Allow empty string as valid URL in DCR workflow

Author: fredericbarthelet

src/shared/auth.test.ts

@@ -23,12 +23,15 @@ describe('SafeUrlSchema', () => {
 
   it('rejects invalid URLs', () => {
     expect(() => SafeUrlSchema.parse('not-a-url')).toThrow();
-    expect(() => SafeUrlSchema.parse('')).toThrow();
   });
 
   it('works with safeParse', () => {
     expect(() => SafeUrlSchema.safeParse('not-a-url')).not.toThrow();
   });
+
+  it('works with empty string', () => {
+    expect(() => SafeUrlSchema.parse('')).not.toThrow();
+  });
 });
 
 describe('OAuthMetadataSchema', () => {

src/shared/auth.ts

@@ -20,7 +20,7 @@ export const SafeUrlSchema = z.string().url()
       return u.protocol !== 'javascript:' && u.protocol !== 'data:' && u.protocol !== 'vbscript:';
     },
     { message: "URL cannot use javascript:, data:, or vbscript: scheme" }
-);
+).or(z.literal(""));
 
 
 /**