refactor: extract validateAuthorizationParameters helper

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[e-mail]>

src/pds.js

···
   }
 
   /**
+   * Validate OAuth authorization request parameters.
+   * Shared between PAR and direct authorization flows.
+   * @param {Object} params - The authorization parameters
+   * @param {string} params.clientId - The client_id
+   * @param {string} params.redirectUri - The redirect_uri
+   * @param {string} params.responseType - The response_type
+   * @param {string} [params.responseMode] - The response_mode
+   * @param {string} [params.scope] - The scope
+   * @param {string} [params.state] - The state
+   * @param {string} params.codeChallenge - The code_challenge
+   * @param {string} params.codeChallengeMethod - The code_challenge_method
+   * @param {string} [params.loginHint] - The login_hint
+   * @returns {Promise<{error: Response} | {clientMetadata: ClientMetadata}>}
+   */
+  async validateAuthorizationParameters({
+    clientId,
+    redirectUri,
+    responseType,
+    codeChallenge,
+    codeChallengeMethod,
+  }) {
+    if (!clientId) {
+      return { error: errorResponse('invalid_request', 'client_id required', 400) };
+    }
+    if (!redirectUri) {
+      return { error: errorResponse('invalid_request', 'redirect_uri required', 400) };
+    }
+    if (responseType !== 'code') {
+      return {
+        error: errorResponse(
+          'unsupported_response_type',
+          'response_type must be code',
+          400,
+        ),
+      };
+    }
+    if (!codeChallenge || codeChallengeMethod !== 'S256') {
+      return { error: errorResponse('invalid_request', 'PKCE with S256 required', 400) };
+    }
+
+    let clientMetadata;
+    try {
+      clientMetadata = await getClientMetadata(clientId);
+    } catch (err) {
+      return { error: errorResponse('invalid_client', err.message, 400) };
+    }
+
+    // Validate redirect_uri against registered URIs
+    const isLoopback =
+      clientId.startsWith('http://localhost') ||
+      clientId.startsWith('http://127.0.0.1');
+    const redirectUriValid = clientMetadata.redirect_uris.some((uri) => {
+      if (isLoopback) {
+        try {
+          const registered = new URL(uri);
+          const requested = new URL(redirectUri);
+          return registered.origin === requested.origin;
+        } catch {
+          return false;
+        }
+      }
+      return uri === redirectUri;
+    });
+    if (!redirectUriValid) {
+      return {
+        error: errorResponse(
+          'invalid_request',
+          'redirect_uri not registered for this client',
+          400,
+        ),
+      };
+    }
+
+    return { clientMetadata };
+  }
+
+  /**
    * Handle Pushed Authorization Request (PAR) endpoint.
    * Validates DPoP proof, client metadata, PKCE parameters, and stores the authorization request.
    * @param {Request} request - The incoming request