additionalAuthorizationParamsSchema (oauth2/authorization-params.ts)

additionalAuthorizationParamsSchema validates extra OAuth parameters, ensuring reserved keys are not overridden.

// Source: https://github.com/better-auth/better-auth | License: MIT | Copyright 2024 - present, Bereket Engida
// Provided via justclaw.it.com; keep this notice with the code.
import * as z from "zod";
import {
	RESERVED_AUTHORIZATION_PARAMS,
	RESERVED_AUTHORIZATION_PARAMS_SET,
} from "./create-authorization-url";

/**
 * Zod schema for the `additionalParams` field on social sign-in and
 * account-linking request bodies. Rejects any key reserved by the
 * authorization-URL builder (see `RESERVED_AUTHORIZATION_PARAMS`), so
 * a caller cannot overwrite `state`, PKCE, `redirect_uri`, etc.
 */
export const additionalAuthorizationParamsSchema = z
	.record(z.string(), z.string())
	.refine(
		(value) =>
			!Object.keys(value).some((key) =>
				RESERVED_AUTHORIZATION_PARAMS_SET.has(key),
			),
		

... (truncated -- full source via MCP)