stricter PRM check overridable w/ OAuthClientProvider.validateProtectedResourceMetadata

Author: ochafik

src/client/auth.ts

@@ -72,6 +72,13 @@ export interface OAuthClientProvider {
    * the authorization result.
    */
   codeVerifier(): string | Promise<string>;
+
+  /**
+   * If defined, overrides the OAuth Protected Resource Metadata (RFC 9728).
+   *
+   * Implementations must verify the provider
+   */
+  validateProtectedResourceMetadata?(metadata?: OAuthProtectedResourceMetadata): Promise<void>;
 }
 
 export type AuthResult = "AUTHORIZED" | "REDIRECT";
@@ -109,11 +116,13 @@ export async function auth(
   } catch (error) {
     console.warn("Could not load OAuth Protected Resource metadata, falling back to /.well-known/oauth-authorization-server", error)
   }
-  if (resourceMetadata) {
+  if (provider.validateProtectedResourceMetadata) {
+    await provider.validateProtectedResourceMetadata(resourceMetadata);
+  } else if (resourceMetadata) {
     if (resourceMetadata.authorization_servers && resourceMetadata.authorization_servers.length > 0) {
       authorizationServerUrl = resourceMetadata.authorization_servers[0];
     }
-    if (resourceMetadata.resource && resourceMetadata.resource !== resource.href) {
+    if (resourceMetadata.resource !== resource.href) {
       throw new Error(`Protected resource ${resourceMetadata.resource} does not match expected ${resource}`);
     }
   }