@hed-hog/core 0.0.385 → 0.0.386

package/dist/authorize/authorize.controller.js

@@ -0,0 +1,120 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizeController = void 0;
+const api_1 = require("@hed-hog/api");
+const api_locale_1 = require("@hed-hog/api-locale");
+const common_1 = require("@nestjs/common");
+const throttler_1 = require("@nestjs/throttler");
+const authorize_service_1 = require("./authorize.service");
+const authorize_info_dto_1 = require("./dto/authorize-info.dto");
+const consent_dto_1 = require("./dto/consent.dto");
+const token_dto_1 = require("./dto/token.dto");
+/**
+ * Endpoints do fluxo Authorization Code + PKCE.
+ *
+ * Note o que NÃO existe aqui: um `GET /auth/authorize` que redireciona. O
+ * redirect final é feito pelo browser, na página de consent do admin, depois do
+ * POST /auth/authorize/consent. Assim toda a validação fica no servidor e o
+ * `code` não passa pelo mecanismo de redirect do Nest (nem pelos seus logs).
+ */
+let AuthorizeController = class AuthorizeController {
+    constructor(service) {
+        this.service = service;
+    }
+    /**
+     * Metadados para a tela de consent. Público: a página precisa validar os
+     * parâmetros e mostrar de quem é o app ANTES de exigir login.
+     */
+    async authorizeInfo(query) {
+        return this.service.getAuthorizationInfo({
+            clientId: query.client_id,
+            redirectUri: query.redirect_uri,
+            scope: query.scope,
+            codeChallenge: query.code_challenge,
+            codeChallengeMethod: query.code_challenge_method,
+        });
+    }
+    /** O usuário logado aprova. O code sai vinculado a ele. */
+    async consent({ id }, body) {
+        const code = await this.service.issueCode({
+            userId: id,
+            clientId: body.client_id,
+            redirectUri: body.redirect_uri,
+            scope: body.scope,
+            codeChallenge: body.code_challenge,
+            codeChallengeMethod: body.code_challenge_method,
+        });
+        return { code };
+    }
+    /**
+     * Troca o code por tokens. Público por definição (o cliente ainda não tem
+     * token) — quem autentica é a posse do code + do code_verifier.
+     *
+     * Sem @Res() e sem cookie `rt`: o refreshToken vai no body. Um Set-Cookie aqui
+     * seria ruído para um cliente não-browser e um vetor de CSRF a mais.
+     */
+    async token(body, locale, ipAddress, userAgent) {
+        return this.service.exchangeCode({
+            code: body.code,
+            codeVerifier: body.code_verifier,
+            clientId: body.client_id,
+            redirectUri: body.redirect_uri,
+            locale,
+            ipAddress,
+            userAgent,
+        });
+    }
+};
+exports.AuthorizeController = AuthorizeController;
+__decorate([
+    (0, api_1.Public)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 30, ttl: 60000 } }),
+    (0, common_1.Get)('authorize/info'),
+    __param(0, (0, common_1.Query)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [authorize_info_dto_1.AuthorizeInfoDTO]),
+    __metadata("design:returntype", Promise)
+], AuthorizeController.prototype, "authorizeInfo", null);
+__decorate([
+    (0, api_1.NoRole)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 10, ttl: 60000 } }),
+    (0, common_1.Post)('authorize/consent'),
+    __param(0, (0, api_1.User)()),
+    __param(1, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, consent_dto_1.ConsentDTO]),
+    __metadata("design:returntype", Promise)
+], AuthorizeController.prototype, "consent", null);
+__decorate([
+    (0, api_1.Public)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 20, ttl: 60000 } }),
+    (0, common_1.Post)('token'),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, api_locale_1.Locale)()),
+    __param(2, (0, common_1.Ip)()),
+    __param(3, (0, common_1.Headers)('user-agent')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [token_dto_1.TokenDTO, String, String, String]),
+    __metadata("design:returntype", Promise)
+], AuthorizeController.prototype, "token", null);
+exports.AuthorizeController = AuthorizeController = __decorate([
+    (0, common_1.Controller)('auth'),
+    __param(0, (0, common_1.Inject)((0, common_1.forwardRef)(() => authorize_service_1.AuthorizeService))),
+    __metadata("design:paramtypes", [authorize_service_1.AuthorizeService])
+], AuthorizeController);
+//# sourceMappingURL=authorize.controller.js.map

package/dist/authorize/authorize.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.controller.js","sourceRoot":"","sources":["../../src/authorize/authorize.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,sCAAoD;AACpD,oDAA6C;AAC7C,2CAWwB;AACxB,iDAA6D;AAC7D,2DAAuD;AACvD,iEAA4D;AAC5D,mDAA+C;AAC/C,+CAA2C;AAE3C;;;;;;;GAOG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAEmB,OAAyB;QAAzB,YAAO,GAAP,OAAO,CAAkB;IACzC,CAAC;IAEJ;;;OAGG;IAKG,AAAN,KAAK,CAAC,aAAa,CAAU,KAAuB;QAClD,OAAO,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YACvC,QAAQ,EAAE,KAAK,CAAC,SAAS;YACzB,WAAW,EAAE,KAAK,CAAC,YAAY;YAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,aAAa,EAAE,KAAK,CAAC,cAAc;YACnC,mBAAmB,EAAE,KAAK,CAAC,qBAAqB;SACjD,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAKrD,AAAN,KAAK,CAAC,OAAO,CAAS,EAAE,EAAE,EAAE,EAAU,IAAgB;QACpD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC;YACxC,MAAM,EAAE,EAAE;YACV,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,aAAa,EAAE,IAAI,CAAC,cAAc;YAClC,mBAAmB,EAAE,IAAI,CAAC,qBAAqB;SAChD,CAAC,CAAC;QAEH,OAAO,EAAE,IAAI,EAAE,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IAKG,AAAN,KAAK,CAAC,KAAK,CACD,IAAc,EACZ,MAAc,EAClB,SAAiB,EACA,SAAiB;QAExC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YAC/B,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,MAAM;YACN,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AArEY,kDAAmB;AAcxB;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,YAAG,EAAC,gBAAgB,CAAC;IACD,WAAA,IAAA,cAAK,GAAE,CAAA;;qCAAQ,qCAAgB;;wDAQnD;AAOK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACX,WAAA,IAAA,UAAI,GAAE,CAAA;IAAU,WAAA,IAAA,aAAI,GAAE,CAAA;;6CAAO,wBAAU;;kDAWrD;AAaK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,OAAO,CAAC;IAEX,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;;qCAHR,oBAAQ;;gDAcvB;8BApEU,mBAAmB;IAD/B,IAAA,mBAAU,EAAC,MAAM,CAAC;IAGd,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,oCAAgB,CAAC,CAAC,CAAA;qCACjB,oCAAgB;GAHjC,mBAAmB,CAqE/B"}

package/dist/authorize/authorize.module.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Separado de OAuthModule de propósito: lá o HedHog é *client* de IdPs externos
+ * (Google, Apple...). Aqui ele é o *provider*. Misturar os dois confundiria dois
+ * papéis opostos no mesmo arquivo.
+ */
+export declare class AuthorizeModule {
+}
+//# sourceMappingURL=authorize.module.d.ts.map

package/dist/authorize/authorize.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.module.d.ts","sourceRoot":"","sources":["../../src/authorize/authorize.module.ts"],"names":[],"mappings":"AAOA;;;;GAIG;AACH,qBAUa,eAAe;CAAG"}

package/dist/authorize/authorize.module.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizeModule = void 0;
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const common_1 = require("@nestjs/common");
+const auth_module_1 = require("../auth/auth.module");
+const security_module_1 = require("../security/security.module");
+const authorize_controller_1 = require("./authorize.controller");
+const authorize_service_1 = require("./authorize.service");
+/**
+ * Separado de OAuthModule de propósito: lá o HedHog é *client* de IdPs externos
+ * (Google, Apple...). Aqui ele é o *provider*. Misturar os dois confundiria dois
+ * papéis opostos no mesmo arquivo.
+ */
+let AuthorizeModule = class AuthorizeModule {
+};
+exports.AuthorizeModule = AuthorizeModule;
+exports.AuthorizeModule = AuthorizeModule = __decorate([
+    (0, common_1.Module)({
+        imports: [
+            (0, common_1.forwardRef)(() => api_prisma_1.PrismaModule),
+            (0, common_1.forwardRef)(() => security_module_1.SecurityModule),
+            (0, common_1.forwardRef)(() => auth_module_1.AuthModule),
+        ],
+        controllers: [authorize_controller_1.AuthorizeController],
+        providers: [authorize_service_1.AuthorizeService],
+        exports: [authorize_service_1.AuthorizeService],
+    })
+], AuthorizeModule);
+//# sourceMappingURL=authorize.module.js.map

package/dist/authorize/authorize.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.module.js","sourceRoot":"","sources":["../../src/authorize/authorize.module.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oDAAmD;AACnD,2CAAoD;AACpD,qDAAiD;AACjD,iEAA6D;AAC7D,iEAA6D;AAC7D,2DAAuD;AAEvD;;;;GAIG;AAWI,IAAM,eAAe,GAArB,MAAM,eAAe;CAAG,CAAA;AAAlB,0CAAe;0BAAf,eAAe;IAV3B,IAAA,eAAM,EAAC;QACN,OAAO,EAAE;YACP,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,yBAAY,CAAC;YAC9B,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC;YAChC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,wBAAU,CAAC;SAC7B;QACD,WAAW,EAAE,CAAC,0CAAmB,CAAC;QAClC,SAAS,EAAE,CAAC,oCAAgB,CAAC;QAC7B,OAAO,EAAE,CAAC,oCAAgB,CAAC;KAC5B,CAAC;GACW,eAAe,CAAG"}

package/dist/authorize/authorize.service.d.ts

@@ -0,0 +1,79 @@
+import { PrismaService } from '@hed-hog/api-prisma';
+import { AuthService } from '../auth/auth.service';
+import { SecurityService } from '../security/security.service';
+/**
+ * Authorization Code + PKCE — o HedHog como OAuth *provider* para apps
+ * first-party (a extensão de navegador; e o que vier depois).
+ *
+ * Modelado no padrão `web ref` do OAuthService: token opaco de que só o hash é
+ * persistido, TTL curto e consumo single-use atômico via UPDATE ... RETURNING.
+ *
+ * Por que existe, em vez de reusar GET /auth/desktop-token: aquele fluxo entrega
+ * accessToken e refreshToken na URL do redirect, e aceita `?scheme=` sem
+ * allowlist (open redirect). Para um gerenciador de senhas isso não serve.
+ */
+export declare class AuthorizeService {
+    private readonly prisma;
+    private readonly security;
+    private readonly auth;
+    private readonly logger;
+    /** Curto de propósito: o code viaja na URL e só precisa sobreviver ao redirect. */
+    private readonly codeTtlMs;
+    constructor(prisma: PrismaService, security: SecurityService, auth: AuthService);
+    private getClient;
+    /**
+     * A allowlist é comparada por igualdade de string, não por parsing de URL:
+     * normalizar/parsear abriria espaço para bypass (barra final, case do host,
+     * userinfo, `origin` valendo "null" em esquemas não-http).
+     */
+    private assertRedirectUri;
+    private assertScope;
+    /** Metadados para a tela de consent. Também valida antes de qualquer redirect. */
+    getAuthorizationInfo(params: {
+        clientId: string;
+        redirectUri: string;
+        scope: string;
+        codeChallenge: string;
+        codeChallengeMethod: string;
+    }): Promise<{
+        clientName: string;
+        scopes: string[];
+    }>;
+    /**
+     * `plain` é rejeitado sem exceção: com ele o "verifier" viaja igual ao
+     * challenge e o PKCE não protege nada. O RFC 7636 permite; nós não.
+     */
+    private assertPkce;
+    /** Emite o code já vinculado ao usuário da sessão que aprovou o consent. */
+    issueCode(params: {
+        userId: number;
+        clientId: string;
+        redirectUri: string;
+        scope: string;
+        codeChallenge: string;
+        codeChallengeMethod: string;
+    }): Promise<string>;
+    /**
+     * Troca o code por tokens. O consumo é atômico (UPDATE ... WHERE consumed_at
+     * IS NULL RETURNING): dois requests concorrentes com o mesmo code — o caso de
+     * replay — só podem ter um vencedor, decidido pelo banco.
+     */
+    exchangeCode(params: {
+        code: string;
+        codeVerifier: string;
+        clientId: string;
+        redirectUri: string;
+        locale: string;
+        ipAddress: string;
+        userAgent: string;
+    }): Promise<{
+        accessToken: string;
+        refreshToken: string;
+        tokenType: string;
+        expiresIn: number;
+        scope: string;
+    }>;
+    /** base64url(sha256(verifier)) === challenge, em tempo constante. */
+    private verifyPkce;
+}
+//# sourceMappingURL=authorize.service.d.ts.map

package/dist/authorize/authorize.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.service.d.ts","sourceRoot":"","sources":["../../src/authorize/authorize.service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAU,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAS5D,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D;;;;;;;;;;GAUG;AACH,qBACa,gBAAgB;IAQzB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAEvB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAEzB,OAAO,CAAC,QAAQ,CAAC,IAAI;IAXvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqC;IAE5D,mFAAmF;IACnF,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAU;gBAIjB,MAAM,EAAE,aAAa,EAErB,QAAQ,EAAE,eAAe,EAEzB,IAAI,EAAE,WAAW;YAGtB,SAAS;IAYvB;;;;OAIG;IACH,OAAO,CAAC,iBAAiB;IAWzB,OAAO,CAAC,WAAW;IAYnB,kFAAkF;IAC5E,oBAAoB,CAAC,MAAM,EAAE;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;KAC7B;;;;IAYD;;;OAGG;IACH,OAAO,CAAC,UAAU;IAclB,4EAA4E;IACtE,SAAS,CAAC,MAAM,EAAE;QACtB,MAAM,EAAE,MAAM,CAAC;QACf,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,MAAM,CAAC;QACtB,mBAAmB,EAAE,MAAM,CAAC;KAC7B,GAAG,OAAO,CAAC,MAAM,CAAC;IA8BnB;;;;OAIG;IACG,YAAY,CAAC,MAAM,EAAE;QACzB,IAAI,EAAE,MAAM,CAAC;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,WAAW,EAAE,MAAM,CAAC;QACpB,MAAM,EAAE,MAAM,CAAC;QACf,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB;;;;;;;IAwDD,qEAAqE;IACrE,OAAO,CAAC,UAAU;CAiBnB"}

package/dist/authorize/authorize.service.js

@@ -0,0 +1,196 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AuthorizeService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizeService = void 0;
+// `Prisma` vem de @hed-hog/api-prisma, não de '@prisma/client': o tsconfig do
+// monorepo mapeia '@prisma/client' para o client gerado (.prisma/client), que
+// não expõe o helper `Prisma.sql`. É a convenção do repo inteiro.
+const api_prisma_1 = require("@hed-hog/api-prisma");
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const auth_service_1 = require("../auth/auth.service");
+const security_service_1 = require("../security/security.service");
+/**
+ * Authorization Code + PKCE — o HedHog como OAuth *provider* para apps
+ * first-party (a extensão de navegador; e o que vier depois).
+ *
+ * Modelado no padrão `web ref` do OAuthService: token opaco de que só o hash é
+ * persistido, TTL curto e consumo single-use atômico via UPDATE ... RETURNING.
+ *
+ * Por que existe, em vez de reusar GET /auth/desktop-token: aquele fluxo entrega
+ * accessToken e refreshToken na URL do redirect, e aceita `?scheme=` sem
+ * allowlist (open redirect). Para um gerenciador de senhas isso não serve.
+ */
+let AuthorizeService = AuthorizeService_1 = class AuthorizeService {
+    constructor(prisma, security, auth) {
+        this.prisma = prisma;
+        this.security = security;
+        this.auth = auth;
+        this.logger = new common_1.Logger(AuthorizeService_1.name);
+        /** Curto de propósito: o code viaja na URL e só precisa sobreviver ao redirect. */
+        this.codeTtlMs = 60000;
+    }
+    async getClient(clientId) {
+        const client = await this.prisma.oauth_app_client.findUnique({
+            where: { client_id: clientId },
+        });
+        if (!client || !client.enabled) {
+            throw new common_1.BadRequestException('Aplicativo desconhecido ou desabilitado.');
+        }
+        return client;
+    }
+    /**
+     * A allowlist é comparada por igualdade de string, não por parsing de URL:
+     * normalizar/parsear abriria espaço para bypass (barra final, case do host,
+     * userinfo, `origin` valendo "null" em esquemas não-http).
+     */
+    assertRedirectUri(client, redirectUri) {
+        const allowed = client.redirect_uris
+            .split('\n')
+            .map((uri) => uri.trim())
+            .filter(Boolean);
+        if (!allowed.includes(redirectUri)) {
+            throw new common_1.BadRequestException('redirect_uri não registrado para este aplicativo.');
+        }
+    }
+    assertScope(client, scope) {
+        const granted = new Set(client.scopes.split(/[\s,]+/).filter(Boolean));
+        const requested = scope.split(/[\s,]+/).filter(Boolean);
+        if (requested.length === 0) {
+            throw new common_1.BadRequestException('scope é obrigatório.');
+        }
+        if (!requested.every((s) => granted.has(s))) {
+            throw new common_1.BadRequestException('scope não autorizado para este aplicativo.');
+        }
+    }
+    /** Metadados para a tela de consent. Também valida antes de qualquer redirect. */
+    async getAuthorizationInfo(params) {
+        const client = await this.getClient(params.clientId);
+        this.assertRedirectUri(client, params.redirectUri);
+        this.assertScope(client, params.scope);
+        this.assertPkce(params.codeChallenge, params.codeChallengeMethod);
+        return {
+            clientName: client.name,
+            scopes: params.scope.split(/[\s,]+/).filter(Boolean),
+        };
+    }
+    /**
+     * `plain` é rejeitado sem exceção: com ele o "verifier" viaja igual ao
+     * challenge e o PKCE não protege nada. O RFC 7636 permite; nós não.
+     */
+    assertPkce(codeChallenge, method) {
+        if (method !== 'S256') {
+            throw new common_1.BadRequestException('code_challenge_method deve ser S256.');
+        }
+        if (!codeChallenge ||
+            codeChallenge.length < 43 ||
+            codeChallenge.length > 128 ||
+            !/^[A-Za-z0-9\-._~]+$/.test(codeChallenge)) {
+            throw new common_1.BadRequestException('code_challenge inválido.');
+        }
+    }
+    /** Emite o code já vinculado ao usuário da sessão que aprovou o consent. */
+    async issueCode(params) {
+        const client = await this.getClient(params.clientId);
+        this.assertRedirectUri(client, params.redirectUri);
+        this.assertScope(client, params.scope);
+        this.assertPkce(params.codeChallenge, params.codeChallengeMethod);
+        const code = this.security.randomOpaque(32);
+        const codeHash = this.security.hashSha256(code);
+        const expiresAt = new Date(Date.now() + this.codeTtlMs);
+        await this.prisma.oauth_authorization_code.create({
+            data: {
+                code_hash: codeHash,
+                client_id: params.clientId,
+                user_id: params.userId,
+                redirect_uri: params.redirectUri,
+                scope: params.scope,
+                code_challenge: params.codeChallenge,
+                code_challenge_method: 'S256',
+                expires_at: expiresAt,
+            },
+        });
+        this.logger.debug(`[AuthorizeService] code emitido client=${params.clientId} userId=${params.userId}`);
+        return code;
+    }
+    /**
+     * Troca o code por tokens. O consumo é atômico (UPDATE ... WHERE consumed_at
+     * IS NULL RETURNING): dois requests concorrentes com o mesmo code — o caso de
+     * replay — só podem ter um vencedor, decidido pelo banco.
+     */
+    async exchangeCode(params) {
+        const client = await this.getClient(params.clientId);
+        if (client.client_type !== 'public') {
+            throw new common_1.BadRequestException('Fluxo indisponível para este aplicativo.');
+        }
+        const codeHash = this.security.hashSha256(params.code);
+        const rows = await this.prisma.$queryRaw(api_prisma_1.Prisma.sql `
+        UPDATE oauth_authorization_code
+        SET consumed_at = NOW()
+        WHERE code_hash = ${codeHash}
+          AND client_id = ${params.clientId}
+          AND redirect_uri = ${params.redirectUri}
+          AND expires_at > NOW()
+          AND consumed_at IS NULL
+        RETURNING user_id, code_challenge, scope
+      `);
+        const row = rows[0];
+        if (!row) {
+            throw new common_1.BadRequestException('Código inválido, expirado ou já utilizado. Refaça a autorização.');
+        }
+        if (!this.verifyPkce(params.codeVerifier, row.code_challenge)) {
+            // O code já foi consumido acima — um verifier errado não dá segunda chance.
+            this.logger.warn(`[AuthorizeService] PKCE falhou client=${params.clientId} userId=${row.user_id}`);
+            throw new common_1.BadRequestException('code_verifier inválido.');
+        }
+        const { accessToken, refreshToken } = await this.auth.getAuthenticationPayload(params.locale, row.user_id, params.ipAddress, params.userAgent);
+        return {
+            accessToken,
+            refreshToken,
+            tokenType: 'Bearer',
+            // Informativo para o cliente agendar refresh; a verdade é o exp do JWT.
+            expiresIn: 3600,
+            scope: row.scope,
+        };
+    }
+    /** base64url(sha256(verifier)) === challenge, em tempo constante. */
+    verifyPkce(codeVerifier, codeChallenge) {
+        if (!codeVerifier || codeVerifier.length < 43 || codeVerifier.length > 128) {
+            return false;
+        }
+        // hashSha256 já devolve base64url — o mesmo formato do S256.
+        const expected = Buffer.from(this.security.hashSha256(codeVerifier));
+        const provided = Buffer.from(codeChallenge);
+        if (expected.length !== provided.length)
+            return false;
+        try {
+            return (0, crypto_1.timingSafeEqual)(expected, provided);
+        }
+        catch (_a) {
+            return false;
+        }
+    }
+};
+exports.AuthorizeService = AuthorizeService;
+exports.AuthorizeService = AuthorizeService = AuthorizeService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)((0, common_1.forwardRef)(() => api_prisma_1.PrismaService))),
+    __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => security_service_1.SecurityService))),
+    __param(2, (0, common_1.Inject)((0, common_1.forwardRef)(() => auth_service_1.AuthService))),
+    __metadata("design:paramtypes", [api_prisma_1.PrismaService,
+        security_service_1.SecurityService,
+        auth_service_1.AuthService])
+], AuthorizeService);
+//# sourceMappingURL=authorize.service.js.map

package/dist/authorize/authorize.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize.service.js","sourceRoot":"","sources":["../../src/authorize/authorize.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,kEAAkE;AAClE,oDAA4D;AAC5D,2CAMwB;AACxB,mCAAyC;AACzC,uDAAmD;AACnD,mEAA+D;AAE/D;;;;;;;;;;GAUG;AAEI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAM3B,YAEE,MAAsC,EAEtC,QAA0C,EAE1C,IAAkC;QAJjB,WAAM,GAAN,MAAM,CAAe;QAErB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,SAAI,GAAJ,IAAI,CAAa;QAXnB,WAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5D,mFAAmF;QAClE,cAAS,GAAG,KAAM,CAAC;IASjC,CAAC;IAEI,KAAK,CAAC,SAAS,CAAC,QAAgB;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;YAC3D,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,iBAAiB,CAAC,MAAiC,EAAE,WAAmB;QAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa;aACjC,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACxB,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,4BAAmB,CAAC,mDAAmD,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,MAA0B,EAAE,KAAa;QAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAExD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,4BAAmB,CAAC,4CAA4C,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,MAM1B;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAElE,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SACrD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,aAAqB,EAAE,MAAc;QACtD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;QACxE,CAAC;QACD,IACE,CAAC,aAAa;YACd,aAAa,CAAC,MAAM,GAAG,EAAE;YACzB,aAAa,CAAC,MAAM,GAAG,GAAG;YAC1B,CAAC,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,SAAS,CAAC,MAOf;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAElE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAExD,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC;YAChD,IAAI,EAAE;gBACJ,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,cAAc,EAAE,MAAM,CAAC,aAAa;gBACpC,qBAAqB,EAAE,MAAM;gBAC7B,UAAU,EAAE,SAAS;aACtB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0CAA0C,MAAM,CAAC,QAAQ,WAAW,MAAM,CAAC,MAAM,EAAE,CACpF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,MAQlB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErD,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtC,mBAAM,CAAC,GAAG,CAAA;;;4BAGY,QAAQ;4BACR,MAAM,CAAC,QAAQ;+BACZ,MAAM,CAAC,WAAW;;;;OAI1C,CACF,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,4BAAmB,CAC3B,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9D,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yCAAyC,MAAM,CAAC,QAAQ,WAAW,GAAG,CAAC,OAAO,EAAE,CACjF,CAAC;YACF,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC5E,MAAM,CAAC,MAAM,EACb,GAAG,CAAC,OAAO,EACX,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,CACjB,CAAC;QAEF,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,QAAQ;YACnB,wEAAwE;YACxE,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,qEAAqE;IAC7D,UAAU,CAAC,YAAoB,EAAE,aAAqB;QAC5D,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE,IAAI,YAAY,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE5C,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AAzNY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAa,CAAC,CAAC,CAAA;IAEvC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kCAAe,CAAC,CAAC,CAAA;IAEzC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC,CAAC,CAAA;qCAHb,0BAAa;QAEX,kCAAe;QAEnB,0BAAW;GAZzB,gBAAgB,CAyN5B"}

package/dist/authorize/dto/authorize-info.dto.d.ts

@@ -0,0 +1,8 @@
+export declare class AuthorizeInfoDTO {
+    client_id: string;
+    redirect_uri: string;
+    scope: string;
+    code_challenge: string;
+    code_challenge_method: string;
+}
+//# sourceMappingURL=authorize-info.dto.d.ts.map

package/dist/authorize/dto/authorize-info.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-info.dto.d.ts","sourceRoot":"","sources":["../../../src/authorize/dto/authorize-info.dto.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAgB;IAG3B,SAAS,EAAE,MAAM,CAAC;IAIlB,YAAY,EAAE,MAAM,CAAC;IAIrB,KAAK,EAAE,MAAM,CAAC;IAId,cAAc,EAAE,MAAM,CAAC;IAIvB,qBAAqB,EAAE,MAAM,CAAC;CAC/B"}

package/dist/authorize/dto/authorize-info.dto.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthorizeInfoDTO = void 0;
+const class_validator_1 = require("class-validator");
+class AuthorizeInfoDTO {
+}
+exports.AuthorizeInfoDTO = AuthorizeInfoDTO;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthorizeInfoDTO.prototype, "client_id", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthorizeInfoDTO.prototype, "redirect_uri", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthorizeInfoDTO.prototype, "scope", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthorizeInfoDTO.prototype, "code_challenge", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], AuthorizeInfoDTO.prototype, "code_challenge_method", void 0);
+//# sourceMappingURL=authorize-info.dto.js.map

package/dist/authorize/dto/authorize-info.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-info.dto.js","sourceRoot":"","sources":["../../../src/authorize/dto/authorize-info.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAuD;AAEvD,MAAa,gBAAgB;CAoB5B;AApBD,4CAoBC;AAjBC;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;mDACK;AAIlB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sDACQ;AAIrB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACC;AAId;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;wDACU;AAIvB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+DACiB"}

package/dist/authorize/dto/consent.dto.d.ts

@@ -0,0 +1,8 @@
+export declare class ConsentDTO {
+    client_id: string;
+    redirect_uri: string;
+    scope: string;
+    code_challenge: string;
+    code_challenge_method: string;
+}
+//# sourceMappingURL=consent.dto.d.ts.map

package/dist/authorize/dto/consent.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.dto.d.ts","sourceRoot":"","sources":["../../../src/authorize/dto/consent.dto.ts"],"names":[],"mappings":"AAEA,qBAAa,UAAU;IAGrB,SAAS,EAAE,MAAM,CAAC;IAIlB,YAAY,EAAE,MAAM,CAAC;IAIrB,KAAK,EAAE,MAAM,CAAC;IAId,cAAc,EAAE,MAAM,CAAC;IAIvB,qBAAqB,EAAE,MAAM,CAAC;CAC/B"}

package/dist/authorize/dto/consent.dto.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConsentDTO = void 0;
+const class_validator_1 = require("class-validator");
+class ConsentDTO {
+}
+exports.ConsentDTO = ConsentDTO;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ConsentDTO.prototype, "client_id", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ConsentDTO.prototype, "redirect_uri", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ConsentDTO.prototype, "scope", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ConsentDTO.prototype, "code_challenge", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], ConsentDTO.prototype, "code_challenge_method", void 0);
+//# sourceMappingURL=consent.dto.js.map

package/dist/authorize/dto/consent.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consent.dto.js","sourceRoot":"","sources":["../../../src/authorize/dto/consent.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAuD;AAEvD,MAAa,UAAU;CAoBtB;AApBD,gCAoBC;AAjBC;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;6CACK;AAIlB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;gDACQ;AAIrB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;yCACC;AAId;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;kDACU;AAIvB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;yDACiB"}

package/dist/authorize/dto/token.dto.d.ts

@@ -0,0 +1,8 @@
+export declare class TokenDTO {
+    grant_type: string;
+    code: string;
+    code_verifier: string;
+    client_id: string;
+    redirect_uri: string;
+}
+//# sourceMappingURL=token.dto.d.ts.map

package/dist/authorize/dto/token.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.dto.d.ts","sourceRoot":"","sources":["../../../src/authorize/dto/token.dto.ts"],"names":[],"mappings":"AAEA,qBAAa,QAAQ;IAGnB,UAAU,EAAE,MAAM,CAAC;IAInB,IAAI,EAAE,MAAM,CAAC;IAIb,aAAa,EAAE,MAAM,CAAC;IAItB,SAAS,EAAE,MAAM,CAAC;IAIlB,YAAY,EAAE,MAAM,CAAC;CACtB"}

package/dist/authorize/dto/token.dto.js

@@ -0,0 +1,42 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TokenDTO = void 0;
+const class_validator_1 = require("class-validator");
+class TokenDTO {
+}
+exports.TokenDTO = TokenDTO;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsIn)(['authorization_code']),
+    __metadata("design:type", String)
+], TokenDTO.prototype, "grant_type", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], TokenDTO.prototype, "code", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], TokenDTO.prototype, "code_verifier", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], TokenDTO.prototype, "client_id", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], TokenDTO.prototype, "redirect_uri", void 0);
+//# sourceMappingURL=token.dto.js.map