@hed-hog/core 0.0.387 → 0.0.393

package/dist/pairing/dto/confirm-pairing.dto.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfirmPairingDTO = void 0;
+const class_validator_1 = require("class-validator");
+/** Direção A: o navegador aprova o aparelho que reivindicou e entrega o blob. */
+class ConfirmPairingDTO {
+}
+exports.ConfirmPairingDTO = ConfirmPairingDTO;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(8192),
+    __metadata("design:type", String)
+], ConfirmPairingDTO.prototype, "payload_enc", void 0);
+//# sourceMappingURL=confirm-pairing.dto.js.map

package/dist/pairing/dto/confirm-pairing.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"confirm-pairing.dto.js","sourceRoot":"","sources":["../../../src/pairing/dto/confirm-pairing.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAkE;AAElE,iFAAiF;AACjF,MAAa,iBAAiB;CAU7B;AAVD,8CAUC;AADC;IAHC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,IAAI,CAAC;;sDACI"}

package/dist/pairing/dto/poll-reverse-pairing.dto.d.ts

@@ -0,0 +1,5 @@
+/** Direção B: o navegador pergunta se já foi aprovado. */
+export declare class PollReversePairingDTO {
+    poll_token: string;
+}
+//# sourceMappingURL=poll-reverse-pairing.dto.d.ts.map

package/dist/pairing/dto/poll-reverse-pairing.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"poll-reverse-pairing.dto.d.ts","sourceRoot":"","sources":["../../../src/pairing/dto/poll-reverse-pairing.dto.ts"],"names":[],"mappings":"AAEA,0DAA0D;AAC1D,qBAAa,qBAAqB;IAIhC,UAAU,EAAE,MAAM,CAAC;CACpB"}

package/dist/pairing/dto/poll-reverse-pairing.dto.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PollReversePairingDTO = void 0;
+const class_validator_1 = require("class-validator");
+/** Direção B: o navegador pergunta se já foi aprovado. */
+class PollReversePairingDTO {
+}
+exports.PollReversePairingDTO = PollReversePairingDTO;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], PollReversePairingDTO.prototype, "poll_token", void 0);
+//# sourceMappingURL=poll-reverse-pairing.dto.js.map

package/dist/pairing/dto/poll-reverse-pairing.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"poll-reverse-pairing.dto.js","sourceRoot":"","sources":["../../../src/pairing/dto/poll-reverse-pairing.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAkE;AAElE,0DAA0D;AAC1D,MAAa,qBAAqB;CAKjC;AALD,sDAKC;AADC;IAHC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,GAAG,CAAC;;yDACI"}

package/dist/pairing/dto/start-pairing.dto.d.ts

@@ -0,0 +1,11 @@
+/** Direção A: o navegador destravado abre o pareamento. */
+export declare class StartPairingDTO {
+    /**
+     * `sha256(authToken)` em base64url, calculado no cliente. O token cru fica no
+     * fragmento do QR e nunca chega aqui — é o que impede um dump do banco de
+     * reivindicar pareamentos.
+     */
+    auth_token_hash: string;
+    client_id: string;
+}
+//# sourceMappingURL=start-pairing.dto.d.ts.map

package/dist/pairing/dto/start-pairing.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-pairing.dto.d.ts","sourceRoot":"","sources":["../../../src/pairing/dto/start-pairing.dto.ts"],"names":[],"mappings":"AAEA,2DAA2D;AAC3D,qBAAa,eAAe;IAC1B;;;;OAIG;IAIH,eAAe,EAAE,MAAM,CAAC;IAKxB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/pairing/dto/start-pairing.dto.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StartPairingDTO = void 0;
+const class_validator_1 = require("class-validator");
+/** Direção A: o navegador destravado abre o pareamento. */
+class StartPairingDTO {
+}
+exports.StartPairingDTO = StartPairingDTO;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], StartPairingDTO.prototype, "auth_token_hash", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(100),
+    __metadata("design:type", String)
+], StartPairingDTO.prototype, "client_id", void 0);
+//# sourceMappingURL=start-pairing.dto.js.map

package/dist/pairing/dto/start-pairing.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-pairing.dto.js","sourceRoot":"","sources":["../../../src/pairing/dto/start-pairing.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAkE;AAElE,2DAA2D;AAC3D,MAAa,eAAe;CAe3B;AAfD,0CAeC;AANC;IAHC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,GAAG,CAAC;;wDACS;AAKxB;IAHC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,GAAG,CAAC;;kDACG"}

package/dist/pairing/dto/start-reverse-pairing.dto.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Direção B: o navegador que QUER acesso abre o pareamento.
+ *
+ * Público de propósito: o caso principal é um computador novo, onde ainda não há
+ * sessão nenhuma. O registro criado aqui não vale nada sozinho — só passa a
+ * valer quando um aparelho autenticado o aprova.
+ */
+export declare class StartReversePairingDTO {
+    /**
+     * `sha256(pollToken)`. O token de poll NÃO entra no QR: só o `id` entra. Assim
+     * quem fotografa a tela não consegue consumir o resultado nem depois de
+     * aprovado.
+     */
+    poll_hash: string;
+    /** Ponto EC não comprimido (65 bytes) em base64 — a pública efêmera da aba. */
+    eph_public_key: string;
+    /**
+     * `true` quando o navegador também precisa de sessão (computador novo);
+     * `false` quando já está logado e só o cofre está travado.
+     */
+    want_session?: boolean;
+    client_id: string;
+}
+//# sourceMappingURL=start-reverse-pairing.dto.d.ts.map

package/dist/pairing/dto/start-reverse-pairing.dto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-reverse-pairing.dto.d.ts","sourceRoot":"","sources":["../../../src/pairing/dto/start-reverse-pairing.dto.ts"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,qBAAa,sBAAsB;IACjC;;;;OAIG;IAIH,SAAS,EAAE,MAAM,CAAC;IAElB,+EAA+E;IAI/E,cAAc,EAAE,MAAM,CAAC;IAEvB;;;OAGG;IAGH,YAAY,CAAC,EAAE,OAAO,CAAC;IAKvB,SAAS,EAAE,MAAM,CAAC;CACnB"}

package/dist/pairing/dto/start-reverse-pairing.dto.js

@@ -0,0 +1,47 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.StartReversePairingDTO = void 0;
+const class_validator_1 = require("class-validator");
+/**
+ * Direção B: o navegador que QUER acesso abre o pareamento.
+ *
+ * Público de propósito: o caso principal é um computador novo, onde ainda não há
+ * sessão nenhuma. O registro criado aqui não vale nada sozinho — só passa a
+ * valer quando um aparelho autenticado o aprova.
+ */
+class StartReversePairingDTO {
+}
+exports.StartReversePairingDTO = StartReversePairingDTO;
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], StartReversePairingDTO.prototype, "poll_hash", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(255),
+    __metadata("design:type", String)
+], StartReversePairingDTO.prototype, "eph_public_key", void 0);
+__decorate([
+    (0, class_validator_1.IsBoolean)(),
+    (0, class_validator_1.IsOptional)(),
+    __metadata("design:type", Boolean)
+], StartReversePairingDTO.prototype, "want_session", void 0);
+__decorate([
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    (0, class_validator_1.MaxLength)(100),
+    __metadata("design:type", String)
+], StartReversePairingDTO.prototype, "client_id", void 0);
+//# sourceMappingURL=start-reverse-pairing.dto.js.map

package/dist/pairing/dto/start-reverse-pairing.dto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"start-reverse-pairing.dto.js","sourceRoot":"","sources":["../../../src/pairing/dto/start-reverse-pairing.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAMyB;AAEzB;;;;;;GAMG;AACH,MAAa,sBAAsB;CA6BlC;AA7BD,wDA6BC;AApBC;IAHC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,GAAG,CAAC;;yDACG;AAMlB;IAHC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,GAAG,CAAC;;8DACQ;AAQvB;IAFC,IAAA,2BAAS,GAAE;IACX,IAAA,4BAAU,GAAE;;4DACU;AAKvB;IAHC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,EAAC,GAAG,CAAC;;yDACG"}

package/dist/pairing/pairing.controller.d.ts

@@ -0,0 +1,118 @@
+import { TokenService } from '../token/token.service';
+import { ApproveReversePairingDTO } from './dto/approve-reverse-pairing.dto';
+import { ClaimPairingDTO } from './dto/claim-pairing.dto';
+import { ConfirmPairingDTO } from './dto/confirm-pairing.dto';
+import { PollReversePairingDTO } from './dto/poll-reverse-pairing.dto';
+import { StartPairingDTO } from './dto/start-pairing.dto';
+import { StartReversePairingDTO } from './dto/start-reverse-pairing.dto';
+import { PairingService } from './pairing.service';
+/**
+ * Pareamento por QR code. Fica em `/auth` ao lado de `/auth/authorize/*` porque
+ * é a mesma família: transferir uma sessão para outro cliente sem manipular
+ * senha.
+ *
+ * Quem chama o quê:
+ * - direção A: o NAVEGADOR abre, acompanha e confirma (rotas autenticadas); o
+ *   CELULAR reivindica e resgata (rotas públicas — ele ainda não tem sessão);
+ * - direção B: o NAVEGADOR abre e faz poll (rotas públicas — pode ser um
+ *   computador onde ninguém está logado); o CELULAR inspeciona e aprova (rotas
+ *   autenticadas).
+ */
+export declare class PairingController {
+    private readonly service;
+    private readonly token;
+    constructor(service: PairingService, token: TokenService);
+    start({ id }: {
+        id: any;
+    }, body: StartPairingDTO, ipAddress: string, userAgent: string): Promise<{
+        id: string;
+        expiresAt: string;
+    }>;
+    /** Poll do navegador enquanto o QR está na tela. Limite alto por isso. */
+    status({ id: userId }: {
+        id: any;
+    }, id: string): Promise<{
+        status: string;
+        claim: {
+            ip: string;
+            userAgent: string;
+            at: string;
+        };
+        expiresAt: string;
+    }>;
+    confirm({ id: userId }: {
+        id: any;
+    }, id: string, body: ConfirmPairingDTO): Promise<{
+        status: string;
+    }>;
+    cancel({ id: userId }: {
+        id: any;
+    }, id: string): Promise<{
+        status: string;
+    }>;
+    /**
+     * Público por definição: quem chama é o aparelho que acabou de ler o QR e
+     * ainda não tem sessão nenhuma. Quem autentica é a posse do token que saiu do
+     * fragmento.
+     */
+    claim(body: ClaimPairingDTO, ipAddress: string, userAgent: string): Promise<{
+        status: string;
+        expiresAt: string;
+    }>;
+    /**
+     * Sem `@Res()` e sem cookie `rt`: quem resgata aqui é um app nativo, para quem
+     * um Set-Cookie é ruído. O refreshToken vai no corpo, como em `/auth/token`.
+     */
+    redeem(body: ClaimPairingDTO, locale: string, ipAddress: string, userAgent: string): Promise<{
+        status: "pending";
+        accessToken?: undefined;
+        refreshToken?: undefined;
+        tokenType?: undefined;
+        expiresIn?: undefined;
+        payload?: undefined;
+    } | {
+        status: "confirmed";
+        accessToken: string;
+        refreshToken: string;
+        tokenType: string;
+        expiresIn: number;
+        payload: string;
+    }>;
+    startReverse(body: StartReversePairingDTO, ipAddress: string, userAgent: string): Promise<{
+        id: string;
+        expiresAt: string;
+    }>;
+    /**
+     * O `k` é a pública efêmera lida do QR, e serve de prova de que quem pergunta
+     * esteve na frente da tela. Ela é pública — pode aparecer no log de acesso sem
+     * problema —, e sem ela o `id` sequencial permitiria varrer os pareamentos
+     * alheios.
+     */
+    reverseRequest(id: string, ephPublicKey: string): Promise<{
+        issuedIp: string;
+        issuedUserAgent: string;
+        ephPublicKey: string;
+        wantSession: boolean;
+        expiresAt: string;
+    }>;
+    approveReverse({ id: userId }: {
+        id: any;
+    }, id: string, body: ApproveReversePairingDTO): Promise<{
+        status: string;
+    }>;
+    rejectReverse({ id: userId }: {
+        id: any;
+    }, id: string, body: {
+        eph_public_key?: string;
+    }): Promise<{
+        status: string;
+    }>;
+    /**
+     * Aqui o cookie `rt` FAZ sentido, ao contrário do redeem: quem resgata é um
+     * navegador, e é o mesmo formato de sessão que o login normal entrega.
+     */
+    pollReverse(body: PollReversePairingDTO, locale: string, res: any): Promise<{
+        [x: string]: unknown;
+    }>;
+}
+//# sourceMappingURL=pairing.controller.d.ts.map

package/dist/pairing/pairing.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.controller.d.ts","sourceRoot":"","sources":["../../src/pairing/pairing.controller.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,wBAAwB,EAAE,MAAM,mCAAmC,CAAC;AAC7E,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,sBAAsB,EAAE,MAAM,iCAAiC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD;;;;;;;;;;;GAWG;AACH,qBACa,iBAAiB;IAG1B,OAAO,CAAC,QAAQ,CAAC,OAAO;IAExB,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAFL,OAAO,EAAE,cAAc,EAEvB,KAAK,EAAE,YAAY;IAShC,KAAK,CACD,EAAE,EAAE,EAAE;;KAAA,EACN,IAAI,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM;;;;IAW1C,0EAA0E;IAKpE,MAAM,CAAS,EAAE,EAAE,EAAE,MAAM,EAAE;;KAAA,EAAe,EAAE,EAAE,MAAM;;;;;;;;;IAQtD,OAAO,CACH,EAAE,EAAE,EAAE,MAAM,EAAE;;KAAA,EACT,EAAE,EAAE,MAAM,EACf,IAAI,EAAE,iBAAiB;;;IAS3B,MAAM,CAAS,EAAE,EAAE,EAAE,MAAM,EAAE;;KAAA,EAAe,EAAE,EAAE,MAAM;;;IAI5D;;;;OAIG;IAKG,KAAK,CACD,IAAI,EAAE,eAAe,EACvB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM;;;;IAU1C;;;OAGG;IAKG,MAAM,CACF,IAAI,EAAE,eAAe,EACnB,MAAM,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM;;;;;;;;;;;;;;;IAiBpC,YAAY,CACR,IAAI,EAAE,sBAAsB,EAC9B,SAAS,EAAE,MAAM,EACA,SAAS,EAAE,MAAM;;;;IAY1C;;;;;OAKG;IAKG,cAAc,CAAc,EAAE,EAAE,MAAM,EAAc,YAAY,EAAE,MAAM;;;;;;;IAQxE,cAAc,CACV,EAAE,EAAE,EAAE,MAAM,EAAE;;KAAA,EACT,EAAE,EAAE,MAAM,EACf,IAAI,EAAE,wBAAwB;;;IAclC,aAAa,CACT,EAAE,EAAE,EAAE,MAAM,EAAE;;KAAA,EACT,EAAE,EAAE,MAAM,EACf,IAAI,EAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAE;;;IAS3C;;;OAGG;IAKG,WAAW,CACP,IAAI,EAAE,qBAAqB,EACzB,MAAM,EAAE,MAAM,EACI,GAAG,KAAA;;;CAuBlC"}

package/dist/pairing/pairing.controller.js

@@ -0,0 +1,296 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PairingController = void 0;
+const api_1 = require("@hed-hog/api");
+const api_locale_1 = require("@hed-hog/api-locale");
+const common_1 = require("@nestjs/common");
+const throttler_1 = require("@nestjs/throttler");
+const token_service_1 = require("../token/token.service");
+const approve_reverse_pairing_dto_1 = require("./dto/approve-reverse-pairing.dto");
+const claim_pairing_dto_1 = require("./dto/claim-pairing.dto");
+const confirm_pairing_dto_1 = require("./dto/confirm-pairing.dto");
+const poll_reverse_pairing_dto_1 = require("./dto/poll-reverse-pairing.dto");
+const start_pairing_dto_1 = require("./dto/start-pairing.dto");
+const start_reverse_pairing_dto_1 = require("./dto/start-reverse-pairing.dto");
+const pairing_service_1 = require("./pairing.service");
+/**
+ * Pareamento por QR code. Fica em `/auth` ao lado de `/auth/authorize/*` porque
+ * é a mesma família: transferir uma sessão para outro cliente sem manipular
+ * senha.
+ *
+ * Quem chama o quê:
+ * - direção A: o NAVEGADOR abre, acompanha e confirma (rotas autenticadas); o
+ *   CELULAR reivindica e resgata (rotas públicas — ele ainda não tem sessão);
+ * - direção B: o NAVEGADOR abre e faz poll (rotas públicas — pode ser um
+ *   computador onde ninguém está logado); o CELULAR inspeciona e aprova (rotas
+ *   autenticadas).
+ */
+let PairingController = class PairingController {
+    constructor(service, token) {
+        this.service = service;
+        this.token = token;
+    }
+    /* ---------------------------- Direção A ---------------------------- */
+    async start({ id }, body, ipAddress, userAgent) {
+        return this.service.start({
+            userId: id,
+            authTokenHash: body.auth_token_hash,
+            clientId: body.client_id,
+            ipAddress,
+            userAgent,
+        });
+    }
+    /** Poll do navegador enquanto o QR está na tela. Limite alto por isso. */
+    async status({ id: userId }, id) {
+        return this.service.status(userId, id);
+    }
+    async confirm({ id: userId }, id, body) {
+        return this.service.confirm({ userId, id, payloadEnc: body.payload_enc });
+    }
+    async cancel({ id: userId }, id) {
+        return this.service.cancel(userId, id);
+    }
+    /**
+     * Público por definição: quem chama é o aparelho que acabou de ler o QR e
+     * ainda não tem sessão nenhuma. Quem autentica é a posse do token que saiu do
+     * fragmento.
+     */
+    async claim(body, ipAddress, userAgent) {
+        return this.service.claim({
+            authToken: body.auth_token,
+            clientId: body.client_id,
+            ipAddress,
+            userAgent,
+        });
+    }
+    /**
+     * Sem `@Res()` e sem cookie `rt`: quem resgata aqui é um app nativo, para quem
+     * um Set-Cookie é ruído. O refreshToken vai no corpo, como em `/auth/token`.
+     */
+    async redeem(body, locale, ipAddress, userAgent) {
+        return this.service.redeem({
+            authToken: body.auth_token,
+            clientId: body.client_id,
+            locale,
+            ipAddress,
+            userAgent,
+        });
+    }
+    /* ---------------------------- Direção B ---------------------------- */
+    async startReverse(body, ipAddress, userAgent) {
+        var _a;
+        return this.service.startReverse({
+            pollHash: body.poll_hash,
+            ephPublicKey: body.eph_public_key,
+            wantSession: (_a = body.want_session) !== null && _a !== void 0 ? _a : true,
+            clientId: body.client_id,
+            ipAddress,
+            userAgent,
+        });
+    }
+    /**
+     * O `k` é a pública efêmera lida do QR, e serve de prova de que quem pergunta
+     * esteve na frente da tela. Ela é pública — pode aparecer no log de acesso sem
+     * problema —, e sem ela o `id` sequencial permitiria varrer os pareamentos
+     * alheios.
+     */
+    async reverseRequest(id, ephPublicKey) {
+        return this.service.getReverseRequest(id, ephPublicKey !== null && ephPublicKey !== void 0 ? ephPublicKey : '');
+    }
+    async approveReverse({ id: userId }, id, body) {
+        return this.service.approveReverse({
+            userId,
+            id,
+            ephPublicKey: body.eph_public_key,
+            payloadEnc: body.payload_enc,
+        });
+    }
+    async rejectReverse({ id: userId }, id, body) {
+        var _a;
+        return this.service.rejectReverse({
+            userId,
+            id,
+            ephPublicKey: (_a = body === null || body === void 0 ? void 0 : body.eph_public_key) !== null && _a !== void 0 ? _a : '',
+        });
+    }
+    /**
+     * Aqui o cookie `rt` FAZ sentido, ao contrário do redeem: quem resgata é um
+     * navegador, e é o mesmo formato de sessão que o login normal entrega.
+     */
+    async pollReverse(body, locale, res) {
+        const result = await this.service.pollReverse({
+            pollToken: body.poll_token,
+            locale,
+        });
+        if ('session' in result && result.session && result.refreshToken) {
+            await this.token.setRefreshTokenCookie(locale, res, result.refreshToken, result.session.expires_at);
+        }
+        // A sessão inteira não volta para o cliente: ele precisa dos tokens, não do
+        // registro do banco.
+        const _a = result, { session } = _a, payload = __rest(_a, ["session"]);
+        return payload;
+    }
+};
+exports.PairingController = PairingController;
+__decorate([
+    (0, api_1.NoRole)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 5, ttl: 60000 } }),
+    (0, common_1.Post)('pairing'),
+    __param(0, (0, api_1.User)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Ip)()),
+    __param(3, (0, common_1.Headers)('user-agent')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, start_pairing_dto_1.StartPairingDTO, String, String]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "start", null);
+__decorate([
+    (0, api_1.NoRole)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 120, ttl: 60000 } }),
+    (0, common_1.Get)('pairing/:id'),
+    __param(0, (0, api_1.User)()),
+    __param(1, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "status", null);
+__decorate([
+    (0, api_1.NoRole)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 10, ttl: 60000 } }),
+    (0, common_1.Post)('pairing/:id/confirm'),
+    __param(0, (0, api_1.User)()),
+    __param(1, (0, common_1.Param)('id')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, confirm_pairing_dto_1.ConfirmPairingDTO]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "confirm", null);
+__decorate([
+    (0, api_1.NoRole)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 20, ttl: 60000 } }),
+    (0, common_1.Delete)('pairing/:id'),
+    __param(0, (0, api_1.User)()),
+    __param(1, (0, common_1.Param)('id')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "cancel", null);
+__decorate([
+    (0, api_1.Public)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 10, ttl: 60000 } }),
+    (0, common_1.Post)('pairing/claim'),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Ip)()),
+    __param(2, (0, common_1.Headers)('user-agent')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [claim_pairing_dto_1.ClaimPairingDTO, String, String]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "claim", null);
+__decorate([
+    (0, api_1.Public)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 60, ttl: 60000 } }),
+    (0, common_1.Post)('pairing/redeem'),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, api_locale_1.Locale)()),
+    __param(2, (0, common_1.Ip)()),
+    __param(3, (0, common_1.Headers)('user-agent')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [claim_pairing_dto_1.ClaimPairingDTO, String, String, String]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "redeem", null);
+__decorate([
+    (0, api_1.Public)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 10, ttl: 60000 } }),
+    (0, common_1.Post)('pairing/reverse'),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, common_1.Ip)()),
+    __param(2, (0, common_1.Headers)('user-agent')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [start_reverse_pairing_dto_1.StartReversePairingDTO, String, String]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "startReverse", null);
+__decorate([
+    (0, api_1.NoRole)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 30, ttl: 60000 } }),
+    (0, common_1.Get)('pairing/reverse/:id'),
+    __param(0, (0, common_1.Param)('id')),
+    __param(1, (0, common_1.Query)('k')),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [String, String]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "reverseRequest", null);
+__decorate([
+    (0, api_1.NoRole)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 10, ttl: 60000 } }),
+    (0, common_1.Post)('pairing/reverse/:id/approve'),
+    __param(0, (0, api_1.User)()),
+    __param(1, (0, common_1.Param)('id')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, approve_reverse_pairing_dto_1.ApproveReversePairingDTO]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "approveReverse", null);
+__decorate([
+    (0, api_1.NoRole)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 20, ttl: 60000 } }),
+    (0, common_1.Post)('pairing/reverse/:id/reject'),
+    __param(0, (0, api_1.User)()),
+    __param(1, (0, common_1.Param)('id')),
+    __param(2, (0, common_1.Body)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "rejectReverse", null);
+__decorate([
+    (0, api_1.Public)(),
+    (0, common_1.UseGuards)(throttler_1.ThrottlerGuard),
+    (0, throttler_1.Throttle)({ default: { limit: 60, ttl: 60000 } }),
+    (0, common_1.Post)('pairing/reverse/poll'),
+    __param(0, (0, common_1.Body)()),
+    __param(1, (0, api_locale_1.Locale)()),
+    __param(2, (0, common_1.Res)({ passthrough: true })),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [poll_reverse_pairing_dto_1.PollReversePairingDTO, String, Object]),
+    __metadata("design:returntype", Promise)
+], PairingController.prototype, "pollReverse", null);
+exports.PairingController = PairingController = __decorate([
+    (0, common_1.Controller)('auth'),
+    __param(0, (0, common_1.Inject)((0, common_1.forwardRef)(() => pairing_service_1.PairingService))),
+    __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => token_service_1.TokenService))),
+    __metadata("design:paramtypes", [pairing_service_1.PairingService,
+        token_service_1.TokenService])
+], PairingController);
+//# sourceMappingURL=pairing.controller.js.map

package/dist/pairing/pairing.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.controller.js","sourceRoot":"","sources":["../../src/pairing/pairing.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,sCAAoD;AACpD,oDAA6C;AAC7C,2CAcwB;AACxB,iDAA6D;AAC7D,0DAAsD;AACtD,mFAA6E;AAC7E,+DAA0D;AAC1D,mEAA8D;AAC9D,6EAAuE;AACvE,+DAA0D;AAC1D,+EAAyE;AACzE,uDAAmD;AAEnD;;;;;;;;;;;GAWG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YAEmB,OAAuB,EAEvB,KAAmB;QAFnB,YAAO,GAAP,OAAO,CAAgB;QAEvB,UAAK,GAAL,KAAK,CAAc;IACnC,CAAC;IAEJ,yEAAyE;IAMnE,AAAN,KAAK,CAAC,KAAK,CACD,EAAE,EAAE,EAAE,EACN,IAAqB,EACvB,SAAiB,EACA,SAAiB;QAExC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACxB,MAAM,EAAE,EAAE;YACV,aAAa,EAAE,IAAI,CAAC,eAAe;YACnC,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAKpE,AAAN,KAAK,CAAC,MAAM,CAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAe,EAAU;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAMK,AAAN,KAAK,CAAC,OAAO,CACH,EAAE,EAAE,EAAE,MAAM,EAAE,EACT,EAAU,EACf,IAAuB;QAE/B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5E,CAAC;IAMK,AAAN,KAAK,CAAC,MAAM,CAAS,EAAE,EAAE,EAAE,MAAM,EAAE,EAAe,EAAU;QAC1D,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACzC,CAAC;IAED;;;;OAIG;IAKG,AAAN,KAAK,CAAC,KAAK,CACD,IAAqB,EACvB,SAAiB,EACA,SAAiB;QAExC,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC;YACxB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IAKG,AAAN,KAAK,CAAC,MAAM,CACF,IAAqB,EACnB,MAAc,EAClB,SAAiB,EACA,SAAiB;QAExC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YACzB,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,MAAM;YACN,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED,yEAAyE;IAMnE,AAAN,KAAK,CAAC,YAAY,CACR,IAA4B,EAC9B,SAAiB,EACA,SAAiB;;QAExC,OAAO,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;YAC/B,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,YAAY,EAAE,IAAI,CAAC,cAAc;YACjC,WAAW,EAAE,MAAA,IAAI,CAAC,YAAY,mCAAI,IAAI;YACtC,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,SAAS;YACT,SAAS;SACV,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IAKG,AAAN,KAAK,CAAC,cAAc,CAAc,EAAU,EAAc,YAAoB;QAC5E,OAAO,IAAI,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,EAAE,YAAY,aAAZ,YAAY,cAAZ,YAAY,GAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAMK,AAAN,KAAK,CAAC,cAAc,CACV,EAAE,EAAE,EAAE,MAAM,EAAE,EACT,EAAU,EACf,IAA8B;QAEtC,OAAO,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YACjC,MAAM;YACN,EAAE;YACF,YAAY,EAAE,IAAI,CAAC,cAAc;YACjC,UAAU,EAAE,IAAI,CAAC,WAAW;SAC7B,CAAC,CAAC;IACL,CAAC;IAMK,AAAN,KAAK,CAAC,aAAa,CACT,EAAE,EAAE,EAAE,MAAM,EAAE,EACT,EAAU,EACf,IAAiC;;QAEzC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;YAChC,MAAM;YACN,EAAE;YACF,YAAY,EAAE,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,cAAc,mCAAI,EAAE;SACzC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IAKG,AAAN,KAAK,CAAC,WAAW,CACP,IAA2B,EACzB,MAAc,EACI,GAAG;QAE/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAC5C,SAAS,EAAE,IAAI,CAAC,UAAU;YAC1B,MAAM;SACP,CAAC,CAAC;QAEH,IAAI,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACjE,MAAM,IAAI,CAAC,KAAK,CAAC,qBAAqB,CACpC,MAAM,EACN,GAAG,EACH,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,OAAO,CAAC,UAAU,CAC1B,CAAC;QACJ,CAAC;QAED,4EAA4E;QAC5E,qBAAqB;QACrB,MAAM,KAA0B,MAE/B,EAFK,EAAE,OAAO,OAEd,EAFmB,OAAO,cAArB,WAAuB,CAE5B,CAAC;QACF,OAAO,OAAO,CAAC;IACjB,CAAC;CACF,CAAA;AA7MY,8CAAiB;AActB;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAC/C,IAAA,aAAI,EAAC,SAAS,CAAC;IAEb,WAAA,IAAA,UAAI,GAAE,CAAA;IACN,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;;6CAFR,mCAAe;;8CAW9B;AAOK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IACjD,IAAA,YAAG,EAAC,aAAa,CAAC;IACL,WAAA,IAAA,UAAI,GAAE,CAAA;IAAkB,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;+CAEhD;AAMK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,qBAAqB,CAAC;IAEzB,WAAA,IAAA,UAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAO,uCAAiB;;gDAGhC;AAMK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,eAAM,EAAC,aAAa,CAAC;IACR,WAAA,IAAA,UAAI,GAAE,CAAA;IAAkB,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;+CAEhD;AAWK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,eAAe,CAAC;IAEnB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;;qCAFR,mCAAe;;8CAU9B;AAUK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,gBAAgB,CAAC;IAEpB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;;qCAHR,mCAAe;;+CAY9B;AAQK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,iBAAiB,CAAC;IAErB,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,WAAE,GAAE,CAAA;IACJ,WAAA,IAAA,gBAAO,EAAC,YAAY,CAAC,CAAA;;qCAFR,kDAAsB;;qDAYrC;AAYK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,YAAG,EAAC,qBAAqB,CAAC;IACL,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IAAc,WAAA,IAAA,cAAK,EAAC,GAAG,CAAC,CAAA;;;;uDAExD;AAMK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,6BAA6B,CAAC;IAEjC,WAAA,IAAA,UAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;;qDAAO,sDAAwB;;uDAQvC;AAMK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAEhC,WAAA,IAAA,UAAI,GAAE,CAAA;IACN,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;;;;sDAOR;AAUK;IAJL,IAAA,YAAM,GAAE;IACR,IAAA,kBAAS,EAAC,0BAAc,CAAC;IACzB,IAAA,oBAAQ,EAAC,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,CAAC;IAChD,IAAA,aAAI,EAAC,sBAAsB,CAAC;IAE1B,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,mBAAM,GAAE,CAAA;IACR,WAAA,IAAA,YAAG,EAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAA;;qCAFb,gDAAqB;;oDAwBpC;4BA5MU,iBAAiB;IAD7B,IAAA,mBAAU,EAAC,MAAM,CAAC;IAGd,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC,CAAC,CAAA;IAExC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,4BAAY,CAAC,CAAC,CAAA;qCADb,gCAAc;QAEhB,4BAAY;GAL3B,iBAAiB,CA6M7B"}

package/dist/pairing/pairing.module.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Separado do AuthorizeModule: lá o HedHog é provedor OAuth para um cliente que
+ * conhece de antemão o servidor; aqui o ponto é justamente o aparelho que ainda
+ * não sabe com quem falar. O que os dois compartilham — token opaco com hash,
+ * TTL curto e consumo atômico — está copiado, não abstraído: uma base comum
+ * amarraria dois fluxos de auth que devem poder divergir.
+ */
+export declare class PairingModule {
+}
+//# sourceMappingURL=pairing.module.d.ts.map

package/dist/pairing/pairing.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pairing.module.d.ts","sourceRoot":"","sources":["../../src/pairing/pairing.module.ts"],"names":[],"mappings":"AAQA;;;;;;GAMG;AACH,qBAWa,aAAa;CAAG"}