| PushedAuthorizationRequestProcessorDecorator | Enforces single-use of a pushed authorization request_uri (RFC 9126 §7.3) by decorating the authorization request processor. Once processing yields a terminal success — an authorization code or token has been minted — the request_uri is removed from storage so it cannot be replayed within its remaining time-to-live. Interactive continuations (login, consent, account selection) leave it in place so the user agent can re-enter the authorization endpoint with the same request_uri. |