@hed-hog/core 0.0.399 → 0.0.401

package/dist/authorize/oauth-exception.filter.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+const authorize_errors_1 = require("./authorize.errors");
+/**
+ * Traduz o que sai dos endpoints OAuth para o formato do RFC 6749 §5.2:
+ * `{ error, error_description }`, sempre `no-store`.
+ *
+ * Existe porque o `HttpExceptionFilter` global quase serve, mas não nos dois
+ * casos que importam: ele acrescenta `statusCode`/`timestamp`/`path` ao corpo, e
+ * uma falha do `ValidationPipe` sai como `{ message: { campo: [...] } }`, que não
+ * é um erro OAuth e nenhum cliente sabe ler.
+ *
+ * O campo `message` é preservado de propósito — os cinco clientes já registrados
+ * leem ele nas respostas de erro de hoje.
+ */
+let OAuthExceptionFilter = class OAuthExceptionFilter {
+    catch(exception, host) {
+        var _a, _b;
+        const response = host.switchToHttp().getResponse();
+        const status = exception.getStatus();
+        const body = exception.getResponse();
+        response.setHeader('Cache-Control', 'no-store');
+        response.setHeader('Pragma', 'no-cache');
+        if (exception instanceof authorize_errors_1.OAuthError) {
+            response.status(status).json(Object.assign(Object.assign(Object.assign({ error: body.error, error_description: body.error_description }, (body.redirectable ? { redirectable: true } : {})), (body.issuer ? { issuer: body.issuer } : {})), { message: body.message }));
+            return;
+        }
+        // Falha de validação de DTO: vira invalid_request, com a mensagem original
+        // preservada para quem estiver depurando.
+        const description = typeof body === 'string'
+            ? body
+            : typeof (body === null || body === void 0 ? void 0 : body.message) === 'string'
+                ? body.message
+                : JSON.stringify((_a = body === null || body === void 0 ? void 0 : body.message) !== null && _a !== void 0 ? _a : 'Invalid request.');
+        response.status(status).json({
+            error: status === 400 ? 'invalid_request' : 'server_error',
+            error_description: description,
+            message: (_b = body === null || body === void 0 ? void 0 : body.message) !== null && _b !== void 0 ? _b : description,
+        });
+    }
+};
+exports.OAuthExceptionFilter = OAuthExceptionFilter;
+exports.OAuthExceptionFilter = OAuthExceptionFilter = __decorate([
+    (0, common_1.Catch)(common_1.HttpException)
+], OAuthExceptionFilter);
+//# sourceMappingURL=oauth-exception.filter.js.map

package/dist/authorize/oauth-exception.filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-exception.filter.js","sourceRoot":"","sources":["../../src/authorize/oauth-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAKwB;AAExB,yDAAgD;AAEhD;;;;;;;;;;;GAWG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,KAAK,CAAC,SAAwB,EAAE,IAAmB;;QACjD,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;QAC7D,MAAM,MAAM,GAAG,SAAS,CAAC,SAAS,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,SAAS,CAAC,WAAW,EAAS,CAAC;QAE5C,QAAQ,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;QAChD,QAAQ,CAAC,SAAS,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAEzC,IAAI,SAAS,YAAY,6BAAU,EAAE,CAAC;YACpC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,6CAC1B,KAAK,EAAE,IAAI,CAAC,KAAK,EACjB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IACtC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GACjD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,KAC/C,OAAO,EAAE,IAAI,CAAC,OAAO,IACrB,CAAC;YACH,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,0CAA0C;QAC1C,MAAM,WAAW,GACf,OAAO,IAAI,KAAK,QAAQ;YACtB,CAAC,CAAC,IAAI;YACN,CAAC,CAAC,OAAO,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,CAAA,KAAK,QAAQ;gBACjC,CAAC,CAAC,IAAI,CAAC,OAAO;gBACd,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,mCAAI,kBAAkB,CAAC,CAAC;QAE5D,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YAC3B,KAAK,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,cAAc;YAC1D,iBAAiB,EAAE,WAAW;YAC9B,OAAO,EAAE,MAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,OAAO,mCAAI,WAAW;SACtC,CAAC,CAAC;IACL,CAAC;CACF,CAAA;AAnCY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,cAAK,EAAC,sBAAa,CAAC;GACR,oBAAoB,CAmChC"}

package/dist/authorize/oauth-metadata.service.d.ts

@@ -0,0 +1,39 @@
+import { SettingService } from '../setting/setting.service';
+/**
+ * Escopo que confina um token ao /mcp.
+ *
+ * Mora aqui, e nao no modulo mcp, porque quem decide se uma concessao e de
+ * recurso e o fluxo de autorizacao — o guard do MCP so verifica o resultado.
+ */
+export declare const MCP_SCOPE = "mcp";
+/**
+ * Os identificadores canônicos do HedHog como OAuth provider.
+ *
+ * Existe como service, e não como constante, porque nada aqui é fixo: o mesmo
+ * código roda em produção, em dev e atrás de um túnel, e o `issuer` precisa
+ * casar exatamente com a origem de onde o cliente buscou os metadados (RFC 8414
+ * §3.3). Um valor compilado serviria a uma instalação só.
+ *
+ * `OAUTH_ISSUER` existe para o caso em que a API responde por um host diferente
+ * do que está na setting — um túnel de teste, tipicamente. Fora disso, a setting
+ * `api-url` é a fonte.
+ */
+export declare class OAuthMetadataService {
+    private readonly setting;
+    constructor(setting: SettingService);
+    /**
+     * Sem barra final, sempre. `https://host/` e `https://host` são URIs válidas e
+     * diferentes, e a comparação de `issuer` e de `resource` é feita por igualdade
+     * de string — normalizar aqui, uma vez, evita que os dois formatos circulem.
+     */
+    getIssuer(): Promise<string>;
+    /** O recurso protegido: o valor que o `aud` de um token de conector carrega. */
+    getMcpResource(): Promise<string>;
+    /** Onde a API recebe o authorization request e redireciona para o consent. */
+    getAuthorizationEndpoint(): Promise<string>;
+    getTokenEndpoint(): Promise<string>;
+    /** Base da tela de consent (o admin), que é onde o usuário aprova de fato. */
+    getConsentUiBase(): Promise<string>;
+    private stripTrailingSlash;
+}
+//# sourceMappingURL=oauth-metadata.service.d.ts.map

package/dist/authorize/oauth-metadata.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-metadata.service.d.ts","sourceRoot":"","sources":["../../src/authorize/oauth-metadata.service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAE5D;;;;;GAKG;AACH,eAAO,MAAM,SAAS,QAAQ,CAAC;AAE/B;;;;;;;;;;;GAWG;AACH,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAP,OAAO,EAAE,cAAc;IAG1C;;;;OAIG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;IAQlC,gFAAgF;IAC1E,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC;IAIvC,8EAA8E;IACxE,wBAAwB,IAAI,OAAO,CAAC,MAAM,CAAC;IAI3C,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAIzC,8EAA8E;IACxE,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;IAKzC,OAAO,CAAC,kBAAkB;CAG3B"}

package/dist/authorize/oauth-metadata.service.js

@@ -0,0 +1,81 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuthMetadataService = exports.MCP_SCOPE = void 0;
+const common_1 = require("@nestjs/common");
+const setting_service_1 = require("../setting/setting.service");
+/**
+ * Escopo que confina um token ao /mcp.
+ *
+ * Mora aqui, e nao no modulo mcp, porque quem decide se uma concessao e de
+ * recurso e o fluxo de autorizacao — o guard do MCP so verifica o resultado.
+ */
+exports.MCP_SCOPE = 'mcp';
+/**
+ * Os identificadores canônicos do HedHog como OAuth provider.
+ *
+ * Existe como service, e não como constante, porque nada aqui é fixo: o mesmo
+ * código roda em produção, em dev e atrás de um túnel, e o `issuer` precisa
+ * casar exatamente com a origem de onde o cliente buscou os metadados (RFC 8414
+ * §3.3). Um valor compilado serviria a uma instalação só.
+ *
+ * `OAUTH_ISSUER` existe para o caso em que a API responde por um host diferente
+ * do que está na setting — um túnel de teste, tipicamente. Fora disso, a setting
+ * `api-url` é a fonte.
+ */
+let OAuthMetadataService = class OAuthMetadataService {
+    constructor(setting) {
+        this.setting = setting;
+    }
+    /**
+     * Sem barra final, sempre. `https://host/` e `https://host` são URIs válidas e
+     * diferentes, e a comparação de `issuer` e de `resource` é feita por igualdade
+     * de string — normalizar aqui, uma vez, evita que os dois formatos circulem.
+     */
+    async getIssuer() {
+        var _a, _b;
+        const fromEnv = (_a = process.env.OAUTH_ISSUER) === null || _a === void 0 ? void 0 : _a.trim();
+        if (fromEnv)
+            return this.stripTrailingSlash(fromEnv);
+        const settings = await this.setting.getSettingValues(['api-url']);
+        return this.stripTrailingSlash(String((_b = settings['api-url']) !== null && _b !== void 0 ? _b : ''));
+    }
+    /** O recurso protegido: o valor que o `aud` de um token de conector carrega. */
+    async getMcpResource() {
+        return `${await this.getIssuer()}/mcp`;
+    }
+    /** Onde a API recebe o authorization request e redireciona para o consent. */
+    async getAuthorizationEndpoint() {
+        return `${await this.getIssuer()}/auth/authorize`;
+    }
+    async getTokenEndpoint() {
+        return `${await this.getIssuer()}/auth/token`;
+    }
+    /** Base da tela de consent (o admin), que é onde o usuário aprova de fato. */
+    async getConsentUiBase() {
+        var _a;
+        const settings = await this.setting.getSettingValues(['url']);
+        return this.stripTrailingSlash(String((_a = settings['url']) !== null && _a !== void 0 ? _a : ''));
+    }
+    stripTrailingSlash(value) {
+        return value.trim().replace(/\/+$/, '');
+    }
+};
+exports.OAuthMetadataService = OAuthMetadataService;
+exports.OAuthMetadataService = OAuthMetadataService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)((0, common_1.forwardRef)(() => setting_service_1.SettingService))),
+    __metadata("design:paramtypes", [setting_service_1.SettingService])
+], OAuthMetadataService);
+//# sourceMappingURL=oauth-metadata.service.js.map

package/dist/authorize/oauth-metadata.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-metadata.service.js","sourceRoot":"","sources":["../../src/authorize/oauth-metadata.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAgE;AAChE,gEAA4D;AAE5D;;;;;GAKG;AACU,QAAA,SAAS,GAAG,KAAK,CAAC;AAE/B;;;;;;;;;;;GAWG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAEmB,OAAuB;QAAvB,YAAO,GAAP,OAAO,CAAgB;IACvC,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,SAAS;;QACb,MAAM,OAAO,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,YAAY,0CAAE,IAAI,EAAE,CAAC;QACjD,IAAI,OAAO;YAAE,OAAO,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAErD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;QAClE,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAA,QAAQ,CAAC,SAAS,CAAC,mCAAI,EAAE,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,cAAc;QAClB,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC;IACzC,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,wBAAwB;QAC5B,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,iBAAiB,CAAC;IACpD,CAAC;IAED,KAAK,CAAC,gBAAgB;QACpB,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC;IAChD,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,gBAAgB;;QACpB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9D,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAA,QAAQ,CAAC,KAAK,CAAC,mCAAI,EAAE,CAAC,CAAC,CAAC;IAChE,CAAC;IAEO,kBAAkB,CAAC,KAAa;QACtC,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF,CAAA;AA1CY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,gCAAc,CAAC,CAAC,CAAA;qCACf,gCAAc;GAH/B,oBAAoB,CA0ChC"}

package/dist/authorize/well-known.controller.d.ts

@@ -0,0 +1,67 @@
+import { OAuthMetadataService } from './oauth-metadata.service';
+/**
+ * Descoberta OAuth: como um cliente que só conhece a URL do recurso chega até o
+ * authorization server.
+ *
+ * Servido na raiz do host da API. Não há `setGlobalPrefix` no `main.ts`, e o
+ * middleware de compatibilidade de lá só remove um `/api` *inicial* — então
+ * `/.well-known/...` chega aqui intacto.
+ *
+ * Os paths são todos literais de propósito: com Express 5 (path-to-regexp v8) uma
+ * rota curinga derruba o boot da aplicação.
+ *
+ * Não servimos `/.well-known/openid-configuration`: não somos OIDC. Não há
+ * `id_token` nem JWKS (a assinatura é HS256, com segredo simétrico), e anunciar
+ * OIDC faria clientes procurarem endpoints que não existem.
+ */
+export declare class WellKnownController {
+    private readonly metadata;
+    constructor(metadata: OAuthMetadataService);
+    /**
+     * RFC 9728. O par sem sufixo e o com `/mcp` devolvem o mesmo documento: a RFC
+     * manda inserir o path do recurso depois do `.well-known`, mas clientes
+     * divergem, e responder aos dois custa uma linha.
+     */
+    protectedResource(): Promise<{
+        resource: string;
+        authorization_servers: string[];
+        scopes_supported: string[];
+        bearer_methods_supported: string[];
+        resource_name: string;
+    }>;
+    protectedResourceMcp(): Promise<{
+        resource: string;
+        authorization_servers: string[];
+        scopes_supported: string[];
+        bearer_methods_supported: string[];
+        resource_name: string;
+    }>;
+    /** RFC 8414. */
+    authorizationServer(): Promise<{
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        scopes_supported: string[];
+        response_types_supported: string[];
+        response_modes_supported: string[];
+        grant_types_supported: string[];
+        token_endpoint_auth_methods_supported: string[];
+        code_challenge_methods_supported: string[];
+        authorization_response_iss_parameter_supported: boolean;
+    }>;
+    authorizationServerMcp(): Promise<{
+        issuer: string;
+        authorization_endpoint: string;
+        token_endpoint: string;
+        scopes_supported: string[];
+        response_types_supported: string[];
+        response_modes_supported: string[];
+        grant_types_supported: string[];
+        token_endpoint_auth_methods_supported: string[];
+        code_challenge_methods_supported: string[];
+        authorization_response_iss_parameter_supported: boolean;
+    }>;
+    private buildProtectedResource;
+    private buildAuthorizationServer;
+}
+//# sourceMappingURL=well-known.controller.d.ts.map

package/dist/authorize/well-known.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.controller.d.ts","sourceRoot":"","sources":["../../src/authorize/well-known.controller.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAEhE;;;;;;;;;;;;;;GAcG;AACH,qBAEa,mBAAmB;IAClB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,oBAAoB;IAE3D;;;;OAIG;IAGG,iBAAiB;;;;;;;IAMjB,oBAAoB;;;;;;;IAI1B,gBAAgB;IAGV,mBAAmB;;;;;;;;;;;;IAMnB,sBAAsB;;;;;;;;;;;;YAId,sBAAsB;YAetB,wBAAwB;CA0BvC"}

package/dist/authorize/well-known.controller.js

@@ -0,0 +1,126 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WellKnownController = void 0;
+const api_1 = require("@hed-hog/api");
+const common_1 = require("@nestjs/common");
+const oauth_metadata_service_1 = require("./oauth-metadata.service");
+/**
+ * Descoberta OAuth: como um cliente que só conhece a URL do recurso chega até o
+ * authorization server.
+ *
+ * Servido na raiz do host da API. Não há `setGlobalPrefix` no `main.ts`, e o
+ * middleware de compatibilidade de lá só remove um `/api` *inicial* — então
+ * `/.well-known/...` chega aqui intacto.
+ *
+ * Os paths são todos literais de propósito: com Express 5 (path-to-regexp v8) uma
+ * rota curinga derruba o boot da aplicação.
+ *
+ * Não servimos `/.well-known/openid-configuration`: não somos OIDC. Não há
+ * `id_token` nem JWKS (a assinatura é HS256, com segredo simétrico), e anunciar
+ * OIDC faria clientes procurarem endpoints que não existem.
+ */
+let WellKnownController = class WellKnownController {
+    constructor(metadata) {
+        this.metadata = metadata;
+    }
+    /**
+     * RFC 9728. O par sem sufixo e o com `/mcp` devolvem o mesmo documento: a RFC
+     * manda inserir o path do recurso depois do `.well-known`, mas clientes
+     * divergem, e responder aos dois custa uma linha.
+     */
+    async protectedResource() {
+        return this.buildProtectedResource();
+    }
+    async protectedResourceMcp() {
+        return this.buildProtectedResource();
+    }
+    /** RFC 8414. */
+    async authorizationServer() {
+        return this.buildAuthorizationServer();
+    }
+    async authorizationServerMcp() {
+        return this.buildAuthorizationServer();
+    }
+    async buildProtectedResource() {
+        const [issuer, resource] = await Promise.all([
+            this.metadata.getIssuer(),
+            this.metadata.getMcpResource(),
+        ]);
+        return {
+            resource,
+            authorization_servers: [issuer],
+            scopes_supported: ['mcp'],
+            bearer_methods_supported: ['header'],
+            resource_name: 'HedHog Hub MCP',
+        };
+    }
+    async buildAuthorizationServer() {
+        const [issuer, authorizationEndpoint, tokenEndpoint] = await Promise.all([
+            this.metadata.getIssuer(),
+            this.metadata.getAuthorizationEndpoint(),
+            this.metadata.getTokenEndpoint(),
+        ]);
+        return {
+            // RFC 8414 §3.3: o cliente compara este valor com a origem de onde buscou o
+            // documento. Uma barra final a mais reprova a validação inteira — por isso
+            // o OAuthMetadataService normaliza na entrada, e não aqui.
+            issuer,
+            authorization_endpoint: authorizationEndpoint,
+            token_endpoint: tokenEndpoint,
+            scopes_supported: ['mcp', 'profile', 'vaults'],
+            response_types_supported: ['code'],
+            response_modes_supported: ['query'],
+            grant_types_supported: ['authorization_code', 'refresh_token'],
+            // Só clientes públicos: `AuthorizeService.exchangeCode` recusa qualquer
+            // `client_type` diferente de 'public', e não existe client_secret no modelo.
+            token_endpoint_auth_methods_supported: ['none'],
+            // `plain` é rejeitado pelo serviço, então não anunciamos.
+            code_challenge_methods_supported: ['S256'],
+            authorization_response_iss_parameter_supported: true,
+        };
+    }
+};
+exports.WellKnownController = WellKnownController;
+__decorate([
+    (0, common_1.Get)('oauth-protected-resource'),
+    (0, common_1.Header)('Cache-Control', 'public, max-age=3600'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], WellKnownController.prototype, "protectedResource", null);
+__decorate([
+    (0, common_1.Get)('oauth-protected-resource/mcp'),
+    (0, common_1.Header)('Cache-Control', 'public, max-age=3600'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], WellKnownController.prototype, "protectedResourceMcp", null);
+__decorate([
+    (0, common_1.Get)('oauth-authorization-server'),
+    (0, common_1.Header)('Cache-Control', 'public, max-age=3600'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], WellKnownController.prototype, "authorizationServer", null);
+__decorate([
+    (0, common_1.Get)('oauth-authorization-server/mcp'),
+    (0, common_1.Header)('Cache-Control', 'public, max-age=3600'),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", []),
+    __metadata("design:returntype", Promise)
+], WellKnownController.prototype, "authorizationServerMcp", null);
+exports.WellKnownController = WellKnownController = __decorate([
+    (0, api_1.Public)(),
+    (0, common_1.Controller)('.well-known'),
+    __metadata("design:paramtypes", [oauth_metadata_service_1.OAuthMetadataService])
+], WellKnownController);
+//# sourceMappingURL=well-known.controller.js.map

package/dist/authorize/well-known.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"well-known.controller.js","sourceRoot":"","sources":["../../src/authorize/well-known.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAsC;AACtC,2CAAyD;AACzD,qEAAgE;AAEhE;;;;;;;;;;;;;;GAcG;AAGI,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAA6B,QAA8B;QAA9B,aAAQ,GAAR,QAAQ,CAAsB;IAAG,CAAC;IAE/D;;;;OAIG;IAGG,AAAN,KAAK,CAAC,iBAAiB;QACrB,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC;IACvC,CAAC;IAIK,AAAN,KAAK,CAAC,oBAAoB;QACxB,OAAO,IAAI,CAAC,sBAAsB,EAAE,CAAC;IACvC,CAAC;IAED,gBAAgB;IAGV,AAAN,KAAK,CAAC,mBAAmB;QACvB,OAAO,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACzC,CAAC;IAIK,AAAN,KAAK,CAAC,sBAAsB;QAC1B,OAAO,IAAI,CAAC,wBAAwB,EAAE,CAAC;IACzC,CAAC;IAEO,KAAK,CAAC,sBAAsB;QAClC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC3C,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;YACzB,IAAI,CAAC,QAAQ,CAAC,cAAc,EAAE;SAC/B,CAAC,CAAC;QAEH,OAAO;YACL,QAAQ;YACR,qBAAqB,EAAE,CAAC,MAAM,CAAC;YAC/B,gBAAgB,EAAE,CAAC,KAAK,CAAC;YACzB,wBAAwB,EAAE,CAAC,QAAQ,CAAC;YACpC,aAAa,EAAE,gBAAgB;SAChC,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,wBAAwB;QACpC,MAAM,CAAC,MAAM,EAAE,qBAAqB,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvE,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE;YACzB,IAAI,CAAC,QAAQ,CAAC,wBAAwB,EAAE;YACxC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,EAAE;SACjC,CAAC,CAAC;QAEH,OAAO;YACL,4EAA4E;YAC5E,2EAA2E;YAC3E,2DAA2D;YAC3D,MAAM;YACN,sBAAsB,EAAE,qBAAqB;YAC7C,cAAc,EAAE,aAAa;YAC7B,gBAAgB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC;YAC9C,wBAAwB,EAAE,CAAC,MAAM,CAAC;YAClC,wBAAwB,EAAE,CAAC,OAAO,CAAC;YACnC,qBAAqB,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YAC9D,wEAAwE;YACxE,6EAA6E;YAC7E,qCAAqC,EAAE,CAAC,MAAM,CAAC;YAC/C,0DAA0D;YAC1D,gCAAgC,EAAE,CAAC,MAAM,CAAC;YAC1C,8CAA8C,EAAE,IAAI;SACrD,CAAC;IACJ,CAAC;CACF,CAAA;AA1EY,kDAAmB;AAUxB;IAFL,IAAA,YAAG,EAAC,0BAA0B,CAAC;IAC/B,IAAA,eAAM,EAAC,eAAe,EAAE,sBAAsB,CAAC;;;;4DAG/C;AAIK;IAFL,IAAA,YAAG,EAAC,8BAA8B,CAAC;IACnC,IAAA,eAAM,EAAC,eAAe,EAAE,sBAAsB,CAAC;;;;+DAG/C;AAKK;IAFL,IAAA,YAAG,EAAC,4BAA4B,CAAC;IACjC,IAAA,eAAM,EAAC,eAAe,EAAE,sBAAsB,CAAC;;;;8DAG/C;AAIK;IAFL,IAAA,YAAG,EAAC,gCAAgC,CAAC;IACrC,IAAA,eAAM,EAAC,eAAe,EAAE,sBAAsB,CAAC;;;;iEAG/C;8BA/BU,mBAAmB;IAF/B,IAAA,YAAM,GAAE;IACR,IAAA,mBAAU,EAAC,aAAa,CAAC;qCAEe,6CAAoB;GADhD,mBAAmB,CA0E/B"}

package/dist/captcha/captcha.service.d.ts

@@ -6,6 +6,17 @@ export interface CaptchaPublicConfig {
     provider_slug: string | null;
     site_key: string | null;
 }
+/**
+ * Contexto da submissao que esta sendo verificada. Tudo opcional: uma superficie
+ * que ainda nao manda `action` continua passando, o que permite subir o backend
+ * antes do front sem derrubar quem esta com bundle antigo em cache.
+ */
+export interface CaptchaVerifyContext {
+    /** IP do visitante (X-Forwarded-For repassado pelo BFF), nao o IP do pod. */
+    remoteIp?: string | null;
+    /** `data-action` que a superficie manda no widget. */
+    expectedAction?: string | null;
+}
 /**
  * Server-side CAPTCHA verification shared by every public form in the platform.
  *
@@ -18,16 +29,35 @@ export declare class CaptchaService {
     /**
      * Verifies a token against the provider configured in an integration profile.
      * Throws `BadRequestException` when the challenge does not check out.
+     *
+     * The profile can be addressed by numeric id or by slug. Forms and channels
+     * hold a real FK (`captcha_integration_profile_id`), but a setting picked
+     * through the admin's entity-picker stores the profile *slug* — as
+     * `commerce-back-in-stock-captcha-profile-id` does. Accepting both keeps a
+     * profile chosen on screen from silently failing the challenge shut.
      */
-    verifyForProfile(integrationProfileId: number | null | undefined, token: string | null | undefined): Promise<void>;
+    verifyForProfile(integrationProfileRef: number | string | null | undefined, token: string | null | undefined, context?: CaptchaVerifyContext): Promise<void>;
     /** Verifies a token against an explicit provider and its credentials. */
-    verify(token: string, providerSlug: string, config: Record<string, string>): Promise<void>;
+    verify(token: string, providerSlug: string, config: Record<string, string>, context?: CaptchaVerifyContext): Promise<void>;
     /**
      * Public settings a front end needs to mount the widget. Only the site key is
      * returned - the secret never leaves the server.
      */
     getPublicConfig(integrationProfileId: number | null | undefined, enabled?: boolean): Promise<CaptchaPublicConfig>;
     static extractSiteKey(config: Record<string, unknown> | null): string | null;
+    /**
+     * Hostnames que o perfil aceita, em `config.hostnames` (separados por virgula).
+     * Vazio significa "nao confira" - todo perfil ja existente continua valendo.
+     */
+    static parseHostnames(config: Record<string, unknown> | null): Set<string>;
+    /**
+     * Chamada canonica de siteverify: manda o IP do visitante, tem timeout, e
+     * confere `action` e `hostname` alem do `success`.
+     *
+     * Toda falha - rede, HTTP nao-2xx, corpo que nao e JSON - vira falha de
+     * CAPTCHA. Deixar a excecao subir crua transformaria um solavanco do provedor em
+     * 500, e o visitante veria "erro do servidor" no lugar de "tente de novo".
+     */
     private verifyRemote;
     /**
      * Altcha is verified locally: the client solves a proof-of-work, and the HMAC

package/dist/captcha/captcha.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"captcha.service.d.ts","sourceRoot":"","sources":["../../src/captcha/captcha.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,eAAO,MAAM,iBAAiB,0DAIpB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAUD;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,aAAa;IAGxC;;;OAGG;IACG,gBAAgB,CACpB,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/C,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC/B,OAAO,CAAC,IAAI,CAAC;IA0BhB,yEAAyE;IACnE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,OAAO,CAAC,IAAI,CAAC;IAiChB;;;OAGG;IACG,eAAe,CACnB,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,UAAO,GACb,OAAO,CAAC,mBAAmB,CAAC;IAoB/B,MAAM,CAAC,cAAc,CACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GACrC,MAAM,GAAG,IAAI;YAMF,YAAY;IAc1B;;;OAGG;IACH,OAAO,CAAC,YAAY;CAsBrB"}
+{"version":3,"file":"captcha.service.d.ts","sourceRoot":"","sources":["../../src/captcha/captcha.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AASpD,eAAO,MAAM,iBAAiB,0DAIpB,CAAC;AAEX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAErE,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED;;;;GAIG;AACH,MAAM,WAAW,oBAAoB;IACnC,6EAA6E;IAC7E,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,sDAAsD;IACtD,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAChC;AAwBD;;;;;GAKG;AACH,qBACa,cAAc;IAGvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,aAAa;IAGxC;;;;;;;;;OASG;IACG,gBAAgB,CACpB,qBAAqB,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,EACzD,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC;IAqChB,yEAAyE;IACnE,MAAM,CACV,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,IAAI,CAAC;IAuChB;;;OAGG;IACG,eAAe,CACnB,oBAAoB,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/C,OAAO,UAAO,GACb,OAAO,CAAC,mBAAmB,CAAC;IAoB/B,MAAM,CAAC,cAAc,CACnB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GACrC,MAAM,GAAG,IAAI;IAMhB;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC;IAU1E;;;;;;;OAOG;YACW,YAAY;IA0D1B;;;OAGG;IACH,OAAO,CAAC,YAAY;CAsBrB"}

package/dist/captcha/captcha.service.js

@@ -22,6 +22,10 @@ exports.CAPTCHA_PROVIDERS = [
     'cloudflare-turnstile',
     'altcha',
 ];
+/** Teto do token aceito pelo siteverify; acima disso nem vale a viagem de rede. */
+const MAX_TOKEN_LENGTH = 2048;
+/** Timeout da chamada ao provedor: sem ele um provedor lento prende o request. */
+const SITEVERIFY_TIMEOUT_MS = 10000;
 /**
  * Server-side CAPTCHA verification shared by every public form in the platform.
  *
@@ -35,14 +39,26 @@ let CaptchaService = CaptchaService_1 = class CaptchaService {
     /**
      * Verifies a token against the provider configured in an integration profile.
      * Throws `BadRequestException` when the challenge does not check out.
+     *
+     * The profile can be addressed by numeric id or by slug. Forms and channels
+     * hold a real FK (`captcha_integration_profile_id`), but a setting picked
+     * through the admin's entity-picker stores the profile *slug* — as
+     * `commerce-back-in-stock-captcha-profile-id` does. Accepting both keeps a
+     * profile chosen on screen from silently failing the challenge shut.
      */
-    async verifyForProfile(integrationProfileId, token) {
+    async verifyForProfile(integrationProfileRef, token, context = {}) {
         var _a, _b;
-        if (!integrationProfileId) {
+        const ref = typeof integrationProfileRef === 'string'
+            ? integrationProfileRef.trim()
+            : integrationProfileRef;
+        // `'0'` is the legacy default of the settings named `...-profile-id`: it is
+        // nobody's id and nobody's slug.
+        if (!ref || ref === '0') {
             throw new common_1.BadRequestException('CAPTCHA is enabled but no integration profile is configured.');
         }
+        const numericId = typeof ref === 'number' ? ref : /^\d+$/.test(ref) ? Number(ref) : null;
         const profile = await this.prisma.integration_profile.findFirst({
-            where: { id: integrationProfileId },
+            where: numericId ? { id: numericId } : { slug: String(ref) },
             select: {
                 config: true,
                 integration_provider: { select: { slug: true } },
@@ -51,19 +67,22 @@ let CaptchaService = CaptchaService_1 = class CaptchaService {
         if (!profile) {
             throw new common_1.BadRequestException('CAPTCHA integration profile not found.');
         }
-        await this.verify(token !== null && token !== void 0 ? token : '', (_a = profile.integration_provider) === null || _a === void 0 ? void 0 : _a.slug, ((_b = profile.config) !== null && _b !== void 0 ? _b : {}));
+        await this.verify(token !== null && token !== void 0 ? token : '', (_a = profile.integration_provider) === null || _a === void 0 ? void 0 : _a.slug, ((_b = profile.config) !== null && _b !== void 0 ? _b : {}), context);
     }
     /** Verifies a token against an explicit provider and its credentials. */
-    async verify(token, providerSlug, config) {
+    async verify(token, providerSlug, config, context = {}) {
         if (!token) {
             throw new common_1.BadRequestException('CAPTCHA token is required.');
         }
+        if (token.length > MAX_TOKEN_LENGTH) {
+            throw new common_1.BadRequestException('CAPTCHA token is malformed.');
+        }
         switch (providerSlug) {
             case 'recaptcha':
-                await this.verifyRemote('https://www.google.com/recaptcha/api/siteverify', config.secret_key, token);
+                await this.verifyRemote('https://www.google.com/recaptcha/api/siteverify', config, token, context);
                 break;
             case 'cloudflare-turnstile':
-                await this.verifyRemote('https://challenges.cloudflare.com/turnstile/v0/siteverify', config.secret_key, token);
+                await this.verifyRemote('https://challenges.cloudflare.com/turnstile/v0/siteverify', config, token, context);
                 break;
             case 'altcha':
                 this.verifyAltcha(token, config);
@@ -101,11 +120,65 @@ let CaptchaService = CaptchaService_1 = class CaptchaService {
         const value = (_b = (_a = config.site_key) !== null && _a !== void 0 ? _a : config.sitekey) !== null && _b !== void 0 ? _b : config.public_key;
         return value ? String(value) : null;
     }
-    async verifyRemote(url, secret, token) {
-        const body = new URLSearchParams({ secret, response: token });
-        const response = await fetch(url, { method: 'POST', body });
-        const json = (await response.json());
-        if (!json.success) {
+    /**
+     * Hostnames que o perfil aceita, em `config.hostnames` (separados por virgula).
+     * Vazio significa "nao confira" - todo perfil ja existente continua valendo.
+     */
+    static parseHostnames(config) {
+        var _a;
+        const raw = (_a = config === null || config === void 0 ? void 0 : config.hostnames) !== null && _a !== void 0 ? _a : config === null || config === void 0 ? void 0 : config.allowed_hostnames;
+        return new Set(String(raw !== null && raw !== void 0 ? raw : '')
+            .split(',')
+            .map((hostname) => hostname.trim().toLowerCase())
+            .filter(Boolean));
+    }
+    /**
+     * Chamada canonica de siteverify: manda o IP do visitante, tem timeout, e
+     * confere `action` e `hostname` alem do `success`.
+     *
+     * Toda falha - rede, HTTP nao-2xx, corpo que nao e JSON - vira falha de
+     * CAPTCHA. Deixar a excecao subir crua transformaria um solavanco do provedor em
+     * 500, e o visitante veria "erro do servidor" no lugar de "tente de novo".
+     */
+    async verifyRemote(url, config, token, context) {
+        const body = new URLSearchParams({
+            secret: config.secret_key,
+            response: token,
+        });
+        if (context.remoteIp) {
+            body.set('remoteip', context.remoteIp);
+        }
+        let result;
+        try {
+            const response = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                signal: AbortSignal.timeout(SITEVERIFY_TIMEOUT_MS),
+                body,
+            });
+            if (!response.ok) {
+                throw new Error(`siteverify ${response.status}`);
+            }
+            result = (await response.json());
+        }
+        catch (_a) {
+            throw new common_1.BadRequestException('CAPTCHA validation failed.');
+        }
+        if (!(result === null || result === void 0 ? void 0 : result.success)) {
+            throw new common_1.BadRequestException('CAPTCHA validation failed.');
+        }
+        // As duas checagens abaixo so valem quando os dois lados informaram o campo:
+        // o reCAPTCHA v2 nao devolve `action`, e um perfil sem `hostnames` nao pediu
+        // conferencia de origem.
+        if (context.expectedAction &&
+            result.action &&
+            result.action !== context.expectedAction) {
+            throw new common_1.BadRequestException('CAPTCHA validation failed.');
+        }
+        const hostnames = CaptchaService_1.parseHostnames(config);
+        if (hostnames.size > 0 &&
+            result.hostname &&
+            !hostnames.has(result.hostname.toLowerCase())) {
             throw new common_1.BadRequestException('CAPTCHA validation failed.');
         }
     }

package/dist/captcha/captcha.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"captcha.service.js","sourceRoot":"","sources":["../../src/captcha/captcha.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,2CAKwB;AACxB,mCAAgD;AAEnC,QAAA,iBAAiB,GAAG;IAC/B,WAAW;IACX,sBAAsB;IACtB,QAAQ;CACA,CAAC;AAkBX;;;;;GAKG;AAEI,IAAM,cAAc,sBAApB,MAAM,cAAc;IACzB,YAEmB,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IACrC,CAAC;IAEJ;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CACpB,oBAA+C,EAC/C,KAAgC;;QAEhC,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,MAAM,IAAI,4BAAmB,CAC3B,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC;YACvE,KAAK,EAAE,EAAE,EAAE,EAAE,oBAAoB,EAAE;YACnC,MAAM,EAAE;gBACN,MAAM,EAAE,IAAI;gBACZ,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;aACjD;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CACf,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,EACX,MAAA,OAAO,CAAC,oBAAoB,0CAAE,IAAc,EAC5C,CAAC,MAAA,OAAO,CAAC,MAAM,mCAAI,EAAE,CAA2B,CACjD,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAM,CACV,KAAa,EACb,YAAoB,EACpB,MAA8B;QAE9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,WAAW;gBACd,MAAM,IAAI,CAAC,YAAY,CACrB,iDAAiD,EACjD,MAAM,CAAC,UAAU,EACjB,KAAK,CACN,CAAC;gBACF,MAAM;YAER,KAAK,sBAAsB;gBACzB,MAAM,IAAI,CAAC,YAAY,CACrB,2DAA2D,EAC3D,MAAM,CAAC,UAAU,EACjB,KAAK,CACN,CAAC;gBACF,MAAM;YAER,KAAK,QAAQ;gBACX,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM;YAER;gBACE,MAAM,IAAI,4BAAmB,CAC3B,iCAAiC,YAAY,GAAG,CACjD,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CACnB,oBAA+C,EAC/C,OAAO,GAAG,IAAI;;QAEd,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjE,CAAC;QAED,MAAM,OAAO,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC;YACvE,KAAK,EAAE,EAAE,EAAE,EAAE,oBAAoB,EAAE;YACnC,MAAM,EAAE;gBACN,MAAM,EAAE,IAAI;gBACZ,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;aACjD;SACF,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,oBAAoB,0CAAE,IAAI,mCAAI,IAAI;YAC1D,QAAQ,EAAE,gBAAc,CAAC,cAAc,CAAC,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CACnB,MAAsC;;QAEtC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,MAAA,MAAA,MAAM,CAAC,QAAQ,mCAAI,MAAM,CAAC,OAAO,mCAAI,MAAM,CAAC,UAAU,CAAC;QACrE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,GAAW,EACX,MAAc,EACd,KAAa;QAEb,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAyB,CAAC;QAE7D,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YAClB,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,KAAa,EAAE,MAA8B;QAChE,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;aAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;aAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,IAAI,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;aAC/C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;aACzB,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,IAAI,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;CACF,CAAA;AAxJY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAa,CAAC,CAAC,CAAA;qCACf,0BAAa;GAH7B,cAAc,CAwJ1B"}
+{"version":3,"file":"captcha.service.js","sourceRoot":"","sources":["../../src/captcha/captcha.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAoD;AACpD,2CAKwB;AACxB,mCAAgD;AAEnC,QAAA,iBAAiB,GAAG;IAC/B,WAAW;IACX,sBAAsB;IACtB,QAAQ;CACA,CAAC;AAsCX,mFAAmF;AACnF,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,kFAAkF;AAClF,MAAM,qBAAqB,GAAG,KAAM,CAAC;AAErC;;;;;GAKG;AAEI,IAAM,cAAc,sBAApB,MAAM,cAAc;IACzB,YAEmB,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IACrC,CAAC;IAEJ;;;;;;;;;OASG;IACH,KAAK,CAAC,gBAAgB,CACpB,qBAAyD,EACzD,KAAgC,EAChC,UAAgC,EAAE;;QAElC,MAAM,GAAG,GACP,OAAO,qBAAqB,KAAK,QAAQ;YACvC,CAAC,CAAC,qBAAqB,CAAC,IAAI,EAAE;YAC9B,CAAC,CAAC,qBAAqB,CAAC;QAE5B,4EAA4E;QAC5E,iCAAiC;QACjC,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,EAAE,CAAC;YACxB,MAAM,IAAI,4BAAmB,CAC3B,8DAA8D,CAC/D,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GACb,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAEzE,MAAM,OAAO,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC;YACvE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE;YAC5D,MAAM,EAAE;gBACN,MAAM,EAAE,IAAI;gBACZ,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;aACjD;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,4BAAmB,CAAC,wCAAwC,CAAC,CAAC;QAC1E,CAAC;QAED,MAAM,IAAI,CAAC,MAAM,CACf,KAAK,aAAL,KAAK,cAAL,KAAK,GAAI,EAAE,EACX,MAAA,OAAO,CAAC,oBAAoB,0CAAE,IAAc,EAC5C,CAAC,MAAA,OAAO,CAAC,MAAM,mCAAI,EAAE,CAA2B,EAChD,OAAO,CACR,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,KAAK,CAAC,MAAM,CACV,KAAa,EACb,YAAoB,EACpB,MAA8B,EAC9B,UAAgC,EAAE;QAElC,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,KAAK,CAAC,MAAM,GAAG,gBAAgB,EAAE,CAAC;YACpC,MAAM,IAAI,4BAAmB,CAAC,6BAA6B,CAAC,CAAC;QAC/D,CAAC;QAED,QAAQ,YAAY,EAAE,CAAC;YACrB,KAAK,WAAW;gBACd,MAAM,IAAI,CAAC,YAAY,CACrB,iDAAiD,EACjD,MAAM,EACN,KAAK,EACL,OAAO,CACR,CAAC;gBACF,MAAM;YAER,KAAK,sBAAsB;gBACzB,MAAM,IAAI,CAAC,YAAY,CACrB,2DAA2D,EAC3D,MAAM,EACN,KAAK,EACL,OAAO,CACR,CAAC;gBACF,MAAM;YAER,KAAK,QAAQ;gBACX,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACjC,MAAM;YAER;gBACE,MAAM,IAAI,4BAAmB,CAC3B,iCAAiC,YAAY,GAAG,CACjD,CAAC;QACN,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,eAAe,CACnB,oBAA+C,EAC/C,OAAO,GAAG,IAAI;;QAEd,IAAI,CAAC,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC;YACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QACjE,CAAC;QAED,MAAM,OAAO,GAAG,MAAO,IAAI,CAAC,MAAc,CAAC,mBAAmB,CAAC,SAAS,CAAC;YACvE,KAAK,EAAE,EAAE,EAAE,EAAE,oBAAoB,EAAE;YACnC,MAAM,EAAE;gBACN,MAAM,EAAE,IAAI;gBACZ,oBAAoB,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE;aACjD;SACF,CAAC,CAAC;QAEH,OAAO;YACL,OAAO,EAAE,IAAI;YACb,aAAa,EAAE,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,oBAAoB,0CAAE,IAAI,mCAAI,IAAI;YAC1D,QAAQ,EAAE,gBAAc,CAAC,cAAc,CAAC,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,IAAI,CAAC;SACjE,CAAC;IACJ,CAAC;IAED,MAAM,CAAC,cAAc,CACnB,MAAsC;;QAEtC,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,KAAK,GAAG,MAAA,MAAA,MAAM,CAAC,QAAQ,mCAAI,MAAM,CAAC,OAAO,mCAAI,MAAM,CAAC,UAAU,CAAC;QACrE,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,cAAc,CAAC,MAAsC;;QAC1D,MAAM,GAAG,GAAG,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,mCAAI,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,iBAAiB,CAAC;QAC3D,OAAO,IAAI,GAAG,CACZ,MAAM,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,EAAE,CAAC;aACd,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aAChD,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,YAAY,CACxB,GAAW,EACX,MAA8B,EAC9B,KAAa,EACb,OAA6B;QAE7B,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC,UAAU;YACzB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;YACrB,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,MAA0B,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;gBAChC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;gBAChE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,qBAAqB,CAAC;gBAClD,IAAI;aACL,CAAC,CAAC;YAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;gBACjB,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;YACnD,CAAC;YAED,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAuB,CAAC;QACzD,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,CAAA,EAAE,CAAC;YACrB,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,6EAA6E;QAC7E,6EAA6E;QAC7E,yBAAyB;QACzB,IACE,OAAO,CAAC,cAAc;YACtB,MAAM,CAAC,MAAM;YACb,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC,cAAc,EACxC,CAAC;YACD,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,SAAS,GAAG,gBAAc,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACxD,IACE,SAAS,CAAC,IAAI,GAAG,CAAC;YAClB,MAAM,CAAC,QAAQ;YACf,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,EAC7C,CAAC;YACD,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED;;;OAGG;IACK,YAAY,CAAC,KAAa,EAAE,MAA8B;QAChE,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACtE,CAAC;QAAC,WAAM,CAAC;YACP,MAAM,IAAI,4BAAmB,CAAC,+BAA+B,CAAC,CAAC;QACjE,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,CAAC;aAC9B,MAAM,CAAC,OAAO,CAAC,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;aAC7C,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,IAAI,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;QAED,MAAM,IAAI,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;aAC/C,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;aACzB,MAAM,CAAC,KAAK,CAAC,CAAC;QACjB,IAAI,IAAI,KAAK,OAAO,CAAC,SAAS,EAAE,CAAC;YAC/B,MAAM,IAAI,4BAAmB,CAAC,4BAA4B,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;CACF,CAAA;AAnPY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,IAAA,mBAAU,EAAC,GAAG,EAAE,CAAC,0BAAa,CAAC,CAAC,CAAA;qCACf,0BAAa;GAH7B,cAAc,CAmP1B"}