@hed-hog/core 0.0.398 → 0.0.400

package/dist/authorize/authorize.service.js

@@ -21,6 +21,10 @@ const api_prisma_1 = require("@hed-hog/api-prisma");
 const common_1 = require("@nestjs/common");
 const crypto_1 = require("crypto");
 const auth_service_1 = require("../auth/auth.service");
+const session_service_1 = require("../session/session.service");
+const token_service_1 = require("../token/token.service");
+const authorize_errors_1 = require("./authorize.errors");
+const oauth_metadata_service_1 = require("./oauth-metadata.service");
 const security_service_1 = require("../security/security.service");
 /**
  * Authorization Code + PKCE — o HedHog como OAuth *provider* para apps
@@ -34,10 +38,13 @@ const security_service_1 = require("../security/security.service");
  * allowlist (open redirect). Para um gerenciador de senhas isso não serve.
  */
 let AuthorizeService = AuthorizeService_1 = class AuthorizeService {
-    constructor(prisma, security, auth) {
+    constructor(prisma, security, auth, session, token, metadata) {
         this.prisma = prisma;
         this.security = security;
         this.auth = auth;
+        this.session = session;
+        this.token = token;
+        this.metadata = metadata;
         this.logger = new common_1.Logger(AuthorizeService_1.name);
         /** Curto de propósito: o code viaja na URL e só precisa sobreviver ao redirect. */
         this.codeTtlMs = 60000;
@@ -47,7 +54,10 @@ let AuthorizeService = AuthorizeService_1 = class AuthorizeService {
             where: { client_id: clientId },
         });
         if (!client || !client.enabled) {
-            throw new common_1.BadRequestException('Aplicativo desconhecido ou desabilitado.');
+            // NAO redirecionavel: sem client valido nao ha redirect_uri de confianca
+            // para onde mandar o erro (RFC 6749 4.1.2.1).
+            this.logger.warn(`[AuthorizeService] client desconhecido ou desabilitado: ${clientId}`);
+            throw new authorize_errors_1.OAuthError('invalid_client', 'Aplicativo desconhecido ou desabilitado.');
         }
         return client;
     }
@@ -57,33 +67,88 @@ let AuthorizeService = AuthorizeService_1 = class AuthorizeService {
      * userinfo, `origin` valendo "null" em esquemas não-http).
      */
     assertRedirectUri(client, redirectUri) {
+        var _a;
         const allowed = client.redirect_uris
             .split('\n')
             .map((uri) => uri.trim())
             .filter(Boolean);
         if (!allowed.includes(redirectUri)) {
-            throw new common_1.BadRequestException('redirect_uri não registrado para este aplicativo.');
+            // O valor rejeitado vai para o log de proposito: e por ele que se descobre
+            // o callback real de um cliente novo (o do Claude, por exemplo) sem ter que
+            // adivinhar. Nao e segredo — quem mandou ja o conhece.
+            this.logger.warn(`[AuthorizeService] redirect_uri recusado client=${(_a = client.client_id) !== null && _a !== void 0 ? _a : '?'} uri=${redirectUri}`);
+            throw new authorize_errors_1.OAuthError('invalid_request', 'redirect_uri não registrado para este aplicativo.');
         }
     }
+    /**
+     * Devolve o escopo efetivo. `scope` ausente assume o que o client tem
+     * registrado — um cliente OAuth padrao pode simplesmente nao mandar o
+     * parametro, e recusa-lo seria recusar o fluxo inteiro por nada.
+     */
     assertScope(client, scope) {
         const granted = new Set(client.scopes.split(/[\s,]+/).filter(Boolean));
-        const requested = scope.split(/[\s,]+/).filter(Boolean);
+        const requested = (scope !== null && scope !== void 0 ? scope : '').split(/[\s,]+/).filter(Boolean);
         if (requested.length === 0) {
-            throw new common_1.BadRequestException('scope é obrigatório.');
+            return [...granted].join(' ');
         }
         if (!requested.every((s) => granted.has(s))) {
-            throw new common_1.BadRequestException('scope não autorizado para este aplicativo.');
+            throw new authorize_errors_1.OAuthError('invalid_scope', 'scope não autorizado para este aplicativo.', true);
+        }
+        return requested.join(' ');
+    }
+    /**
+     * `resource` (RFC 8707) é uma allowlist de um item só: o /mcp deste servidor.
+     * Igualdade exata — o middleware de compatibilidade do main.ts faz `/api/mcp`
+     * responder no mesmo lugar, e comparar por prefixo deixaria nascer um token com
+     * audiência paralela que o TokenService nunca reconheceria.
+     *
+     * E ele é OBRIGATÓRIO quando a concessão inclui o escopo `mcp`. Sem essa regra
+     * o confinamento seria opt-in pela parte que ele restringe: bastava o cliente
+     * omitir o parâmetro para receber um token sem `aud` — válido na API REST
+     * inteira, com o TTL longo de login e renovável pelo /auth/refresh. Um cliente
+     * de MCP nunca deve conseguir uma sessão de propósito geral.
+     */
+    async assertResource(scope, resource) {
+        const confinedToMcp = scope
+            .split(/[\s,]+/)
+            .filter(Boolean)
+            .includes(oauth_metadata_service_1.MCP_SCOPE);
+        if (!resource) {
+            if (confinedToMcp) {
+                throw new authorize_errors_1.OAuthError('invalid_target', `resource é obrigatório para o escopo '${oauth_metadata_service_1.MCP_SCOPE}'.`, true);
+            }
+            return null;
+        }
+        const mcpResource = await this.metadata.getMcpResource();
+        if (resource !== mcpResource) {
+            throw new authorize_errors_1.OAuthError('invalid_target', 'resource não reconhecido por este servidor.', true);
+        }
+        return mcpResource;
+    }
+    /** RFC 6749: só `code`. Ausente, assume `code` — nenhum client atual manda. */
+    assertResponseType(responseType) {
+        if (responseType && responseType !== 'code') {
+            throw new authorize_errors_1.OAuthError('unsupported_response_type', 'Apenas response_type=code é suportado.', true);
         }
     }
     /** Metadados para a tela de consent. Também valida antes de qualquer redirect. */
     async getAuthorizationInfo(params) {
+        // A ordem importa: primeiro o que NAO pode redirecionar (client, redirect),
+        // so depois o que pode. Invertida, um erro de escopo tentaria redirecionar
+        // para um redirect_uri ainda nao validado.
         const client = await this.getClient(params.clientId);
         this.assertRedirectUri(client, params.redirectUri);
-        this.assertScope(client, params.scope);
+        this.assertResponseType(params.responseType);
+        const scope = this.assertScope(client, params.scope);
         this.assertPkce(params.codeChallenge, params.codeChallengeMethod);
+        await this.assertResource(scope, params.resource);
         return {
             clientName: client.name,
-            scopes: params.scope.split(/[\s,]+/).filter(Boolean),
+            scopes: scope.split(/[\s,]+/).filter(Boolean),
+            // A tela precisa devolver `iss` no redirect (RFC 9207), e anunciamos
+            // `authorization_response_iss_parameter_supported`. Mandar daqui evita mais
+            // uma variavel de ambiente no admin e garante que os dois concordem.
+            issuer: await this.metadata.getIssuer(),
         };
     }
     /**
@@ -92,21 +157,23 @@ let AuthorizeService = AuthorizeService_1 = class AuthorizeService {
      */
     assertPkce(codeChallenge, method) {
         if (method !== 'S256') {
-            throw new common_1.BadRequestException('code_challenge_method deve ser S256.');
+            throw new authorize_errors_1.OAuthError('invalid_request', 'code_challenge_method deve ser S256.', true);
         }
         if (!codeChallenge ||
             codeChallenge.length < 43 ||
             codeChallenge.length > 128 ||
             !/^[A-Za-z0-9\-._~]+$/.test(codeChallenge)) {
-            throw new common_1.BadRequestException('code_challenge inválido.');
+            throw new authorize_errors_1.OAuthError('invalid_request', 'code_challenge inválido.', true);
         }
     }
     /** Emite o code já vinculado ao usuário da sessão que aprovou o consent. */
     async issueCode(params) {
         const client = await this.getClient(params.clientId);
         this.assertRedirectUri(client, params.redirectUri);
-        this.assertScope(client, params.scope);
+        this.assertResponseType(params.responseType);
+        const scope = this.assertScope(client, params.scope);
         this.assertPkce(params.codeChallenge, params.codeChallengeMethod);
+        const resource = await this.assertResource(scope, params.resource);
         const code = this.security.randomOpaque(32);
         const codeHash = this.security.hashSha256(code);
         const expiresAt = new Date(Date.now() + this.codeTtlMs);
@@ -116,10 +183,13 @@ let AuthorizeService = AuthorizeService_1 = class AuthorizeService {
                 client_id: params.clientId,
                 user_id: params.userId,
                 redirect_uri: params.redirectUri,
-                scope: params.scope,
+                scope,
                 code_challenge: params.codeChallenge,
                 code_challenge_method: 'S256',
                 expires_at: expiresAt,
+                // Guardado para a troca do code exigir o MESMO recurso. Sem isso um
+                // cliente autorizaria para um recurso e pegaria token para outro.
+                resource,
             },
         });
         this.logger.debug(`[AuthorizeService] code emitido client=${params.clientId} userId=${params.userId}`);
@@ -131,9 +201,10 @@ let AuthorizeService = AuthorizeService_1 = class AuthorizeService {
      * replay — só podem ter um vencedor, decidido pelo banco.
      */
     async exchangeCode(params) {
+        var _a, _b;
         const client = await this.getClient(params.clientId);
         if (client.client_type !== 'public') {
-            throw new common_1.BadRequestException('Fluxo indisponível para este aplicativo.');
+            throw new authorize_errors_1.OAuthError('unauthorized_client', 'Fluxo indisponível para este aplicativo.');
         }
         const codeHash = this.security.hashSha256(params.code);
         const rows = await this.prisma.$queryRaw(api_prisma_1.Prisma.sql `
@@ -144,27 +215,141 @@ let AuthorizeService = AuthorizeService_1 = class AuthorizeService {
           AND redirect_uri = ${params.redirectUri}
           AND expires_at > NOW()
           AND consumed_at IS NULL
-        RETURNING user_id, code_challenge, scope
+        RETURNING user_id, code_challenge, scope, resource
       `);
         const row = rows[0];
         if (!row) {
-            throw new common_1.BadRequestException('Código inválido, expirado ou já utilizado. Refaça a autorização.');
+            throw new authorize_errors_1.OAuthError('invalid_grant', 'Código inválido, expirado ou já utilizado. Refaça a autorização.');
         }
         if (!this.verifyPkce(params.codeVerifier, row.code_challenge)) {
             // O code já foi consumido acima — um verifier errado não dá segunda chance.
             this.logger.warn(`[AuthorizeService] PKCE falhou client=${params.clientId} userId=${row.user_id}`);
-            throw new common_1.BadRequestException('code_verifier inválido.');
+            throw new authorize_errors_1.OAuthError('invalid_grant', 'code_verifier inválido.');
+        }
+        // O recurso pedido agora tem que ser o mesmo pedido na autorizacao. Divergir
+        // aqui seria autorizar para um recurso e receber token para outro.
+        if (((_a = params.resource) !== null && _a !== void 0 ? _a : null) !== ((_b = row.resource) !== null && _b !== void 0 ? _b : null)) {
+            throw new authorize_errors_1.OAuthError('invalid_target', 'resource não confere com o da autorização.');
+        }
+        const oauth = row.resource
+            ? {
+                audience: row.resource,
+                scope: row.scope,
+                clientId: params.clientId,
+                issuer: await this.metadata.getIssuer(),
+                ttlMinutes: session_service_1.SessionService.CONNECTOR_SESSION_TTL_MINUTES,
+            }
+            : undefined;
+        const { accessToken, refreshToken } = await this.auth.getAuthenticationPayload(params.locale, row.user_id, params.ipAddress, params.userAgent, params.browserId, oauth);
+        return this.buildTokenResponse(accessToken, refreshToken, row.scope);
+    }
+    /**
+     * Renovacao do cliente OAuth externo.
+     *
+     * Existe separado do POST /auth/refresh porque aquele devolve um token SEM
+     * `aud` — e por isso mesmo recusa sessao de conector. Aqui o `aud` e reaplicado
+     * a partir da propria sessao, que e a unica coisa que sobrevive a rotacao do
+     * refresh token (que e opaco).
+     */
+    async exchangeRefreshToken(params) {
+        var _a, _b, _c;
+        const client = await this.getClient(params.clientId);
+        if (client.client_type !== 'public') {
+            throw new authorize_errors_1.OAuthError('unauthorized_client', 'Fluxo indisponível para este aplicativo.');
         }
-        const { accessToken, refreshToken } = await this.auth.getAuthenticationPayload(params.locale, row.user_id, params.ipAddress, params.userAgent, params.browserId);
+        // TUDO o que pode recusar acontece ANTES de girar.
+        //
+        // `session.refresh()` commita o compare-and-swap na hora: o token que o
+        // cliente tem passa a valer por mais 30s (a janela de graca) e o substituto
+        // so existe se a chamada chegar ao fim. Validar depois dela transformava
+        // qualquer recusa — client errado, resource divergente — na destruicao da
+        // sessao do cliente, em vez da negacao de um pedido.
+        const existing = await this.session.peekByRefreshToken(params.refreshToken);
+        if (!existing || existing.revoked_at !== null || existing.expires_at <= new Date()) {
+            throw new authorize_errors_1.OAuthError('invalid_grant', 'refresh_token inválido, expirado ou revogado.');
+        }
+        // A sessao tem que ser deste client. Sem esta checagem, o refresh token de um
+        // cliente valeria apresentado por outro.
+        if (existing.oauth_client_id && existing.oauth_client_id !== params.clientId) {
+            throw new authorize_errors_1.OAuthError('invalid_grant', 'refresh_token não pertence a este aplicativo.');
+        }
+        const audience = (_a = existing.audience) !== null && _a !== void 0 ? _a : null;
+        if (((_b = params.resource) !== null && _b !== void 0 ? _b : null) !== audience) {
+            throw new authorize_errors_1.OAuthError('invalid_target', 'resource não confere com o da sessão.');
+        }
+        // O escopo sai do que o client tem REGISTRADO, nunca de um literal. Fixar
+        // 'mcp' aqui promovia a cliente de MCP qualquer client que chegasse a este
+        // endpoint — inclusive os que so tem 'profile' ou 'vaults'.
+        const scope = this.assertScope(client);
+        // Uma sessao de recurso so pode ser renovada por um client que ainda tenha o
+        // escopo correspondente. Se o registro do client mudou no meio do caminho, a
+        // renovacao para aqui em vez de emitir um token que o McpAuthGuard recusaria.
+        if (audience && !scope.split(/[\s,]+/).filter(Boolean).includes(oauth_metadata_service_1.MCP_SCOPE)) {
+            throw new authorize_errors_1.OAuthError('invalid_scope', `Este aplicativo não tem mais o escopo '${oauth_metadata_service_1.MCP_SCOPE}'.`);
+        }
+        let session;
+        let token;
+        try {
+            ({ session, token } = await this.session.refresh(params.locale, params.refreshToken, params.ipAddress, params.userAgent, (_c = params.browserId) !== null && _c !== void 0 ? _c : null));
+        }
+        catch (error) {
+            // So o que o SessionService classifica como credencial invalida vira
+            // invalid_grant. Erro de infraestrutura (timeout, pool esgotado) NAO pode:
+            // pelo RFC 6749 5.2 esse codigo manda o cliente descartar o refresh token,
+            // entao um soluco de banco desconectaria todo mundo de forma permanente.
+            if (error instanceof common_1.UnauthorizedException) {
+                throw new authorize_errors_1.OAuthError('invalid_grant', 'refresh_token inválido, expirado ou revogado.');
+            }
+            throw error;
+        }
+        const payload = audience
+            ? {
+                sub: session.user_id,
+                sessionId: session.id,
+                aud: audience,
+                iss: await this.metadata.getIssuer(),
+                scope,
+                cid: params.clientId,
+            }
+            : { sub: session.user_id, sessionId: session.id };
+        const accessToken = await this.token.createAccessToken(payload);
+        return this.buildTokenResponse(accessToken, token, scope);
+    }
+    /**
+     * `expires_in` sai do `exp` do proprio JWT recem-assinado, e nao da setting: o
+     * JwtModule le `access-token-expiration-minutes` uma UNICA vez, no boot, entao a
+     * setting e o token podem divergir ate o proximo deploy. O token e a verdade.
+     *
+     * A resposta traz snake_case e camelCase ao mesmo tempo. O RFC 6749 5.1 permite
+     * membros extras, e os cinco clientes ja registrados leem camelCase — passar so
+     * a snake_case quebraria todos de uma vez.
+     */
+    buildTokenResponse(accessToken, refreshToken, scope) {
+        const expiresIn = this.expiresInFromJwt(accessToken);
         return {
+            access_token: accessToken,
             accessToken,
+            refresh_token: refreshToken,
             refreshToken,
+            token_type: 'Bearer',
             tokenType: 'Bearer',
-            // Informativo para o cliente agendar refresh; a verdade é o exp do JWT.
-            expiresIn: 3600,
-            scope: row.scope,
+            expires_in: expiresIn,
+            expiresIn,
+            scope,
         };
     }
+    expiresInFromJwt(accessToken) {
+        try {
+            const claims = JSON.parse(Buffer.from(accessToken.split('.')[1], 'base64url').toString('utf8'));
+            const seconds = Number(claims === null || claims === void 0 ? void 0 : claims.exp) - Math.floor(Date.now() / 1000);
+            return seconds > 0 ? seconds : 0;
+        }
+        catch (_a) {
+            // Token sem exp legivel nao deve derrubar a resposta; o cliente reage ao
+            // 401 de qualquer forma.
+            return 0;
+        }
+    }
     /** base64url(sha256(verifier)) === challenge, em tempo constante. */
     verifyPkce(codeVerifier, codeChallenge) {
         if (!codeVerifier || codeVerifier.length < 43 || codeVerifier.length > 128) {
@@ -189,8 +374,14 @@ exports.AuthorizeService = AuthorizeService = AuthorizeService_1 = __decorate([
     __param(0, (0, common_1.Inject)((0, common_1.forwardRef)(() => api_prisma_1.PrismaService))),
     __param(1, (0, common_1.Inject)((0, common_1.forwardRef)(() => security_service_1.SecurityService))),
     __param(2, (0, common_1.Inject)((0, common_1.forwardRef)(() => auth_service_1.AuthService))),
+    __param(3, (0, common_1.Inject)((0, common_1.forwardRef)(() => session_service_1.SessionService))),
+    __param(4, (0, common_1.Inject)((0, common_1.forwardRef)(() => token_service_1.TokenService))),
+    __param(5, (0, common_1.Inject)((0, common_1.forwardRef)(() => oauth_metadata_service_1.OAuthMetadataService))),
     __metadata("design:paramtypes", [api_prisma_1.PrismaService,
         security_service_1.SecurityService,
-        auth_service_1.AuthService])
+        auth_service_1.AuthService,
+        session_service_1.SessionService,
+        token_service_1.TokenService,
+        oauth_metadata_service_1.OAuthMetadataService])
 ], AuthorizeService);
 //# sourceMappingURL=authorize.service.js.map

package/dist/authorize/authorize.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize.service.js","sourceRoot":"","sources":["../../src/authorize/authorize.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,kEAAkE;AAClE,oDAA4D;AAC5D,2CAMwB;AACxB,mCAAyC;AACzC,uDAAmD;AACnD,mEAA+D;AAE/D;;;;;;;;;;GAUG;AAEI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAM3B,YAEE,MAAsC,EAEtC,QAA0C,EAE1C,IAAkC;QAJjB,WAAM,GAAN,MAAM,CAAe;QAErB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,SAAI,GAAJ,IAAI,CAAa;QAXnB,WAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5D,mFAAmF;QAClE,cAAS,GAAG,KAAM,CAAC;IASjC,CAAC;IAEI,KAAK,CAAC,SAAS,CAAC,QAAgB;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;YAC3D,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,iBAAiB,CAAC,MAAiC,EAAE,WAAmB;QAC9E,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa;aACjC,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACxB,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,4BAAmB,CAAC,mDAAmD,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,MAA0B,EAAE,KAAa;QAC3D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAExD,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAAC,sBAAsB,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,4BAAmB,CAAC,4CAA4C,CAAC,CAAC;QAC9E,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,MAM1B;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAElE,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;SACrD,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,aAAqB,EAAE,MAAc;QACtD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;QACxE,CAAC;QACD,IACE,CAAC,aAAa;YACd,aAAa,CAAC,MAAM,GAAG,EAAE;YACzB,aAAa,CAAC,MAAM,GAAG,GAAG;YAC1B,CAAC,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,4BAAmB,CAAC,0BAA0B,CAAC,CAAC;QAC5D,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,SAAS,CAAC,MAOf;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAElE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAExD,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC;YAChD,IAAI,EAAE;gBACJ,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,cAAc,EAAE,MAAM,CAAC,aAAa;gBACpC,qBAAqB,EAAE,MAAM;gBAC7B,UAAU,EAAE,SAAS;aACtB;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0CAA0C,MAAM,CAAC,QAAQ,WAAW,MAAM,CAAC,MAAM,EAAE,CACpF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,MAelB;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErD,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;QAC5E,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtC,mBAAM,CAAC,GAAG,CAAA;;;4BAGY,QAAQ;4BACR,MAAM,CAAC,QAAQ;+BACZ,MAAM,CAAC,WAAW;;;;OAI1C,CACF,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,4BAAmB,CAC3B,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9D,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yCAAyC,MAAM,CAAC,QAAQ,WAAW,GAAG,CAAC,OAAO,EAAE,CACjF,CAAC;YACF,MAAM,IAAI,4BAAmB,CAAC,yBAAyB,CAAC,CAAC;QAC3D,CAAC;QAED,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC5E,MAAM,CAAC,MAAM,EACb,GAAG,CAAC,OAAO,EACX,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,CACjB,CAAC;QAEF,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,QAAQ;YACnB,wEAAwE;YACxE,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,GAAG,CAAC,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,qEAAqE;IAC7D,UAAU,CAAC,YAAoB,EAAE,aAAqB;QAC5D,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE,IAAI,YAAY,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE5C,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AAjOY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAa,CAAC,CAAC,CAAA;IAEvC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kCAAe,CAAC,CAAC,CAAA;IAEzC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC,CAAC,CAAA;qCAHb,0BAAa;QAEX,kCAAe;QAEnB,0BAAW;GAZzB,gBAAgB,CAiO5B"}
+{"version":3,"file":"authorize.service.js","sourceRoot":"","sources":["../../src/authorize/authorize.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8EAA8E;AAC9E,8EAA8E;AAC9E,kEAAkE;AAClE,oDAA4D;AAC5D,2CAOwB;AACxB,mCAAyC;AACzC,uDAAmD;AACnD,gEAA4D;AAC5D,0DAAsD;AACtD,yDAAgD;AAChD,qEAA2E;AAC3E,mEAA+D;AAE/D;;;;;;;;;;GAUG;AAEI,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAM3B,YAEE,MAAsC,EAEtC,QAA0C,EAE1C,IAAkC,EAElC,OAAwC,EAExC,KAAoC,EAEpC,QAA+C;QAV9B,WAAM,GAAN,MAAM,CAAe;QAErB,aAAQ,GAAR,QAAQ,CAAiB;QAEzB,SAAI,GAAJ,IAAI,CAAa;QAEjB,YAAO,GAAP,OAAO,CAAgB;QAEvB,UAAK,GAAL,KAAK,CAAc;QAEnB,aAAQ,GAAR,QAAQ,CAAsB;QAjBhC,WAAM,GAAG,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;QAE5D,mFAAmF;QAClE,cAAS,GAAG,KAAM,CAAC;IAejC,CAAC;IAII,KAAK,CAAC,SAAS,CAAC,QAAgB;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,UAAU,CAAC;YAC3D,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE;SAC/B,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YAC/B,yEAAyE;YACzE,8CAA8C;YAC9C,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2DAA2D,QAAQ,EAAE,CAAC,CAAC;YACxF,MAAM,IAAI,6BAAU,CAAC,gBAAgB,EAAE,0CAA0C,CAAC,CAAC;QACrF,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;;OAIG;IACK,iBAAiB,CACvB,MAAqD,EACrD,WAAmB;;QAEnB,MAAM,OAAO,GAAG,MAAM,CAAC,aAAa;aACjC,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;aACxB,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;YACnC,2EAA2E;YAC3E,4EAA4E;YAC5E,uDAAuD;YACvD,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,mDAAmD,MAAC,MAAc,CAAC,SAAS,mCAAI,GAAG,QAAQ,WAAW,EAAE,CACzG,CAAC;YACF,MAAM,IAAI,6BAAU,CAClB,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;QACJ,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,WAAW,CAAC,MAA0B,EAAE,KAAc;QAC5D,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,CAAC,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEhE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,6BAAU,CAClB,eAAe,EACf,4CAA4C,EAC5C,IAAI,CACL,CAAC;QACJ,CAAC;QACD,OAAO,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,cAAc,CAC1B,KAAa,EACb,QAAiB;QAEjB,MAAM,aAAa,GAAG,KAAK;aACxB,KAAK,CAAC,QAAQ,CAAC;aACf,MAAM,CAAC,OAAO,CAAC;aACf,QAAQ,CAAC,kCAAS,CAAC,CAAC;QAEvB,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,IAAI,aAAa,EAAE,CAAC;gBAClB,MAAM,IAAI,6BAAU,CAClB,gBAAgB,EAChB,yCAAyC,kCAAS,IAAI,EACtD,IAAI,CACL,CAAC;YACJ,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE,CAAC;QACzD,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;YAC7B,MAAM,IAAI,6BAAU,CAClB,gBAAgB,EAChB,6CAA6C,EAC7C,IAAI,CACL,CAAC;QACJ,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,+EAA+E;IACvE,kBAAkB,CAAC,YAAqB;QAC9C,IAAI,YAAY,IAAI,YAAY,KAAK,MAAM,EAAE,CAAC;YAC5C,MAAM,IAAI,6BAAU,CAClB,2BAA2B,EAC3B,wCAAwC,EACxC,IAAI,CACL,CAAC;QACJ,CAAC;IACH,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,oBAAoB,CAAC,MAQ1B;QACC,4EAA4E;QAC5E,2EAA2E;QAC3E,2CAA2C;QAC3C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAClE,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAElD,OAAO;YACL,UAAU,EAAE,MAAM,CAAC,IAAI;YACvB,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;YAC7C,qEAAqE;YACrE,4EAA4E;YAC5E,qEAAqE;YACrE,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;SACxC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACK,UAAU,CAAC,aAAqB,EAAE,MAAc;QACtD,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,IAAI,6BAAU,CAClB,iBAAiB,EACjB,sCAAsC,EACtC,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IACE,CAAC,aAAa;YACd,aAAa,CAAC,MAAM,GAAG,EAAE;YACzB,aAAa,CAAC,MAAM,GAAG,GAAG;YAC1B,CAAC,qBAAqB,CAAC,IAAI,CAAC,aAAa,CAAC,EAC1C,CAAC;YACD,MAAM,IAAI,6BAAU,CAAC,iBAAiB,EAAE,0BAA0B,EAAE,IAAI,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,SAAS,CAAC,MASf;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACrD,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC;QACnD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAClE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QAEnE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC;QAExD,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,MAAM,CAAC;YAChD,IAAI,EAAE;gBACJ,SAAS,EAAE,QAAQ;gBACnB,SAAS,EAAE,MAAM,CAAC,QAAQ;gBAC1B,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,KAAK;gBACL,cAAc,EAAE,MAAM,CAAC,aAAa;gBACpC,qBAAqB,EAAE,MAAM;gBAC7B,UAAU,EAAE,SAAS;gBACrB,oEAAoE;gBACpE,kEAAkE;gBAClE,QAAQ;aACT;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,KAAK,CACf,0CAA0C,MAAM,CAAC,QAAQ,WAAW,MAAM,CAAC,MAAM,EAAE,CACpF,CAAC;QAEF,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,MAgBlB;;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErD,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,6BAAU,CAClB,qBAAqB,EACrB,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAEvD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,CAGtC,mBAAM,CAAC,GAAG,CAAA;;;4BAGY,QAAQ;4BACR,MAAM,CAAC,QAAQ;+BACZ,MAAM,CAAC,WAAW;;;;OAI1C,CACF,CAAC;QAEF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,6BAAU,CAClB,eAAe,EACf,kEAAkE,CACnE,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;YAC9D,4EAA4E;YAC5E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,yCAAyC,MAAM,CAAC,QAAQ,WAAW,GAAG,CAAC,OAAO,EAAE,CACjF,CAAC;YACF,MAAM,IAAI,6BAAU,CAAC,eAAe,EAAE,yBAAyB,CAAC,CAAC;QACnE,CAAC;QAED,6EAA6E;QAC7E,mEAAmE;QACnE,IAAI,CAAC,MAAA,MAAM,CAAC,QAAQ,mCAAI,IAAI,CAAC,KAAK,CAAC,MAAA,GAAG,CAAC,QAAQ,mCAAI,IAAI,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,6BAAU,CAClB,gBAAgB,EAChB,4CAA4C,CAC7C,CAAC;QACJ,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ;YACxB,CAAC,CAAC;gBACE,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;gBACvC,UAAU,EAAE,gCAAc,CAAC,6BAA6B;aACzD;YACH,CAAC,CAAC,SAAS,CAAC;QAEd,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAC5E,MAAM,CAAC,MAAM,EACb,GAAG,CAAC,OAAO,EACX,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,EAChB,KAAK,CACN,CAAC;QAEF,OAAO,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IACvE,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,oBAAoB,CAAC,MAQ1B;;QACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAErD,IAAI,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,IAAI,6BAAU,CAClB,qBAAqB,EACrB,0CAA0C,CAC3C,CAAC;QACJ,CAAC;QAED,mDAAmD;QACnD,EAAE;QACF,wEAAwE;QACxE,4EAA4E;QAC5E,yEAAyE;QACzE,0EAA0E;QAC1E,qDAAqD;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAE5E,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,UAAU,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,IAAI,IAAI,IAAI,EAAE,EAAE,CAAC;YACnF,MAAM,IAAI,6BAAU,CAClB,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,CAAC;QAED,8EAA8E;QAC9E,yCAAyC;QACzC,IAAI,QAAQ,CAAC,eAAe,IAAI,QAAQ,CAAC,eAAe,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC7E,MAAM,IAAI,6BAAU,CAClB,eAAe,EACf,+CAA+C,CAChD,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAA,QAAQ,CAAC,QAAQ,mCAAI,IAAI,CAAC;QAC3C,IAAI,CAAC,MAAA,MAAM,CAAC,QAAQ,mCAAI,IAAI,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC3C,MAAM,IAAI,6BAAU,CAClB,gBAAgB,EAChB,uCAAuC,CACxC,CAAC;QACJ,CAAC;QAED,0EAA0E;QAC1E,2EAA2E;QAC3E,4DAA4D;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAEvC,6EAA6E;QAC7E,6EAA6E;QAC7E,8EAA8E;QAC9E,IAAI,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,kCAAS,CAAC,EAAE,CAAC;YAC3E,MAAM,IAAI,6BAAU,CAClB,eAAe,EACf,0CAA0C,kCAAS,IAAI,CACxD,CAAC;QACJ,CAAC;QAED,IAAI,OAAY,CAAC;QACjB,IAAI,KAAa,CAAC;QAClB,IAAI,CAAC;YACH,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAC9C,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,SAAS,EAChB,MAAM,CAAC,SAAS,EAChB,MAAA,MAAM,CAAC,SAAS,mCAAI,IAAI,CACzB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,qEAAqE;YACrE,2EAA2E;YAC3E,2EAA2E;YAC3E,yEAAyE;YACzE,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;gBAC3C,MAAM,IAAI,6BAAU,CAClB,eAAe,EACf,+CAA+C,CAChD,CAAC;YACJ,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,MAAM,OAAO,GAAG,QAAQ;YACtB,CAAC,CAAC;gBACE,GAAG,EAAE,OAAO,CAAC,OAAO;gBACpB,SAAS,EAAE,OAAO,CAAC,EAAE;gBACrB,GAAG,EAAE,QAAQ;gBACb,GAAG,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;gBACpC,KAAK;gBACL,GAAG,EAAE,MAAM,CAAC,QAAQ;aACrB;YACH,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAEpD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAEhE,OAAO,IAAI,CAAC,kBAAkB,CAAC,WAAW,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;IAC5D,CAAC;IAED;;;;;;;;OAQG;IACK,kBAAkB,CAAC,WAAmB,EAAE,YAAoB,EAAE,KAAa;QACjF,MAAM,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;QAErD,OAAO;YACL,YAAY,EAAE,WAAW;YACzB,WAAW;YACX,aAAa,EAAE,YAAY;YAC3B,YAAY;YACZ,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,QAAQ;YACnB,UAAU,EAAE,SAAS;YACrB,SAAS;YACT,KAAK;SACN,CAAC;IACJ,CAAC;IAEO,gBAAgB,CAAC,WAAmB;QAC1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CACvB,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CACrE,CAAC;YACF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;YACpE,OAAO,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;QAAC,WAAM,CAAC;YACP,yEAAyE;YACzE,yBAAyB;YACzB,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,qEAAqE;IAC7D,UAAU,CAAC,YAAoB,EAAE,aAAqB;QAC5D,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,MAAM,GAAG,EAAE,IAAI,YAAY,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC3E,OAAO,KAAK,CAAC;QACf,CAAC;QAED,6DAA6D;QAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC;QACrE,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE5C,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAEtD,IAAI,CAAC;YACH,OAAO,IAAA,wBAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAC7C,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;CACF,CAAA;AA1fY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAa,CAAC,CAAC,CAAA;IAEvC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,kCAAe,CAAC,CAAC,CAAA;IAEzC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAW,CAAC,CAAC,CAAA;IAErC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC,CAAC,CAAA;IAExC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,4BAAY,CAAC,CAAC,CAAA;IAEtC,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,6CAAoB,CAAC,CAAC,CAAA;qCATtB,0BAAa;QAEX,kCAAe;QAEnB,0BAAW;QAER,gCAAc;QAEhB,4BAAY;QAET,6CAAoB;GAlBtC,gBAAgB,CA0f5B"}

package/dist/authorize/dto/authorize-info.dto.d.ts

@@ -1,8 +1,17 @@
 export declare class AuthorizeInfoDTO {
     client_id: string;
     redirect_uri: string;
-    scope: string;
+    /** Ausente, assume os escopos registrados do client. */
+    scope?: string;
     code_challenge: string;
     code_challenge_method: string;
+    /**
+     * Opcionais porque os cinco clientes ja registrados nao os mandam. Quando
+     * ausentes, o comportamento e byte a byte o de hoje; quando presentes e
+     * invalidos, a requisicao e recusada.
+     */
+    response_type?: string;
+    resource?: string;
+    state?: string;
 }
 //# sourceMappingURL=authorize-info.dto.d.ts.map

package/dist/authorize/dto/authorize-info.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authorize-info.dto.d.ts","sourceRoot":"","sources":["../../../src/authorize/dto/authorize-info.dto.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAgB;IAG3B,SAAS,EAAE,MAAM,CAAC;IAIlB,YAAY,EAAE,MAAM,CAAC;IAIrB,KAAK,EAAE,MAAM,CAAC;IAId,cAAc,EAAE,MAAM,CAAC;IAIvB,qBAAqB,EAAE,MAAM,CAAC;CAC/B"}
+{"version":3,"file":"authorize-info.dto.d.ts","sourceRoot":"","sources":["../../../src/authorize/dto/authorize-info.dto.ts"],"names":[],"mappings":"AAEA,qBAAa,gBAAgB;IAG3B,SAAS,EAAE,MAAM,CAAC;IAIlB,YAAY,EAAE,MAAM,CAAC;IAErB,wDAAwD;IAGxD,KAAK,CAAC,EAAE,MAAM,CAAC;IAIf,cAAc,EAAE,MAAM,CAAC;IAIvB,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IAGH,aAAa,CAAC,EAAE,MAAM,CAAC;IAIvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/authorize/dto/authorize-info.dto.js

@@ -25,8 +25,8 @@ __decorate([
     __metadata("design:type", String)
 ], AuthorizeInfoDTO.prototype, "redirect_uri", void 0);
 __decorate([
+    (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
 ], AuthorizeInfoDTO.prototype, "scope", void 0);
 __decorate([
@@ -39,4 +39,19 @@ __decorate([
     (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
 ], AuthorizeInfoDTO.prototype, "code_challenge_method", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AuthorizeInfoDTO.prototype, "response_type", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AuthorizeInfoDTO.prototype, "resource", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], AuthorizeInfoDTO.prototype, "state", void 0);
 //# sourceMappingURL=authorize-info.dto.js.map

package/dist/authorize/dto/authorize-info.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"authorize-info.dto.js","sourceRoot":"","sources":["../../../src/authorize/dto/authorize-info.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAuD;AAEvD,MAAa,gBAAgB;CAoB5B;AApBD,4CAoBC;AAjBC;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;mDACK;AAIlB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sDACQ;AAIrB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACC;AAId;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;wDACU;AAIvB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+DACiB"}
+{"version":3,"file":"authorize-info.dto.js","sourceRoot":"","sources":["../../../src/authorize/dto/authorize-info.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAmE;AAEnE,MAAa,gBAAgB;CAsC5B;AAtCD,4CAsCC;AAnCC;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;mDACK;AAIlB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sDACQ;AAKrB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;+CACI;AAIf;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;wDACU;AAIvB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+DACiB;AAS9B;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;uDACY;AAIvB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;kDACO;AAIlB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;+CACI"}

package/dist/authorize/dto/consent.dto.d.ts

@@ -1,8 +1,17 @@
 export declare class ConsentDTO {
     client_id: string;
     redirect_uri: string;
-    scope: string;
+    /** Ausente, assume os escopos registrados do client. */
+    scope?: string;
     code_challenge: string;
     code_challenge_method: string;
+    /**
+     * Opcionais porque os cinco clientes ja registrados nao os mandam. Quando
+     * ausentes, o comportamento e byte a byte o de hoje; quando presentes e
+     * invalidos, a requisicao e recusada.
+     */
+    response_type?: string;
+    resource?: string;
+    state?: string;
 }
 //# sourceMappingURL=consent.dto.d.ts.map

package/dist/authorize/dto/consent.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"consent.dto.d.ts","sourceRoot":"","sources":["../../../src/authorize/dto/consent.dto.ts"],"names":[],"mappings":"AAEA,qBAAa,UAAU;IAGrB,SAAS,EAAE,MAAM,CAAC;IAIlB,YAAY,EAAE,MAAM,CAAC;IAIrB,KAAK,EAAE,MAAM,CAAC;IAId,cAAc,EAAE,MAAM,CAAC;IAIvB,qBAAqB,EAAE,MAAM,CAAC;CAC/B"}
+{"version":3,"file":"consent.dto.d.ts","sourceRoot":"","sources":["../../../src/authorize/dto/consent.dto.ts"],"names":[],"mappings":"AAEA,qBAAa,UAAU;IAGrB,SAAS,EAAE,MAAM,CAAC;IAIlB,YAAY,EAAE,MAAM,CAAC;IAErB,wDAAwD;IAGxD,KAAK,CAAC,EAAE,MAAM,CAAC;IAIf,cAAc,EAAE,MAAM,CAAC;IAIvB,qBAAqB,EAAE,MAAM,CAAC;IAE9B;;;;OAIG;IAGH,aAAa,CAAC,EAAE,MAAM,CAAC;IAIvB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAIlB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB"}

package/dist/authorize/dto/consent.dto.js

@@ -25,8 +25,8 @@ __decorate([
     __metadata("design:type", String)
 ], ConsentDTO.prototype, "redirect_uri", void 0);
 __decorate([
+    (0, class_validator_1.IsOptional)(),
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
 ], ConsentDTO.prototype, "scope", void 0);
 __decorate([
@@ -39,4 +39,19 @@ __decorate([
     (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
 ], ConsentDTO.prototype, "code_challenge_method", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ConsentDTO.prototype, "response_type", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ConsentDTO.prototype, "resource", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], ConsentDTO.prototype, "state", void 0);
 //# sourceMappingURL=consent.dto.js.map

package/dist/authorize/dto/consent.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"consent.dto.js","sourceRoot":"","sources":["../../../src/authorize/dto/consent.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAuD;AAEvD,MAAa,UAAU;CAoBtB;AApBD,gCAoBC;AAjBC;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;6CACK;AAIlB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;gDACQ;AAIrB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;yCACC;AAId;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;kDACU;AAIvB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;yDACiB"}
+{"version":3,"file":"consent.dto.js","sourceRoot":"","sources":["../../../src/authorize/dto/consent.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAmE;AAEnE,MAAa,UAAU;CAsCtB;AAtCD,gCAsCC;AAnCC;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;6CACK;AAIlB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;gDACQ;AAKrB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;yCACI;AAIf;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;kDACU;AAIvB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;yDACiB;AAS9B;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;iDACY;AAIvB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;4CACO;AAIlB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;yCACI"}

package/dist/authorize/dto/token.dto.d.ts

@@ -1,8 +1,20 @@
+/**
+ * Os campos obrigatórios dependem do grant. `authorization_code` continua
+ * exigindo exatamente o que exigia; `refresh_token` só existe para o cliente
+ * OAuth externo renovar sem passar pelo `/auth/refresh` — que devolve token sem
+ * audiência e por isso recusa sessão de conector.
+ */
 export declare class TokenDTO {
     grant_type: string;
     code: string;
     code_verifier: string;
     client_id: string;
     redirect_uri: string;
+    refresh_token: string;
+    /**
+     * RFC 8707. Opcional: sem ele o token sai sem `aud` e o comportamento é o de
+     * hoje — que é o que os cinco clientes já registrados esperam.
+     */
+    resource?: string;
 }
 //# sourceMappingURL=token.dto.d.ts.map

package/dist/authorize/dto/token.dto.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"token.dto.d.ts","sourceRoot":"","sources":["../../../src/authorize/dto/token.dto.ts"],"names":[],"mappings":"AAEA,qBAAa,QAAQ;IAGnB,UAAU,EAAE,MAAM,CAAC;IAInB,IAAI,EAAE,MAAM,CAAC;IAIb,aAAa,EAAE,MAAM,CAAC;IAItB,SAAS,EAAE,MAAM,CAAC;IAIlB,YAAY,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"token.dto.d.ts","sourceRoot":"","sources":["../../../src/authorize/dto/token.dto.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,qBAAa,QAAQ;IAGnB,UAAU,EAAE,MAAM,CAAC;IAKnB,IAAI,EAAE,MAAM,CAAC;IAKb,aAAa,EAAE,MAAM,CAAC;IAItB,SAAS,EAAE,MAAM,CAAC;IAKlB,YAAY,EAAE,MAAM,CAAC;IAKrB,aAAa,EAAE,MAAM,CAAC;IAEtB;;;OAGG;IAGH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB"}

package/dist/authorize/dto/token.dto.js

@@ -11,20 +11,28 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TokenDTO = void 0;
 const class_validator_1 = require("class-validator");
+/**
+ * Os campos obrigatórios dependem do grant. `authorization_code` continua
+ * exigindo exatamente o que exigia; `refresh_token` só existe para o cliente
+ * OAuth externo renovar sem passar pelo `/auth/refresh` — que devolve token sem
+ * audiência e por isso recusa sessão de conector.
+ */
 class TokenDTO {
 }
 exports.TokenDTO = TokenDTO;
 __decorate([
     (0, class_validator_1.IsString)(),
-    (0, class_validator_1.IsIn)(['authorization_code']),
+    (0, class_validator_1.IsIn)(['authorization_code', 'refresh_token']),
     __metadata("design:type", String)
 ], TokenDTO.prototype, "grant_type", void 0);
 __decorate([
+    (0, class_validator_1.ValidateIf)((o) => o.grant_type !== 'refresh_token'),
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
 ], TokenDTO.prototype, "code", void 0);
 __decorate([
+    (0, class_validator_1.ValidateIf)((o) => o.grant_type !== 'refresh_token'),
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
@@ -35,8 +43,20 @@ __decorate([
     __metadata("design:type", String)
 ], TokenDTO.prototype, "client_id", void 0);
 __decorate([
+    (0, class_validator_1.ValidateIf)((o) => o.grant_type !== 'refresh_token'),
     (0, class_validator_1.IsString)(),
     (0, class_validator_1.IsNotEmpty)(),
     __metadata("design:type", String)
 ], TokenDTO.prototype, "redirect_uri", void 0);
+__decorate([
+    (0, class_validator_1.ValidateIf)((o) => o.grant_type === 'refresh_token'),
+    (0, class_validator_1.IsString)(),
+    (0, class_validator_1.IsNotEmpty)(),
+    __metadata("design:type", String)
+], TokenDTO.prototype, "refresh_token", void 0);
+__decorate([
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], TokenDTO.prototype, "resource", void 0);
 //# sourceMappingURL=token.dto.js.map

package/dist/authorize/dto/token.dto.js.map

@@ -1 +1 @@
-{"version":3,"file":"token.dto.js","sourceRoot":"","sources":["../../../src/authorize/dto/token.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAA6D;AAE7D,MAAa,QAAQ;CAoBpB;AApBD,4BAoBC;AAjBC;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,sBAAI,EAAC,CAAC,oBAAoB,CAAC,CAAC;;4CACV;AAInB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sCACA;AAIb;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACS;AAItB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;2CACK;AAIlB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;8CACQ"}
+{"version":3,"file":"token.dto.js","sourceRoot":"","sources":["../../../src/authorize/dto/token.dto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qDAAqF;AAErF;;;;;GAKG;AACH,MAAa,QAAQ;CAoCpB;AApCD,4BAoCC;AAjCC;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,sBAAI,EAAC,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC;;4CAC3B;AAKnB;IAHC,IAAA,4BAAU,EAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC;IACnD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;sCACA;AAKb;IAHC,IAAA,4BAAU,EAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC;IACnD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACS;AAItB;IAFC,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;2CACK;AAKlB;IAHC,IAAA,4BAAU,EAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC;IACnD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;8CACQ;AAKrB;IAHC,IAAA,4BAAU,EAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,eAAe,CAAC;IACnD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACS;AAQtB;IAFC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;0CACO"}

package/dist/authorize/oauth-exception.filter.d.ts

@@ -0,0 +1,17 @@
+import { ArgumentsHost, ExceptionFilter, HttpException } from '@nestjs/common';
+/**
+ * Traduz o que sai dos endpoints OAuth para o formato do RFC 6749 §5.2:
+ * `{ error, error_description }`, sempre `no-store`.
+ *
+ * Existe porque o `HttpExceptionFilter` global quase serve, mas não nos dois
+ * casos que importam: ele acrescenta `statusCode`/`timestamp`/`path` ao corpo, e
+ * uma falha do `ValidationPipe` sai como `{ message: { campo: [...] } }`, que não
+ * é um erro OAuth e nenhum cliente sabe ler.
+ *
+ * O campo `message` é preservado de propósito — os cinco clientes já registrados
+ * leem ele nas respostas de erro de hoje.
+ */
+export declare class OAuthExceptionFilter implements ExceptionFilter {
+    catch(exception: HttpException, host: ArgumentsHost): void;
+}
+//# sourceMappingURL=oauth-exception.filter.d.ts.map

package/dist/authorize/oauth-exception.filter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-exception.filter.d.ts","sourceRoot":"","sources":["../../src/authorize/oauth-exception.filter.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EAEb,eAAe,EACf,aAAa,EACd,MAAM,gBAAgB,CAAC;AAIxB;;;;;;;;;;;GAWG;AACH,qBACa,oBAAqB,YAAW,eAAe;IAC1D,KAAK,CAAC,SAAS,EAAE,aAAa,EAAE,IAAI,EAAE,aAAa,GAAG,IAAI;CAkC3D"}