npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.21 → 2.0.0-dev.23 - Mend

emilsoftware-utilities 2.0.0-dev.21 → 2.0.0-dev.23

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (379) hide show

package/dist/accessi-module/Services/AuthService/AuthService.js CHANGED Viewed

@@ -55,24 +55,26 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 var AuthService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthService = void 0;
+exports.AuthService = exports.PASSWORD_LOGIN_DISABLED = void 0;
 const common_1 = require("@nestjs/common");
+const TwoFactorService_1 = require("../TwoFactorService/TwoFactorService");
 const jwt = __importStar(require("jsonwebtoken"));
 const Orm_1 = require("../../../Orm");
 const Utilities_1 = require("../../../Utilities");
 const StatoRegistrazione_1 = require("../../Dtos/StatoRegistrazione");
 const UserService_1 = require("../UserService/UserService");
-const PermissionService_1 = require("../PermissionService/PermissionService");
 const FiltriService_1 = require("../FiltriService/FiltriService");
 const authenticatedToken_1 = require("../../security/authenticatedToken");
 const passwordResetToken_1 = require("../../security/passwordResetToken");
 const Logger_1 = require("../../../Logger");
+/** Error code deliberately returned when a user is configured as SSO-only. */
+exports.PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';
 let AuthService = AuthService_1 = class AuthService {
-    constructor(userService, permissionService, filtriService, accessiOptions) {
+    constructor(userService, filtriService, accessiOptions, twoFactorService) {
         this.userService = userService;
-        this.permissionService = permissionService;
         this.filtriService = filtriService;
         this.accessiOptions = accessiOptions;
+        this.twoFactorService = twoFactorService;
         this.logger = new Logger_1.Logger(AuthService_1.name);
     }
     refreshPasswordExpiration(codiceUtente) {
@@ -96,6 +98,58 @@ let AuthService = AuthService_1 = class AuthService {
         const nodeEnv = ((_a = process.env.NODE_ENV) !== null && _a !== void 0 ? _a : "production").toLowerCase();
         return nodeEnv !== "production" || process.env.ACCESSI_ALLOW_MOCK_DEMO_USER === "true";
     }
+    /** Creates the normal internal JWT consumed by all existing Accessi guards. */
+    createAccessiToken(utente, methods = []) {
+        if (!(utente === null || utente === void 0 ? void 0 : utente.codiceUtente)) {
+            throw new Error('Impossibile creare un token senza un utente Accessi valido.');
+        }
+        if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp')) {
+            throw new common_1.UnauthorizedException('Verifica del codice di accesso richiesta.');
+        }
+        return {
+            expiresIn: this.accessiOptions.jwtOptions.expiresIn,
+            value: jwt.sign({ utente, typ: 'access', amr: methods }, (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions), {
+                expiresIn: this.accessiOptions.jwtOptions.expiresIn,
+            }),
+            type: 'Bearer',
+        };
+    }
+    /** Builds the standard login response for a user authenticated by any supported method. */
+    getLoginResultForUser(codiceUtente) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const users = yield this.userService.getUsers({ codiceUtente }, { includeExtensionFields: true, includeGrants: true });
+            const result = users[0];
+            if (!(result === null || result === void 0 ? void 0 : result.utente)) {
+                throw new Error('Utente Accessi non trovato.');
+            }
+            const current = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(current))
+                throw new common_1.UnauthorizedException('Utente non abilitato.');
+            result.utente = Object.assign(Object.assign({}, result.utente), current);
+            return {
+                utente: result.utente,
+                filtri: yield this.filtriService.getFiltriUser(codiceUtente),
+                userGrants: result.userGrants,
+                extensionFields: result.extensionFields,
+            };
+        });
+    }
+    /** Users without a row retain the historic password-login enabled default. */
+    isPasswordLoginEnabled(codiceUtente) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (((_a = this.accessiOptions.federatedAuthentication) === null || _a === void 0 ? void 0 : _a.enabled) !== true)
+                return true;
+            const rows = yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?', [codiceUtente]);
+            const policy = rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
+            return (policy === null || policy === void 0 ? void 0 : policy.passwordLoginEnabled) !== false && (policy === null || policy === void 0 ? void 0 : policy.passwordLoginEnabled) !== 0 && (policy === null || policy === void 0 ? void 0 : policy.passwordLoginEnabled) !== '0';
+        });
+    }
+    /**
+     * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.
+     * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.
+     * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.
+     */
     login(request) {
         return __awaiter(this, void 0, void 0, function* () {
             const mockDemoUserEnabled = this.isMockDemoUserEnabled();
@@ -107,9 +161,19 @@ let AuthService = AuthService_1 = class AuthService {
                 request.email.toLowerCase() === "admin") {
                 return this.getAdminUser();
             }
-            const utente = yield this.userService.getUserByEmail(request.email.toLowerCase());
-            if (!utente)
+            const utente = yield this.userService.getUserByEmail(request.email.trim().toLowerCase());
+            if (!utente) {
+                if (!request.password)
+                    return { passwordRequired: true };
                 throw new Error("Nome utente o password errata!");
+            }
+            const currentUser = yield this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);
+            if ((0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {
+                return { challenge: yield this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email.trim(), mode: 'passwordless' }) };
+            }
+            // The email-only step has the same response for unknown and ordinary local accounts.
+            if (!request.password)
+                return { passwordRequired: true };
             switch (utente.statoRegistrazione) {
                 case undefined:
                     throw new Error("Struttura dati compromessa: Stato Registrazione inesistente.");
@@ -122,32 +186,40 @@ let AuthService = AuthService_1 = class AuthService {
             if (utente.statoRegistrazione !== StatoRegistrazione_1.StatoRegistrazione.CONF) {
                 throw new Error(`Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`);
             }
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser))
+                throw new Error('Utente non abilitato');
+            if (!(yield this.isPasswordLoginEnabled(utente.codiceUtente))) {
+                throw new Error(exports.PASSWORD_LOGIN_DISABLED);
+            }
+            if (typeof request.password !== 'string' || request.password.length === 0) {
+                throw new Error('Nome utente o password errata!');
+            }
             const isPasswordValid = yield this.verifyPassword(utente.codiceUtente, request.password);
             if (!isPasswordValid)
                 throw new Error("Nome utente o password errata!");
             if (this.accessiOptions.passwordExpiration &&
                 this.accessiOptions.passwordExpiration == true) {
                 const today = new Date();
-                const targetDate = new Date(utente.dataScadenzaPassword);
-                if (today >= targetDate) {
+                const targetDate = utente.dataScadenzaPassword
+                    ? new Date(utente.dataScadenzaPassword)
+                    : undefined;
+                // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.
+                if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {
                     throw new Error("PASSWORD_EXPIRED");
                 }
             }
-            const userGrants = yield this.permissionService.getUserRolesAndGrants(utente.codiceUtente);
-            const filtri = yield this.filtriService.getFiltriUser(utente.codiceUtente);
+            if (currentUser.flagDueFattori) {
+                return { challenge: yield this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email, mode: 'password' }) };
+            }
             const updateLastAccessDateQuery = "UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?";
             yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, updateLastAccessDateQuery, [utente.codiceUtente]);
-            const extensionFields = {};
-            if (this.accessiOptions.extensionFieldsOptions &&
-                this.accessiOptions.extensionFieldsOptions.length > 0) {
-                for (const ext of this.accessiOptions.extensionFieldsOptions) {
-                    const values = (yield Orm_1.Orm.query(ext.databaseOptions, `SELECT ${ext.tableFields.join(",")} FROM ${ext.tableName} WHERE ${ext.tableJoinFieldName} = ?`, [utente.codiceUtente])).map(Utilities_1.RestUtilities.convertKeysToCamelCase);
-                    extensionFields[ext.objectKey] = values;
-                }
-            }
-            return { utente, filtri, userGrants, extensionFields };
+            return this.getLoginResultForUser(utente.codiceUtente);
         });
     }
+    /**
+     * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.
+     * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.
+     */
     getAuthenticatedTokenPayload(token) {
         return __awaiter(this, void 0, void 0, function* () {
             if (typeof token !== "string" || token.trim() === "") {
@@ -160,12 +232,61 @@ let AuthService = AuthService_1 = class AuthService {
                 throw new Error("Token non valido.");
             }
             const currentUser = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
-            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+            if (!currentUser || !(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(decoded, currentUser)) {
                 throw new Error("Token non valido o utente non autorizzato.");
             }
             return (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(decoded, currentUser);
         });
     }
+    /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */
+    beginFederatedTwoFactor(codiceUtente, identityKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(user) || !user.flagDueFattori)
+                throw new common_1.UnauthorizedException();
+            return { challenge: yield this.twoFactorService.issue({ codiceUtente, email: user.email, mode: 'federated', identityKey }) };
+        });
+    }
+    validateTwoFactorProof(proof) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const user = yield this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(user) || !user.flagDueFattori || ((_a = user.email) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase()) !== proof.email.trim().toLowerCase()) {
+                throw new common_1.UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');
+            }
+            if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled)
+                throw new common_1.UnauthorizedException('Accesso senza password disabilitato.');
+            if (proof.mode === 'password' && !(yield this.isPasswordLoginEnabled(proof.codiceUtente)))
+                throw new common_1.UnauthorizedException('Login locale disabilitato.');
+            if (proof.mode === 'federated') {
+                if (!((_b = this.accessiOptions.federatedAuthentication) === null || _b === void 0 ? void 0 : _b.enabled))
+                    throw new common_1.UnauthorizedException();
+                const rows = yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, 'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1', [proof.identityKey, proof.codiceUtente], false);
+                if (!rows.length)
+                    throw new common_1.UnauthorizedException('Identita SSO non piu abilitata.');
+            }
+        });
+    }
+    verifyTwoFactor(challengeId, code) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const proof = yield this.twoFactorService.consume(challengeId, code);
+            yield this.validateTwoFactorProof(proof);
+            const result = yield this.getLoginResultForUser(proof.codiceUtente);
+            result.token = this.createAccessiToken(result.utente, [proof.mode, 'otp']);
+            yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);
+            if (proof.mode === 'federated') {
+                yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);
+            }
+            return result;
+        });
+    }
+    resendTwoFactor(challengeId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.validateTwoFactorProof(yield this.twoFactorService.describe(challengeId));
+            return { challenge: yield this.twoFactorService.resend(challengeId) };
+        });
+    }
+    /** Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email. */
     setPassword(codiceUtente, nuovaPassword) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
@@ -183,6 +304,10 @@ let AuthService = AuthService_1 = class AuthService {
             }
         });
     }
+    /**
+     * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.
+     * E idempotente: hash moderni e gia migrati vengono ignorati.
+     */
     migrateLegacyEncryptedPasswords() {
         return __awaiter(this, void 0, void 0, function* () {
             const startedAt = performance.now();
@@ -208,6 +333,7 @@ let AuthService = AuthService_1 = class AuthService {
             this.logger.info(`Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`);
         });
     }
+    /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */
     verifyPassword(codiceUtente, plainPassword) {
         return __awaiter(this, void 0, void 0, function* () {
             const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;
@@ -234,6 +360,7 @@ let AuthService = AuthService_1 = class AuthService {
             return isLegacyPasswordValid;
         });
     }
+    /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */
     getAdminUser() {
         return __awaiter(this, void 0, void 0, function* () {
             return {
@@ -262,6 +389,7 @@ let AuthService = AuthService_1 = class AuthService {
             };
         });
     }
+    /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */
     getDemoUser() {
         return {
             utente: {
@@ -288,8 +416,13 @@ let AuthService = AuthService_1 = class AuthService {
             },
         };
     }
+    /**
+     * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.
+     * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.
+     */
     confirmResetPassword(token, newPassword) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             try {
                 if (typeof token !== "string" || token.trim() === "") {
                     throw new Error("Token non valido.");
@@ -301,17 +434,37 @@ let AuthService = AuthService_1 = class AuthService {
                 }
                 const secret = (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions);
                 const { codiceUtente, nonce } = (0, passwordResetToken_1.verifyPasswordResetToken)(token.trim(), secret);
-                const result = (yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, "SELECT CODUTE AS codice_utente, STAREG AS stato_registrazione FROM UTENTI WHERE CODUTE = ? AND KEYREG = ?", [codiceUtente, nonce]).then((rows) => rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)));
-                if (result.length === 0) {
-                    throw new Error("Token non valido o gia usato.");
+                const hashedPassword = Utilities_1.PasswordUtilities.hashPassword(newPassword);
+                const db = yield Orm_1.Orm.connect(this.accessiOptions.databaseOptions);
+                let transaction;
+                try {
+                    transaction = yield Orm_1.Orm.startTransaction(db);
+                    const query = (sql, params) => new Promise((resolve, reject) => {
+                        transaction.query(sql, params, (error, result) => error ? reject(error) : resolve(result));
+                    });
+                    // A conditional write claims the nonce under the database row lock. A second
+                    // concurrent reset cannot also consume it; failures roll the whole reset back.
+                    const claimed = yield query('UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE', [StatoRegistrazione_1.StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione_1.StatoRegistrazione.CONF, StatoRegistrazione_1.StatoRegistrazione.INVIO]);
+                    const row = Array.isArray(claimed) ? claimed[0] : claimed;
+                    if (Number((_a = row === null || row === void 0 ? void 0 : row.CODUTE) !== null && _a !== void 0 ? _a : row === null || row === void 0 ? void 0 : row.codute) !== codiceUtente) {
+                        throw new Error('Token non valido, gia usato o utente non autorizzato.');
+                    }
+                    yield query('UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)', [codiceUtente, hashedPassword]);
+                    if (this.accessiOptions.passwordExpiration) {
+                        const days = Number(this.accessiOptions.passwordExpirationDays);
+                        const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;
+                        yield query(`UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`, [codiceUtente]);
+                    }
+                    yield Orm_1.Orm.commitTransaction(transaction);
+                }
+                catch (error) {
+                    if (transaction)
+                        yield Orm_1.Orm.rollbackTransaction(transaction).catch(() => undefined);
+                    throw error;
                 }
-                const currentState = Number(result[0].statoRegistrazione);
-                if (currentState === StatoRegistrazione_1.StatoRegistrazione.BLOCC ||
-                    currentState === StatoRegistrazione_1.StatoRegistrazione.DELETE) {
-                    throw new Error("Utente non autorizzato a completare il reset password.");
+                finally {
+                    yield new Promise((resolve) => db.detach(() => resolve()));
                 }
-                yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, "UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ?", [StatoRegistrazione_1.StatoRegistrazione.CONF, codiceUtente]);
-                yield this.setPassword(codiceUtente, newPassword);
             }
             catch (error) {
                 throw error;
@@ -322,9 +475,8 @@ let AuthService = AuthService_1 = class AuthService {
 exports.AuthService = AuthService;
 exports.AuthService = AuthService = AuthService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __param(3, (0, common_1.Inject)("ACCESSI_OPTIONS")),
+    __param(2, (0, common_1.Inject)("ACCESSI_OPTIONS")),
     __metadata("design:paramtypes", [UserService_1.UserService,
-        PermissionService_1.PermissionService,
-        FiltriService_1.FiltriService, Object])
+        FiltriService_1.FiltriService, Object, TwoFactorService_1.TwoFactorService])
 ], AuthService);
 //# sourceMappingURL=AuthService.js.map

package/dist/accessi-module/Services/AuthService/AuthService.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AuthService/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,sEAAmE;AACnE,4DAAyD;AACzD,8EAA2E;AAC3E,kEAA+D;AAC/D,0EAI2C;AAC3C,0EAG2C;AAC3C,4CAAyC;AAGlC,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,iBAAoC,EACpC,aAA4B,EACT,cAA+C;QAHlE,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QAN3D,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM,CAAC;IACzF,CAAC;IAEK,KAAK,CAAC,OAAqB;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAC5B,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAE/D,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAEzD,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CACnE,MAAM,CAAC,YAAY,CACpB,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAE3E,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,MAAM,eAAe,GAAG,EAAE,CAAC;YAE3B,IACE,IAAI,CAAC,cAAc,CAAC,sBAAsB;gBAC1C,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EACrD,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,sBAAsB,EAAE,CAAC;oBAC7D,MAAM,MAAM,GAAG,CACb,MAAM,SAAG,CAAC,KAAK,CACb,GAAG,CAAC,eAAe,EACnB,UAAU,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,SAAS,UACvD,GAAG,CAAC,kBACN,MAAM,EACN,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CACF,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC;oBAE5C,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;QACzD,CAAC;KAAA;IAEY,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAElE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,CAAC;KAAA;IAEY,WAAW,CAAC,YAAoB,EAAE,aAAqB;;YAClE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAEY,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAEK,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAE1C,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;gBACtD,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,cAAc,KAAK,uBAAuB,CAAC;YAEzE,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAEK,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,aAAa,EAAE,OAAO;oBACtB,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAEY,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IACE,OAAO,WAAW,KAAK,QAAQ;oBAC/B,WAAW,CAAC,MAAM,GAAG,CAAC;oBACtB,WAAW,CAAC,MAAM,GAAG,GAAG,EACxB,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBACxD,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,2GAA2G,EAC3G,CAAC,YAAY,EAAE,KAAK,CAAC,CACtB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAG7D,CAAC;gBAEJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC1D,IACE,YAAY,KAAK,uCAAkB,CAAC,KAAK;oBACzC,YAAY,KAAK,uCAAkB,CAAC,MAAM,EAC1C,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,8DAA8D,EAC9D,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,CAAC,CACxC,CAAC;gBAEF,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAlXY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAHL,yBAAW;QACL,qCAAiB;QACrB,6BAAa;GAN3B,WAAW,CAkXvB","sourcesContent":["import { Inject, Injectable } from \"@nestjs/common\";\nimport * as jwt from \"jsonwebtoken\";\nimport { Orm } from \"../../../Orm\";\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\nimport { AccessiOptions } from \"../../AccessiModule\";\nimport { LoginRequest } from \"../../Dtos/LoginRequest\";\nimport { LoginResult } from \"../../Dtos/LoginResponse\";\nimport { StatoRegistrazione } from \"../../Dtos/StatoRegistrazione\";\nimport { UserService } from \"../UserService/UserService\";\nimport { PermissionService } from \"../PermissionService/PermissionService\";\nimport { FiltriService } from \"../FiltriService/FiltriService\";\nimport {\n buildAuthenticatedTokenPayload,\n isAuthenticatedUserEnabledForJwt,\n resolveCodiceUtenteFromTokenPayload,\n} from \"../../security/authenticatedToken\";\nimport {\n getAccessiJwtSecret,\n verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport { Logger } from \"../../../Logger\";\n\n@Injectable()\nexport class AuthService {\n private readonly logger = new Logger(AuthService.name);\n\n constructor(\n private userService: UserService,\n private permissionService: PermissionService,\n private filtriService: FiltriService,\n @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions\n ) {}\n\n private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\n if (!this.accessiOptions.passwordExpiration) {\n return;\n }\n\n const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\n const expirationDays =\n Number.isFinite(configuredDays) && configuredDays > 0\n ? Math.trunc(configuredDays)\n : 90;\n\n const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\n await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n }\n\n private isMockDemoUserEnabled(): boolean {\n if (!this.accessiOptions.mockDemoUser) {\n return false;\n }\n\n const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\n return nodeEnv !== \"production\" \|\| process.env.ACCESSI_ALLOW_MOCK_DEMO_USER === \"true\";\n }\n\n async login(request: LoginRequest): Promise<LoginResult> {\n const mockDemoUserEnabled = this.isMockDemoUserEnabled();\n\n if (\n mockDemoUserEnabled &&\n request.email.toLowerCase() === \"demo\"\n ) {\n return this.getDemoUser();\n }\n\n if (\n mockDemoUserEnabled &&\n request.email.toLowerCase() === \"admin\"\n ) {\n return this.getAdminUser();\n }\n\n const utente = await this.userService.getUserByEmail(\n request.email.toLowerCase()\n );\n if (!utente) throw new Error(\"Nome utente o password errata!\");\n\n switch (utente.statoRegistrazione) {\n case undefined:\n throw new Error(\n \"Struttura dati compromessa: Stato Registrazione inesistente.\"\n );\n case StatoRegistrazione.BLOCC:\n case StatoRegistrazione.DELETE:\n throw new Error(\"Utente non abilitato\");\n case StatoRegistrazione.INVIO:\n throw new Error(\"Rinnovo password necessario.\");\n }\n\n if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\n throw new Error(\n `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\n );\n }\n\n const isPasswordValid = await this.verifyPassword(\n utente.codiceUtente,\n request.password\n );\n if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\n\n if (\n this.accessiOptions.passwordExpiration &&\n this.accessiOptions.passwordExpiration == true\n ) {\n const today = new Date();\n const targetDate = new Date(utente.dataScadenzaPassword);\n\n if (today >= targetDate) {\n throw new Error(\"PASSWORD_EXPIRED\");\n }\n }\n\n const userGrants = await this.permissionService.getUserRolesAndGrants(\n utente.codiceUtente\n );\n\n const filtri = await this.filtriService.getFiltriUser(utente.codiceUtente);\n\n const updateLastAccessDateQuery =\n \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\n await Orm.query(\n this.accessiOptions.databaseOptions,\n updateLastAccessDateQuery,\n [utente.codiceUtente]\n );\n\n const extensionFields = {};\n\n if (\n this.accessiOptions.extensionFieldsOptions &&\n this.accessiOptions.extensionFieldsOptions.length > 0\n ) {\n for (const ext of this.accessiOptions.extensionFieldsOptions) {\n const values = (\n await Orm.query(\n ext.databaseOptions,\n `SELECT ${ext.tableFields.join(\",\")} FROM ${ext.tableName} WHERE ${\n ext.tableJoinFieldName\n } = ?`,\n [utente.codiceUtente]\n )\n ).map(RestUtilities.convertKeysToCamelCase);\n\n extensionFields[ext.objectKey] = values;\n }\n }\n\n return { utente, filtri, userGrants, extensionFields };\n }\n\n public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\n if (typeof token !== \"string\" \|\| token.trim() === \"\") {\n throw new Error(\"Token non fornito.\");\n }\n\n const secret = getAccessiJwtSecret(this.accessiOptions);\n const decoded = jwt.verify(token.trim(), secret);\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n\n if (!codiceUtente) {\n throw new Error(\"Token non valido.\");\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\n throw new Error(\"Token non valido o utente non autorizzato.\");\n }\n\n return buildAuthenticatedTokenPayload(decoded, currentUser);\n }\n\n public async setPassword(codiceUtente: number, nuovaPassword: string) {\n try {\n const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\n const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\n\n const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\n codiceUtente,\n hashedPassword,\n ]);\n await this.refreshPasswordExpiration(codiceUtente);\n return result;\n } catch (error) {\n throw error;\n }\n }\n\n public async migrateLegacyEncryptedPasswords(): Promise<void> {\n const startedAt = performance.now();\n this.logger.info(\"Avvio migrazione password legacy accessi.\");\n const results = await Orm.query(\n this.accessiOptions.databaseOptions,\n \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n []\n );\n\n const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\n codiceUtente?: number;\n password?: string;\n }[];\n let migratedCount = 0;\n let skippedCount = 0;\n\n for (const row of rows) {\n const codiceUtente = Number(row.codiceUtente);\n const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\n if (\n !codiceUtente \|\|\n !storedPassword \|\|\n PasswordUtilities.isPasswordHash(storedPassword) \|\|\n PasswordUtilities.isLegacyPasswordHash(storedPassword)\n ) {\n skippedCount += 1;\n continue;\n }\n\n const protectedLegacyPassword =\n PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\n\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n [protectedLegacyPassword, codiceUtente, storedPassword]\n );\n migratedCount += 1;\n }\n\n this.logger.info(\n `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n );\n }\n\n async verifyPassword(\n codiceUtente: number,\n plainPassword: string\n ): Promise<boolean> {\n const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\n const result = (await Orm.query(\n this.accessiOptions.databaseOptions,\n query,\n [codiceUtente]\n ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\n password: string;\n }[];\n\n if (result.length === 0 \|\| typeof result[0].password !== \"string\") {\n return false;\n }\n\n const storedPassword = result[0].password;\n\n if (PasswordUtilities.isPasswordHash(storedPassword)) {\n return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\n }\n\n const legacyEncryptedPassword = CryptUtilities.encrypt(\n plainPassword,\n this.accessiOptions.encryptionKey\n );\n\n if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\n const isMigratedLegacyPasswordValid =\n PasswordUtilities.verifyLegacyEncryptedPassword(\n legacyEncryptedPassword,\n storedPassword\n );\n\n if (isMigratedLegacyPasswordValid) {\n await this.setPassword(codiceUtente, plainPassword);\n }\n\n return isMigratedLegacyPasswordValid;\n }\n\n const isLegacyPasswordValid = storedPassword === legacyEncryptedPassword;\n\n if (isLegacyPasswordValid) {\n await this.setPassword(codiceUtente, plainPassword);\n }\n\n return isLegacyPasswordValid;\n }\n\n async getAdminUser(): Promise<LoginResult> {\n return {\n utente: {\n codiceUtente: 6789,\n email: \"admin\",\n statoRegistrazione: StatoRegistrazione.CONF,\n cognome: \"Admin\",\n nome: \"Admin\",\n flagGdpr: true,\n avatar: \"/path/to/avatar.jpg\",\n flagDueFattori: false,\n codiceLingua: \"IT\",\n cellulare: \"+391234567890\",\n flagSuper: true,\n paginaDefault: \"/home\",\n roles: [],\n permissions: [],\n },\n filtri: null,\n userGrants: {\n abilitazioni: [],\n grants: [],\n ruoli: [],\n },\n };\n }\n\n getDemoUser(): LoginResult {\n return {\n utente: {\n codiceUtente: 12345,\n email: \"jdoe\",\n statoRegistrazione: StatoRegistrazione.CONF,\n cognome: \"Doe\",\n nome: \"John\",\n flagGdpr: true,\n avatar: \"/path/to/avatar.jpg\",\n flagDueFattori: false,\n codiceLingua: \"IT\",\n cellulare: \"+391234567890\",\n flagSuper: false,\n paginaDefault: \"/home\",\n roles: [],\n permissions: [],\n },\n filtri: null,\n userGrants: {\n abilitazioni: [],\n grants: [],\n ruoli: [],\n },\n };\n }\n\n public async confirmResetPassword(\n token: string,\n newPassword: string\n ): Promise<void> {\n try {\n if (typeof token !== \"string\" \|\| token.trim() === \"\") {\n throw new Error(\"Token non valido.\");\n }\n\n if (\n typeof newPassword !== \"string\" \|\|\n newPassword.length < 8 \|\|\n newPassword.length > 100\n ) {\n throw new Error(\"La nuova password deve essere compresa tra 8 e 100 caratteri.\");\n }\n\n const secret = getAccessiJwtSecret(this.accessiOptions);\n const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\n\n const result = (await Orm.query(\n this.accessiOptions.databaseOptions,\n \"SELECT CODUTE AS codice_utente, STAREG AS stato_registrazione FROM UTENTI WHERE CODUTE = ? AND KEYREG = ?\",\n [codiceUtente, nonce]\n ).then((rows) => rows.map(RestUtilities.convertKeysToCamelCase))) as {\n codiceUtente?: number;\n statoRegistrazione?: StatoRegistrazione \| number;\n }[];\n\n if (result.length === 0) {\n throw new Error(\"Token non valido o gia usato.\");\n }\n\n const currentState = Number(result[0].statoRegistrazione);\n if (\n currentState === StatoRegistrazione.BLOCC \|\|\n currentState === StatoRegistrazione.DELETE\n ) {\n throw new Error(\"Utente non autorizzato a completare il reset password.\");\n }\n\n await Orm.query(\n this.accessiOptions.databaseOptions,\n \"UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ?\",\n [StatoRegistrazione.CONF, codiceUtente]\n );\n\n await this.setPassword(codiceUtente, newPassword);\n } catch (error) {\n throw error;\n }\n }\n}\n"]}
1	+ {"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AuthService/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA2E;AAC3E,2EAAwF;AACxF,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,sEAAmE;AACnE,4DAAyD;AACzD,kEAA+D;AAC/D,0EAK2C;AAC3C,0EAG2C;AAC3C,4CAAyC;AAGzC,8EAA8E;AACjE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAG1D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,aAA4B,EACT,cAA+C,EACzD,gBAAkC;QAH3C,gBAAW,GAAX,WAAW,CAAa;QACxB,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QACzD,qBAAgB,GAAhB,gBAAgB,CAAkB;QANpC,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM,CAAC;IACzF,CAAC;IAED,+EAA+E;IACxE,kBAAkB,CAAC,MAA6B,EAAE,UAAoB,EAAE;QAC7E,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,8BAAqB,CAAC,2CAA2C,CAAC,CAAC;QAC/E,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS;YACnD,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,EAAE;gBACjG,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAgB;aAC3D,CAAC;YACF,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC9E,qBAAqB,CAAC,YAAoB;;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAC3C,EAAE,YAAY,EAAE,EAChB,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CACtD,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAA,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,CAAC,IAAA,qDAAgC,EAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YACzG,MAAM,CAAC,MAAM,mCAAQ,MAAM,CAAC,MAAM,GAAK,OAAO,CAAE,CAAC;YAEjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC;QACJ,CAAC;KAAA;IAED,8EAA8E;IAChE,sBAAsB,CAAC,YAAoB;;;YACvD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE/E,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAmD,CAAC;YACnH,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,GAAG,CAAC;QAC9H,CAAC;KAAA;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAqB;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,wBAAwB,EAAE,CAAC;gBACxH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YACxJ,CAAC;YACD,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAEzD,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,+BAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB;oBAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,CAAC,CAAC,SAAS,CAAC;gBAEd,qGAAqG;gBACrG,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YAC7I,CAAC;YAED,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;KAAA;IAED;;;OAGG;IACU,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAElE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1H,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,CAAC;KAAA;IAED,+FAA+F;IAClF,uBAAuB,CAAC,YAAoB,EAAE,WAAmB;;YAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACvG,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QAC/H,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAqB;;;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrF,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7I,MAAM,IAAI,8BAAqB,CAAC,8DAA8D,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAAE,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;YAC7I,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;YACzJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,CAAA;oBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;gBAC7F,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAC9D,6KAA6K,EAC7K,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB,EAAE,IAAY;;YAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,qEAAqE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACpJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,kFAAkF,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAClK,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB;;YAC9C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,CAAC;KAAA;IAED,6GAA6G;IAChG,WAAW,CAAC,YAAoB,EAAE,aAAqB;;YAClE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACU,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAED,yGAAyG;IACnG,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAE1C,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;gBACtD,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,cAAc,KAAK,uBAAuB,CAAC;YAEzE,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAED,8GAA8G;IACxG,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,aAAa,EAAE,OAAO;oBACtB,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,2EAA2E;IAC3E,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACU,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IACE,OAAO,WAAW,KAAK,QAAQ;oBAC/B,WAAW,CAAC,MAAM,GAAG,CAAC;oBACtB,WAAW,CAAC,MAAM,GAAG,GAAG,EACxB,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBACxD,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBACnE,MAAM,EAAE,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC,CAAC;gBAClE,IAAI,WAAyE,CAAC;gBAC9E,IAAI,CAAC;oBACH,WAAW,GAAG,MAAM,SAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;oBAC7C,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,MAAiB,EAAE,EAAE,CAAC,IAAI,OAAO,CAAM,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;wBACrF,WAAY,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;oBAC9F,CAAC,CAAC,CAAC;oBACH,6EAA6E;oBAC7E,+EAA+E;oBAC/E,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB,mHAAmH,EACnH,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uCAAkB,CAAC,IAAI,EAAE,uCAAkB,CAAC,KAAK,CAAC,CAClG,CAAC;oBACF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;oBAC1D,IAAI,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBAC3E,CAAC;oBACD,MAAM,KAAK,CAAC,gFAAgF,EAAE,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC,CAAC;oBAC9H,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;wBAChE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,MAAM,KAAK,CAAC,yCAAyC,cAAc,6CAA6C,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;oBACpI,CAAC;oBACD,MAAM,SAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBAC3C,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,IAAI,WAAW;wBAAE,MAAM,SAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACnF,MAAM,KAAK,CAAC;gBACd,CAAC;wBAAS,CAAC;oBACT,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;gBACnE,CAAC;YACH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAteY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFL,yBAAW;QACT,6BAAa,UAED,mCAAgB;GAP1C,WAAW,CAsevB","sourcesContent":["import { Inject, Injectable, UnauthorizedException } from \"@nestjs/common\";\nimport { TwoFactorService, TwoFactorProof } from '../TwoFactorService/TwoFactorService';\nimport * as jwt from \"jsonwebtoken\";\nimport { Orm } from \"../../../Orm\";\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\nimport type { AccessiOptions } from \"../../AccessiModule\";\nimport { LoginRequest } from \"../../Dtos/LoginRequest\";\nimport { LoginResult } from \"../../Dtos/LoginResponse\";\nimport { StatoRegistrazione } from \"../../Dtos/StatoRegistrazione\";\nimport { UserService } from \"../UserService/UserService\";\nimport { FiltriService } from \"../FiltriService/FiltriService\";\nimport {\n buildAuthenticatedTokenPayload,\n isAuthenticatedUserEnabledForJwt,\n isAccessiTokenAllowedForUser,\n resolveCodiceUtenteFromTokenPayload,\n} from \"../../security/authenticatedToken\";\nimport {\n getAccessiJwtSecret,\n verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport { Logger } from \"../../../Logger\";\nimport { TokenResult } from '../../Dtos/TokenResult';\n\n/** Error code deliberately returned when a user is configured as SSO-only. /\nexport const PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';\n\n@Injectable()\nexport class AuthService {\n private readonly logger = new Logger(AuthService.name);\n\n constructor(\n private userService: UserService,\n private filtriService: FiltriService,\n @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions,\n private readonly twoFactorService: TwoFactorService,\n ) {}\n\n private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\n if (!this.accessiOptions.passwordExpiration) {\n return;\n }\n\n const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\n const expirationDays =\n Number.isFinite(configuredDays) && configuredDays > 0\n ? Math.trunc(configuredDays)\n : 90;\n\n const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\n await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n }\n\n private isMockDemoUserEnabled(): boolean {\n if (!this.accessiOptions.mockDemoUser) {\n return false;\n }\n\n const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\n return nodeEnv !== \"production\" \|\| process.env.ACCESSI_ALLOW_MOCK_DEMO_USER === \"true\";\n }\n\n /* Creates the normal internal JWT consumed by all existing Accessi guards. /\n public createAccessiToken(utente: LoginResult['utente'], methods: string[] = []): TokenResult {\n if (!utente?.codiceUtente) {\n throw new Error('Impossibile creare un token senza un utente Accessi valido.');\n }\n if ((utente.flagDueFattori === true \|\| Number(utente.flagDueFattori) === 1) && !methods.includes('otp')) {\n throw new UnauthorizedException('Verifica del codice di accesso richiesta.');\n }\n\n return {\n expiresIn: this.accessiOptions.jwtOptions.expiresIn,\n value: jwt.sign({ utente, typ: 'access', amr: methods }, getAccessiJwtSecret(this.accessiOptions), {\n expiresIn: this.accessiOptions.jwtOptions.expiresIn as any,\n }),\n type: 'Bearer',\n };\n }\n\n /* Builds the standard login response for a user authenticated by any supported method. /\n public async getLoginResultForUser(codiceUtente: number): Promise<LoginResult> {\n const users = await this.userService.getUsers(\n { codiceUtente },\n { includeExtensionFields: true, includeGrants: true },\n );\n const result = users[0];\n if (!result?.utente) {\n throw new Error('Utente Accessi non trovato.');\n }\n const current = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(current)) throw new UnauthorizedException('Utente non abilitato.');\n result.utente = { ...result.utente, ...current };\n\n return {\n utente: result.utente,\n filtri: await this.filtriService.getFiltriUser(codiceUtente),\n userGrants: result.userGrants,\n extensionFields: result.extensionFields,\n };\n }\n\n /* Users without a row retain the historic password-login enabled default. /\n private async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n if (this.accessiOptions.federatedAuthentication?.enabled !== true) return true;\n\n const rows = await Orm.query(\n this.accessiOptions.databaseOptions,\n 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n [codiceUtente],\n );\n const policy = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { passwordLoginEnabled?: unknown } \| undefined;\n return policy?.passwordLoginEnabled !== false && policy?.passwordLoginEnabled !== 0 && policy?.passwordLoginEnabled !== '0';\n }\n\n /\n Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.\n * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.\n * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.\n /\n async login(request: LoginRequest): Promise<LoginResult> {\n const mockDemoUserEnabled = this.isMockDemoUserEnabled();\n\n if (\n mockDemoUserEnabled &&\n request.email.toLowerCase() === \"demo\"\n ) {\n return this.getDemoUser();\n }\n\n if (\n mockDemoUserEnabled &&\n request.email.toLowerCase() === \"admin\"\n ) {\n return this.getAdminUser();\n }\n\n const utente = await this.userService.getUserByEmail(\n request.email.trim().toLowerCase()\n );\n if (!utente) {\n if (!request.password) return { passwordRequired: true };\n throw new Error(\"Nome utente o password errata!\");\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);\n if (isAuthenticatedUserEnabledForJwt(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {\n return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email.trim(), mode: 'passwordless' }) };\n }\n // The email-only step has the same response for unknown and ordinary local accounts.\n if (!request.password) return { passwordRequired: true };\n\n switch (utente.statoRegistrazione) {\n case undefined:\n throw new Error(\n \"Struttura dati compromessa: Stato Registrazione inesistente.\"\n );\n case StatoRegistrazione.BLOCC:\n case StatoRegistrazione.DELETE:\n throw new Error(\"Utente non abilitato\");\n case StatoRegistrazione.INVIO:\n throw new Error(\"Rinnovo password necessario.\");\n }\n\n if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\n throw new Error(\n `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\n );\n }\n\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) throw new Error('Utente non abilitato');\n if (!(await this.isPasswordLoginEnabled(utente.codiceUtente))) {\n throw new Error(PASSWORD_LOGIN_DISABLED);\n }\n\n if (typeof request.password !== 'string' \|\| request.password.length === 0) {\n throw new Error('Nome utente o password errata!');\n }\n\n const isPasswordValid = await this.verifyPassword(\n utente.codiceUtente,\n request.password\n );\n if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\n\n if (\n this.accessiOptions.passwordExpiration &&\n this.accessiOptions.passwordExpiration == true\n ) {\n const today = new Date();\n const targetDate = utente.dataScadenzaPassword\n ? new Date(utente.dataScadenzaPassword)\n : undefined;\n\n // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.\n if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {\n throw new Error(\"PASSWORD_EXPIRED\");\n }\n }\n\n if (currentUser.flagDueFattori) {\n return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email, mode: 'password' }) };\n }\n\n const updateLastAccessDateQuery =\n \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\n await Orm.query(\n this.accessiOptions.databaseOptions,\n updateLastAccessDateQuery,\n [utente.codiceUtente]\n );\n\n return this.getLoginResultForUser(utente.codiceUtente);\n }\n\n /\n Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.\n * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.\n /\n public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\n if (typeof token !== \"string\" \|\| token.trim() === \"\") {\n throw new Error(\"Token non fornito.\");\n }\n\n const secret = getAccessiJwtSecret(this.accessiOptions);\n const decoded = jwt.verify(token.trim(), secret);\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n\n if (!codiceUtente) {\n throw new Error(\"Token non valido.\");\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!currentUser \|\| !isAuthenticatedUserEnabledForJwt(currentUser) \|\| !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n throw new Error(\"Token non valido o utente non autorizzato.\");\n }\n\n return buildAuthenticatedTokenPayload(decoded, currentUser);\n }\n\n /* Starts a second-factor challenge after the hosting backend has verified an SSO identity. /\n public async beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult> {\n const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(user) \|\| !user.flagDueFattori) throw new UnauthorizedException();\n return { challenge: await this.twoFactorService.issue({ codiceUtente, email: user.email, mode: 'federated', identityKey }) };\n }\n\n private async validateTwoFactorProof(proof: TwoFactorProof): Promise<void> {\n const user = await this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(user) \|\| !user.flagDueFattori \|\| user.email?.trim().toLowerCase() !== proof.email.trim().toLowerCase()) {\n throw new UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');\n }\n if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled) throw new UnauthorizedException('Accesso senza password disabilitato.');\n if (proof.mode === 'password' && !(await this.isPasswordLoginEnabled(proof.codiceUtente))) throw new UnauthorizedException('Login locale disabilitato.');\n if (proof.mode === 'federated') {\n if (!this.accessiOptions.federatedAuthentication?.enabled) throw new UnauthorizedException();\n const rows = await Orm.query(this.accessiOptions.databaseOptions,\n 'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1',\n [proof.identityKey, proof.codiceUtente], false);\n if (!rows.length) throw new UnauthorizedException('Identita SSO non piu abilitata.');\n }\n }\n\n public async verifyTwoFactor(challengeId: string, code: string): Promise<LoginResult> {\n const proof = await this.twoFactorService.consume(challengeId, code);\n await this.validateTwoFactorProof(proof);\n const result = await this.getLoginResultForUser(proof.codiceUtente);\n result.token = this.createAccessiToken(result.utente, [proof.mode, 'otp']);\n await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);\n if (proof.mode === 'federated') {\n await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);\n }\n return result;\n }\n\n public async resendTwoFactor(challengeId: string): Promise<LoginResult> {\n await this.validateTwoFactorProof(await this.twoFactorService.describe(challengeId));\n return { challenge: await this.twoFactorService.resend(challengeId) };\n }\n\n /* Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email. /\n public async setPassword(codiceUtente: number, nuovaPassword: string) {\n try {\n const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\n const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\n\n const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\n codiceUtente,\n hashedPassword,\n ]);\n await this.refreshPasswordExpiration(codiceUtente);\n return result;\n } catch (error) {\n throw error;\n }\n }\n\n /\n Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.\n * E idempotente: hash moderni e gia migrati vengono ignorati.\n /\n public async migrateLegacyEncryptedPasswords(): Promise<void> {\n const startedAt = performance.now();\n this.logger.info(\"Avvio migrazione password legacy accessi.\");\n const results = await Orm.query(\n this.accessiOptions.databaseOptions,\n \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n []\n );\n\n const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\n codiceUtente?: number;\n password?: string;\n }[];\n let migratedCount = 0;\n let skippedCount = 0;\n\n for (const row of rows) {\n const codiceUtente = Number(row.codiceUtente);\n const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\n if (\n !codiceUtente \|\|\n !storedPassword \|\|\n PasswordUtilities.isPasswordHash(storedPassword) \|\|\n PasswordUtilities.isLegacyPasswordHash(storedPassword)\n ) {\n skippedCount += 1;\n continue;\n }\n\n const protectedLegacyPassword =\n PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\n\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n [protectedLegacyPassword, codiceUtente, storedPassword]\n );\n migratedCount += 1;\n }\n\n this.logger.info(\n `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n );\n }\n\n /* Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. /\n async verifyPassword(\n codiceUtente: number,\n plainPassword: string\n ): Promise<boolean> {\n const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\n const result = (await Orm.query(\n this.accessiOptions.databaseOptions,\n query,\n [codiceUtente]\n ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\n password: string;\n }[];\n\n if (result.length === 0 \|\| typeof result[0].password !== \"string\") {\n return false;\n }\n\n const storedPassword = result[0].password;\n\n if (PasswordUtilities.isPasswordHash(storedPassword)) {\n return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\n }\n\n const legacyEncryptedPassword = CryptUtilities.encrypt(\n plainPassword,\n this.accessiOptions.encryptionKey\n );\n\n if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\n const isMigratedLegacyPasswordValid =\n PasswordUtilities.verifyLegacyEncryptedPassword(\n legacyEncryptedPassword,\n storedPassword\n );\n\n if (isMigratedLegacyPasswordValid) {\n await this.setPassword(codiceUtente, plainPassword);\n }\n\n return isMigratedLegacyPasswordValid;\n }\n\n const isLegacyPasswordValid = storedPassword === legacyEncryptedPassword;\n\n if (isLegacyPasswordValid) {\n await this.setPassword(codiceUtente, plainPassword);\n }\n\n return isLegacyPasswordValid;\n }\n\n /* Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. /\n async getAdminUser(): Promise<LoginResult> {\n return {\n utente: {\n codiceUtente: 6789,\n email: \"admin\",\n statoRegistrazione: StatoRegistrazione.CONF,\n cognome: \"Admin\",\n nome: \"Admin\",\n flagGdpr: true,\n avatar: \"/path/to/avatar.jpg\",\n flagDueFattori: false,\n codiceLingua: \"IT\",\n cellulare: \"+391234567890\",\n flagSuper: true,\n paginaDefault: \"/home\",\n roles: [],\n permissions: [],\n },\n filtri: null,\n userGrants: {\n abilitazioni: [],\n grants: [],\n ruoli: [],\n },\n };\n }\n\n /* Restituisce l'utente demo fittizio; non contiene dati o grant reali. /\n getDemoUser(): LoginResult {\n return {\n utente: {\n codiceUtente: 12345,\n email: \"jdoe\",\n statoRegistrazione: StatoRegistrazione.CONF,\n cognome: \"Doe\",\n nome: \"John\",\n flagGdpr: true,\n avatar: \"/path/to/avatar.jpg\",\n flagDueFattori: false,\n codiceLingua: \"IT\",\n cellulare: \"+391234567890\",\n flagSuper: false,\n paginaDefault: \"/home\",\n roles: [],\n permissions: [],\n },\n filtri: null,\n userGrants: {\n abilitazioni: [],\n grants: [],\n ruoli: [],\n },\n };\n }\n\n /\n Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.\n * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.\n */\n public async confirmResetPassword(\n token: string,\n newPassword: string\n ): Promise<void> {\n try {\n if (typeof token !== \"string\" \|\| token.trim() === \"\") {\n throw new Error(\"Token non valido.\");\n }\n\n if (\n typeof newPassword !== \"string\" \|\|\n newPassword.length < 8 \|\|\n newPassword.length > 100\n ) {\n throw new Error(\"La nuova password deve essere compresa tra 8 e 100 caratteri.\");\n }\n\n const secret = getAccessiJwtSecret(this.accessiOptions);\n const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\n\n const hashedPassword = PasswordUtilities.hashPassword(newPassword);\n const db = await Orm.connect(this.accessiOptions.databaseOptions);\n let transaction: Awaited<ReturnType<typeof Orm.startTransaction>> \| undefined;\n try {\n transaction = await Orm.startTransaction(db);\n const query = (sql: string, params: unknown[]) => new Promise<any>((resolve, reject) => {\n transaction!.query(sql, params, (error, result) => error ? reject(error) : resolve(result));\n });\n // A conditional write claims the nonce under the database row lock. A second\n // concurrent reset cannot also consume it; failures roll the whole reset back.\n const claimed = await query(\n 'UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE',\n [StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione.CONF, StatoRegistrazione.INVIO],\n );\n const row = Array.isArray(claimed) ? claimed[0] : claimed;\n if (Number(row?.CODUTE ?? row?.codute) !== codiceUtente) {\n throw new Error('Token non valido, gia usato o utente non autorizzato.');\n }\n await query('UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)', [codiceUtente, hashedPassword]);\n if (this.accessiOptions.passwordExpiration) {\n const days = Number(this.accessiOptions.passwordExpirationDays);\n const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;\n await query(`UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`, [codiceUtente]);\n }\n await Orm.commitTransaction(transaction);\n } catch (error) {\n if (transaction) await Orm.rollbackTransaction(transaction).catch(() => undefined);\n throw error;\n } finally {\n await new Promise<void>((resolve) => db.detach(() => resolve()));\n }\n } catch (error) {\n throw error;\n }\n }\n}\n"]}

package/dist/accessi-module/Services/ConfiguratorService/ConfiguratorService.d.ts CHANGED Viewed

@@ -1,7 +1,9 @@
-import { AccessiOptions } from '../../AccessiModule';
+import type { AccessiOptions } from '../../AccessiModule';
 export declare class ConfiguratorService {
     private readonly accessiOptions;
     constructor(accessiOptions: AccessiOptions);
+    /** Enables or disables one menu in the runtime catalog. Disabled menus are excluded from normal grant resolution. */
     setMenuEnabled(codiceMenu: string, enabled: boolean): Promise<void>;
+    /** Enables or disables a whole group. Existing menus and role mappings are preserved for future reactivation. */
     setGroupEnabled(codiceGruppo: string, enabled: boolean): Promise<void>;
 }

package/dist/accessi-module/Services/ConfiguratorService/ConfiguratorService.js CHANGED Viewed

@@ -29,6 +29,7 @@ let ConfiguratorService = class ConfiguratorService {
     constructor(accessiOptions) {
         this.accessiOptions = accessiOptions;
     }
+    /** Enables or disables one menu in the runtime catalog. Disabled menus are excluded from normal grant resolution. */
     setMenuEnabled(codiceMenu, enabled) {
         return __awaiter(this, void 0, void 0, function* () {
             const query = `UPDATE MENU SET FLGENABLED = ? WHERE CODMNU = ?`;
@@ -36,6 +37,7 @@ let ConfiguratorService = class ConfiguratorService {
             yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, query, [enabledValue, codiceMenu]);
         });
     }
+    /** Enables or disables a whole group. Existing menus and role mappings are preserved for future reactivation. */
     setGroupEnabled(codiceGruppo, enabled) {
         return __awaiter(this, void 0, void 0, function* () {
             const query = `UPDATE MENU_GRP SET FLGENABLED = ? WHERE CODGRP = ?`;
@@ -47,7 +49,9 @@ let ConfiguratorService = class ConfiguratorService {
 exports.ConfiguratorService = ConfiguratorService;
 exports.ConfiguratorService = ConfiguratorService = __decorate([
     autobind_1.autobind,
-    (0, common_1.Injectable)(),
+    (0, common_1.Injectable)()
+    /** Administrative catalog service. Disabling a menu or group does not delete grants already stored for it. */
+    ,
     __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
     __metadata("design:paramtypes", [Object])
 ], ConfiguratorService);

package/dist/accessi-module/Services/ConfiguratorService/ConfiguratorService.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ConfiguratorService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/ConfiguratorService/ConfiguratorService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,gDAA6C;AAE7C,sCAAmC;~~AAI5B~~,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAC8C,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAEzE,CAAC;~~IAES~~,cAAc,CAAC,UAAkB,EAAE,OAAgB;;YAC9D,MAAM,KAAK,GAAG,iDAAiD,CAAC;YAChE,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,EAAC,UAAU,CAAC,CAAC,CAAA;QAC1F,CAAC;KAAA;~~IAEY~~,eAAe,CAAC,YAAoB,EAAE,OAAgB;;YACjE,MAAM,KAAK,GAAG,qDAAqD,CAAA;YACnE,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7F,CAAC;KAAA;CAKF,CAAA;~~AArBY~~,kDAAmB;8BAAnB,mBAAmB;~~IAF~~/B,mBAAQ;IACR,IAAA,mBAAU,GAAE;~~IAGR~~,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAFjB,mBAAmB,~~CAqB~~/B","sourcesContent":["import { Inject, Injectable } from '@nestjs/common';\nimport { autobind } from '../../../autobind';\nimport { AccessiOptions } from '../../AccessiModule';\nimport { Orm } from '../../../Orm';\n\n@autobind\n@Injectable()\nexport class ConfiguratorService {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n\n ) {}\n\n public async setMenuEnabled(codiceMenu: string, enabled: boolean): Promise<void> {\n const query = `UPDATE MENU SET FLGENABLED = ? WHERE CODMNU = ?`;\n const enabledValue = enabled ? 1 : 0\n await Orm.execute(this.accessiOptions.databaseOptions, query, [enabledValue,codiceMenu])\n }\n\n public async setGroupEnabled(codiceGruppo: string, enabled: boolean): Promise<void> {\n const query = `UPDATE MENU_GRP SET FLGENABLED = ? WHERE CODGRP = ?`\n const enabledValue = enabled ? 1 : 0\n await Orm.execute(this.accessiOptions.databaseOptions, query, [enabledValue, codiceGruppo])\n }\n\n\n\n\n}\n"]}
1	+ {"version":3,"file":"ConfiguratorService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/ConfiguratorService/ConfiguratorService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,gDAA6C;AAE7C,sCAAmC;AAK5B,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAC8C,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAEzE,CAAC;IAEJ,qHAAqH;IACxG,cAAc,CAAC,UAAkB,EAAE,OAAgB;;YAC9D,MAAM,KAAK,GAAG,iDAAiD,CAAC;YAChE,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,EAAC,UAAU,CAAC,CAAC,CAAA;QAC1F,CAAC;KAAA;IAED,iHAAiH;IACpG,eAAe,CAAC,YAAoB,EAAE,OAAgB;;YACjE,MAAM,KAAK,GAAG,qDAAqD,CAAA;YACnE,MAAM,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC,CAAA;QAC7F,CAAC;KAAA;CAKF,CAAA;AAvBY,kDAAmB;8BAAnB,mBAAmB;IAH/B,mBAAQ;IACR,IAAA,mBAAU,GAAE;IACb,8GAA8G;;IAGzG,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAFjB,mBAAmB,CAuB/B","sourcesContent":["import { Inject, Injectable } from '@nestjs/common';\nimport { autobind } from '../../../autobind';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { Orm } from '../../../Orm';\n\n@autobind\n@Injectable()\n/** Administrative catalog service. Disabling a menu or group does not delete grants already stored for it. /\nexport class ConfiguratorService {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n\n ) {}\n\n /* Enables or disables one menu in the runtime catalog. Disabled menus are excluded from normal grant resolution. /\n public async setMenuEnabled(codiceMenu: string, enabled: boolean): Promise<void> {\n const query = `UPDATE MENU SET FLGENABLED = ? WHERE CODMNU = ?`;\n const enabledValue = enabled ? 1 : 0\n await Orm.execute(this.accessiOptions.databaseOptions, query, [enabledValue,codiceMenu])\n }\n\n /* Enables or disables a whole group. Existing menus and role mappings are preserved for future reactivation. */\n public async setGroupEnabled(codiceGruppo: string, enabled: boolean): Promise<void> {\n const query = `UPDATE MENU_GRP SET FLGENABLED = ? WHERE CODGRP = ?`\n const enabledValue = enabled ? 1 : 0\n await Orm.execute(this.accessiOptions.databaseOptions, query, [enabledValue, codiceGruppo])\n }\n\n\n\n\n}\n"]}

package/dist/accessi-module/Services/EmailService/EmailService.d.ts CHANGED Viewed

@@ -1,9 +1,15 @@
-import { AccessiOptions } from '../../AccessiModule';
+import type { AccessiOptions } from '../../AccessiModule';
 export declare class EmailService {
     private readonly accessiOptions;
     constructor(accessiOptions: AccessiOptions);
     sendAccountUpdateEmail(email: string, message: string): Promise<void>;
     private transporter;
+    /** Sends the one-time login code without including it in application logs. */
+    sendTwoFactorCode(email: string, code: string, validityMinutes: number): Promise<void>;
+    /**
+     * Creates a short-lived, one-use reset token and sends it by email. Invalid, missing, blocked or deleted users
+     * return without error to prevent account enumeration. On delivery failure the stored reset nonce is cleared.
+     */
     sendPasswordResetEmail(email: string, htmlMail?: string): Promise<void>;
     private GetHtmlMail;
 }

package/dist/accessi-module/Services/EmailService/EmailService.js CHANGED Viewed

@@ -39,11 +39,27 @@ let EmailService = class EmailService {
     sendAccountUpdateEmail(email, message) {
         throw new Error('Method not implemented.');
     }
+    /** Sends the one-time login code without including it in application logs. */
+    sendTwoFactorCode(email, code, validityMinutes) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.transporter.sendMail({
+                from: this.accessiOptions.emailOptions.from,
+                to: email,
+                subject: 'Codice di accesso',
+                text: `Il tuo codice di accesso e: ${code}\n\nScade entro ${validityMinutes} minuti e puo essere usato una sola volta. Se non hai richiesto l accesso, ignora questa email.`,
+            });
+        });
+    }
+    /**
+     * Creates a short-lived, one-use reset token and sends it by email. Invalid, missing, blocked or deleted users
+     * return without error to prevent account enumeration. On delivery failure the stored reset nonce is cleared.
+     */
     sendPasswordResetEmail(email, htmlMail) {
         return __awaiter(this, void 0, void 0, function* () {
             var _a;
             let codiceUtente = null;
             let resetToken = null;
+            let nonce = null;
             try {
                 if (typeof email !== 'string' || email.trim() === '') {
                     return;
@@ -63,10 +79,10 @@ let EmailService = class EmailService {
                     return;
                 }
                 codiceUtente = user.codiceUtente;
-                const nonce = (0, uuid_1.v4)();
+                nonce = (0, uuid_1.v4)();
                 const secret = (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions);
                 resetToken = (0, passwordResetToken_1.createPasswordResetToken)(codiceUtente, nonce, secret);
-                yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET KEYREG = ? WHERE CODUTE = ? ', [nonce, codiceUtente]);
+                yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET KEYREG = ? WHERE CODUTE = ? ', [nonce, codiceUtente], false);
                 //costruizione dei queryparams
                 const returnUrlQueryParams = '?returnUrl=' +
                     encodeURIComponent(this.accessiOptions.confirmationEmailReturnUrl) +
@@ -108,8 +124,8 @@ let EmailService = class EmailService {
                 yield this.transporter.sendMail(mailOptions);
             }
             catch (error) {
-                if (codiceUtente) {
-                    yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET KEYREG = NULL WHERE CODUTE = ?', [codiceUtente]).catch(() => undefined);
+                if (codiceUtente && nonce) {
+                    yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET KEYREG = NULL WHERE CODUTE = ? AND KEYREG = ?', [codiceUtente, nonce], false).catch(() => undefined);
                 }
                 console.error("Errore nell'invio dell'email di reset password:", error);
                 throw new Error("Errore durante l'invio dell'email di reset password.");
@@ -407,7 +423,9 @@ let EmailService = class EmailService {
 };
 exports.EmailService = EmailService;
 exports.EmailService = EmailService = __decorate([
-    (0, common_1.Injectable)(),
+    (0, common_1.Injectable)()
+    /** Sends password lifecycle email. It deliberately does not expose whether an email exists to public callers. */
+    ,
     __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
     __metadata("design:paramtypes", [Object])
 ], EmailService);