@go-mondo/identity-sdk 0.0.2-beta.8 → 0.0.2-beta.9

package/dist/cjs/oauth/authorize/schema/grants/authorization-code.test.js

@@ -0,0 +1,334 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const arktype_1 = require("arktype");
+const vitest_1 = require("vitest");
+const utils_js_1 = require("../../../../app/utils.js");
+const schema_js_1 = require("../../../common/schema.js");
+const authorization_code_js_1 = require("./authorization-code.js");
+(0, vitest_1.describe)('OAuth Authorization Code Schema', () => {
+    (0, vitest_1.describe)('AuthorizationCodeSchema validation', () => {
+        (0, vitest_1.test)('should validate minimal valid authorization code request', () => {
+            const minimalPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(minimalPayload);
+            (0, vitest_1.expect)(result).toEqual(minimalPayload);
+        });
+        (0, vitest_1.test)('should validate complete authorization code request', () => {
+            const completePayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://example.com/callback',
+                scope: 'openid profile email',
+                state: 'random-state-value',
+                code_challenge: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+                nonce: 'random-nonce-value',
+                display: 'page',
+                prompt: 'consent',
+                max_age: 3600,
+                audience: 'https://api.example.com',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(completePayload);
+            (0, vitest_1.expect)(result).toEqual(completePayload);
+        });
+        (0, vitest_1.test)('should validate authorization code request with PKCE', () => {
+            const pkcePayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+                redirect_uri: 'https://app.example.com/auth/callback',
+                scope: 'openid',
+                state: 'xyz',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(pkcePayload);
+            (0, vitest_1.expect)(result).toEqual(pkcePayload);
+        });
+        (0, vitest_1.test)('should validate authorization code request with plain PKCE', () => {
+            const plainPkcePayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.PLAIN,
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(plainPkcePayload);
+            (0, vitest_1.expect)(result).toEqual(plainPkcePayload);
+        });
+        (0, vitest_1.test)('should validate request without PKCE parameters', () => {
+            const noPkcePayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://legacy.example.com/callback',
+                scope: 'openid profile',
+                state: 'legacy-state',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(noPkcePayload);
+            (0, vitest_1.expect)(result).toEqual(noPkcePayload);
+        });
+        (0, vitest_1.test)('should validate OIDC specific parameters', () => {
+            const oidcPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                nonce: 'unique-nonce-12345',
+                display: 'popup',
+                prompt: 'login',
+                max_age: 7200,
+                scope: 'openid profile email address phone',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(oidcPayload);
+            (0, vitest_1.expect)(result).toEqual(oidcPayload);
+        });
+        (0, vitest_1.test)('should validate with optional audience parameter', () => {
+            const audiencePayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                audience: 'https://api.myservice.com',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(audiencePayload);
+            (0, vitest_1.expect)(result).toEqual(audiencePayload);
+        });
+    });
+    (0, vitest_1.describe)('AuthorizationCodeSchema validation errors', () => {
+        (0, vitest_1.test)('should reject missing response_type', () => {
+            const invalidPayload = {
+                client_id: (0, utils_js_1.generateAppId)(),
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(invalidPayload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid response_type', () => {
+            const invalidPayload = {
+                response_type: 'invalid_type',
+                client_id: (0, utils_js_1.generateAppId)(),
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(invalidPayload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject missing client_id', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(invalidPayload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid client_id format', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: 'invalid-client-id',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(invalidPayload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid redirect_uri format', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'not-a-url',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(invalidPayload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid code_challenge_method', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'valid-challenge',
+                code_challenge_method: 'invalid_method',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(invalidPayload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid display value', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                display: 'invalid_display',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(invalidPayload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject invalid prompt value', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                prompt: 'invalid_prompt',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(invalidPayload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject non-number max_age', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                max_age: 'not-a-number',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(invalidPayload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should reject negative max_age', () => {
+            const invalidPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                max_age: -100,
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(invalidPayload);
+            (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+        });
+    });
+    (0, vitest_1.describe)('PKCE validation edge cases', () => {
+        (0, vitest_1.test)('should require both code_challenge and code_challenge_method when one is provided', () => {
+            const onlyChallenge = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'challenge-without-method',
+            };
+            const result1 = (0, authorization_code_js_1.AuthorizationCodeSchema)(onlyChallenge);
+            (0, vitest_1.expect)(result1).toBeInstanceOf(arktype_1.type.errors);
+            const onlyMethod = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+            };
+            const result2 = (0, authorization_code_js_1.AuthorizationCodeSchema)(onlyMethod);
+            (0, vitest_1.expect)(result2).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should allow neither code_challenge nor code_challenge_method', () => {
+            const noPkce = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://example.com/callback',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(noPkce);
+            (0, vitest_1.expect)(result).toEqual(noPkce);
+        });
+        (0, vitest_1.test)('should validate PKCE with S256 method', () => {
+            const s256Pkce = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(s256Pkce);
+            (0, vitest_1.expect)(result).toEqual(s256Pkce);
+        });
+        (0, vitest_1.test)('should validate PKCE with plain method', () => {
+            const plainPkce = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                code_challenge: 'plain-text-challenge',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.PLAIN,
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(plainPkce);
+            (0, vitest_1.expect)(result).toEqual(plainPkce);
+        });
+    });
+    (0, vitest_1.describe)('Real-world scenarios', () => {
+        (0, vitest_1.test)('should validate typical SPA authorization request', () => {
+            const spaRequest = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://myapp.com/auth/callback',
+                scope: 'openid profile email',
+                state: 'abc123def456',
+                code_challenge: 'E9Melhoa2OwvFrEMTJguCHaoeK1t8URWbuGJSstw-cM',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+                nonce: 'xyz789',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(spaRequest);
+            (0, vitest_1.expect)(result).toEqual(spaRequest);
+        });
+        (0, vitest_1.test)('should validate server-side web app authorization request', () => {
+            const webAppRequest = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://webapp.example.com/oauth/callback',
+                scope: 'openid profile email address phone',
+                state: 'secure-random-state-12345',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(webAppRequest);
+            (0, vitest_1.expect)(result).toEqual(webAppRequest);
+        });
+        (0, vitest_1.test)('should validate mobile app authorization request', () => {
+            const mobileRequest = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'com.example.myapp://oauth/callback',
+                scope: 'openid profile',
+                state: 'mobile-state-token',
+                code_challenge: 'dBjftJeZ4CVP-mB92K27uhbUJU1p1r_wW1gFWFOEjXk',
+                code_challenge_method: schema_js_1.CodeChallengeMethod.S256,
+                display: 'touch',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(mobileRequest);
+            (0, vitest_1.expect)(result).toEqual(mobileRequest);
+        });
+        (0, vitest_1.test)('should validate enterprise SSO request', () => {
+            const enterpriseRequest = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                redirect_uri: 'https://enterprise.example.com/sso/callback',
+                scope: 'openid profile email groups',
+                state: 'enterprise-session-12345',
+                prompt: 'select_account',
+                max_age: 28800, // 8 hours
+                audience: 'https://api.enterprise.example.com',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(enterpriseRequest);
+            (0, vitest_1.expect)(result).toEqual(enterpriseRequest);
+        });
+        (0, vitest_1.test)('should validate request with multiple scopes', () => {
+            const multiScopeRequest = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                scope: 'openid profile email address phone offline_access custom:read custom:write',
+                redirect_uri: 'https://example.com/callback',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(multiScopeRequest);
+            (0, vitest_1.expect)(result).toEqual(multiScopeRequest);
+        });
+    });
+    (0, vitest_1.describe)('Edge cases and boundary conditions', () => {
+        (0, vitest_1.test)('should handle empty strings for optional string fields', () => {
+            const emptyStringsPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                scope: '',
+                state: '',
+                nonce: '',
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(emptyStringsPayload);
+            (0, vitest_1.expect)(result).toEqual(emptyStringsPayload);
+        });
+        (0, vitest_1.test)('should handle very long valid values', () => {
+            const longValuesPayload = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                state: 'a'.repeat(1000),
+                nonce: 'b'.repeat(500),
+                scope: `openid profile email ${'custom:scope'.repeat(100)}`,
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(longValuesPayload);
+            (0, vitest_1.expect)(result).toEqual(longValuesPayload);
+        });
+        (0, vitest_1.test)('should handle zero max_age', () => {
+            const zeroMaxAge = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                max_age: 0,
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(zeroMaxAge);
+            (0, vitest_1.expect)(result).toEqual(zeroMaxAge);
+        });
+        (0, vitest_1.test)('should handle large max_age values', () => {
+            const largeMaxAge = {
+                response_type: schema_js_1.ResponseType.CODE,
+                client_id: (0, utils_js_1.generateAppId)(),
+                max_age: 31536000, // 1 year in seconds
+            };
+            const result = (0, authorization_code_js_1.AuthorizationCodeSchema)(largeMaxAge);
+            (0, vitest_1.expect)(result).toEqual(largeMaxAge);
+        });
+    });
+});

package/dist/cjs/oauth/common/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/cjs/oauth/common/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../src/oauth/common/schema.test.ts"],"names":[],"mappings":""}

package/dist/cjs/oauth/common/schema.test.js

@@ -0,0 +1,290 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const arktype_1 = require("arktype");
+const vitest_1 = require("vitest");
+const schema_js_1 = require("./schema.js");
+(0, vitest_1.describe)('OAuth Common Schema', () => {
+    (0, vitest_1.describe)('GrantType constants', () => {
+        (0, vitest_1.test)('should define correct grant type values', () => {
+            (0, vitest_1.expect)(schema_js_1.GrantType.CLIENT_CREDENTIALS).toBe('client_credentials');
+            (0, vitest_1.expect)(schema_js_1.GrantType.AUTHORIZATION_CODE).toBe('authorization_code');
+            (0, vitest_1.expect)(schema_js_1.GrantType.IMPLICIT).toBe('implicit');
+            (0, vitest_1.expect)(schema_js_1.GrantType.REFRESH_TOKEN).toBe('refresh_token');
+        });
+        (0, vitest_1.test)('should have corresponding labels for each grant type', () => {
+            (0, vitest_1.expect)(schema_js_1.GrantTypeLabel[schema_js_1.GrantType.CLIENT_CREDENTIALS]).toBe('Client Credentials');
+            (0, vitest_1.expect)(schema_js_1.GrantTypeLabel[schema_js_1.GrantType.AUTHORIZATION_CODE]).toBe('Authorization Code');
+            (0, vitest_1.expect)(schema_js_1.GrantTypeLabel[schema_js_1.GrantType.IMPLICIT]).toBe('Implicit');
+            (0, vitest_1.expect)(schema_js_1.GrantTypeLabel[schema_js_1.GrantType.REFRESH_TOKEN]).toBe('Refresh Token');
+        });
+        (0, vitest_1.test)('should have all grant types covered in labels', () => {
+            const grantTypeKeys = Object.keys(schema_js_1.GrantType);
+            const labelKeys = Object.keys(schema_js_1.GrantTypeLabel);
+            (0, vitest_1.expect)(labelKeys).toHaveLength(grantTypeKeys.length);
+            for (const key of grantTypeKeys) {
+                const grantType = schema_js_1.GrantType[key];
+                (0, vitest_1.expect)(schema_js_1.GrantTypeLabel).toHaveProperty(grantType);
+            }
+        });
+        (0, vitest_1.test)('AnyGrantType type should work with valid values', () => {
+            const validGrantTypes = [
+                'client_credentials',
+                'authorization_code',
+                'implicit',
+                'refresh_token',
+            ];
+            for (const grantType of validGrantTypes) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.GrantType)).toContain(grantType);
+            }
+        });
+    });
+    (0, vitest_1.describe)('ResponseType constants', () => {
+        (0, vitest_1.test)('should define correct response type values', () => {
+            (0, vitest_1.expect)(schema_js_1.ResponseType.ID_TOKEN).toBe('id_token');
+            (0, vitest_1.expect)(schema_js_1.ResponseType.TOKEN).toBe('token');
+            (0, vitest_1.expect)(schema_js_1.ResponseType.CODE).toBe('code');
+        });
+        (0, vitest_1.test)('AnyResponseType type should work with valid values', () => {
+            const validResponseTypes = [
+                'id_token',
+                'token',
+                'code',
+            ];
+            for (const responseType of validResponseTypes) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.ResponseType)).toContain(responseType);
+            }
+        });
+    });
+    (0, vitest_1.describe)('CodeChallengeMethod constants and schema', () => {
+        (0, vitest_1.test)('should define correct code challenge method values', () => {
+            (0, vitest_1.expect)(schema_js_1.CodeChallengeMethod.DEFAULT).toBe('S256');
+            (0, vitest_1.expect)(schema_js_1.CodeChallengeMethod.S256).toBe('S256');
+            (0, vitest_1.expect)(schema_js_1.CodeChallengeMethod.PLAIN).toBe('plain');
+        });
+        (0, vitest_1.test)('CodeChallengeMethodSchema should validate valid methods', () => {
+            const validResult1 = (0, schema_js_1.CodeChallengeMethodSchema)('S256');
+            (0, vitest_1.expect)(validResult1).toBe('S256');
+            const validResult2 = (0, schema_js_1.CodeChallengeMethodSchema)('plain');
+            (0, vitest_1.expect)(validResult2).toBe('plain');
+        });
+        (0, vitest_1.test)('CodeChallengeMethodSchema should reject invalid methods', () => {
+            const invalidResult = (0, schema_js_1.CodeChallengeMethodSchema)('invalid_method');
+            (0, vitest_1.expect)(invalidResult).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('AnyCodeChallengeMethod type should work with valid values', () => {
+            const validMethods = ['S256', 'plain'];
+            for (const method of validMethods) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.CodeChallengeMethod)).toContain(method);
+            }
+        });
+    });
+    (0, vitest_1.describe)('AuthorizationDisplay constants and schema', () => {
+        (0, vitest_1.test)('should define correct authorization display values', () => {
+            (0, vitest_1.expect)(schema_js_1.AuthorizationDisplay.PAGE).toBe('page');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationDisplay.POPUP).toBe('popup');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationDisplay.TOUCH).toBe('touch');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationDisplay.WAP).toBe('wap');
+        });
+        (0, vitest_1.test)('AuthorizationDisplaySchema should validate valid display values', () => {
+            const validDisplays = ['page', 'popup', 'touch', 'wap'];
+            for (const display of validDisplays) {
+                const result = (0, schema_js_1.AuthorizationDisplaySchema)(display);
+                (0, vitest_1.expect)(result).toBe(display);
+            }
+        });
+        (0, vitest_1.test)('AuthorizationDisplaySchema should reject invalid display values', () => {
+            const invalidResult = (0, schema_js_1.AuthorizationDisplaySchema)('invalid_display');
+            (0, vitest_1.expect)(invalidResult).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('AnyAuthorizationDisplay type should work with valid values', () => {
+            const validDisplays = [
+                'page',
+                'popup',
+                'touch',
+                'wap',
+            ];
+            for (const display of validDisplays) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.AuthorizationDisplay)).toContain(display);
+            }
+        });
+    });
+    (0, vitest_1.describe)('AuthorizationPrompt constants and schema', () => {
+        (0, vitest_1.test)('should define correct authorization prompt values', () => {
+            (0, vitest_1.expect)(schema_js_1.AuthorizationPrompt.NONE).toBe('none');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationPrompt.LOGIN).toBe('login');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationPrompt.CONSENT).toBe('consent');
+            (0, vitest_1.expect)(schema_js_1.AuthorizationPrompt.SELECT_ACCOUNT).toBe('select_account');
+        });
+        (0, vitest_1.test)('AuthorizationPromptSchema should validate valid prompt values', () => {
+            const validPrompts = ['none', 'login', 'consent', 'select_account'];
+            for (const prompt of validPrompts) {
+                const result = (0, schema_js_1.AuthorizationPromptSchema)(prompt);
+                (0, vitest_1.expect)(result).toBe(prompt);
+            }
+        });
+        (0, vitest_1.test)('AuthorizationPromptSchema should reject invalid prompt values', () => {
+            const invalidResult = (0, schema_js_1.AuthorizationPromptSchema)('invalid_prompt');
+            (0, vitest_1.expect)(invalidResult).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('AnyAuthorizationPrompt type should work with valid values', () => {
+            const validPrompts = [
+                'none',
+                'login',
+                'consent',
+                'select_account',
+            ];
+            for (const prompt of validPrompts) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.AuthorizationPrompt)).toContain(prompt);
+            }
+        });
+    });
+    (0, vitest_1.describe)('OptionalSchema', () => {
+        (0, vitest_1.test)('should validate object with optional audience', () => {
+            const validWithAudience = (0, schema_js_1.OptionalSchema)({
+                audience: 'https://api.example.com',
+            });
+            (0, vitest_1.expect)(validWithAudience).toEqual({
+                audience: 'https://api.example.com',
+            });
+            const validWithoutAudience = (0, schema_js_1.OptionalSchema)({});
+            (0, vitest_1.expect)(validWithoutAudience).toEqual({});
+        });
+        (0, vitest_1.test)('should reject non-string audience values', () => {
+            const invalidResult = (0, schema_js_1.OptionalSchema)({ audience: 123 });
+            (0, vitest_1.expect)(invalidResult).toBeInstanceOf(arktype_1.type.errors);
+        });
+        (0, vitest_1.test)('should allow additional properties to be filtered', () => {
+            // Depending on schema configuration, extra properties might be filtered
+            const input = {
+                audience: 'https://api.example.com',
+                extraProperty: 'should be handled based on schema config',
+            };
+            const result = (0, schema_js_1.OptionalSchema)(input);
+            // The result depends on schema configuration (onUndeclaredKey behavior)
+            (0, vitest_1.expect)(result).toHaveProperty('audience', 'https://api.example.com');
+        });
+    });
+    (0, vitest_1.describe)('OIDC and OAuth Scopes', () => {
+        (0, vitest_1.test)('should define correct OIDC scope values', () => {
+            (0, vitest_1.expect)(schema_js_1.OIDCScope.OPENID).toBe('openid');
+            (0, vitest_1.expect)(schema_js_1.OIDCScope.PROFILE).toBe('profile');
+            (0, vitest_1.expect)(schema_js_1.OIDCScope.EMAIL).toBe('email');
+            (0, vitest_1.expect)(schema_js_1.OIDCScope.ADDRESS).toBe('address');
+            (0, vitest_1.expect)(schema_js_1.OIDCScope.PHONE).toBe('phone');
+        });
+        (0, vitest_1.test)('should define correct OAuth scope values', () => {
+            (0, vitest_1.expect)(schema_js_1.OAuthScope.OFFLINE_ACCESS).toBe('offline_access');
+        });
+        (0, vitest_1.test)('Scope should combine OIDC and OAuth scopes', () => {
+            (0, vitest_1.expect)(schema_js_1.Scope.OPENID).toBe('openid');
+            (0, vitest_1.expect)(schema_js_1.Scope.PROFILE).toBe('profile');
+            (0, vitest_1.expect)(schema_js_1.Scope.EMAIL).toBe('email');
+            (0, vitest_1.expect)(schema_js_1.Scope.ADDRESS).toBe('address');
+            (0, vitest_1.expect)(schema_js_1.Scope.PHONE).toBe('phone');
+            (0, vitest_1.expect)(schema_js_1.Scope.OFFLINE_ACCESS).toBe('offline_access');
+        });
+        (0, vitest_1.test)('AnyOIDCScope type should work with valid OIDC values', () => {
+            const validOIDCScopes = [
+                'openid',
+                'profile',
+                'email',
+                'address',
+                'phone',
+            ];
+            for (const scope of validOIDCScopes) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.OIDCScope)).toContain(scope);
+            }
+        });
+        (0, vitest_1.test)('AnyOAuthScope type should work with valid OAuth values', () => {
+            const validOAuthScopes = ['offline_access'];
+            for (const scope of validOAuthScopes) {
+                (0, vitest_1.expect)(Object.values(schema_js_1.OAuthScope)).toContain(scope);
+            }
+        });
+        (0, vitest_1.test)('AnyScope type should work with any string', () => {
+            const validScopes = [
+                'openid',
+                'profile',
+                'offline_access',
+                'custom:read',
+                'api:write',
+                'admin:all',
+            ];
+            // All should be valid as AnyScope includes string
+            for (const scope of validScopes) {
+                (0, vitest_1.expect)(typeof scope).toBe('string');
+            }
+        });
+        (0, vitest_1.test)('ScopeSchema should validate string values', () => {
+            const validScopes = [
+                'openid',
+                'profile email',
+                'custom:scope',
+                'api:read api:write',
+                'offline_access',
+            ];
+            for (const scope of validScopes) {
+                const result = (0, schema_js_1.ScopeSchema)(scope);
+                (0, vitest_1.expect)(result).toBe(scope);
+            }
+        });
+        (0, vitest_1.test)('ScopeSchema should reject non-string values', () => {
+            const invalidValues = [123, true, null, undefined, {}, []];
+            for (const value of invalidValues) {
+                const result = (0, schema_js_1.ScopeSchema)(value);
+                (0, vitest_1.expect)(result).toBeInstanceOf(arktype_1.type.errors);
+            }
+        });
+    });
+    (0, vitest_1.describe)('Type consistency', () => {
+        (0, vitest_1.test)('should ensure all constants are properly typed', () => {
+            // Test that constants match their type definitions
+            const grantType = schema_js_1.GrantType.AUTHORIZATION_CODE;
+            (0, vitest_1.expect)(grantType).toBe('authorization_code');
+            const responseType = schema_js_1.ResponseType.CODE;
+            (0, vitest_1.expect)(responseType).toBe('code');
+            const challengeMethod = schema_js_1.CodeChallengeMethod.S256;
+            (0, vitest_1.expect)(challengeMethod).toBe('S256');
+            const display = schema_js_1.AuthorizationDisplay.PAGE;
+            (0, vitest_1.expect)(display).toBe('page');
+            const prompt = schema_js_1.AuthorizationPrompt.LOGIN;
+            (0, vitest_1.expect)(prompt).toBe('login');
+        });
+        (0, vitest_1.test)('should handle scope combinations correctly', () => {
+            const oidcScope = 'openid';
+            const oauthScope = 'offline_access';
+            const customScope = 'custom:permission';
+            (0, vitest_1.expect)(typeof oidcScope).toBe('string');
+            (0, vitest_1.expect)(typeof oauthScope).toBe('string');
+            (0, vitest_1.expect)(typeof customScope).toBe('string');
+            // Test that combined scope includes both OIDC and OAuth
+            (0, vitest_1.expect)(schema_js_1.Scope).toHaveProperty('OPENID');
+            (0, vitest_1.expect)(schema_js_1.Scope).toHaveProperty('OFFLINE_ACCESS');
+        });
+    });
+    (0, vitest_1.describe)('Schema edge cases', () => {
+        (0, vitest_1.test)('should handle empty strings appropriately', () => {
+            const emptyString = '';
+            const scopeResult = (0, schema_js_1.ScopeSchema)(emptyString);
+            (0, vitest_1.expect)(scopeResult).toBe(emptyString); // Empty string is valid string
+            const challengeResult = (0, schema_js_1.CodeChallengeMethodSchema)(emptyString);
+            (0, vitest_1.expect)(challengeResult).toBeInstanceOf(arktype_1.type.errors); // Empty string not valid enum
+        });
+        (0, vitest_1.test)('should handle whitespace and special characters', () => {
+            const spacedScope = '  openid profile  ';
+            const result = (0, schema_js_1.ScopeSchema)(spacedScope);
+            (0, vitest_1.expect)(result).toBe(spacedScope); // Preserves whitespace
+            const specialScope = 'custom:read+write';
+            const specialResult = (0, schema_js_1.ScopeSchema)(specialScope);
+            (0, vitest_1.expect)(specialResult).toBe(specialScope);
+        });
+        (0, vitest_1.test)('should validate complex optional schema scenarios', () => {
+            const complexValid = (0, schema_js_1.OptionalSchema)({
+                audience: 'urn:example:audience',
+            });
+            (0, vitest_1.expect)(complexValid.audience).toBe('urn:example:audience');
+            const emptyValid = (0, schema_js_1.OptionalSchema)({});
+            (0, vitest_1.expect)(emptyValid).toEqual({});
+        });
+    });
+});

package/dist/cjs/oauth/token/schema/schema.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=schema.test.d.ts.map

package/dist/cjs/oauth/token/schema/schema.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.test.d.ts","sourceRoot":"","sources":["../../../../../src/oauth/token/schema/schema.test.ts"],"names":[],"mappings":""}