Kind: Interface
Source: atloria-monorepo/apps/api/src/project/playground-oauth2.ts
The owner's OAuth2 declaration, overlaid onto the served spec.
Atloria's own spec builder emits exactly one security scheme — bearerAuth — because that is
all the source can honestly tell us: a @UseGuards(JwtAuthGuard) says a credential is
required, not which authorization server issues it, at which URL, under which client id, or
with what scope catalog. Inferring an OAuth2 configuration from source would mean guessing
those four things and redirecting readers somewhere wrong, so we do not.
Instead the owner declares it once, the same way apiExec.baseUrl is declared, and it is
overlaid at serve time — which also survives every regeneration of the spec.
Deliberately its own settings key rather than a field on apiExec: apiExec carries a
server-side secret (authHeaderValue) and is read by the agent executor. THIS block is
public by construction — every value in it is published in the spec the whole internet can
read — and toPublicOAuth2Scheme is what enforces that, dropping anything secret-shaped
rather than trusting the writer.
Properties
| Property | Type |
|---|---|
schemeId | string |
clientId | string |
authorizationUrl | string |
tokenUrl | string |
openIdConnectUrl | string |
scopes | Record<string, string> |
description | string |
Was this page helpful?