📐 OAuth schemas

OAuth exports five reusable OpenAPI query parameters and three initiation schemas. Callback routes compose no schema, including for their state query.

Inventory

Export	Request location	Contract
fpQueryParameter	Query	Required string fp.
purposeQueryParameter	Query	Required oauth-login or oauth-signup.
redirectUrlQueryParameter	Query	Required string redirectUrl.
typeIdQueryParameter	Query	Optional string typeId.
stateQueryParameter	Query	Required string state; currently uncomposed.
googleOauthSchema	Query, body	Google initiation parameters and an empty JSON object body.
lineOauthSchema	Query, body	LINE initiation parameters and an empty JSON object body.
twitterOauthSchema	Query, body	Twitter initiation parameters and an empty JSON object body.

Details

fpQueryParameter

Definition

Location	Field	Type	Required	Constraints
Query	fp	string	Yes	Fingerprint value used in Google and LINE state.

Spread by googleOauthSchema and lineOauthSchema. Used by route: googleOAuthRoute and lineOAuthRoute. Used by feature: googleOAuthFeature and lineOAuthFeature.

View complete source

export const fpQueryParameter: OpenAPIParameter = {
  in: 'query',
  name: 'fp',
  required: true,
  schema: {type: 'string'},
};

---

purposeQueryParameter

Definition

Location	Field	Type	Required	Constraints
Query	purpose	string	Yes	Enum oauth-login, oauth-signup.

Spread by googleOauthSchema, lineOauthSchema, and twitterOauthSchema. Used by route: googleOAuthRoute, lineOAuthRoute, and twitterOAuthRoute. Used by feature: googleOAuthFeature, lineOAuthFeature, and twitterOAuthFeature.

View complete source

export const purposeQueryParameter: OpenAPIParameter = {
  in: 'query',
  name: 'purpose',
  required: true,
  schema: {enum: [OAUTH_LOGIN, OAUTH_SIGNUP], type: 'string'},
};

---

redirectUrlQueryParameter

Definition

Location	Field	Type	Required	Constraints
Query	redirectUrl	string	Yes	Callback destination; generateRedirectURL preserves its percent encoding and appends onetimeToken.

This parameter schema requires a string; origin validation is performed by the route handler. Google, LINE, and Twitter initiation routes check params.requestQuery.redirectUrl with validateURL before preparing provider state or calling the driver. Malformed/disallowed URLs return 400; missing/empty allowlists return AuthenticationUnexpectedError, mapped to 500 by the initiation route. During the Google, LINE, or Twitter callback, validateURL checks the state's URL against configuration.oauth.allowedRedirectOrigins after provider callback/state processing and before identity checks, token generation, or storage. The URL must be absolute with an allowed origin: malformed/disallowed URLs return 400, and missing/empty origins return 500.

Spread by googleOauthSchema, lineOauthSchema, and twitterOauthSchema. Used by route: googleOAuthRoute, lineOAuthRoute, and twitterOAuthRoute. Used by feature: googleOAuthFeature, lineOAuthFeature, and twitterOAuthFeature.

View complete source

export const redirectUrlQueryParameter: OpenAPIParameter = {
  in: 'query',
  name: 'redirectUrl',
  required: true,
  schema: {type: 'string'},
};

---

typeIdQueryParameter

Definition

Location	Field	Type	Required	Constraints
Query	typeId	string	No	Required later only when a new oauth-signup identity is created.

Spread by googleOauthSchema, lineOauthSchema, and twitterOauthSchema. Used by route: googleOAuthRoute, lineOAuthRoute, and twitterOAuthRoute. Used by feature: googleOAuthFeature, lineOAuthFeature, and twitterOAuthFeature.

View complete source

export const typeIdQueryParameter: OpenAPIParameter = {
  in: 'query',
  name: 'typeId',
  required: false,
  schema: {type: 'string'},
};

---

stateQueryParameter

Definition

Location	Field	Type	Required	Constraints
Query	state	string	Yes	Public reusable parameter; no OAuth schema or feature currently uses it.

Google and LINE callbacks read requestQuery.state directly; this declaration does not validate them.

View complete source

export const stateQueryParameter: OpenAPIParameter = {
  in: 'query',
  name: 'state',
  required: true,
  schema: {type: 'string'},
};

---

googleOauthSchema

Definition

Used by route: googleOAuthRoute. Used by feature: googleOAuthFeature.

Location	Field	Type	Required	Constraints
Query	fp	string	Yes	Shared parameter.
Query	purpose	string	Yes	Shared enum.
Query	redirectUrl	string	Yes	Shared parameter.
Query	typeId	string	No	Shared parameter.
Body	—	object	No	application/json, maxProperties: 0; no fields allowed.

View complete source

export const googleOauthSchema = withSchema({
  parameters: [fpQueryParameter, purposeQueryParameter, redirectUrlQueryParameter, typeIdQueryParameter],
  requestBody: {content: {'application/json': {schema: {maxProperties: 0, type: 'object'}}}},
});

---

lineOauthSchema

Definition

Used by route: lineOAuthRoute. Used by feature: lineOAuthFeature.

Location	Field	Type	Required	Constraints
Query	fp	string	Yes	Shared parameter.
Query	purpose	string	Yes	Shared enum.
Query	redirectUrl	string	Yes	Shared parameter.
Query	typeId	string	No	Shared parameter.
Body	—	object	No	application/json, maxProperties: 0; no fields allowed.

View complete source

export const lineOauthSchema = withSchema({
  parameters: [fpQueryParameter, purposeQueryParameter, redirectUrlQueryParameter, typeIdQueryParameter],
  requestBody: {content: {'application/json': {schema: {maxProperties: 0, type: 'object'}}}},
});

---

twitterOauthSchema

Definition

Used by route: twitterOAuthRoute. Used by feature: twitterOAuthFeature.

Location	Field	Type	Required	Constraints
Query	purpose	string	Yes	Shared enum.
Query	redirectUrl	string	Yes	Shared parameter.
Query	typeId	string	No	Shared parameter.
Body	—	object	No	application/json, maxProperties: 0; no fields allowed.

View complete source

export const twitterOauthSchema = withSchema({
  parameters: [purposeQueryParameter, redirectUrlQueryParameter, typeIdQueryParameter],
  requestBody: {content: {'application/json': {schema: {maxProperties: 0, type: 'object'}}}},
});

---