@stackonward/cli 0.0.1 → 1.0.0

package/dist/resources/templates/go-backend/internal/common/runtimeinput/runtime_input_test.go

@@ -0,0 +1,245 @@
+package runtimeinput
+
+import (
+	"strings"
+	"testing"
+)
+
+func TestApplyInputTransformMapsArraysAndFields(t *testing.T) {
+	params := Object{
+		"image_urls": []string{"https://cdn.example.com/input.webp"},
+		"ratio":      "9:16",
+		"quality":    "high",
+		"x-input-transform": map[string]any{
+			"copy_array": map[string]any{
+				"image_urls": "image",
+			},
+			"map_fields": []any{
+				map[string]any{"source": "ratio", "target": "size"},
+			},
+		},
+	}
+
+	if err := ApplyInputTransform(params); err != nil {
+		t.Fatalf("ApplyInputTransform() error = %v", err)
+	}
+
+	image, ok := params["image"].([]string)
+	if !ok || len(image) != 1 || image[0] != "https://cdn.example.com/input.webp" {
+		t.Fatalf("image = %#v, want one copied URL", params["image"])
+	}
+	if params["size"] != "9:16" {
+		t.Fatalf("size = %v, want 9:16", params["size"])
+	}
+	if _, ok := params["image_urls"]; ok {
+		t.Fatal("image_urls must be consumed")
+	}
+	if _, ok := params["ratio"]; ok {
+		t.Fatal("ratio must be consumed")
+	}
+	if _, ok := params["x-input-transform"]; ok {
+		t.Fatal("x-input-transform must be consumed")
+	}
+}
+
+func TestApplyInputTransformBuildsNestedProviderPayload(t *testing.T) {
+	params := Object{
+		"image_urls": []string{"https://cdn.example.com/input.webp"},
+		"prompt":     "animate this image",
+		"duration":   float64(5),
+		"resolution": "720p",
+		"x-input-transform": map[string]any{
+			"map_fields": []any{
+				map[string]any{
+					"source": "resolution",
+					"target": "resolution",
+					"values": map[string]any{"720p": "720P"},
+				},
+			},
+			"array_items_from_strings": []any{
+				map[string]any{
+					"source":      "image_urls",
+					"target":      "input.media",
+					"value_field": "url",
+					"item_fields": map[string]any{"type": "first_frame"},
+				},
+			},
+			"move_fields": []any{
+				map[string]any{"source": "prompt", "target": "input.prompt"},
+				map[string]any{"source": "duration", "target": "parameters.duration"},
+				map[string]any{"source": "resolution", "target": "parameters.resolution"},
+			},
+		},
+	}
+
+	if err := ApplyInputTransform(params); err != nil {
+		t.Fatalf("ApplyInputTransform() error = %v", err)
+	}
+
+	input, ok := params["input"].(Object)
+	if !ok {
+		t.Fatalf("input = %#v, want object", params["input"])
+	}
+	if input["prompt"] != "animate this image" {
+		t.Fatalf("input.prompt = %#v", input["prompt"])
+	}
+	media, ok := input["media"].([]any)
+	if !ok || len(media) != 1 {
+		t.Fatalf("input.media = %#v, want one item", input["media"])
+	}
+	firstFrame, ok := media[0].(Object)
+	if !ok {
+		t.Fatalf("input.media[0] = %#v, want object", media[0])
+	}
+	if firstFrame["type"] != "first_frame" || firstFrame["url"] != "https://cdn.example.com/input.webp" {
+		t.Fatalf("input.media[0] = %#v", firstFrame)
+	}
+	parameters, ok := params["parameters"].(Object)
+	if !ok {
+		t.Fatalf("parameters = %#v, want object", params["parameters"])
+	}
+	if parameters["duration"] != float64(5) || parameters["resolution"] != "720P" {
+		t.Fatalf("parameters = %#v", parameters)
+	}
+	for _, consumed := range []string{"image_urls", "prompt", "duration", "resolution", "x-input-transform"} {
+		if _, ok := params[consumed]; ok {
+			t.Fatalf("%s must be consumed", consumed)
+		}
+	}
+}
+
+func TestApplyInputTransformArrayItemsFromStringsMergesIndexedItemFields(t *testing.T) {
+	params := Object{
+		"image_urls": []string{"https://cdn.example.com/start.webp", "https://cdn.example.com/end.webp"},
+		"x-input-transform": map[string]any{
+			"array_items_from_strings": []any{
+				map[string]any{
+					"source":      "image_urls",
+					"target":      "input.media",
+					"value_field": "url",
+					"item_fields": map[string]any{"role": "reference", "type": "first_frame"},
+					"indexed_item_fields": []any{
+						map[string]any{"index": 0, "fields": map[string]any{"type": "first_frame"}},
+						map[string]any{"index": 1, "fields": map[string]any{"type": "last_frame"}},
+					},
+				},
+			},
+		},
+	}
+
+	if err := ApplyInputTransform(params); err != nil {
+		t.Fatalf("ApplyInputTransform() error = %v", err)
+	}
+
+	input, ok := params["input"].(Object)
+	if !ok {
+		t.Fatalf("input = %#v, want object", params["input"])
+	}
+	media, ok := input["media"].([]any)
+	if !ok || len(media) != 2 {
+		t.Fatalf("input.media = %#v, want two items", input["media"])
+	}
+	firstFrame, ok := media[0].(Object)
+	if !ok {
+		t.Fatalf("input.media[0] = %#v, want object", media[0])
+	}
+	lastFrame, ok := media[1].(Object)
+	if !ok {
+		t.Fatalf("input.media[1] = %#v, want object", media[1])
+	}
+	if firstFrame["type"] != "first_frame" || firstFrame["url"] != "https://cdn.example.com/start.webp" || firstFrame["role"] != "reference" {
+		t.Fatalf("input.media[0] = %#v", firstFrame)
+	}
+	if lastFrame["type"] != "last_frame" || lastFrame["url"] != "https://cdn.example.com/end.webp" || lastFrame["role"] != "reference" {
+		t.Fatalf("input.media[1] = %#v", lastFrame)
+	}
+}
+
+func TestApplyInputTransformArrayItemsFromStringsAppliesBaseItemFieldsWithoutIndexedOverride(t *testing.T) {
+	params := Object{
+		"image_urls": []string{"https://cdn.example.com/start.webp", "https://cdn.example.com/end.webp"},
+		"x-input-transform": map[string]any{
+			"array_items_from_strings": []any{
+				map[string]any{
+					"source":      "image_urls",
+					"target":      "media",
+					"value_field": "url",
+					"item_fields": map[string]any{"role": "reference", "type": "first_frame"},
+				},
+			},
+		},
+	}
+
+	if err := ApplyInputTransform(params); err != nil {
+		t.Fatalf("ApplyInputTransform() error = %v", err)
+	}
+
+	media, ok := params["media"].([]any)
+	if !ok || len(media) != 2 {
+		t.Fatalf("media = %#v, want two items", params["media"])
+	}
+	for i := range media {
+		item, ok := media[i].(Object)
+		if !ok {
+			t.Fatalf("media[%d] = %#v, want object", i, media[i])
+		}
+		if item["type"] != "first_frame" || item["role"] != "reference" {
+			t.Fatalf("media[%d] = %#v", i, item)
+		}
+	}
+}
+
+func TestApplyInputTransformArrayItemsFromStringsRejectsInvalidIndexedItemFields(t *testing.T) {
+	cases := []struct {
+		name    string
+		indexed any
+		wantErr string
+	}{
+		{
+			name:    "not_array",
+			indexed: map[string]any{},
+			wantErr: "indexed_item_fields are invalid",
+		},
+		{
+			name:    "missing_index",
+			indexed: []any{map[string]any{"fields": map[string]any{"type": "first_frame"}}},
+			wantErr: "indexed_item_fields index is missing",
+		},
+		{
+			name:    "negative_index",
+			indexed: []any{map[string]any{"index": -1, "fields": map[string]any{"type": "first_frame"}}},
+			wantErr: "indexed_item_fields index is invalid",
+		},
+		{
+			name:    "invalid_fields",
+			indexed: []any{map[string]any{"index": 0, "fields": "first_frame"}},
+			wantErr: "indexed_item_fields fields are invalid",
+		},
+	}
+
+	for _, tc := range cases {
+		t.Run(tc.name, func(t *testing.T) {
+			params := Object{
+				"image_urls": []string{"https://cdn.example.com/start.webp"},
+				"x-input-transform": map[string]any{
+					"array_items_from_strings": []any{
+						map[string]any{
+							"source":              "image_urls",
+							"target":              "media",
+							"value_field":         "url",
+							"indexed_item_fields": tc.indexed,
+						},
+					},
+				},
+			}
+
+			err := ApplyInputTransform(params)
+			if err == nil {
+				t.Fatal("ApplyInputTransform() error = nil, want error")
+			}
+			if !strings.Contains(err.Error(), tc.wantErr) {
+				t.Fatalf("ApplyInputTransform() error = %v, want containing %q", err, tc.wantErr)
+			}
+		})
+	}
+}

package/dist/resources/templates/go-backend/internal/common/semver/errors.go

@@ -0,0 +1,6 @@
+package semver
+
+import "errors"
+
+// ErrInvalidVersion 表示输入不符合 Semantic Versioning 2.0.0。
+var ErrInvalidVersion = errors.New("invalid semantic version")

package/dist/resources/templates/go-backend/internal/common/semver/semver.go

@@ -0,0 +1,125 @@
+// Package semver 提供严格的 Semantic Versioning 2.0.0 校验与优先级比较。
+package semver
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+var semanticVersionPattern = regexp.MustCompile(
+	`^(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)(-((0|[1-9][0-9]*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(\.(0|[1-9][0-9]*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*))?(\+([0-9A-Za-z-]+(\.[0-9A-Za-z-]+)*))?$`,
+)
+
+// IsValid 判断 value 是否严格符合 Semantic Versioning 2.0.0。
+func IsValid(value string) bool {
+	return semanticVersionPattern.MatchString(value)
+}
+
+// Major 返回 value 的无前导零 major 标识符。
+func Major(value string) (string, error) {
+	version, err := parse(value)
+	if err != nil {
+		return "", err
+	}
+	return version.core[0], nil
+}
+
+// Compare 按 Semantic Versioning 2.0.0 precedence 比较两个版本。
+// 返回 -1、0 或 1；build metadata 不参与比较。
+func Compare(left, right string) (int, error) {
+	leftVersion, err := parse(left)
+	if err != nil {
+		return 0, fmt.Errorf("left version: %w", err)
+	}
+	rightVersion, err := parse(right)
+	if err != nil {
+		return 0, fmt.Errorf("right version: %w", err)
+	}
+	return compare(leftVersion, rightVersion), nil
+}
+
+type parsedVersion struct {
+	core       [3]string
+	prerelease []string
+}
+
+func parse(value string) (parsedVersion, error) {
+	if !IsValid(value) {
+		return parsedVersion{}, fmt.Errorf("%w: %q", ErrInvalidVersion, value)
+	}
+	precedence, _, _ := strings.Cut(value, "+")
+	versionCore, prerelease, hasPrerelease := strings.Cut(precedence, "-")
+	core := strings.Split(versionCore, ".")
+	version := parsedVersion{core: [3]string{core[0], core[1], core[2]}}
+	if hasPrerelease {
+		version.prerelease = strings.Split(prerelease, ".")
+	}
+	return version, nil
+}
+
+func compare(left, right parsedVersion) int {
+	for index := range left.core {
+		if result := compareNumericIdentifiers(left.core[index], right.core[index]); result != 0 {
+			return result
+		}
+	}
+
+	switch {
+	case len(left.prerelease) == 0 && len(right.prerelease) == 0:
+		return 0
+	case len(left.prerelease) == 0:
+		return 1
+	case len(right.prerelease) == 0:
+		return -1
+	}
+
+	for index := 0; index < len(left.prerelease) && index < len(right.prerelease); index++ {
+		if result := comparePrereleaseIdentifiers(left.prerelease[index], right.prerelease[index]); result != 0 {
+			return result
+		}
+	}
+	switch {
+	case len(left.prerelease) < len(right.prerelease):
+		return -1
+	case len(left.prerelease) > len(right.prerelease):
+		return 1
+	default:
+		return 0
+	}
+}
+
+func comparePrereleaseIdentifiers(left, right string) int {
+	leftNumeric := isNumericIdentifier(left)
+	rightNumeric := isNumericIdentifier(right)
+	switch {
+	case leftNumeric && rightNumeric:
+		return compareNumericIdentifiers(left, right)
+	case leftNumeric:
+		return -1
+	case rightNumeric:
+		return 1
+	default:
+		return strings.Compare(left, right)
+	}
+}
+
+func compareNumericIdentifiers(left, right string) int {
+	switch {
+	case len(left) < len(right):
+		return -1
+	case len(left) > len(right):
+		return 1
+	default:
+		return strings.Compare(left, right)
+	}
+}
+
+func isNumericIdentifier(value string) bool {
+	for index := range value {
+		if value[index] < '0' || value[index] > '9' {
+			return false
+		}
+	}
+	return true
+}

package/dist/resources/templates/go-backend/internal/common/semver/semver_test.go

@@ -0,0 +1,205 @@
+package semver
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestIsValidAcceptsSemanticVersioningExamples(t *testing.T) {
+	t.Parallel()
+
+	versions := []string{
+		"0.0.0",
+		"1.0.0",
+		"2.1.3",
+		"1.0.0-alpha",
+		"1.0.0-alpha.1",
+		"1.0.0-0.3.7",
+		"1.0.0-x.7.z.92",
+		"1.0.0-x-y-z.--",
+		"1.0.0-alpha+001",
+		"1.0.0+20130313144700",
+		"1.0.0+21AF26D3----117B344092BD",
+		"1.0.0-beta+exp.sha.5114f85",
+		"1.0.0-0123ABC",
+		"1.0.0+001",
+		"999999999999999999999999999999.0.0",
+	}
+
+	for _, version := range versions {
+		version := version
+		t.Run(version, func(t *testing.T) {
+			t.Parallel()
+			if !IsValid(version) {
+				t.Fatalf("IsValid(%q) = false, want true", version)
+			}
+		})
+	}
+}
+
+func TestIsValidRejectsInvalidSemanticVersions(t *testing.T) {
+	t.Parallel()
+
+	versions := []string{
+		"",
+		" ",
+		"v1.0.0",
+		"=1.0.0",
+		"1",
+		"1.0",
+		"1.0.0.0",
+		".1.0.0",
+		"1.0.0.",
+		"-1.0.0",
+		"01.0.0",
+		"1.01.0",
+		"1.0.01",
+		"1.0.0-",
+		"1.0.0+",
+		"1.0.0-.",
+		"1.0.0+.",
+		"1.0.0-alpha..1",
+		"1.0.0+build..1",
+		"1.0.0-01",
+		"1.0.0-00",
+		"1.0.0-alpha_1",
+		"1.0.0+build_1",
+		"1.0.0-alpha+build+more",
+		"1.0.0-α",
+		"1.0.0\n",
+		" 1.0.0",
+		"1.0.0 ",
+	}
+
+	for _, version := range versions {
+		version := version
+		t.Run(version, func(t *testing.T) {
+			t.Parallel()
+			if IsValid(version) {
+				t.Fatalf("IsValid(%q) = true, want false", version)
+			}
+		})
+	}
+}
+
+func TestMajorReturnsCanonicalArbitraryPrecisionIdentifier(t *testing.T) {
+	t.Parallel()
+
+	const largeMajor = "999999999999999999999999999999999999999999999999999"
+	tests := []struct {
+		version string
+		want    string
+	}{
+		{version: "0.1.0", want: "0"},
+		{version: "2.0.0-rc.1+build.9", want: "2"},
+		{version: largeMajor + ".1.0", want: largeMajor},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.version, func(t *testing.T) {
+			t.Parallel()
+			got, err := Major(test.version)
+			if err != nil || got != test.want {
+				t.Fatalf("Major(%q) = %q, %v, want %q", test.version, got, err, test.want)
+			}
+		})
+	}
+
+	if got, err := Major("01.0.0"); got != "" || !errors.Is(err, ErrInvalidVersion) {
+		t.Fatalf("Major(invalid) = %q, %v, want empty ErrInvalidVersion", got, err)
+	}
+}
+
+func TestCompareMatchesSemanticVersioningPrecedenceExample(t *testing.T) {
+	t.Parallel()
+
+	chains := [][]string{
+		{"1.0.0", "2.0.0", "2.1.0", "2.1.1"},
+		{
+			"1.0.0-alpha",
+			"1.0.0-alpha.1",
+			"1.0.0-alpha.beta",
+			"1.0.0-beta",
+			"1.0.0-beta.2",
+			"1.0.0-beta.11",
+			"1.0.0-rc.1",
+			"1.0.0",
+		},
+	}
+	for _, versions := range chains {
+		for index := 1; index < len(versions); index++ {
+			lower := versions[index-1]
+			higher := versions[index]
+			result, err := Compare(lower, higher)
+			if err != nil || result != -1 {
+				t.Fatalf("Compare(%q, %q) = %d, %v, want -1", lower, higher, result, err)
+			}
+			result, err = Compare(higher, lower)
+			if err != nil || result != 1 {
+				t.Fatalf("Compare(%q, %q) = %d, %v, want 1", higher, lower, result, err)
+			}
+		}
+	}
+}
+
+func TestCompareHandlesArbitraryPrecisionNumericIdentifiers(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		left  string
+		right string
+		want  int
+	}{
+		{left: "999999999999999999999999999999999999999.0.0", right: "2.999.999", want: 1},
+		{left: "1.999999999999999999999999999999999999999.0", right: "1.2.999", want: 1},
+		{left: "1.0.999999999999999999999999999999999999999", right: "1.0.2", want: 1},
+		{
+			left:  "1.0.0-999999999999999999999999999999999999999",
+			right: "1.0.0-1000000000000000000000000000000000000000",
+			want:  -1,
+		},
+		{left: "0.0.9", right: "0.0.10", want: -1},
+		{left: "0.1.0", right: "0.2.0", want: -1},
+	}
+	for _, test := range tests {
+		test := test
+		t.Run(test.left+"_to_"+test.right, func(t *testing.T) {
+			t.Parallel()
+			got, err := Compare(test.left, test.right)
+			if err != nil || got != test.want {
+				t.Fatalf("Compare(%q, %q) = %d, %v, want %d", test.left, test.right, got, err, test.want)
+			}
+		})
+	}
+}
+
+func TestCompareIgnoresBuildMetadata(t *testing.T) {
+	t.Parallel()
+
+	tests := [][2]string{
+		{"1.0.0", "1.0.0+20130313144700"},
+		{"1.0.0+build.1", "1.0.0+build.2"},
+		{"1.0.0-alpha+001", "1.0.0-alpha+exp.sha.5114f85"},
+	}
+	for _, test := range tests {
+		result, err := Compare(test[0], test[1])
+		if err != nil || result != 0 {
+			t.Fatalf("Compare(%q, %q) = %d, %v, want 0", test[0], test[1], result, err)
+		}
+	}
+}
+
+func TestCompareRejectsEitherInvalidInput(t *testing.T) {
+	t.Parallel()
+
+	tests := [][2]string{
+		{"v1.0.0", "1.0.0"},
+		{"1.0.0", "1.0.0-01"},
+		{"not-a-version", "also-invalid"},
+	}
+	for _, test := range tests {
+		if result, err := Compare(test[0], test[1]); result != 0 || !errors.Is(err, ErrInvalidVersion) {
+			t.Fatalf("Compare(%q, %q) = %d, %v, want 0 ErrInvalidVersion", test[0], test[1], result, err)
+		}
+	}
+}

package/dist/resources/templates/go-backend/internal/common/serviceidentity/audience.go

@@ -0,0 +1,48 @@
+package serviceidentity
+
+import (
+	"fmt"
+	"net/url"
+	"strings"
+	"unicode"
+)
+
+const maximumAudienceLength = 160
+
+const (
+	// AudienceIdentityTokenService 仅用于机密客户端调用授权服务器令牌端点。
+	AudienceIdentityTokenService = "urn:onex:resource:identity-token-service"
+	// AudiencePlatformInternalAPI 仅用于访问 OneX 平台内部资源 API。
+	AudiencePlatformInternalAPI = "urn:onex:resource:platform-internal-api"
+	// AudienceDocumentationAPI 仅用于访问独立文档资源服务。
+	AudienceDocumentationAPI = "urn:onex:resource:documentation-api"
+)
+
+// ValidateAudience 校验内部服务令牌受众是无用户信息的绝对 URN 或 HTTP(S) URI。
+func ValidateAudience(value string) error {
+	if value == "" || len(value) > maximumAudienceLength || strings.TrimSpace(value) != value ||
+		strings.ContainsFunc(value, func(character rune) bool { return unicode.IsSpace(character) || unicode.IsControl(character) }) {
+		return fmt.Errorf("internal service audience is invalid")
+	}
+	parsed, err := url.Parse(value)
+	schemeSeparator := strings.IndexByte(value, ':')
+	if err != nil || schemeSeparator < 1 || value[:schemeSeparator] != strings.ToLower(value[:schemeSeparator]) ||
+		parsed.Scheme == "" || parsed.User != nil ||
+		parsed.RawQuery != "" || parsed.Fragment != "" {
+		return fmt.Errorf("internal service audience is invalid")
+	}
+	switch parsed.Scheme {
+	case "http", "https":
+		if parsed.Host == "" || parsed.Opaque != "" {
+			return fmt.Errorf("internal service audience is invalid")
+		}
+	case "urn":
+		parts := strings.SplitN(parsed.Opaque, ":", 2)
+		if parsed.Host != "" || parsed.Path != "" || len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+			return fmt.Errorf("internal service audience is invalid")
+		}
+	default:
+		return fmt.Errorf("internal service audience is invalid")
+	}
+	return nil
+}

package/dist/resources/templates/go-backend/internal/common/serviceidentity/audience_test.go

@@ -0,0 +1,35 @@
+package serviceidentity
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestValidateAudienceAcceptsAbsoluteServiceIdentifiers(t *testing.T) {
+	for _, value := range []string{
+		"urn:onex:resource:platform-internal-api",
+		"https://platform.internal.example/internal-api",
+		"http://127.0.0.1:25702/internal-api",
+	} {
+		require.NoError(t, ValidateAudience(value), value)
+	}
+}
+
+func TestValidateAudienceRejectsRelativeAndAmbiguousIdentifiers(t *testing.T) {
+	for _, value := range []string{
+		"",
+		"abc",
+		"//platform.internal.example/internal-api",
+		"URN:onex:resource:platform-internal-api",
+		"urn:onex",
+		"https:///internal-api",
+		"https://user@platform.internal.example/internal-api",
+		"https://platform.internal.example/internal-api?target=other",
+		"https://platform.internal.example/internal-api#other",
+		" https://platform.internal.example/internal-api",
+		"ftp://platform.internal.example/internal-api",
+	} {
+		require.Error(t, ValidateAudience(value), value)
+	}
+}

package/dist/resources/templates/go-backend/internal/common/serviceidentity/resource_identifier.go

@@ -0,0 +1,33 @@
+package serviceidentity
+
+import (
+	"fmt"
+	"net/netip"
+	"net/url"
+	"strings"
+	"unicode"
+)
+
+const maximumResourceIdentifierLength = 512
+
+// ValidateResourceIdentifier 校验 OAuth 受保护资源使用可定位且无歧义的绝对 URL。
+func ValidateResourceIdentifier(value string) error {
+	if value == "" || len(value) > maximumResourceIdentifierLength || strings.TrimSpace(value) != value ||
+		strings.ContainsFunc(value, func(character rune) bool { return unicode.IsSpace(character) || unicode.IsControl(character) }) {
+		return fmt.Errorf("OAuth protected resource identifier is invalid")
+	}
+	parsed, err := url.Parse(value)
+	schemeSeparator := strings.IndexByte(value, ':')
+	if err != nil || parsed.Host == "" || parsed.Opaque != "" || parsed.User != nil || parsed.RawQuery != "" || parsed.Fragment != "" ||
+		schemeSeparator < 1 || value[:schemeSeparator] != strings.ToLower(value[:schemeSeparator]) {
+		return fmt.Errorf("OAuth protected resource identifier is invalid")
+	}
+	if parsed.Scheme == "https" {
+		return nil
+	}
+	address, addressErr := netip.ParseAddr(parsed.Hostname())
+	if parsed.Scheme == "http" && (strings.EqualFold(parsed.Hostname(), "localhost") || addressErr == nil && address.IsLoopback()) {
+		return nil
+	}
+	return fmt.Errorf("OAuth protected resource identifier must use HTTPS")
+}