @see {@link https://www.ietf.org/archive/id/draft-ietf-oauth-client-id-metadata-document-00.html}
- */
-export const oauthClientIdDiscoverableSchema = z
-  .intersection(oauthClientIdSchema, httpsUriSchema)
-  .superRefine((value, ctx): value is `https://${string}/${string}` => {
-    const url = new URL(value)
-
-    if (url.username || url.password) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'ClientID must not contain credentials',
-      })
-      return false
-    }
-
-    if (url.hash) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'ClientID must not contain a fragment',
-      })
-      return false
-    }
-
-    if (url.pathname === '/') {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message:
-          'ClientID must contain a path component (e.g. "/client-metadata.json")',
-      })
-      return false
-    }
-
-    if (url.pathname.endsWith('/')) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'ClientID path must not end with a trailing slash',
-      })
-      return false
-    }
-
-    if (isHostnameIP(url.hostname)) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'ClientID hostname must not be an IP address',
-      })
-      return false
-    }
-
-    // URL constructor normalizes the URL, so we extract the path manually to
-    // avoid normalization, then compare it to the normalized path to ensure
-    // that the URL does not contain path traversal or other unexpected characters
-    if (extractUrlPath(value) !== url.pathname) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: `ClientID must be in canonical form ("${url.href}", got "${value}")`,
-      })
-      return false
-    }
-
-    return true
-  })
-
-export type OAuthClientIdDiscoverable = TypeOf<
-  typeof oauthClientIdDiscoverableSchema
->
-
-export function isOAuthClientIdDiscoverable(
-  clientId: string,
-): clientId is OAuthClientIdDiscoverable {
-  return oauthClientIdDiscoverableSchema.safeParse(clientId).success
-}
-
-export const conventionalOAuthClientIdSchema =
-  oauthClientIdDiscoverableSchema.superRefine(
-    (value, ctx): value is `https://${string}/oauth-client-metadata.json` => {
-      const url = new URL(value)
-
-      if (url.port) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'ClientID must not contain a port',
-        })
-        return false
-      }
-
-      if (url.search) {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'ClientID must not contain a query string',
-        })
-        return false
-      }
-
-      if (url.pathname !== '/oauth-client-metadata.json') {
-        ctx.addIssue({
-          code: z.ZodIssueCode.custom,
-          message: 'ClientID must be "/oauth-client-metadata.json"',
-        })
-        return false
-      }
-
-      return true
-    },
-  )
-
-export type ConventionalOAuthClientId = TypeOf<
-  typeof conventionalOAuthClientIdSchema
->
-
-export function isConventionalOAuthClientId(
-  clientId: string,
-): clientId is ConventionalOAuthClientId {
-  return conventionalOAuthClientIdSchema.safeParse(clientId).success
-}
-
-export function assertOAuthDiscoverableClientId(
-  value: string,
-): asserts value is OAuthClientIdDiscoverable {
-  void oauthClientIdDiscoverableSchema.parse(value)
-}
-
-export function parseOAuthDiscoverableClientId(clientId: string): URL {
-  return new URL(oauthClientIdDiscoverableSchema.parse(clientId))
-}

package/src/oauth-client-id-loopback.ts

@@ -1,164 +0,0 @@
-import { oauthClientIdSchema } from './oauth-client-id.js'
-import {
-  OAuthLoopbackRedirectURI,
-  oauthLoopbackClientRedirectUriSchema,
-} from './oauth-redirect-uri.js'
-import { OAuthScope, oauthScopeSchema } from './oauth-scope.js'
-
-export const LOOPBACK_CLIENT_ID_ORIGIN = 'http://localhost'
-
-// @NOTE This is not actually based on a standard, but rather a convention
-// established by Bluesky in the Atproto specs and implementation. As such, and
-// in order to respect the convention from this package, these should be
-// prefixed with "Atproto" instead of "OAuth". For legacy reasons, we keep the
-// current names, but we should rename them in a future major release, unless
-// loopback client ids have since then been standardized.
-
-export type OAuthClientIdLoopback =
-  `http://localhost${'' | `/`}${'' | `?${string}`}`
-
-export type OAuthLoopbackClientIdParams = {
-  scope?: OAuthScope
-  redirect_uris?: [OAuthLoopbackRedirectURI, ...OAuthLoopbackRedirectURI[]]
-}
-
-export const oauthClientIdLoopbackSchema = oauthClientIdSchema.superRefine(
-  (input, ctx): input is OAuthClientIdLoopback => {
-    const result = safeParseOAuthLoopbackClientId(input)
-    if (!result.success) {
-      ctx.addIssue({ code: 'custom', message: result.message })
-    }
-    return result.success
-  },
-)
-
-export function assertOAuthLoopbackClientId(
-  input: string,
-): asserts input is OAuthClientIdLoopback {
-  void parseOAuthLoopbackClientId(input)
-}
-
-export function isOAuthClientIdLoopback<T extends string>(
-  input: T,
-): input is T & OAuthClientIdLoopback {
-  return safeParseOAuthLoopbackClientId(input).success
-}
-
-export function asOAuthClientIdLoopback<T extends string>(input: T) {
-  assertOAuthLoopbackClientId(input)
-  return input
-}
-
-export function parseOAuthLoopbackClientId(
-  input: string,
-): OAuthLoopbackClientIdParams {
-  const result = safeParseOAuthLoopbackClientId(input)
-  if (result.success) return result.value
-
-  throw new TypeError(`Invalid loopback client ID: ${result.message}`)
-}
-
-/**
- * Similar to Zod's {@link SafeParseReturnType} but uses a simple "message"
- * string instead of an "error" Error object.
- */
-type LightParseReturnType<T> =
-  | { success: true; value: T }
-  | { success: false; message: string }
-
-export function safeParseOAuthLoopbackClientId(
-  input: string,
-): LightParseReturnType<OAuthLoopbackClientIdParams> {
-  // @NOTE Not using "new URL" to ensure input indeed matches the type
-  // OAuthClientIdLoopback
-
-  if (!input.startsWith(LOOPBACK_CLIENT_ID_ORIGIN)) {
-    return {
-      success: false,
-      message: `Value must start with "${LOOPBACK_CLIENT_ID_ORIGIN}"`,
-    }
-  }
-
-  if (input.includes('#', LOOPBACK_CLIENT_ID_ORIGIN.length)) {
-    return {
-      success: false,
-      message: 'Value must not contain a hash component',
-    }
-  }
-
-  // Since we don't allow a path component (except for a single "/") the query
-  // string starts after the origin (+ 1 if there is a "/")
-  const queryStringIdx =
-    input.length > LOOPBACK_CLIENT_ID_ORIGIN.length &&
-    input.charCodeAt(LOOPBACK_CLIENT_ID_ORIGIN.length) === 0x2f /* '/' */
-      ? LOOPBACK_CLIENT_ID_ORIGIN.length + 1
-      : LOOPBACK_CLIENT_ID_ORIGIN.length
-
-  // Since we determined the position of the query string based on the origin
-  // length (instead of looking for a "?"), we need to make sure the query
-  // string position (if any) indeed starts with a "?".
-  if (
-    input.length !== queryStringIdx &&
-    input.charCodeAt(queryStringIdx) !== 0x3f /* '?' */
-  ) {
-    return {
-      success: false,
-      message: 'Value must not contain a path component',
-    }
-  }
-
-  const queryString = input.slice(queryStringIdx + 1)
-  return safeParseOAuthLoopbackClientIdQueryString(queryString)
-}
-
-export function safeParseOAuthLoopbackClientIdQueryString(
-  input: string | Iterable<[key: string, value: string]>,
-): LightParseReturnType<OAuthLoopbackClientIdParams> {
-  // Parse query params
-  const params: OAuthLoopbackClientIdParams = {}
-
-  const it = typeof input === 'string' ? new URLSearchParams(input) : input
-  for (const [key, value] of it) {
-    if (key === 'scope') {
-      if ('scope' in params) {
-        return {
-          success: false,
-          message: 'Duplicate "scope" query parameter',
-        }
-      }
-
-      const res = oauthScopeSchema.safeParse(value)
-      if (!res.success) {
-        const reason = res.error.issues.map((i) => i.message).join(', ')
-        return {
-          success: false,
-          message: `Invalid "scope" query parameter: ${reason || 'Validation failed'}`,
-        }
-      }
-
-      params.scope = res.data
-    } else if (key === 'redirect_uri') {
-      const res = oauthLoopbackClientRedirectUriSchema.safeParse(value)
-      if (!res.success) {
-        const reason = res.error.issues.map((i) => i.message).join(', ')
-        return {
-          success: false,
-          message: `Invalid "redirect_uri" query parameter: ${reason || 'Validation failed'}`,
-        }
-      }
-
-      if (params.redirect_uris == null) params.redirect_uris = [res.data]
-      else params.redirect_uris.push(res.data)
-    } else {
-      return {
-        success: false,
-        message: `Unexpected query parameter "${key}"`,
-      }
-    }
-  }
-
-  return {
-    success: true,
-    value: params,
-  }
-}

package/src/oauth-client-id.ts

@@ -1,4 +0,0 @@
-import { z } from 'zod'
-
-export const oauthClientIdSchema = z.string().min(1)
-export type OAuthClientId = z.infer<typeof oauthClientIdSchema>

package/src/oauth-client-metadata.ts

@@ -1,80 +0,0 @@
-import { z } from 'zod'
-import { jwksPubSchema } from '@atproto/jwk'
-import { oauthClientIdSchema } from './oauth-client-id.js'
-import { oauthEndpointAuthMethod } from './oauth-endpoint-auth-method.js'
-import { oauthGrantTypeSchema } from './oauth-grant-type.js'
-import { oauthRedirectUriSchema } from './oauth-redirect-uri.js'
-import { oauthResponseTypeSchema } from './oauth-response-type.js'
-import { oauthScopeSchema } from './oauth-scope.js'
-import { webUriSchema } from './uri.js'
-
-/**
- * @see {@link https://openid.net/specs/openid-connect-registration-1_0.html}
- * @see {@link https://datatracker.ietf.org/doc/html/rfc7591}
- * @note we do not enforce https: scheme in URIs to support development
- * environments. Make sure to validate the URIs before using it in a production
- * environment.
- */
-export const oauthClientMetadataSchema = z.object({
-  /**
-   * @note redirect_uris require additional validation
-   */
-  // https://www.rfc-editor.org/rfc/rfc7591.html#section-2
-  redirect_uris: z.array(oauthRedirectUriSchema).nonempty(),
-  response_types: z
-    .array(oauthResponseTypeSchema)
-    .nonempty()
-    // > If omitted, the default is that the client will use only the "code"
-    // > response type.
-    .default(['code']),
-  grant_types: z
-    .array(oauthGrantTypeSchema)
-    .nonempty()
-    // > If omitted, the default behavior is that the client will use only the
-    // > "authorization_code" Grant Type.
-    .default(['authorization_code']),
-  scope: oauthScopeSchema.optional(),
-  // https://www.rfc-editor.org/rfc/rfc7591.html#section-2
-  token_endpoint_auth_method: oauthEndpointAuthMethod
-    // > If unspecified or omitted, the default is "client_secret_basic" [...].
-    .default('client_secret_basic'),
-  token_endpoint_auth_signing_alg: z.string().optional(),
-  userinfo_signed_response_alg: z.string().optional(),
-  userinfo_encrypted_response_alg: z.string().optional(),
-  jwks_uri: webUriSchema.optional(),
-  jwks: jwksPubSchema.optional(),
-  application_type: z.enum(['web', 'native']).default('web'), // default, per spec, is "web"
-  subject_type: z.enum(['public', 'pairwise']).default('public'),
-  request_object_signing_alg: z.string().optional(),
-  id_token_signed_response_alg: z.string().optional(),
-  authorization_signed_response_alg: z.string().default('RS256'),
-  authorization_encrypted_response_enc: z.enum(['A128CBC-HS256']).optional(),
-  authorization_encrypted_response_alg: z.string().optional(),
-  client_id: oauthClientIdSchema.optional(),
-  client_name: z.string().optional(),
-  client_uri: webUriSchema.optional(),
-  policy_uri: webUriSchema.optional(),
-  tos_uri: webUriSchema.optional(),
-  logo_uri: webUriSchema.optional(), // @TODO: allow data: uri ?
-
-  /**
-   * Default Maximum Authentication Age. Specifies that the End-User MUST be
-   * actively authenticated if the End-User was authenticated longer ago than
-   * the specified number of seconds. The max_age request parameter overrides
-   * this default value. If omitted, no default Maximum Authentication Age is
-   * specified.
-   */
-  default_max_age: z.number().optional(),
-  require_auth_time: z.boolean().optional(),
-  contacts: z.array(z.string().email()).optional(),
-  tls_client_certificate_bound_access_tokens: z.boolean().optional(),
-
-  // https://datatracker.ietf.org/doc/html/rfc9449#section-5.2
-  dpop_bound_access_tokens: z.boolean().optional(),
-
-  // https://datatracker.ietf.org/doc/html/rfc9396#section-14.5
-  authorization_details_types: z.array(z.string()).optional(),
-})
-
-export type OAuthClientMetadata = z.infer<typeof oauthClientMetadataSchema>
-export type OAuthClientMetadataInput = z.input<typeof oauthClientMetadataSchema>

package/src/oauth-code-challenge-method.ts

@@ -1,3 +0,0 @@
-import { z } from 'zod'
-
-export const oauthCodeChallengeMethodSchema = z.enum(['S256', 'plain'])

package/src/oauth-endpoint-auth-method.ts

@@ -1,13 +0,0 @@
-import { z } from 'zod'
-
-export const oauthEndpointAuthMethod = z.enum([
-  'client_secret_basic',
-  'client_secret_jwt',
-  'client_secret_post',
-  'none',
-  'private_key_jwt',
-  'self_signed_tls_client_auth',
-  'tls_client_auth',
-])
-
-export type OauthEndpointAuthMethod = z.infer<typeof oauthEndpointAuthMethod>

package/src/oauth-endpoint-name.ts

@@ -1,8 +0,0 @@
-export const OAUTH_ENDPOINT_NAMES = [
-  'token',
-  'revocation',
-  'introspection',
-  'pushed_authorization_request',
-] as const
-
-export type OAuthEndpointName = (typeof OAUTH_ENDPOINT_NAMES)[number]

package/src/oauth-grant-type.ts

@@ -1,13 +0,0 @@
-import { z } from 'zod'
-
-export const oauthGrantTypeSchema = z.enum([
-  'authorization_code',
-  'implicit',
-  'refresh_token',
-  'password', // Not part of OAuth 2.1
-  'client_credentials',
-  'urn:ietf:params:oauth:grant-type:jwt-bearer',
-  'urn:ietf:params:oauth:grant-type:saml2-bearer',
-])
-
-export type OAuthGrantType = z.infer<typeof oauthGrantTypeSchema>

package/src/oauth-introspection-response.ts

@@ -1,23 +0,0 @@
-import { OAuthAuthorizationDetails } from './oauth-authorization-details.js'
-import { OAuthTokenType } from './oauth-token-type.js'
-
-// https://datatracker.ietf.org/doc/html/rfc7662#section-2.2
-export type OAuthIntrospectionResponse =
-  | { active: false }
-  | {
-      active: true
-
-      scope?: string
-      client_id?: string
-      username?: string
-      token_type?: OAuthTokenType
-      authorization_details?: OAuthAuthorizationDetails
-
-      aud?: string | [string, ...string[]]
-      exp?: number
-      iat?: number
-      iss?: string
-      jti?: string
-      nbf?: number
-      sub?: string
-    }

package/src/oauth-issuer-identifier.ts

@@ -1,47 +0,0 @@
-import { z } from 'zod'
-import { webUriSchema } from './uri.js'
-
-export const oauthIssuerIdentifierSchema = webUriSchema.superRefine(
-  (value, ctx) => {
-    // Validate the issuer (MIX-UP attacks)
-
-    if (value.endsWith('/')) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'Issuer URL must not end with a slash',
-      })
-      return false
-    }
-
-    const url = new URL(value)
-
-    if (url.username || url.password) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'Issuer URL must not contain a username or password',
-      })
-      return false
-    }
-
-    if (url.hash || url.search) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'Issuer URL must not contain a query or fragment',
-      })
-      return false
-    }
-
-    const canonicalValue = url.pathname === '/' ? url.origin : url.href
-    if (value !== canonicalValue) {
-      ctx.addIssue({
-        code: z.ZodIssueCode.custom,
-        message: 'Issuer URL must be in the canonical form',
-      })
-      return false
-    }
-
-    return true
-  },
-)
-
-export type OAuthIssuerIdentifier = z.infer<typeof oauthIssuerIdentifierSchema>

package/src/oauth-par-response.ts

@@ -1,8 +0,0 @@
-import { z } from 'zod'
-
-export const oauthParResponseSchema = z.object({
-  request_uri: z.string(),
-  expires_in: z.number().int().positive(),
-})
-
-export type OAuthParResponse = z.infer<typeof oauthParResponseSchema>

package/src/oauth-password-grant-token-request.ts

@@ -1,11 +0,0 @@
-import { z } from 'zod'
-
-export const oauthPasswordGrantTokenRequestSchema = z.object({
-  grant_type: z.literal('password'),
-  username: z.string(),
-  password: z.string(),
-})
-
-export type OAuthPasswordGrantTokenRequest = z.infer<
-  typeof oauthPasswordGrantTokenRequestSchema
->

package/src/oauth-prompt-mode.ts

@@ -1,18 +0,0 @@
-import { z } from 'zod'
-
-/**
- * - "none" will only be allowed if the user already allowed the client on the same device
- * - "login" will force the user to login again, unless he very recently logged in
- * - "consent" will force the user to consent again
- * - "select_account" will force the user to select an account
- * - "create" will force the user registration screen
- */
-export const oauthPromptModeSchema = z.enum([
-  'none',
-  'login',
-  'consent',
-  'select_account',
-  'create',
-])
-
-export type OAuthPromptMode = z.infer<typeof oauthPromptModeSchema>

package/src/oauth-protected-resource-metadata.ts

@@ -1,94 +0,0 @@
-import { z } from 'zod'
-import { oauthIssuerIdentifierSchema } from './oauth-issuer-identifier.js'
-import { webUriSchema } from './uri.js'
-
-/**
- * @see {@link https://www.rfc-editor.org/rfc/rfc9728.html#section-3.2}
- */
-export const oauthProtectedResourceMetadataSchema = z.object({
-  /**
-   * REQUIRED. The protected resource's resource identifier, which is a URL that
-   * uses the https scheme and has no query or fragment components. Using these
-   * well-known resources is described in Section 3.
-   *
-   * @note This schema allows non https URLs for testing & development purposes.
-   * Make sure to validate the URL before using it in a production environment.
-   */
-  resource: webUriSchema
-    .refine((url) => !url.includes('?'), {
-      message: 'Resource URL must not contain query parameters',
-    })
-    .refine((url) => !url.includes('#'), {
-      message: 'Resource URL must not contain a fragment',
-    }),
-
-  /**
-   * OPTIONAL. JSON array containing a list of OAuth authorization server issuer
-   * identifiers, as defined in [RFC8414], for authorization servers that can be
-   * used with this protected resource. Protected resources MAY choose not to
-   * advertise some supported authorization servers even when this parameter is
-   * used. In some use cases, the set of authorization servers will not be
-   * enumerable, in which case this metadata parameter would not be used.
-   */
-  authorization_servers: z.array(oauthIssuerIdentifierSchema).optional(),
-
-  /**
-   * OPTIONAL. URL of the protected resource's JWK Set [JWK] document. This
-   * contains public keys belonging to the protected resource, such as signing
-   * key(s) that the resource server uses to sign resource responses. This URL
-   * MUST use the https scheme. When both signing and encryption keys are made
-   * available, a use (public key use) parameter value is REQUIRED for all keys
-   * in the referenced JWK Set to indicate each key's intended usage.
-   */
-  jwks_uri: webUriSchema.optional(),
-
-  /**
-   * RECOMMENDED. JSON array containing a list of the OAuth 2.0 [RFC6749] scope
-   * values that are used in authorization requests to request access to this
-   * protected resource. Protected resources MAY choose not to advertise some
-   * scope values supported even when this parameter is used.
-   */
-  scopes_supported: z.array(z.string()).optional(),
-
-  /**
-   * OPTIONAL. JSON array containing a list of the supported methods of sending
-   * an OAuth 2.0 Bearer Token [RFC6750] to the protected resource. Defined
-   * values are ["header", "body", "query"], corresponding to Sections 2.1, 2.2,
-   * and 2.3 of RFC 6750.
-   */
-  bearer_methods_supported: z
-    .array(z.enum(['header', 'body', 'query']))
-    .optional(),
-
-  /**
-   * OPTIONAL. JSON array containing a list of the JWS [JWS] signing algorithms
-   * (alg values) [JWA] supported by the protected resource for signing resource
-   * responses, for instance, as described in [FAPI.MessageSigning]. No default
-   * algorithms are implied if this entry is omitted. The value none MUST NOT be
-   * used.
-   */
-  resource_signing_alg_values_supported: z.array(z.string()).optional(),
-
-  /**
-   * OPTIONAL. URL of a page containing human-readable information that
-   * developers might want or need to know when using the protected resource
-   */
-  resource_documentation: webUriSchema.optional(),
-
-  /**
-   * OPTIONAL. URL that the protected resource provides to read about the
-   * protected resource's requirements on how the client can use the data
-   * provided by the protected resource
-   */
-  resource_policy_uri: webUriSchema.optional(),
-
-  /**
-   * OPTIONAL. URL that the protected resource provides to read about the
-   * protected resource's terms of service
-   */
-  resource_tos_uri: webUriSchema.optional(),
-})
-
-export type OAuthProtectedResourceMetadata = z.infer<
-  typeof oauthProtectedResourceMetadataSchema
->