- Add CURLOPT_RESOLVE DNS bypass for db-nica.ru / file.db-nica.ru
- Add OAuth callback route with CSRF state validation
- Add /authorize endpoint to generate OAuth URL with state
- Add ABITUR special case: init empty module core without ZIP download
- Add token validation caching (150s) to reduce API calls
- Block PHP/PHTML/PHAR files inside ZIP before extraction
- Add VikonTokenRefresh middleware for auto token refresh
- Add vikon.refresh middleware alias to Kernel
Original vikon_core security.php validates tokens via:
POST db-nica.ru/oauth2/resource/token/introspect
Body: client_id=542&access_token=XXX
Our code was incorrectly using:
GET auth.db-nica.ru/api/profile_applicant/check_access_token
Header: Authorization: Bearer XXX
This was the WRONG endpoint — the profile check is for abitur forms,
not for the update system.
F4ilji