@hed-hog/core 0.0.399 → 0.0.401

package/dist/oauth/providers/abstract.provider.js

@@ -15,29 +15,52 @@ class BaseOAuthProvider {
             grant_type: 'authorization_code',
             code,
         }).toString();
-        const response = await (0, rxjs_1.lastValueFrom)(this.http.post(url, body, {
-            headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-        }));
-        return response.data;
+        try {
+            const response = await (0, rxjs_1.lastValueFrom)(this.http.post(url, body, {
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+            }));
+            return response.data;
+        }
+        catch (error) {
+            throw this.mapProviderError(this.getProviderType(), error);
+        }
     }
     async fetchProfile(accessToken, url) {
-        const response = await (0, rxjs_1.lastValueFrom)(this.http.get(url, {
-            headers: { Authorization: `Bearer ${accessToken}` },
-        }));
-        return response.data;
+        try {
+            const response = await (0, rxjs_1.lastValueFrom)(this.http.get(url, {
+                headers: { Authorization: `Bearer ${accessToken}` },
+            }));
+            return response.data;
+        }
+        catch (error) {
+            throw this.mapProviderError(this.getProviderType(), error);
+        }
     }
+    /**
+     * Traduz a falha crua do provider (quase sempre um AxiosError) para o tipo que
+     * `OAuthService.mapCallbackError` sabe classificar. Sem isso o erro atravessa
+     * todos os ramos de lá e vira um 503 genérico — inclusive um `invalid_grant`,
+     * que é código reusado/expirado e deveria ser 400 "refaça o login".
+     *
+     * É idempotente de propósito: os helpers acima já mapeiam, então um provider
+     * que também tenha o próprio try/catch (Microsoft Entra ID) recebe aqui um
+     * erro já traduzido e não pode reembrulhá-lo.
+     */
     mapProviderError(provider, error) {
         var _a;
+        if (error instanceof oauth_errors_1.OAuthProviderException) {
+            return error;
+        }
         const providerError = this.extractProviderError(error);
         const providerErrorCode = this.extractProviderErrorCode(error);
         const status = (_a = error === null || error === void 0 ? void 0 : error.response) === null || _a === void 0 ? void 0 : _a.status;
         if (this.isConsumedAuthorizationCodeError(error)) {
-            return new oauth_errors_1.OAuthProviderException(provider, 'callback_consumed', 'OAuth callback is no longer valid. Start the sign-in flow again.', status, providerError, providerErrorCode);
+            return new oauth_errors_1.OAuthProviderException(provider, 'callback_consumed', 'OAuth callback is no longer valid. Start the sign-in flow again.', status, providerError, providerErrorCode, error);
         }
         if (this.isInvalidAuthorizationCodeError(error)) {
-            return new oauth_errors_1.OAuthProviderException(provider, 'invalid_callback', 'OAuth callback is invalid or expired. Start the sign-in flow again.', status, providerError, providerErrorCode);
+            return new oauth_errors_1.OAuthProviderException(provider, 'invalid_callback', 'OAuth callback is invalid or expired. Start the sign-in flow again.', status, providerError, providerErrorCode, error);
         }
-        return new oauth_errors_1.OAuthProviderException(provider, 'upstream_failure', `Unable to complete ${provider} OAuth authentication.`, status, providerError, providerErrorCode);
+        return new oauth_errors_1.OAuthProviderException(provider, 'upstream_failure', `Unable to complete ${provider} OAuth authentication.`, status, providerError, providerErrorCode, error);
     }
     extractProviderError(error) {
         var _a, _b;
@@ -57,7 +80,11 @@ class BaseOAuthProvider {
             /(AADSTS54005|already redeemed|already been redeemed|authorization code was already redeemed)/i.test(description));
     }
     isInvalidAuthorizationCodeError(error) {
-        return this.extractProviderError(error) === 'invalid_grant';
+        const providerError = this.extractProviderError(error);
+        // `bad_verification_code` é o `invalid_grant` do GitHub, que responde 200 com
+        // o erro no corpo em vez de status de erro.
+        return (providerError === 'invalid_grant' ||
+            providerError === 'bad_verification_code');
     }
 }
 exports.BaseOAuthProvider = BaseOAuthProvider;

package/dist/oauth/providers/abstract.provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"abstract.provider.js","sourceRoot":"","sources":["../../../src/oauth/providers/abstract.provider.ts"],"names":[],"mappings":";;;AACA,+BAAqC;AAErC,kDAAyD;AAEzD,MAAsB,iBAAiB;IACrC,YAA+B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;IAAG,CAAC;IAM1C,KAAK,CAAC,UAAU,CAAC,EACzB,IAAI,EACJ,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,WAAW,GAOZ;QACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;YAChC,IAAI;SACL,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEd,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAa,EAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;YACxB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;SACjE,CAAC,CACH,CAAC;QAEF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAES,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,GAAW;QAC3D,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAa,EAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;YACjB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;SACpD,CAAC,CACH,CAAC;QACF,OAAO,QAAQ,CAAC,IAAI,CAAC;IACvB,CAAC;IAES,gBAAgB,CAAC,QAAgB,EAAE,KAAU;;QACrD,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,MAAM,CAAC;QAEvC,IAAI,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,qCAAsB,CAC/B,QAAQ,EACR,mBAAmB,EACnB,kEAAkE,EAClE,MAAM,EACN,aAAa,EACb,iBAAiB,CAClB,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,qCAAsB,CAC/B,QAAQ,EACR,kBAAkB,EAClB,qEAAqE,EACrE,MAAM,EACN,aAAa,EACb,iBAAiB,CAClB,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,qCAAsB,CAC/B,QAAQ,EACR,kBAAkB,EAClB,sBAAsB,QAAQ,wBAAwB,EACtD,MAAM,EACN,aAAa,EACb,iBAAiB,CAClB,CAAC;IACJ,CAAC;IAES,oBAAoB,CAAC,KAAU;;QACvC,OAAO,CAAA,MAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,IAAI,0CAAE,KAAK,MAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,CAAA,IAAI,eAAe,CAAC;IACxE,CAAC;IAES,wBAAwB,CAAC,KAAU;;QAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,CAAA,MAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,IAAI,0CAAE,iBAAiB,KAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9C,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,KAAI,SAAS,CAAC;IACjC,CAAC;IAES,gCAAgC,CAAC,KAAU;;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,CAAA,MAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,IAAI,0CAAE,iBAAiB,KAAI,EAAE,CAAC,CAAC;QAE3E,OAAO,CACL,aAAa,KAAK,eAAe;YACjC,+FAA+F,CAAC,IAAI,CAClG,WAAW,CACZ,CACF,CAAC;IACJ,CAAC;IAES,+BAA+B,CAAC,KAAU;QAClD,OAAO,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,eAAe,CAAC;IAC9D,CAAC;CACF;AA5GD,8CA4GC"}
+{"version":3,"file":"abstract.provider.js","sourceRoot":"","sources":["../../../src/oauth/providers/abstract.provider.ts"],"names":[],"mappings":";;;AACA,+BAAqC;AAErC,kDAAyD;AAEzD,MAAsB,iBAAiB;IACrC,YAA+B,IAAiB;QAAjB,SAAI,GAAJ,IAAI,CAAa;IAAG,CAAC;IAM1C,KAAK,CAAC,UAAU,CAAC,EACzB,IAAI,EACJ,GAAG,EACH,QAAQ,EACR,YAAY,EACZ,WAAW,GAOZ;QACC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,YAAY,EAAE,WAAW;YACzB,UAAU,EAAE,oBAAoB;YAChC,IAAI;SACL,CAAC,CAAC,QAAQ,EAAE,CAAC;QAEd,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAa,EAClC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE;gBACxB,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;aACjE,CAAC,CACH,CAAC;YAEF,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAES,KAAK,CAAC,YAAY,CAAC,WAAmB,EAAE,GAAW;QAC3D,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAA,oBAAa,EAClC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE;gBACjB,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE;aACpD,CAAC,CACH,CAAC;YACF,OAAO,QAAQ,CAAC,IAAI,CAAC;QACvB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;IAED;;;;;;;;;OASG;IACO,gBAAgB,CAAC,QAAgB,EAAE,KAAU;;QACrD,IAAI,KAAK,YAAY,qCAAsB,EAAE,CAAC;YAC5C,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,iBAAiB,GAAG,IAAI,CAAC,wBAAwB,CAAC,KAAK,CAAC,CAAC;QAC/D,MAAM,MAAM,GAAG,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,MAAM,CAAC;QAEvC,IAAI,IAAI,CAAC,gCAAgC,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,OAAO,IAAI,qCAAsB,CAC/B,QAAQ,EACR,mBAAmB,EACnB,kEAAkE,EAClE,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,KAAK,CACN,CAAC;QACJ,CAAC;QAED,IAAI,IAAI,CAAC,+BAA+B,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,OAAO,IAAI,qCAAsB,CAC/B,QAAQ,EACR,kBAAkB,EAClB,qEAAqE,EACrE,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,KAAK,CACN,CAAC;QACJ,CAAC;QAED,OAAO,IAAI,qCAAsB,CAC/B,QAAQ,EACR,kBAAkB,EAClB,sBAAsB,QAAQ,wBAAwB,EACtD,MAAM,EACN,aAAa,EACb,iBAAiB,EACjB,KAAK,CACN,CAAC;IACJ,CAAC;IAES,oBAAoB,CAAC,KAAU;;QACvC,OAAO,CAAA,MAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,IAAI,0CAAE,KAAK,MAAI,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,IAAI,CAAA,IAAI,eAAe,CAAC;IACxE,CAAC;IAES,wBAAwB,CAAC,KAAU;;QAC3C,MAAM,WAAW,GAAG,MAAM,CAAC,CAAA,MAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,IAAI,0CAAE,iBAAiB,KAAI,EAAE,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9C,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAC,KAAI,SAAS,CAAC;IACjC,CAAC;IAES,gCAAgC,CAAC,KAAU;;QACnD,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,MAAM,CAAC,CAAA,MAAA,MAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,QAAQ,0CAAE,IAAI,0CAAE,iBAAiB,KAAI,EAAE,CAAC,CAAC;QAE3E,OAAO,CACL,aAAa,KAAK,eAAe;YACjC,+FAA+F,CAAC,IAAI,CAClG,WAAW,CACZ,CACF,CAAC;IACJ,CAAC;IAES,+BAA+B,CAAC,KAAU;QAClD,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,CAAC;QAEvD,8EAA8E;QAC9E,4CAA4C;QAC5C,OAAO,CACL,aAAa,KAAK,eAAe;YACjC,aAAa,KAAK,uBAAuB,CAC1C,CAAC;IACJ,CAAC;CACF;AA5ID,8CA4IC"}

package/dist/oauth/providers/github.provider.d.ts

@@ -12,7 +12,7 @@ export declare class GithubProvider extends BaseOAuthProvider {
     getAuthUrl(callbackPath: string): Promise<string>;
     getProfile(code: string, _type?: string, redirectUri?: string): Promise<{
         id: any;
-        email: any;
+        email: string;
         name: any;
         picture: any;
         oauth_tokens: {

package/dist/oauth/providers/github.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"github.provider.d.ts","sourceRoot":"","sources":["../../../src/oauth/providers/github.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,qBACa,cAAe,SAAQ,iBAAiB;IASjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IARzB,OAAO,CAAC,sBAAsB;gBAK5B,IAAI,EAAE,WAAW,EAEA,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa;IAKxC,eAAe;YAID,UAAU;IAqBlB,UAAU,CAAC,YAAY,EAAE,MAAM;IAuB/B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;;;;;;;;;;;;CAoEpE"}
+{"version":3,"file":"github.provider.d.ts","sourceRoot":"","sources":["../../../src/oauth/providers/github.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,qBACa,cAAe,SAAQ,iBAAiB;IASjD,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IARzB,OAAO,CAAC,sBAAsB;gBAK5B,IAAI,EAAE,WAAW,EAEA,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa;IAKxC,eAAe;YAID,UAAU;IAqBlB,UAAU,CAAC,YAAY,EAAE,MAAM;IAuB/B,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM;;;;;;;;;;;;CA2FpE"}

package/dist/oauth/providers/github.provider.js

@@ -76,35 +76,61 @@ let GithubProvider = class GithubProvider extends abstract_provider_1.BaseOAuthP
         const redirectURI = (redirectUri === null || redirectUri === void 0 ? void 0 : redirectUri.trim())
             ? redirectUri.trim()
             : new URL(fixedCallbackPath, apiUrl.replace(':3200', ':3100')).toString();
-        const tokenResponse = await this.http.axiosRef.post('https://github.com/login/oauth/access_token', {
-            client_id: clientId,
-            client_secret: clientSecret,
-            code,
-            redirect_uri: redirectURI,
-        }, {
-            headers: {
-                Accept: 'application/json',
-            },
-        });
+        // Este provider não usa os helpers da base (fala com o axios direto), então
+        // precisa do mesmo tratamento de erro que eles aplicam — sem isso o AxiosError
+        // cru chega ao OAuthService e vira 503 genérico.
+        let tokenResponse;
+        try {
+            tokenResponse = await this.http.axiosRef.post('https://github.com/login/oauth/access_token', {
+                client_id: clientId,
+                client_secret: clientSecret,
+                code,
+                redirect_uri: redirectURI,
+            }, {
+                headers: {
+                    Accept: 'application/json',
+                },
+            });
+        }
+        catch (error) {
+            throw this.mapProviderError(this.getProviderType(), error);
+        }
         const { access_token, error, error_description } = tokenResponse.data;
         if (error || !access_token) {
-            throw new Error(`GitHub OAuth error: ${error_description || error || 'No access token received'}`);
+            // O GitHub responde 200 com o erro no corpo, então não há AxiosError para
+            // capturar: monta-se a mesma forma que o mapeador lê.
+            throw this.mapProviderError(this.getProviderType(), {
+                response: {
+                    status: tokenResponse.status,
+                    data: {
+                        error: error || 'no_access_token',
+                        error_description: error_description || 'No access token received from GitHub.',
+                    },
+                },
+            });
         }
-        const profileResponse = await this.http.axiosRef.get('https://api.github.com/user', {
-            headers: {
-                Authorization: `Bearer ${access_token}`,
-            },
-        });
-        const profile = profileResponse.data;
-        let email = profile.email;
-        if (!email) {
-            const emailResponse = await this.http.axiosRef.get('https://api.github.com/user/emails', {
+        let profile;
+        let email;
+        try {
+            const profileResponse = await this.http.axiosRef.get('https://api.github.com/user', {
                 headers: {
                     Authorization: `Bearer ${access_token}`,
                 },
             });
-            const primaryEmail = emailResponse.data.find((e) => e.primary && e.verified);
-            email = (primaryEmail === null || primaryEmail === void 0 ? void 0 : primaryEmail.email) || null;
+            profile = profileResponse.data;
+            email = profile.email;
+            if (!email) {
+                const emailResponse = await this.http.axiosRef.get('https://api.github.com/user/emails', {
+                    headers: {
+                        Authorization: `Bearer ${access_token}`,
+                    },
+                });
+                const primaryEmail = emailResponse.data.find((e) => e.primary && e.verified);
+                email = (primaryEmail === null || primaryEmail === void 0 ? void 0 : primaryEmail.email) || null;
+            }
+        }
+        catch (error) {
+            throw this.mapProviderError(this.getProviderType(), error);
         }
         return {
             id: profile.id.toString(),

package/dist/oauth/providers/github.provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"github.provider.js","sourceRoot":"","sources":["../../../src/oauth/providers/github.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,yCAA4C;AAC5C,2CAAqF;AACrF,mGAAsG;AACtG,mEAA+D;AAC/D,2DAAwD;AAGjD,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,qCAAiB;IAE3C,sBAAsB,CAAC,KAAa;QAC1C,OAAO,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,YACE,IAAiB,EAEA,OAAuB,EACvB,MAAqB;QAEtC,KAAK,CAAC,IAAI,CAAC,CAAC;QAHK,YAAO,GAAP,OAAO,CAAgB;QACvB,WAAM,GAAN,MAAM,CAAe;IAGxC,CAAC;IAED,eAAe;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,UAAU;;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACnD,yBAAyB;YACzB,SAAS;SACV,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,QAAQ,CAAC,yBAAyB,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;QAExF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC;YAC/D,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAC5B,OAAO,EAAE,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,4BAAmB,CAAC,iCAAiC,CAAC,CAAC;QAE/E,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAA,2DAA+B,EAChE,OAAO,CAAC,oBAAoB,CAAC,IAAI,EACjC,OAAO,CAAC,MAAM,CACf,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAA,QAAQ,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,YAAoB;;QACnC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAa,MAAA,QAAQ,CAAC,qBAAqB,CAAC,mCAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAExF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC;YAC3D,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC;YACpD,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,YAAY,EAAE,MAAM;YACpB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,OAAO,4CAA4C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,KAAc,EAAE,WAAoB;QACjE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAEnE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;QACnD,MAAM,WAAW,GAAG,CAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,IAAI,EAAE;YACrC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;YACpB,CAAC,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5E,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CACjD,6CAA6C,EAC7C;YACE,SAAS,EAAE,QAAQ;YACnB,aAAa,EAAE,YAAY;YAC3B,IAAI;YACJ,YAAY,EAAE,WAAW;SAC1B,EACD;YACE,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;aAC3B;SACF,CACF,CAAC;QAEF,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC;QACtE,IAAI,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,uBAAuB,iBAAiB,IAAI,KAAK,IAAI,0BAA0B,EAAE,CAClF,CAAC;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAClD,6BAA6B,EAC7B;YACE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,YAAY,EAAE;aACxC;SACF,CACF,CAAC;QAEF,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC;QACrC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAChD,oCAAoC,EACpC;gBACE,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,YAAY,EAAE;iBACxC;aACF,CACF,CAAC;YACF,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAC1C,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CACpC,CAAC;YACF,KAAK,GAAG,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,KAAI,IAAI,CAAC;QACtC,CAAC;QAED,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE;YACzB,KAAK;YACL,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK;YACnC,OAAO,EAAE,OAAO,CAAC,UAAU;YAC3B,YAAY,EAAE;gBACZ,YAAY,EAAE,YAAY;gBAC1B,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,QAAQ;aACrB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AAnIY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC,CAAC,CAAA;qCADnC,mBAAW;QAES,gCAAc;QACf,0BAAa;GAV7B,cAAc,CAmI1B"}
+{"version":3,"file":"github.provider.js","sourceRoot":"","sources":["../../../src/oauth/providers/github.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,yCAA4C;AAC5C,2CAAqF;AACrF,mGAAsG;AACtG,mEAA+D;AAC/D,2DAAwD;AAGjD,IAAM,cAAc,GAApB,MAAM,cAAe,SAAQ,qCAAiB;IAE3C,sBAAsB,CAAC,KAAa;QAC1C,OAAO,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,YACE,IAAiB,EAEA,OAAuB,EACvB,MAAqB;QAEtC,KAAK,CAAC,IAAI,CAAC,CAAC;QAHK,YAAO,GAAP,OAAO,CAAgB;QACvB,WAAM,GAAN,MAAM,CAAe;IAGxC,CAAC;IAED,eAAe;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,UAAU;;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACnD,yBAAyB;YACzB,SAAS;SACV,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,QAAQ,CAAC,yBAAyB,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7E,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,4BAAmB,CAAC,sCAAsC,CAAC,CAAC;QAExF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC;YAC/D,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAC5B,OAAO,EAAE,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,4BAAmB,CAAC,iCAAiC,CAAC,CAAC;QAE/E,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAA,2DAA+B,EAChE,OAAO,CAAC,oBAAoB,CAAC,IAAI,EACjC,OAAO,CAAC,MAAM,CACf,CAAC;QACF,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,CAAC,MAAA,QAAQ,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC,EAAE,CAAC;IAC/E,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,YAAoB;;QACnC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC;QAC9E,MAAM,MAAM,GAAa,MAAA,QAAQ,CAAC,qBAAqB,CAAC,mCAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAExF,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;QACnD,MAAM,WAAW,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC;YAC3D,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,sBAAsB,CAAC,YAAY,CAAC;YACpD,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,YAAY,EAAE,MAAM;YACpB,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;QAEH,OAAO,4CAA4C,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACzE,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,KAAc,EAAE,WAAoB;QACjE,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QAEnE,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;QACnD,MAAM,WAAW,GAAG,CAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,IAAI,EAAE;YACrC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE;YACpB,CAAC,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5E,4EAA4E;QAC5E,+EAA+E;QAC/E,iDAAiD;QACjD,IAAI,aAAkB,CAAC;QACvB,IAAI,CAAC;YACH,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAC3C,6CAA6C,EAC7C;gBACE,SAAS,EAAE,QAAQ;gBACnB,aAAa,EAAE,YAAY;gBAC3B,IAAI;gBACJ,YAAY,EAAE,WAAW;aAC1B,EACD;gBACE,OAAO,EAAE;oBACP,MAAM,EAAE,kBAAkB;iBAC3B;aACF,CACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,iBAAiB,EAAE,GAAG,aAAa,CAAC,IAAI,CAAC;QACtE,IAAI,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YAC3B,0EAA0E;YAC1E,sDAAsD;YACtD,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE;gBAClD,QAAQ,EAAE;oBACR,MAAM,EAAE,aAAa,CAAC,MAAM;oBAC5B,IAAI,EAAE;wBACJ,KAAK,EAAE,KAAK,IAAI,iBAAiB;wBACjC,iBAAiB,EACf,iBAAiB,IAAI,uCAAuC;qBAC/D;iBACF;aACF,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAY,CAAC;QACjB,IAAI,KAAoB,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAClD,6BAA6B,EAC7B;gBACE,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,YAAY,EAAE;iBACxC;aACF,CACF,CAAC;YAEF,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC;YAC/B,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YACtB,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAChD,oCAAoC,EACpC;oBACE,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,YAAY,EAAE;qBACxC;iBACF,CACF,CAAC;gBACF,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAC1C,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CACpC,CAAC;gBACF,KAAK,GAAG,CAAA,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,KAAI,IAAI,CAAC;YACtC,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,CAAC,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE;YACzB,KAAK;YACL,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,KAAK;YACnC,OAAO,EAAE,OAAO,CAAC,UAAU;YAC3B,YAAY,EAAE;gBACZ,YAAY,EAAE,YAAY;gBAC1B,aAAa,EAAE,YAAY;gBAC3B,UAAU,EAAE,IAAI;gBAChB,UAAU,EAAE,QAAQ;aACrB;SACF,CAAC;IACJ,CAAC;CACF,CAAA;AA1JY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IASR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC,CAAC,CAAA;qCADnC,mBAAW;QAES,gCAAc;QACf,0BAAa;GAV7B,cAAc,CA0J1B"}

package/dist/oauth/providers/microsoft-entra-id.provider.d.ts

@@ -13,6 +13,12 @@ export declare class MicrosoftEntraIdProvider extends BaseOAuthProvider {
     private static readonly API_CALLBACK_PATH;
     private static readonly API_BOUNCE_APPS;
     private loadConfig;
+    /**
+     * Escopos que a Microsoft devolveu no token, ou `null` quando ela não
+     * informou — só nesse caso vale cair de volta para os escopos pedidos.
+     * Uma lista vazia é resposta legítima e não pode virar "assume o pedido".
+     */
+    private parseGrantedScopes;
     /** Absolute redirect URI the web flow registers/exchanges against (the API). */
     private buildApiRedirectUri;
     getAuthUrl(callbackPath: string, flow?: 'login' | 'register' | 'connect', app?: string): Promise<string>;

package/dist/oauth/providers/microsoft-entra-id.provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"microsoft-entra-id.provider.d.ts","sourceRoot":"","sources":["../../../src/oauth/providers/microsoft-entra-id.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,qBACa,wBAAyB,SAAQ,iBAAiB;IAM3D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAGlE,IAAI,EAAE,WAAW,EAEA,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa;IAKxC,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,gBAAgB;IASxB,eAAe;IAMf,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAwC;IAOjF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAsD;YAE/E,UAAU;IA+BxB,gFAAgF;IAChF,OAAO,CAAC,mBAAmB;IASrB,UAAU,CACd,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,EACvC,GAAG,CAAC,EAAE,MAAM;IAsCR,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;CAuDjF"}
+{"version":3,"file":"microsoft-entra-id.provider.d.ts","sourceRoot":"","sources":["../../../src/oauth/providers/microsoft-entra-id.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAG5C,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAExD,qBACa,wBAAyB,SAAQ,iBAAiB;IAM3D,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,MAAM;IANzB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA6C;gBAGlE,IAAI,EAAE,WAAW,EAEA,OAAO,EAAE,cAAc,EACvB,MAAM,EAAE,aAAa;IAKxC,OAAO,CAAC,gBAAgB;IAIxB,OAAO,CAAC,gBAAgB;IASxB,eAAe;IAMf,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,iBAAiB,CAAwC;IAOjF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAsD;YAE/E,UAAU;IA+BxB;;;;OAIG;IACH,OAAO,CAAC,kBAAkB;IAQ1B,gFAAgF;IAChF,OAAO,CAAC,mBAAmB;IASrB,UAAU,CACd,YAAY,EAAE,MAAM,EACpB,IAAI,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,EACvC,GAAG,CAAC,EAAE,MAAM;IAsCR,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;CA4EjF"}

package/dist/oauth/providers/microsoft-entra-id.provider.js

@@ -68,6 +68,19 @@ let MicrosoftEntraIdProvider = MicrosoftEntraIdProvider_1 = class MicrosoftEntra
             apiUrl: String((_c = settings['api-url']) !== null && _c !== void 0 ? _c : ''),
         };
     }
+    /**
+     * Escopos que a Microsoft devolveu no token, ou `null` quando ela não
+     * informou — só nesse caso vale cair de volta para os escopos pedidos.
+     * Uma lista vazia é resposta legítima e não pode virar "assume o pedido".
+     */
+    parseGrantedScopes(scope) {
+        if (typeof scope !== 'string')
+            return null;
+        return scope
+            .split(/[\s,]+/)
+            .map((item) => item.trim())
+            .filter(Boolean);
+    }
     /** Absolute redirect URI the web flow registers/exchanges against (the API). */
     buildApiRedirectUri(apiUrl) {
         if (!String(apiUrl).trim()) {
@@ -107,7 +120,7 @@ let MicrosoftEntraIdProvider = MicrosoftEntraIdProvider_1 = class MicrosoftEntra
         return `https://login.microsoftonline.com/${tenantId}/oauth2/v2.0/authorize?${params.toString()}`;
     }
     async getProfile(code, type, redirectUri) {
-        var _a, _b, _c, _d, _e;
+        var _a, _b, _c, _d, _e, _f;
         let resolvedRedirectUri = '';
         try {
             const { clientId, clientSecret, tenantId, baseUrl } = await this.loadConfig();
@@ -124,14 +137,27 @@ let MicrosoftEntraIdProvider = MicrosoftEntraIdProvider_1 = class MicrosoftEntra
                 redirectUri: resolvedRedirectUri,
             });
             const profile = await this.fetchProfile(token.access_token, 'https://graph.microsoft.com/v1.0/me');
-            this.logger.log(`OAuth profile fetched: provider=MICROSOFT-ENTRA-ID type=${type} profileIdPresent=${(profile === null || profile === void 0 ? void 0 : profile.id) ? 'yes' : 'no'} emailPresent=${(profile === null || profile === void 0 ? void 0 : profile.mail) || (profile === null || profile === void 0 ? void 0 : profile.userPrincipalName) ? 'yes' : 'no'}`);
+            // `token.scope` é o que a Microsoft de fato consentiu, que pode ser MENOS
+            // do que a setting pede — consentimento antigo do usuário, ou escopo novo
+            // ainda sem aprovação do admin. Gravar a setting como se fosse o concedido
+            // faz o refresh seguinte pedir escopo que o grant não cobre, e aí a
+            // resposta é `invalid_grant`: a UI diz "reconecte a conta", e reconectar
+            // pelo login regrava a mesma setting, então nunca sai do lugar.
+            const grantedScopes = (_c = this.parseGrantedScopes(token.scope)) !== null && _c !== void 0 ? _c : scopes;
+            // A Microsoft não repete `offline_access` em `token.scope`, mas ter
+            // devolvido um refresh token é prova de que foi concedido.
+            if (token.refresh_token && !grantedScopes.includes('offline_access')) {
+                grantedScopes.push('offline_access');
+            }
+            const missing = scopes.filter((scope) => !grantedScopes.includes(scope));
+            this.logger.log(`OAuth profile fetched: provider=MICROSOFT-ENTRA-ID type=${type} profileIdPresent=${(profile === null || profile === void 0 ? void 0 : profile.id) ? 'yes' : 'no'} emailPresent=${(profile === null || profile === void 0 ? void 0 : profile.mail) || (profile === null || profile === void 0 ? void 0 : profile.userPrincipalName) ? 'yes' : 'no'} scopesGranted=${grantedScopes.length}/${scopes.length}${missing.length ? ` missing=${missing.join(' ')}` : ''}`);
             const pictureUrl = 'https://graph.microsoft.com/v1.0/me/photo/$value';
             return {
                 id: profile.id,
                 email: profile.mail || profile.userPrincipalName,
                 name: profile.displayName,
                 picture: pictureUrl,
-                oauth_scopes: scopes.join(','),
+                oauth_scopes: grantedScopes.join(','),
                 oauth_tokens: {
                     access_token: token.access_token,
                     refresh_token: token.refresh_token,
@@ -141,8 +167,14 @@ let MicrosoftEntraIdProvider = MicrosoftEntraIdProvider_1 = class MicrosoftEntra
             };
         }
         catch (error) {
+            // O try acima cobre também o `loadConfig`, que sinaliza perfil ausente com
+            // uma HttpException — mapeá-la transformaria um 400 de configuração em um
+            // 503 de indisponibilidade.
+            if (error instanceof common_1.HttpException) {
+                throw error;
+            }
             const mappedError = this.mapProviderError('Microsoft Entra ID', error);
-            this.logger.warn(`OAuth callback failed: provider=MICROSOFT-ENTRA-ID status=${(_c = mappedError.status) !== null && _c !== void 0 ? _c : 'unknown'} error=${(_d = mappedError.providerError) !== null && _d !== void 0 ? _d : 'unknown'} providerCode=${(_e = mappedError.providerErrorCode) !== null && _e !== void 0 ? _e : 'n/a'} reason=${mappedError.reason} redirectUri=${resolvedRedirectUri || 'unresolved'}`);
+            this.logger.warn(`OAuth callback failed: provider=MICROSOFT-ENTRA-ID status=${(_d = mappedError.status) !== null && _d !== void 0 ? _d : 'unknown'} error=${(_e = mappedError.providerError) !== null && _e !== void 0 ? _e : 'unknown'} providerCode=${(_f = mappedError.providerErrorCode) !== null && _f !== void 0 ? _f : 'n/a'} reason=${mappedError.reason} redirectUri=${resolvedRedirectUri || 'unresolved'}`);
             throw mappedError;
         }
     }

package/dist/oauth/providers/microsoft-entra-id.provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"microsoft-entra-id.provider.js","sourceRoot":"","sources":["../../../src/oauth/providers/microsoft-entra-id.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,yCAA4C;AAC5C,2CAA6F;AAC7F,mGAAsG;AACtG,mEAA+D;AAC/D,2DAAwD;AAGjD,IAAM,wBAAwB,gCAA9B,MAAM,wBAAyB,SAAQ,qCAAiB;IAG7D,YACE,IAAiB,EAEjB,OAAwC,EACvB,MAAqB;QAEtC,KAAK,CAAC,IAAI,CAAC,CAAC;QAHK,YAAO,GAAP,OAAO,CAAgB;QACvB,WAAM,GAAN,MAAM,CAAe;QANvB,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IASpE,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAEO,gBAAgB,CAAC,OAAe,EAAE,YAAoB;QAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,sBAAsB,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;YACzD,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;QAEvB,OAAO,IAAI,GAAG,CAAC,sBAAsB,EAAE,GAAG,iBAAiB,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC;IAED,eAAe;QACb,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAaO,KAAK,CAAC,UAAU;;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACnD,qCAAqC;YACrC,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,QAAQ,CAAC,qCAAqC,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzF,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,4BAAmB,CAAC,kDAAkD,CAAC,CAAC;QAEpG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC;YAC/D,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAC5B,OAAO,EAAE,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAE3F,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAA,2DAA+B,EAC1E,OAAO,CAAC,oBAAoB,CAAC,IAAI,EACjC,OAAO,CAAC,MAAM,CACf,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,wDAAwD,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,QAAQ;YACR,YAAY;YACZ,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAA,QAAQ,CAAC,KAAK,CAAC,mCAAI,EAAE,CAAC;YACtC,MAAM,EAAE,MAAM,CAAC,MAAA,QAAQ,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED,gFAAgF;IACxE,mBAAmB,CAAC,MAAc;QACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAC3B,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,0BAAwB,CAAC,iBAAiB,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,UAAU,CACd,YAAoB,EACpB,IAAuC,EACvC,GAAY;;QAEZ,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC1F,MAAM,UAAU,GAAa,MAAA,QAAQ,CAAC,iCAAiC,CAAC,mCAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAClD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAEtC,gFAAgF;QAChF,+EAA+E;QAC/E,uDAAuD;QACvD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,IAAI,0BAAwB,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChF,MAAM,WAAW,GAAG,YAAY;YAC9B,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,YAAY;YAChC,CAAC,CAAC,IAAI,KAAK,SAAS;YACpB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qEAAqE,WAAW,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,gBAAgB,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,qBAAqB,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAChP,CAAC;QAEF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,qCAAqC,QAAQ,0BAA0B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,WAAoB;;QAC/D,IAAI,mBAAmB,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC;YAC1F,MAAM,MAAM,GAAa,MAAA,QAAQ,CAAC,iCAAiC,CAAC,mCAAI,EAAE,CAAC;YAC3E,mBAAmB;gBACjB,CAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,IAAI,EAAE,KAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;YAExF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,kEAAkE,IAAI,gBAAgB,mBAAmB,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,eAAe,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,CAAC,EAAE,CAC3K,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;gBAClC,IAAI;gBACJ,GAAG,EAAE,qCAAqC,QAAQ,oBAAoB;gBACtE,QAAQ;gBACR,YAAY;gBACZ,WAAW,EAAE,mBAAmB;aACjC,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC,KAAK,CAAC,YAAY,EAClB,qCAAqC,CACtC,CAAC;YAEF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,2DAA2D,IAAI,qBAAqB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,EAAE,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,MAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,iBAAiB,CAAA,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAC5L,CAAC;YAEF,MAAM,UAAU,GAAG,kDAAkD,CAAC;YACtE,OAAO;gBACL,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,iBAAiB;gBAChD,IAAI,EAAE,OAAO,CAAC,WAAW;gBACzB,OAAO,EAAE,UAAU;gBACnB,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;gBAC9B,YAAY,EAAE;oBACZ,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;YAEvE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6DAA6D,MAAA,WAAW,CAAC,MAAM,mCAAI,SAAS,UAAU,MAAA,WAAW,CAAC,aAAa,mCAAI,SAAS,iBAAiB,MAAA,WAAW,CAAC,iBAAiB,mCAAI,KAAK,WAAW,WAAW,CAAC,MAAM,gBAAgB,mBAAmB,IAAI,YAAY,EAAE,CACtR,CAAC;YAEF,MAAM,WAAW,CAAC;QACpB,CAAC;IACH,CAAC;;AAhLU,4DAAwB;AA6BnC,+EAA+E;AAC/E,wEAAwE;AAChD,0CAAiB,GAAG,oCAAoC,AAAvC,CAAwC;AAEjF,gFAAgF;AAChF,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,oFAAoF;AAC5D,wCAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,AAArD,CAAsD;mCAtClF,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC,CAAC,CAAA;qCADnC,mBAAW;QAES,gCAAc;QACf,0BAAa;GAP7B,wBAAwB,CAiLpC"}
+{"version":3,"file":"microsoft-entra-id.provider.js","sourceRoot":"","sources":["../../../src/oauth/providers/microsoft-entra-id.provider.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,yCAA4C;AAC5C,2CAA4G;AAC5G,mGAAsG;AACtG,mEAA+D;AAC/D,2DAAwD;AAGjD,IAAM,wBAAwB,gCAA9B,MAAM,wBAAyB,SAAQ,qCAAiB;IAG7D,YACE,IAAiB,EAEjB,OAAwC,EACvB,MAAqB;QAEtC,KAAK,CAAC,IAAI,CAAC,CAAC;QAHK,YAAO,GAAP,OAAO,CAAgB;QACvB,WAAM,GAAN,MAAM,CAAe;QANvB,WAAM,GAAG,IAAI,eAAM,CAAC,0BAAwB,CAAC,IAAI,CAAC,CAAC;IASpE,CAAC;IAEO,gBAAgB,CAAC,GAAW;QAClC,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAEO,gBAAgB,CAAC,OAAe,EAAE,YAAoB;QAC5D,MAAM,iBAAiB,GAAG,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzD,MAAM,sBAAsB,GAAG,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC;YACzD,CAAC,CAAC,YAAY;YACd,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC;QAEvB,OAAO,IAAI,GAAG,CAAC,sBAAsB,EAAE,GAAG,iBAAiB,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC7E,CAAC;IAED,eAAe;QACb,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAaO,KAAK,CAAC,UAAU;;QACtB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;YACnD,qCAAqC;YACrC,KAAK;YACL,SAAS;SACV,CAAC,CAAC;QACH,MAAM,WAAW,GAAG,MAAM,CAAC,MAAA,QAAQ,CAAC,qCAAqC,CAAC,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzF,IAAI,CAAC,WAAW;YAAE,MAAM,IAAI,4BAAmB,CAAC,kDAAkD,CAAC,CAAC;QAEpG,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,mBAAmB,CAAC,UAAU,CAAC;YAC/D,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;YAC5B,OAAO,EAAE,EAAE,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE;SAC9D,CAAC,CAAC;QACH,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAE3F,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,GAAG,IAAA,2DAA+B,EAC1E,OAAO,CAAC,oBAAoB,CAAC,IAAI,EACjC,OAAO,CAAC,MAAM,CACf,CAAC;QACF,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,4BAAmB,CAAC,wDAAwD,CAAC,CAAC;QAC1F,CAAC;QACD,OAAO;YACL,QAAQ;YACR,YAAY;YACZ,QAAQ;YACR,OAAO,EAAE,MAAM,CAAC,MAAA,QAAQ,CAAC,KAAK,CAAC,mCAAI,EAAE,CAAC;YACtC,MAAM,EAAE,MAAM,CAAC,MAAA,QAAQ,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACK,kBAAkB,CAAC,KAAc;QACvC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3C,OAAO,KAAK;aACT,KAAK,CAAC,QAAQ,CAAC;aACf,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,gFAAgF;IACxE,mBAAmB,CAAC,MAAc;QACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC3B,MAAM,IAAI,4BAAmB,CAC3B,+EAA+E,CAChF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,EAAE,0BAAwB,CAAC,iBAAiB,CAAC,CAAC;IACnF,CAAC;IAED,KAAK,CAAC,UAAU,CACd,YAAoB,EACpB,IAAuC,EACvC,GAAY;;QAEZ,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC1F,MAAM,UAAU,GAAa,MAAA,QAAQ,CAAC,iCAAiC,CAAC,mCAAI,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAClD,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,CAAC,GAAG,UAAU,EAAE,gBAAgB,CAAC,CAAC;QAEtC,gFAAgF;QAChF,+EAA+E;QAC/E,uDAAuD;QACvD,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,IAAI,0BAAwB,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChF,MAAM,WAAW,GAAG,YAAY;YAC9B,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC;YAClC,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACjD,MAAM,aAAa,GAAG,YAAY;YAChC,CAAC,CAAC,IAAI,KAAK,SAAS;YACpB,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,QAAQ;YACnB,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YACvB,aAAa,EAAE,OAAO;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,qEAAqE,WAAW,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,gBAAgB,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,qBAAqB,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAChP,CAAC;QAEF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;QAED,OAAO,qCAAqC,QAAQ,0BAA0B,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,IAAY,EAAE,IAAY,EAAE,WAAoB;;QAC/D,IAAI,mBAAmB,GAAG,EAAE,CAAC;QAE7B,IAAI,CAAC;YACH,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YAC9E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,iCAAiC,CAAC,CAAC,CAAC;YAC1F,MAAM,MAAM,GAAa,MAAA,QAAQ,CAAC,iCAAiC,CAAC,mCAAI,EAAE,CAAC;YAC3E,mBAAmB;gBACjB,CAAA,WAAW,aAAX,WAAW,uBAAX,WAAW,CAAE,IAAI,EAAE,KAAI,IAAI,CAAC,gBAAgB,CAAC,OAAO,EAAE,8BAA8B,CAAC,CAAC;YAExF,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,kEAAkE,IAAI,gBAAgB,mBAAmB,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,eAAe,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,MAAM,mCAAI,CAAC,EAAE,CAC3K,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC;gBAClC,IAAI;gBACJ,GAAG,EAAE,qCAAqC,QAAQ,oBAAoB;gBACtE,QAAQ;gBACR,YAAY;gBACZ,WAAW,EAAE,mBAAmB;aACjC,CAAC,CAAC;YAEH,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,YAAY,CACrC,KAAK,CAAC,YAAY,EAClB,qCAAqC,CACtC,CAAC;YAEF,0EAA0E;YAC1E,0EAA0E;YAC1E,2EAA2E;YAC3E,oEAAoE;YACpE,yEAAyE;YACzE,gEAAgE;YAChE,MAAM,aAAa,GAAG,MAAA,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,mCAAI,MAAM,CAAC;YACrE,oEAAoE;YACpE,2DAA2D;YAC3D,IAAI,KAAK,CAAC,aAAa,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;gBACrE,aAAa,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;YACvC,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;YAEzE,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,2DAA2D,IAAI,qBAAqB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,EAAE,EAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,iBAAiB,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI,MAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,iBAAiB,CAAA,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,kBAAkB,aAAa,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3S,CAAC;YAEF,MAAM,UAAU,GAAG,kDAAkD,CAAC;YACtE,OAAO;gBACL,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,KAAK,EAAE,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,iBAAiB;gBAChD,IAAI,EAAE,OAAO,CAAC,WAAW;gBACzB,OAAO,EAAE,UAAU;gBACnB,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;gBACrC,YAAY,EAAE;oBACZ,YAAY,EAAE,KAAK,CAAC,YAAY;oBAChC,aAAa,EAAE,KAAK,CAAC,aAAa;oBAClC,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC7B;aACF,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,2EAA2E;YAC3E,0EAA0E;YAC1E,4BAA4B;YAC5B,IAAI,KAAK,YAAY,sBAAa,EAAE,CAAC;gBACnC,MAAM,KAAK,CAAC;YACd,CAAC;YAED,MAAM,WAAW,GAAG,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,EAAE,KAAK,CAAC,CAAC;YAEvE,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6DAA6D,MAAA,WAAW,CAAC,MAAM,mCAAI,SAAS,UAAU,MAAA,WAAW,CAAC,aAAa,mCAAI,SAAS,iBAAiB,MAAA,WAAW,CAAC,iBAAiB,mCAAI,KAAK,WAAW,WAAW,CAAC,MAAM,gBAAgB,mBAAmB,IAAI,YAAY,EAAE,CACtR,CAAC;YAEF,MAAM,WAAW,CAAC;QACpB,CAAC;IACH,CAAC;;AAlNU,4DAAwB;AA6BnC,+EAA+E;AAC/E,wEAAwE;AAChD,0CAAiB,GAAG,oCAAoC,AAAvC,CAAwC;AAEjF,gFAAgF;AAChF,mFAAmF;AACnF,mFAAmF;AACnF,oFAAoF;AACpF,oFAAoF;AAC5D,wCAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,AAArD,CAAsD;mCAtClF,wBAAwB;IADpC,IAAA,mBAAU,GAAE;IAMR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC,CAAC,CAAA;qCADnC,mBAAW;QAES,gCAAc;QACf,0BAAa;GAP7B,wBAAwB,CAmNpC"}

package/dist/observability/monitored-cron.d.ts

@@ -13,22 +13,39 @@ export type MonitoredCronOptions = {
  * simultaneamente, o Sentry recebe 2×N check-ins por execução e estoura o
  * rate limit de 6/min por monitor (ver docs/sentry.md).
  *
- * A eleição e `work()` rodam na MESMA transação interativa — é o que faz o
- * `pg_try_advisory_xact_lock` valer como exclusão mútua de verdade. Uma
- * versão anterior comitava a eleição sozinha (fora de transação): o Postgres
- * liberava o lock no instante em que a query retornava, antes do trabalho
- * real começar, e pods suficientemente próximos no tempo (o que é comum,
- * já que o @Cron dispara no mesmo segundo em todos) "ganhavam" o mesmo tick
- * e mandavam check-ins duplicados — foi o que gerou o incidente do
- * sac-sla-sweep. `work()` deliberadamente NÃO recebe `tx` (continua fechando
- * sobre `this.prisma`/outros serviços do chamador): a conexão que segura o
- * lock fica ociosa (idle in transaction) durante o trabalho real, em vez de
- * segurar locks de linha por uma chamada HTTP potencialmente longa (ex.:
- * renovação de assinatura do Graph, até 10 min).
+ * A exclusão mútua é uma LEASE na tabela `cron_lock`, não um lock de banco.
+ * Já passamos por duas versões piores:
+ *
+ * 1. `pg_try_advisory_xact_lock` numa transação que comitava logo em seguida: o
+ *    Postgres liberava o lock no instante em que a query retornava, antes do
+ *    trabalho real começar, e pods próximos no tempo (o que é comum, já que o
+ *    @Cron dispara no mesmo segundo em todos) "ganhavam" o mesmo tick — foi o
+ *    que gerou o incidente do sac-sla-sweep.
+ * 2. O mesmo lock, mas com a transação segurada durante `work()` inteiro. A
+ *    exclusão passou a valer, ao custo de manter uma conexão do pool em
+ *    `idle in transaction` por até 10 minutos. Com PRISMA_CONNECTION_LIMIT=5 por
+ *    pod e cinco crons disputando (um deles de minuto em minuto), o pool
+ *    esgotava e o próprio cron morria em "Unable to start a transaction in the
+ *    given time" — o mecanismo de observabilidade consumindo o pool de que ele
+ *    precisava (Sentry API-1H).
+ *
+ * A lease resolve as duas: a eleição é uma statement só (conexão devolvida na
+ * hora, `work()` roda sem segurar nada) e a validade gravada em `locked_until`
+ * é o que mantém os outros pods fora até o dono terminar ou o prazo vencer.
+ *
+ * Trade-off assumido: se `work()` passar de `maxRuntimeMinutes` + 30s, a lease
+ * vence e outro pod pode iniciar uma execução concorrente. A versão anterior
+ * abortava a transação no timeout — nenhum dos dois é bom, mas este não leva o
+ * pool junto.
  *
  * Quando outro pod já ganhou o tick, resolve para `undefined` sem chamar
  * `work` — não é uma falha, é a mesma semântica de "outro worker já pegou o
  * job" que a fila customizada já usa.
+ *
+ * O check-in só é emitido para os slugs de `SENTRY_CRON_MONITOR_SLUGS` (ver
+ * `DEFAULT_CRON_MONITOR_SLUGS`): a cota do plano não cobre os cinco monitores, e
+ * check-in sem cota é descartado na entrada. Tudo o mais — lease, eleição, span,
+ * captura de exceção — é igual para todos os slugs.
  */
 export declare function runMonitoredCron<T>(prisma: any, options: MonitoredCronOptions, work: () => Promise<T>): Promise<T | undefined>;
 //# sourceMappingURL=monitored-cron.d.ts.map

package/dist/observability/monitored-cron.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"monitored-cron.d.ts","sourceRoot":"","sources":["../../src/observability/monitored-cron.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,oBAAoB,GAAG;IACjC,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAgCF;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAwCxB"}
+{"version":3,"file":"monitored-cron.d.ts","sourceRoot":"","sources":["../../src/observability/monitored-cron.ts"],"names":[],"mappings":"AAGA,MAAM,MAAM,oBAAoB,GAAG;IACjC,yCAAyC;IACzC,IAAI,EAAE,MAAM,CAAC;IACb,6DAA6D;IAC7D,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B,CAAC;AAqGF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,MAAM,EAAE,GAAG,EACX,OAAO,EAAE,oBAAoB,EAC7B,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GACrB,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CA6CxB"}