From 967db81d3c9dfe8fa7e82c51a4a709a2ca430f16 Mon Sep 17 00:00:00 2001
From: F4ilji <F4ilj@yandex.ru>
Date: Sat, 4 Jul 2026 13:54:56 +0500
Subject: [PATCH] fix(vikon): use correct token introspect endpoint for update
 system
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Original vikon_core security.php validates tokens via:
  POST db-nica.ru/oauth2/resource/token/introspect
  Body: client_id=542&access_token=XXX

Our code was incorrectly using:
  GET auth.db-nica.ru/api/profile_applicant/check_access_token
  Header: Authorization: Bearer XXX

This was the WRONG endpoint — the profile check is for abitur forms,
not for the update system.
---
 .../Providers/VikonServiceProvider.php                |  1 +
 .../VikonIntegration/Tasks/ValidateTokenTask.php      | 11 ++++++-----
 2 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/app/Containers/VikonIntegration/Providers/VikonServiceProvider.php b/app/Containers/VikonIntegration/Providers/VikonServiceProvider.php
index 5a8f75a..395b97f 100644
--- a/app/Containers/VikonIntegration/Providers/VikonServiceProvider.php
+++ b/app/Containers/VikonIntegration/Providers/VikonServiceProvider.php
@@ -28,6 +28,7 @@ class VikonServiceProvider extends ServiceProvider
 
         $this->app->singleton(ValidateTokenTask::class, fn ($app) => new ValidateTokenTask(
             http: $app->make(HttpTask::class),
+            clientId: config('vikon.client_id'),
         ));
 
         $this->app->singleton(RefreshTokenTask::class, fn ($app) => new RefreshTokenTask(
diff --git a/app/Containers/VikonIntegration/Tasks/ValidateTokenTask.php b/app/Containers/VikonIntegration/Tasks/ValidateTokenTask.php
index d1a211e..0696bc7 100644
--- a/app/Containers/VikonIntegration/Tasks/ValidateTokenTask.php
+++ b/app/Containers/VikonIntegration/Tasks/ValidateTokenTask.php
@@ -8,16 +8,17 @@ class ValidateTokenTask
 {
     public function __construct(
         private readonly HttpTask $http,
+        private readonly string $clientId,
     ) {}
 
     public function run(string $accessToken): bool
     {
         try {
-            $response = $this->http->getWithToken(
-                'api/profile_applicant/check_access_token',
-                $accessToken,
-                'auth'
-            );
+            $response = $this->http->post('oauth2/resource/token/introspect', [
+                'client_id'    => $this->clientId,
+                'access_token' => $accessToken,
+            ]);
+
             return $response->successful();
         } catch (\Throwable $e) {
             Log::warning('Vikon token validation failed', ['error' => $e->getMessage()]);