Allow empty string as valid URL in DCR workflow

Author: fredericbarthelet

src/shared/auth.test.ts

@@ -18,12 +18,15 @@ describe('SafeUrlSchema', () => {
 
     it('rejects invalid URLs', () => {
         expect(() => SafeUrlSchema.parse('not-a-url')).toThrow();
-        expect(() => SafeUrlSchema.parse('')).toThrow();
     });
 
     it('works with safeParse', () => {
         expect(() => SafeUrlSchema.safeParse('not-a-url')).not.toThrow();
     });
+
+    it('works with empty string', () => {
+        expect(() => SafeUrlSchema.parse('')).not.toThrow();
+    });
 });
 
 describe('OAuthMetadataSchema', () => {

src/shared/auth.ts

@@ -23,7 +23,8 @@ export const SafeUrlSchema = z
             return u.protocol !== 'javascript:' && u.protocol !== 'data:' && u.protocol !== 'vbscript:';
         },
         { message: 'URL cannot use javascript:, data:, or vbscript: scheme' }
-    );
+    )
+    .or(z.literal(''));
 
 /**
  * RFC 9728 OAuth Protected Resource Metadata