emilsoftware-utilities 2.0.0-dev.22 → 2.0.0-dev.24

package/dist/accessi-module/index.js

@@ -26,10 +26,9 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
+exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.ServiceTokenService = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
 exports.initializeAccessiModule = initializeAccessiModule;
 const express_1 = __importDefault(require("express"));
-const common_1 = require("@nestjs/common");
 const core_1 = require("@nestjs/core");
 const platform_express_1 = require("@nestjs/platform-express");
 const AccessiModule_1 = require("./AccessiModule");
@@ -37,11 +36,24 @@ const Logger_1 = require("../Logger");
 const AuthService_1 = require("./Services/AuthService/AuthService");
 const SwaggerConfig_1 = require("../swagger/SwaggerConfig");
 const authenticateGen_1 = require("./middleware/authenticateGen");
+const accessiValidation_1 = require("./security/accessiValidation");
+const AccessiHttpExceptionFilter_1 = require("./security/AccessiHttpExceptionFilter");
 function describeDatabaseTarget(options) {
     var _a, _b, _c, _d;
     const dbOptions = options.databaseOptions;
     return `${(_a = dbOptions.host) !== null && _a !== void 0 ? _a : "?"}:${(_b = dbOptions.port) !== null && _b !== void 0 ? _b : "?"} -> ${(_c = dbOptions.database) !== null && _c !== void 0 ? _c : "?"} as ${(_d = dbOptions.user) !== null && _d !== void 0 ? _d : "?"}`;
 }
+/**
+ * Monta il modulo Accessi in un'applicazione Express gia esistente.
+ *
+ * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,
+ * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.
+ * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware
+ * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.
+ *
+ * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.
+ * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.
+ */
 function initializeAccessiModule(app, options) {
     return __awaiter(this, void 0, void 0, function* () {
         const logger = new Logger_1.Logger("initializeAccessiModule");
@@ -69,15 +81,9 @@ function initializeAccessiModule(app, options) {
                 bufferLogs: true
             });
             logger.info("Applicazione Nest accessi creata.");
-            nestApp.enableCors();
-            nestApp.useGlobalPipes(new common_1.ValidationPipe({
-                whitelist: true,
-                forbidNonWhitelisted: true,
-                transform: true,
-                transformOptions: {
-                    enableImplicitConversion: true,
-                },
-            }));
+            nestApp.enableCors({ exposedHeaders: ['X-Total-Count'] });
+            nestApp.useGlobalPipes((0, accessiValidation_1.createAccessiValidationPipe)());
+            nestApp.useGlobalFilters(new AccessiHttpExceptionFilter_1.AccessiHttpExceptionFilter());
             nestApp.setGlobalPrefix('api', {
                 exclude: ['/swagger', '/swagger/(.*)']
             });
@@ -115,6 +121,14 @@ var AccessiModule_2 = require("./AccessiModule");
 Object.defineProperty(exports, "AccessiModule", { enumerable: true, get: function () { return AccessiModule_2.AccessiModule; } });
 var AccessiDatabaseUpdater_1 = require("./database-updates/AccessiDatabaseUpdater");
 Object.defineProperty(exports, "AccessiDatabaseUpdater", { enumerable: true, get: function () { return AccessiDatabaseUpdater_1.AccessiDatabaseUpdater; } });
+var ServiceTokenService_1 = require("./Services/ServiceTokenService/ServiceTokenService");
+Object.defineProperty(exports, "ServiceTokenService", { enumerable: true, get: function () { return ServiceTokenService_1.ServiceTokenService; } });
+var serviceTokenGuard_1 = require("./security/serviceTokenGuard");
+Object.defineProperty(exports, "ServiceTokenGuard", { enumerable: true, get: function () { return serviceTokenGuard_1.ServiceTokenGuard; } });
+Object.defineProperty(exports, "RequireServiceTokenScopes", { enumerable: true, get: function () { return serviceTokenGuard_1.RequireServiceTokenScopes; } });
+Object.defineProperty(exports, "getAccessiServiceToken", { enumerable: true, get: function () { return serviceTokenGuard_1.getAccessiServiceToken; } });
+var FederatedAuthService_1 = require("./federated-auth/FederatedAuthService");
+Object.defineProperty(exports, "FederatedAuthService", { enumerable: true, get: function () { return FederatedAuthService_1.FederatedAuthService; } });
 __exportStar(require("./Dtos"), exports);
 var authenticateGen_2 = require("./middleware/authenticateGen");
 Object.defineProperty(exports, "authorizeAccessi", { enumerable: true, get: function () { return authenticateGen_2.authorizeAccessi; } });

package/dist/accessi-module/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0BA,0DAmFC;AA7GD,sDAAwD;AACxD,2CAAgD;AAChD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAAwD;AACxD,kEAKsC;AAEtC,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAI,KAAK,kBAAkB;gBAC3B,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBACpC,IAAI,KAAK,uBAAuB;gBAChC,IAAI,KAAK,uBAAuB,CAAC;YAErC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,CAAC,cAAc,CAClB,IAAI,uBAAc,CAAC;gBACf,SAAS,EAAE,IAAI;gBACf,oBAAoB,EAAE,IAAI;gBAC1B,SAAS,EAAE,IAAI;gBACf,gBAAgB,EAAE;oBACd,wBAAwB,EAAE,IAAI;iBACjC;aACJ,CAAC,CACL,CAAC;YAEF,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;aACzC,CAAC,CAAC;YAEH,IAAA,4BAAY,EAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,sBAAsB;gBACvC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,wCAAsB,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACnD,IAAA,uCAAqB,EAAC,kBAAkB,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAE/B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { ValidationPipe } from \"@nestjs/common\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport { setupSwagger } from \"../swagger/SwaggerConfig\";\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    AuthenticateGenService,\n    setAccessiAuthService\n} from \"./middleware/authenticateGen\";\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n    const dbOptions = options.databaseOptions as {\n        host?: string;\n        port?: number;\n        database?: string;\n        user?: string;\n    };\n\n    return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions) {\n    const logger: Logger = new Logger(\"initializeAccessiModule\");\n    beginAccessiAuthInitialization();\n    const startedAt = performance.now();\n\n    try {\n        logger.info(\"Inizializzazione modulo accessi avviata.\");\n        logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n        logger.info(\n            `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n        );\n        const nestHostApp = express();\n        const isNestRoute = (path: string) =>\n            path === \"/api/accessi\" ||\n            path.startsWith(\"/api/accessi/\") ||\n            path === \"/accessi/swagger\" ||\n            path.startsWith(\"/accessi/swagger/\") ||\n            path === \"/accessi/swagger.json\" ||\n            path === \"/accessi/swagger-json\";\n\n        app.use((req: Request, res, next) => {\n            if (!isNestRoute(req.path)) {\n                return next();\n            }\n\n            return nestHostApp(req, res, next);\n        });\n\n        const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n        const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: true\n        });\n        logger.info(\"Applicazione Nest accessi creata.\");\n\n        nestApp.enableCors();\n        nestApp.useGlobalPipes(\n            new ValidationPipe({\n                whitelist: true,\n                forbidNonWhitelisted: true,\n                transform: true,\n                transformOptions: {\n                    enableImplicitConversion: true,\n                },\n            }),\n        );\n\n        nestApp.setGlobalPrefix('api', {\n            exclude: ['/swagger', '/swagger/(.*)']\n        });\n\n        setupSwagger(nestApp, {\n            swaggerPath: \"accessi/swagger\",\n            swaggerJsonPath: \"accessi/swagger.json\",\n            title: \"Accessi API Documentation\",\n            description: \"API del modulo accessi\",\n        });\n        logger.info(\"Avvio init del modulo accessi.\");\n        await nestApp.init();\n        logger.info(\"Init del modulo accessi completata.\");\n        if (options.legacyPasswordMigrationOnStartup !== false) {\n            logger.info(\"Avvio migrazione password legacy accessi.\");\n            const passwordMigrationService = nestApp.get(AuthService);\n            await passwordMigrationService.migrateLegacyEncryptedPasswords();\n            logger.info(\"Migrazione password legacy accessi completata.\");\n        }\n\n        const accessiAuthService = nestApp.get(AuthenticateGenService);\n        app.locals.accessiAuthService = accessiAuthService;\n        setAccessiAuthService(accessiAuthService);\n        const elapsedMs = performance.now() - startedAt;\n        logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n    } catch (error) {\n        failAccessiAuthInitialization(error);\n        logger.error(\n            \"Errore in initialize AccessiModule:\",\n            error instanceof Error\n                ? { name: error.name, message: error.message, stack: error.stack }\n                : { error: String(error) }\n        );\n        throw error;\n    }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport * from \"./Dtos\";\nexport {\n    authorizeAccessi,\n    authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport type {\n    AccessiAuthorizationOptions,\n    AccessiRequirementNode,\n    AccessiCustomRequirementContext,\n    AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,0DA2EC;AAjHD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAAwD;AACxD,kEAKsC;AACtC,oEAA2E;AAC3E,sFAAmF;AAEnF,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAI,KAAK,kBAAkB;gBAC3B,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBACpC,IAAI,KAAK,uBAAuB;gBAChC,IAAI,KAAK,uBAAuB,CAAC;YAErC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;aACzC,CAAC,CAAC;YAEH,IAAA,4BAAY,EAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,sBAAsB;gBACvC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,wCAAsB,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACnD,IAAA,uCAAqB,EAAC,kBAAkB,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAG/B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAO5B,kEAAoH;AAA3G,sHAAA,iBAAiB,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AAAE,2HAAA,sBAAsB,OAAA;AAC7E,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\r\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport { setupSwagger } from \"../swagger/SwaggerConfig\";\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    AuthenticateGenService,\n    setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n    const dbOptions = options.databaseOptions as {\n        host?: string;\n        port?: number;\n        database?: string;\n        user?: string;\n    };\n\n    return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/**\n * Monta il modulo Accessi in un'applicazione Express gia esistente.\n *\n * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,\n * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n *\n * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n */\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<void> {\n    const logger: Logger = new Logger(\"initializeAccessiModule\");\n    beginAccessiAuthInitialization();\n    const startedAt = performance.now();\n\n    try {\n        logger.info(\"Inizializzazione modulo accessi avviata.\");\n        logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n        logger.info(\n            `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n        );\n        const nestHostApp = express();\n        const isNestRoute = (path: string) =>\n            path === \"/api/accessi\" ||\n            path.startsWith(\"/api/accessi/\") ||\n            path === \"/accessi/swagger\" ||\n            path.startsWith(\"/accessi/swagger/\") ||\n            path === \"/accessi/swagger.json\" ||\n            path === \"/accessi/swagger-json\";\n\n        app.use((req: Request, res, next) => {\n            if (!isNestRoute(req.path)) {\n                return next();\n            }\n\n            return nestHostApp(req, res, next);\n        });\n\n        const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n        const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: true\n        });\n        logger.info(\"Applicazione Nest accessi creata.\");\n\n        nestApp.enableCors({ exposedHeaders: ['X-Total-Count'] });\n        nestApp.useGlobalPipes(createAccessiValidationPipe());\n        nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\r\n        nestApp.setGlobalPrefix('api', {\n            exclude: ['/swagger', '/swagger/(.*)']\n        });\n\n        setupSwagger(nestApp, {\n            swaggerPath: \"accessi/swagger\",\n            swaggerJsonPath: \"accessi/swagger.json\",\n            title: \"Accessi API Documentation\",\n            description: \"API del modulo accessi\",\n        });\n        logger.info(\"Avvio init del modulo accessi.\");\n        await nestApp.init();\n        logger.info(\"Init del modulo accessi completata.\");\n        if (options.legacyPasswordMigrationOnStartup !== false) {\n            logger.info(\"Avvio migrazione password legacy accessi.\");\n            const passwordMigrationService = nestApp.get(AuthService);\n            await passwordMigrationService.migrateLegacyEncryptedPasswords();\n            logger.info(\"Migrazione password legacy accessi completata.\");\n        }\n\n        const accessiAuthService = nestApp.get(AuthenticateGenService);\n        app.locals.accessiAuthService = accessiAuthService;\n        setAccessiAuthService(accessiAuthService);\n        const elapsedMs = performance.now() - startedAt;\n        logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n    } catch (error) {\n        failAccessiAuthInitialization(error);\n        logger.error(\n            \"Errore in initialize AccessiModule:\",\n            error instanceof Error\n                ? { name: error.name, message: error.message, stack: error.stack }\n                : { error: String(error) }\n        );\n        throw error;\n    }\n}\n\r\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\r\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from \"./AccessiModule\";\r\nexport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\r\nexport type {\r\n    ServiceTokenMetadata,\r\n    IssuedServiceToken,\r\n    VerifiedServiceToken,\r\n    IssueServiceTokenInput\r\n} from './Services/ServiceTokenService/ServiceTokenService';\r\nexport { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\r\n    authorizeAccessi,\r\n    authenticateGen\r\n} from \"./middleware/authenticateGen\";\r\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\r\nexport type {\r\n    AccessiAuthorizationOptions,\r\n    AccessiRequirementNode,\r\n    AccessiCustomRequirementContext,\r\n    AccessiCustomRequirementHandler\r\n} from \"./middleware/accessiRequirements\";\r\n"]}

package/dist/accessi-module/jwt/jwt.strategy.d.ts

@@ -1,5 +1,5 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
-import { AccessiOptions } from '../AccessiModule';
+import type { AccessiOptions } from '../AccessiModule';
 import { UserService } from '../Services/UserService/UserService';
 export declare class JwtSimpleGuard implements CanActivate {
     private readonly accessiOptions;

package/dist/accessi-module/jwt/jwt.strategy.js

@@ -59,6 +59,7 @@ const common_1 = require("@nestjs/common");
 const jwt = __importStar(require("jsonwebtoken"));
 const UserService_1 = require("../Services/UserService/UserService");
 const authenticatedToken_1 = require("../security/authenticatedToken");
+const passwordResetToken_1 = require("../security/passwordResetToken");
 let JwtSimpleGuard = class JwtSimpleGuard {
     constructor(accessiOptions, userService) {
         this.accessiOptions = accessiOptions;
@@ -66,26 +67,34 @@ let JwtSimpleGuard = class JwtSimpleGuard {
     }
     canActivate(context) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
             const request = context.switchToHttp().getRequest();
             const authHeader = request.headers['authorization'];
             if (!authHeader)
                 throw new common_1.UnauthorizedException('Token mancante.');
-            const token = authHeader.split(' ')[1];
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(authHeader);
             if (!token)
                 throw new common_1.UnauthorizedException('Formato token non valido.');
             try {
-                const secret = ((_b = (_a = this.accessiOptions) === null || _a === void 0 ? void 0 : _a.jwtOptions) === null || _b === void 0 ? void 0 : _b.secret) || process.env.ACC_JWT_SECRET;
-                if (!secret) {
+                let secret;
+                try {
+                    secret = (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions, 'access');
+                }
+                catch (_a) {
                     throw new common_1.InternalServerErrorException('JWT secret non configurato.');
                 }
-                const payload = jwt.verify(token, secret);
+                let payload;
+                try {
+                    payload = jwt.verify(token, secret, { algorithms: ['HS256'] });
+                }
+                catch (_b) {
+                    throw new common_1.UnauthorizedException('Token non valido o scaduto.');
+                }
                 const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(payload);
                 if (!codiceUtente) {
                     throw new common_1.UnauthorizedException('Token privo di un utente valido.');
                 }
                 const currentUser = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
-                if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+                if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(payload, currentUser)) {
                     throw new common_1.UnauthorizedException('Utente non piu autorizzato.');
                 }
                 request.user = (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(payload, currentUser);
@@ -95,7 +104,7 @@ let JwtSimpleGuard = class JwtSimpleGuard {
                 if (error instanceof common_1.InternalServerErrorException || error instanceof common_1.UnauthorizedException) {
                     throw error;
                 }
-                throw new common_1.UnauthorizedException('Token non valido o scaduto.');
+                throw new common_1.InternalServerErrorException('Errore durante la verifica dell utente.');
             }
         });
     }

package/dist/accessi-module/jwt/jwt.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kDAAoC;AAEpC,qEAAkE;AAClE,uEAIwC;AAGjC,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAA,MAAA,MAAA,IAAI,CAAC,cAAc,0CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBACrF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC1C,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;oBACnD,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAxCY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CAwC1B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  Inject,\n  Injectable,\n  InternalServerErrorException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport * as jwt from 'jsonwebtoken';\nimport { AccessiOptions } from '../AccessiModule';\nimport { UserService } from '../Services/UserService/UserService';\nimport {\n  buildAuthenticatedTokenPayload,\n  isAuthenticatedUserEnabledForJwt,\n  resolveCodiceUtenteFromTokenPayload,\n} from '../security/authenticatedToken';\n\n@Injectable()\nexport class JwtSimpleGuard implements CanActivate {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly userService: UserService,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const authHeader = request.headers['authorization'];\n    if (!authHeader) throw new UnauthorizedException('Token mancante.');\n\n    const token = authHeader.split(' ')[1];\n    if (!token) throw new UnauthorizedException('Formato token non valido.');\n\n    try {\n      const secret = this.accessiOptions?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\n      if (!secret) {\n        throw new InternalServerErrorException('JWT secret non configurato.');\n      }\n      const payload = jwt.verify(token, secret);\n      const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\n      if (!codiceUtente) {\n        throw new UnauthorizedException('Token privo di un utente valido.');\n      }\n\n      const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n      if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\n        throw new UnauthorizedException('Utente non piu autorizzato.');\n      }\n\n      request.user = buildAuthenticatedTokenPayload(payload, currentUser);\n      return true;\n    } catch (error) {\n      if (error instanceof InternalServerErrorException || error instanceof UnauthorizedException) {\n        throw error;\n      }\n      throw new UnauthorizedException('Token non valido o scaduto.');\n    }\n  }\n}\n"]}
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kDAAoC;AAEpC,qEAAkE;AAClE,uEAMwC;AACxC,uEAAqE;AAG9D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,IAAI,MAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;gBAC9D,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,OAAgC,CAAC;gBACrC,IAAI,CAAC;oBACC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACrE,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,yCAAyC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA/CY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CA+C1B","sourcesContent":["import {\r\n  CanActivate,\r\n  ExecutionContext,\r\n  Inject,\r\n  Injectable,\r\n  InternalServerErrorException,\r\n  UnauthorizedException,\r\n} from '@nestjs/common';\r\nimport * as jwt from 'jsonwebtoken';\r\nimport type { AccessiOptions } from '../AccessiModule';\r\nimport { UserService } from '../Services/UserService/UserService';\r\nimport {\r\n  buildAuthenticatedTokenPayload,\r\n  extractAccessiBearerToken,\r\n  isAuthenticatedUserEnabledForJwt,\r\n  isAccessiTokenAllowedForUser,\r\n  resolveCodiceUtenteFromTokenPayload,\r\n} from '../security/authenticatedToken';\r\nimport { getAccessiJwtSecret } from '../security/passwordResetToken';\n\r\n@Injectable()\r\nexport class JwtSimpleGuard implements CanActivate {\r\n  constructor(\r\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\r\n    private readonly userService: UserService,\r\n  ) {}\r\n\r\n  async canActivate(context: ExecutionContext): Promise<boolean> {\r\n    const request = context.switchToHttp().getRequest();\r\n\r\n    const authHeader = request.headers['authorization'];\r\n    if (!authHeader) throw new UnauthorizedException('Token mancante.');\r\n\r\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) throw new UnauthorizedException('Formato token non valido.');\r\n\r\n    try {\r\n      let secret: string;\r\n      try {\r\n        secret = getAccessiJwtSecret(this.accessiOptions, 'access');\r\n      } catch {\r\n        throw new InternalServerErrorException('JWT secret non configurato.');\r\n      }\r\n      let payload: jwt.JwtPayload | string;\n      try {\n            payload = jwt.verify(token, secret, { algorithms: ['HS256'] });\n      } catch {\n        throw new UnauthorizedException('Token non valido o scaduto.');\n      }\n      const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\r\n      if (!codiceUtente) {\r\n        throw new UnauthorizedException('Token privo di un utente valido.');\r\n      }\r\n\r\n      const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\r\n      if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(payload, currentUser)) {\n        throw new UnauthorizedException('Utente non piu autorizzato.');\r\n      }\r\n\r\n      request.user = buildAuthenticatedTokenPayload(payload, currentUser);\r\n      return true;\r\n    } catch (error) {\r\n      if (error instanceof InternalServerErrorException || error instanceof UnauthorizedException) {\r\n        throw error;\r\n      }\r\n      throw new InternalServerErrorException('Errore durante la verifica dell utente.');\n    }\r\n  }\r\n}\r\n"]}

package/dist/accessi-module/middleware/accessiRequirements.d.ts

@@ -1,42 +1,57 @@
 import { Request } from "express";
+/** Grant effettivo letto da Accessi. Il confronto usa `tipoAbilitazione >= minPermissionLevel`. */
 export type AccessiGrant = {
     codiceMenu: string;
     tipoAbilitazione?: number;
 };
+/** Risultato memoizzato durante una singola autorizzazione. Non modificarlo nel custom handler. */
 export type GrantsResult = {
     grants?: AccessiGrant[];
     [key: string]: unknown;
 };
+/** Richiede l'accesso a un menu con almeno il livello indicato. Valori convenzionali: 10 lettura, 20 scrittura. */
 export type AccessiPermissionRequirement = {
     type: "permission";
     menuCode: string;
     minPermissionLevel: number;
 };
+/** Tutti i requisiti figli devono essere soddisfatti. Una lista vuota e una configurazione non valida. */
 export type AccessiAllRequirement = {
     type: "and";
     requirements: AccessiRequirementNode[];
 };
+/** Almeno un requisito figlio deve essere soddisfatto. Una lista vuota e una configurazione non valida. */
 export type AccessiAnyRequirement = {
     type: "or";
     requirements: AccessiRequirementNode[];
 };
+/** Nega il risultato del requisito figlio. Usarlo con cautela per non creare policy difficili da verificare. */
 export type AccessiNotRequirement = {
     type: "not";
     requirement: AccessiRequirementNode;
 };
+/** Delega una condizione applicativa a un handler registrato dal backend. */
 export type AccessiCustomRequirement = {
     type: "custom";
     key: string;
     payload?: unknown;
 };
+/** Nodo composabile dell'albero di autorizzazione valutato da `authorizeAccessi`. */
 export type AccessiRequirementNode = AccessiPermissionRequirement | AccessiAllRequirement | AccessiAnyRequirement | AccessiNotRequirement | AccessiCustomRequirement;
+/** Contesto in sola lettura consegnato a un requisito personalizzato. */
 export type AccessiCustomRequirementContext = {
     req: Request;
-    decodedToken: any;
+    decodedToken: Record<string, unknown>;
     userCode: number;
     getGrantsResult: () => Promise<GrantsResult>;
 };
+/** Handler applicativo per `accessiRequirement.custom`; `false` nega la richiesta, un errore produce 500. */
 export type AccessiCustomRequirementHandler = (context: AccessiCustomRequirementContext, payload?: unknown) => boolean | Promise<boolean>;
+/**
+ * Policy passata a `authorizeAccessi`.
+ * `requirements` e la forma compatibile storica ed equivale a un AND; `requirementTree`
+ * permette policy annidate e ha precedenza quando entrambi sono presenti.
+ */
 export type AccessiAuthorizationOptions = {
     requirements?: {
         menuCode: string;
@@ -45,10 +60,12 @@ export type AccessiAuthorizationOptions = {
     requirementTree?: AccessiRequirementNode;
     customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;
 };
+/** Errore di configurazione di una policy, distinto dal normale diniego 403. */
 export declare class RequirementEvaluationError extends Error {
     readonly code: string;
     constructor(code: string, message: string);
 }
+/** Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. */
 export declare const accessiRequirement: {
     permission: (menuCode: string, minPermissionLevel: number) => AccessiPermissionRequirement;
     and: (...requirements: AccessiRequirementNode[]) => AccessiAllRequirement;
@@ -56,5 +73,10 @@ export declare const accessiRequirement: {
     not: (requirement: AccessiRequirementNode) => AccessiNotRequirement;
     custom: (key: string, payload?: unknown) => AccessiCustomRequirement;
 };
+/** Normalizza la forma compatibile `requirements` nell'albero interno. */
 export declare function buildRequirementTree(options?: AccessiAuthorizationOptions): AccessiRequirementNode | undefined;
+/**
+ * Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.
+ * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.
+ */
 export declare function evaluateRequirement(requirement: AccessiRequirementNode, context: AccessiCustomRequirementContext, options?: AccessiAuthorizationOptions): Promise<boolean>;

package/dist/accessi-module/middleware/accessiRequirements.js

@@ -12,6 +12,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.accessiRequirement = exports.RequirementEvaluationError = void 0;
 exports.buildRequirementTree = buildRequirementTree;
 exports.evaluateRequirement = evaluateRequirement;
+/** Errore di configurazione di una policy, distinto dal normale diniego 403. */
 class RequirementEvaluationError extends Error {
     constructor(code, message) {
         super(message);
@@ -23,6 +24,7 @@ exports.RequirementEvaluationError = RequirementEvaluationError;
 function requirementError(code, message) {
     return new RequirementEvaluationError(code, message);
 }
+/** Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. */
 exports.accessiRequirement = {
     permission: (menuCode, minPermissionLevel) => ({
         type: "permission",
@@ -47,6 +49,7 @@ exports.accessiRequirement = {
         payload,
     }),
 };
+/** Normalizza la forma compatibile `requirements` nell'albero interno. */
 function buildRequirementTree(options) {
     var _a;
     if (options === null || options === void 0 ? void 0 : options.requirementTree)
@@ -57,6 +60,10 @@ function buildRequirementTree(options) {
     const nodes = requirements.map((requirement) => exports.accessiRequirement.permission(requirement.menuCode, requirement.minPermissionLevel));
     return exports.accessiRequirement.and(...nodes);
 }
+/**
+ * Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.
+ * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.
+ */
 function evaluateRequirement(requirement, context, options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a, _b;

package/dist/accessi-module/middleware/accessiRequirements.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessiRequirements.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/accessiRequirements.ts"],"names":[],"mappings":";;;;;;;;;;;;AAuGA,oDAgBC;AAED,kDAwDC;AAjHD,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAEY,QAAA,kBAAkB,GAAG;IAChC,UAAU,EAAE,CACV,QAAgB,EAChB,kBAA0B,EACI,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,kBAAkB;KACnB,CAAC;IACF,GAAG,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,KAAK;QACX,YAAY;KACb,CAAC;IACF,EAAE,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,IAAI;QACV,YAAY;KACb,CAAC;IACF,GAAG,EAAE,CAAC,WAAmC,EAAyB,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,KAAK;QACX,WAAW;KACZ,CAAC;IACF,MAAM,EAAE,CAAC,GAAW,EAAE,OAAiB,EAA4B,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,OAAO;KACR,CAAC;CACH,CAAC;AAEF,SAAgB,oBAAoB,CAClC,OAAqC;;IAErC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC;IAE7D,MAAM,YAAY,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE,CAAC;IACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,KAAK,GAA6B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACvE,0BAAkB,CAAC,UAAU,CAC3B,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,kBAAkB,CAC/B,CACF,CAAC;IAEF,OAAO,0BAAkB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,SAAsB,mBAAmB,CACvC,WAAmC,EACnC,OAAwC,EACxC,OAAqC;;;QAErC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAA,YAAY,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE;;oBACR,OAAA,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ;wBACxC,MAAM,CAAC,MAAA,KAAK,CAAC,gBAAgB,mCAAI,CAAC,CAAC,IAAI,WAAW,CAAC,kBAAkB,CAAA;iBAAA,CACxE,CAAC;YACJ,CAAC;YACD,KAAK,KAAK;gBACR,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,6DAA6D,CAC9D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAC1E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,KAAK,IAAI;gBACP,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,4DAA4D,CAC7D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtE,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,KAAK,KAAK;gBACR,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,yBAAyB,mCAAI,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,WAAW,CAAC,GAAG,aAAa,CAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD;gBACE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,CAChC,CAAC;QACN,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { Request } from \"express\";\n\nexport type AccessiGrant = {\n  codiceMenu: string;\n  tipoAbilitazione?: number;\n};\n\nexport type GrantsResult = {\n  grants?: AccessiGrant[];\n  [key: string]: unknown;\n};\n\nexport type AccessiPermissionRequirement = {\n  type: \"permission\";\n  menuCode: string;\n  minPermissionLevel: number;\n};\n\nexport type AccessiAllRequirement = {\n  type: \"and\";\n  requirements: AccessiRequirementNode[];\n};\n\nexport type AccessiAnyRequirement = {\n  type: \"or\";\n  requirements: AccessiRequirementNode[];\n};\n\nexport type AccessiNotRequirement = {\n  type: \"not\";\n  requirement: AccessiRequirementNode;\n};\n\nexport type AccessiCustomRequirement = {\n  type: \"custom\";\n  key: string;\n  payload?: unknown;\n};\n\nexport type AccessiRequirementNode =\n  | AccessiPermissionRequirement\n  | AccessiAllRequirement\n  | AccessiAnyRequirement\n  | AccessiNotRequirement\n  | AccessiCustomRequirement;\n\nexport type AccessiCustomRequirementContext = {\n  req: Request;\n  decodedToken: any;\n  userCode: number;\n  getGrantsResult: () => Promise<GrantsResult>;\n};\n\nexport type AccessiCustomRequirementHandler = (\n  context: AccessiCustomRequirementContext,\n  payload?: unknown\n) => boolean | Promise<boolean>;\n\nexport type AccessiAuthorizationOptions = {\n  requirements?: { menuCode: string; minPermissionLevel: number }[];\n  requirementTree?: AccessiRequirementNode;\n  customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;\n};\n\nexport class RequirementEvaluationError extends Error {\n  constructor(public readonly code: string, message: string) {\n    super(message);\n    this.name = \"RequirementEvaluationError\";\n  }\n}\n\nfunction requirementError(code: string, message: string): RequirementEvaluationError {\n  return new RequirementEvaluationError(code, message);\n}\n\nexport const accessiRequirement = {\n  permission: (\n    menuCode: string,\n    minPermissionLevel: number\n  ): AccessiPermissionRequirement => ({\n    type: \"permission\",\n    menuCode,\n    minPermissionLevel,\n  }),\n  and: (...requirements: AccessiRequirementNode[]): AccessiAllRequirement => ({\n    type: \"and\",\n    requirements,\n  }),\n  or: (...requirements: AccessiRequirementNode[]): AccessiAnyRequirement => ({\n    type: \"or\",\n    requirements,\n  }),\n  not: (requirement: AccessiRequirementNode): AccessiNotRequirement => ({\n    type: \"not\",\n    requirement,\n  }),\n  custom: (key: string, payload?: unknown): AccessiCustomRequirement => ({\n    type: \"custom\",\n    key,\n    payload,\n  }),\n};\n\nexport function buildRequirementTree(\n  options?: AccessiAuthorizationOptions\n): AccessiRequirementNode | undefined {\n  if (options?.requirementTree) return options.requirementTree;\n\n  const requirements = options?.requirements ?? [];\n  if (requirements.length === 0) return undefined;\n\n  const nodes: AccessiRequirementNode[] = requirements.map((requirement) =>\n    accessiRequirement.permission(\n      requirement.menuCode,\n      requirement.minPermissionLevel\n    )\n  );\n\n  return accessiRequirement.and(...nodes);\n}\n\nexport async function evaluateRequirement(\n  requirement: AccessiRequirementNode,\n  context: AccessiCustomRequirementContext,\n  options?: AccessiAuthorizationOptions\n): Promise<boolean> {\n  switch (requirement.type) {\n    case \"permission\": {\n      const grantsResult = await context.getGrantsResult();\n      const grants = grantsResult.grants ?? [];\n      return grants.some(\n        (grant) =>\n          grant.codiceMenu == requirement.menuCode &&\n          Number(grant.tipoAbilitazione ?? 0) >= requirement.minPermissionLevel\n      );\n    }\n    case \"and\":\n      if (!requirement.requirements || requirement.requirements.length === 0) {\n        throw requirementError(\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n          \"AND requirement must contain at least one child requirement\"\n        );\n      }\n      for (const child of requirement.requirements) {\n        if (!(await evaluateRequirement(child, context, options))) return false;\n      }\n      return true;\n    case \"or\":\n      if (!requirement.requirements || requirement.requirements.length === 0) {\n        throw requirementError(\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n          \"OR requirement must contain at least one child requirement\"\n        );\n      }\n      for (const child of requirement.requirements) {\n        if (await evaluateRequirement(child, context, options)) return true;\n      }\n      return false;\n    case \"not\":\n      return !(await evaluateRequirement(requirement.requirement, context, options));\n    case \"custom\": {\n      const handlers = options?.customRequirementHandlers ?? {};\n      const handler = handlers[requirement.key];\n      if (!handler) {\n        throw requirementError(\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n          `Custom requirement handler \"${requirement.key}\" not found`\n        );\n      }\n      return Boolean(await handler(context, requirement.payload));\n    }\n    default:\n      throw requirementError(\n        \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n        \"Unknown requirement node type\"\n      );\n  }\n}\n"]}
+{"version":3,"file":"accessiRequirements.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/accessiRequirements.ts"],"names":[],"mappings":";;;;;;;;;;;;AAyHA,oDAgBC;AAMD,kDAwDC;AAxHD,gFAAgF;AAChF,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,yGAAyG;AAC5F,QAAA,kBAAkB,GAAG;IAChC,UAAU,EAAE,CACV,QAAgB,EAChB,kBAA0B,EACI,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,kBAAkB;KACnB,CAAC;IACF,GAAG,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,KAAK;QACX,YAAY;KACb,CAAC;IACF,EAAE,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,IAAI;QACV,YAAY;KACb,CAAC;IACF,GAAG,EAAE,CAAC,WAAmC,EAAyB,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,KAAK;QACX,WAAW;KACZ,CAAC;IACF,MAAM,EAAE,CAAC,GAAW,EAAE,OAAiB,EAA4B,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,OAAO;KACR,CAAC;CACH,CAAC;AAEF,0EAA0E;AAC1E,SAAgB,oBAAoB,CAClC,OAAqC;;IAErC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC;IAE7D,MAAM,YAAY,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE,CAAC;IACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,KAAK,GAA6B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACvE,0BAAkB,CAAC,UAAU,CAC3B,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,kBAAkB,CAC/B,CACF,CAAC;IAEF,OAAO,0BAAkB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAsB,mBAAmB,CACvC,WAAmC,EACnC,OAAwC,EACxC,OAAqC;;;QAErC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAA,YAAY,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE;;oBACR,OAAA,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ;wBACxC,MAAM,CAAC,MAAA,KAAK,CAAC,gBAAgB,mCAAI,CAAC,CAAC,IAAI,WAAW,CAAC,kBAAkB,CAAA;iBAAA,CACxE,CAAC;YACJ,CAAC;YACD,KAAK,KAAK;gBACR,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,6DAA6D,CAC9D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAC1E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,KAAK,IAAI;gBACP,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,4DAA4D,CAC7D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtE,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,KAAK,KAAK;gBACR,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,yBAAyB,mCAAI,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,WAAW,CAAC,GAAG,aAAa,CAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD;gBACE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,CAChC,CAAC;QACN,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { Request } from \"express\";\r\n\r\n/** Grant effettivo letto da Accessi. Il confronto usa `tipoAbilitazione >= minPermissionLevel`. */\nexport type AccessiGrant = {\n  codiceMenu: string;\r\n  tipoAbilitazione?: number;\r\n};\r\n\r\n/** Risultato memoizzato durante una singola autorizzazione. Non modificarlo nel custom handler. */\nexport type GrantsResult = {\n  grants?: AccessiGrant[];\r\n  [key: string]: unknown;\r\n};\r\n\r\n/** Richiede l'accesso a un menu con almeno il livello indicato. Valori convenzionali: 10 lettura, 20 scrittura. */\nexport type AccessiPermissionRequirement = {\n  type: \"permission\";\r\n  menuCode: string;\r\n  minPermissionLevel: number;\r\n};\r\n\r\n/** Tutti i requisiti figli devono essere soddisfatti. Una lista vuota e una configurazione non valida. */\nexport type AccessiAllRequirement = {\n  type: \"and\";\r\n  requirements: AccessiRequirementNode[];\r\n};\r\n\r\n/** Almeno un requisito figlio deve essere soddisfatto. Una lista vuota e una configurazione non valida. */\nexport type AccessiAnyRequirement = {\n  type: \"or\";\r\n  requirements: AccessiRequirementNode[];\r\n};\r\n\r\n/** Nega il risultato del requisito figlio. Usarlo con cautela per non creare policy difficili da verificare. */\nexport type AccessiNotRequirement = {\n  type: \"not\";\r\n  requirement: AccessiRequirementNode;\r\n};\r\n\r\n/** Delega una condizione applicativa a un handler registrato dal backend. */\nexport type AccessiCustomRequirement = {\n  type: \"custom\";\r\n  key: string;\r\n  payload?: unknown;\r\n};\r\n\r\n/** Nodo composabile dell'albero di autorizzazione valutato da `authorizeAccessi`. */\nexport type AccessiRequirementNode =\n  | AccessiPermissionRequirement\r\n  | AccessiAllRequirement\r\n  | AccessiAnyRequirement\r\n  | AccessiNotRequirement\r\n  | AccessiCustomRequirement;\r\n\r\n/** Contesto in sola lettura consegnato a un requisito personalizzato. */\nexport type AccessiCustomRequirementContext = {\n  req: Request;\r\n  decodedToken: Record<string, unknown>;\r\n  userCode: number;\r\n  getGrantsResult: () => Promise<GrantsResult>;\r\n};\r\n\r\n/** Handler applicativo per `accessiRequirement.custom`; `false` nega la richiesta, un errore produce 500. */\nexport type AccessiCustomRequirementHandler = (\n  context: AccessiCustomRequirementContext,\r\n  payload?: unknown\r\n) => boolean | Promise<boolean>;\r\n\r\n/**\n * Policy passata a `authorizeAccessi`.\n * `requirements` e la forma compatibile storica ed equivale a un AND; `requirementTree`\n * permette policy annidate e ha precedenza quando entrambi sono presenti.\n */\nexport type AccessiAuthorizationOptions = {\n  requirements?: { menuCode: string; minPermissionLevel: number }[];\r\n  requirementTree?: AccessiRequirementNode;\r\n  customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;\r\n};\r\n\r\n/** Errore di configurazione di una policy, distinto dal normale diniego 403. */\nexport class RequirementEvaluationError extends Error {\n  constructor(public readonly code: string, message: string) {\r\n    super(message);\r\n    this.name = \"RequirementEvaluationError\";\r\n  }\r\n}\r\n\r\nfunction requirementError(code: string, message: string): RequirementEvaluationError {\r\n  return new RequirementEvaluationError(code, message);\r\n}\r\n\r\n/** Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. */\nexport const accessiRequirement = {\n  permission: (\r\n    menuCode: string,\r\n    minPermissionLevel: number\r\n  ): AccessiPermissionRequirement => ({\r\n    type: \"permission\",\r\n    menuCode,\r\n    minPermissionLevel,\r\n  }),\r\n  and: (...requirements: AccessiRequirementNode[]): AccessiAllRequirement => ({\r\n    type: \"and\",\r\n    requirements,\r\n  }),\r\n  or: (...requirements: AccessiRequirementNode[]): AccessiAnyRequirement => ({\r\n    type: \"or\",\r\n    requirements,\r\n  }),\r\n  not: (requirement: AccessiRequirementNode): AccessiNotRequirement => ({\r\n    type: \"not\",\r\n    requirement,\r\n  }),\r\n  custom: (key: string, payload?: unknown): AccessiCustomRequirement => ({\r\n    type: \"custom\",\r\n    key,\r\n    payload,\r\n  }),\r\n};\r\n\r\n/** Normalizza la forma compatibile `requirements` nell'albero interno. */\nexport function buildRequirementTree(\n  options?: AccessiAuthorizationOptions\r\n): AccessiRequirementNode | undefined {\r\n  if (options?.requirementTree) return options.requirementTree;\r\n\r\n  const requirements = options?.requirements ?? [];\r\n  if (requirements.length === 0) return undefined;\r\n\r\n  const nodes: AccessiRequirementNode[] = requirements.map((requirement) =>\r\n    accessiRequirement.permission(\r\n      requirement.menuCode,\r\n      requirement.minPermissionLevel\r\n    )\r\n  );\r\n\r\n  return accessiRequirement.and(...nodes);\r\n}\r\n\r\n/**\n * Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.\n * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.\n */\nexport async function evaluateRequirement(\n  requirement: AccessiRequirementNode,\r\n  context: AccessiCustomRequirementContext,\r\n  options?: AccessiAuthorizationOptions\r\n): Promise<boolean> {\r\n  switch (requirement.type) {\r\n    case \"permission\": {\r\n      const grantsResult = await context.getGrantsResult();\r\n      const grants = grantsResult.grants ?? [];\r\n      return grants.some(\r\n        (grant) =>\r\n          grant.codiceMenu == requirement.menuCode &&\r\n          Number(grant.tipoAbilitazione ?? 0) >= requirement.minPermissionLevel\r\n      );\r\n    }\r\n    case \"and\":\r\n      if (!requirement.requirements || requirement.requirements.length === 0) {\r\n        throw requirementError(\r\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n          \"AND requirement must contain at least one child requirement\"\r\n        );\r\n      }\r\n      for (const child of requirement.requirements) {\r\n        if (!(await evaluateRequirement(child, context, options))) return false;\r\n      }\r\n      return true;\r\n    case \"or\":\r\n      if (!requirement.requirements || requirement.requirements.length === 0) {\r\n        throw requirementError(\r\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n          \"OR requirement must contain at least one child requirement\"\r\n        );\r\n      }\r\n      for (const child of requirement.requirements) {\r\n        if (await evaluateRequirement(child, context, options)) return true;\r\n      }\r\n      return false;\r\n    case \"not\":\r\n      return !(await evaluateRequirement(requirement.requirement, context, options));\r\n    case \"custom\": {\r\n      const handlers = options?.customRequirementHandlers ?? {};\r\n      const handler = handlers[requirement.key];\r\n      if (!handler) {\r\n        throw requirementError(\r\n          \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n          `Custom requirement handler \"${requirement.key}\" not found`\r\n        );\r\n      }\r\n      return Boolean(await handler(context, requirement.payload));\r\n    }\r\n    default:\r\n      throw requirementError(\r\n        \"AUTH_REQUIREMENTS_MISCONFIGURED\",\r\n        \"Unknown requirement node type\"\r\n      );\r\n  }\r\n}\r\n"]}

package/dist/accessi-module/middleware/authenticateGen.d.ts

@@ -1,5 +1,5 @@
 import { NextFunction, Request, Response } from "express";
-import { AccessiOptions } from "../AccessiModule";
+import type { AccessiOptions } from "../AccessiModule";
 import { PermissionService } from "../Services/PermissionService/PermissionService";
 import { UserService } from "../Services/UserService/UserService";
 import { AccessiAuthorizationOptions } from "./accessiRequirements";
@@ -8,10 +8,25 @@ export declare class AuthenticateGenService {
     private readonly permissionService;
     private readonly userService;
     constructor(accessiOptions: AccessiOptions, permissionService: PermissionService, userService: UserService);
+    /**
+     * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.
+     * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.
+     */
     authorize(req: Request, res: Response, next: NextFunction, options?: AccessiAuthorizationOptions): Promise<void | Response<any, Record<string, any>>>;
 }
+/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */
 export declare function beginAccessiAuthInitialization(): void;
+/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */
 export declare function setAccessiAuthService(service: AuthenticateGenService): void;
+/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */
 export declare function failAccessiAuthInitialization(error: unknown): void;
+/**
+ * Middleware Express pubblico di Accessi.
+ *
+ * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente
+ * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente
+ * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.
+ */
 export declare function authorizeAccessi(req: Request, res: Response, next: NextFunction, options?: AccessiAuthorizationOptions): Promise<void | Response<any, Record<string, any>>>;
+/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */
 export declare const authenticateGen: typeof authorizeAccessi;

package/dist/accessi-module/middleware/authenticateGen.js

@@ -66,6 +66,7 @@ const UserService_1 = require("../Services/UserService/UserService");
 const Logger_1 = require("../../Logger");
 const accessiRequirements_1 = require("./accessiRequirements");
 const authenticatedToken_1 = require("../security/authenticatedToken");
+const passwordResetToken_1 = require("../security/passwordResetToken");
 const logger = new Logger_1.Logger("AuthenticateGen");
 const ACCESSI_AUTH_SERVICE_LOCALS_KEY = "accessiAuthService";
 const ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for("emilsoftware.accessiAuthService");
@@ -112,27 +113,47 @@ function logAuthFailure(req, authErr) {
     else
         logger.warning(message);
 }
+/** Sends the documented Accessi error contract from Express middleware. */
+function sendAuthenticationError(res, authErr) {
+    const message = authErr.status === 403
+        ? 'Operazione non autorizzata.'
+        : authErr.status >= 500
+            ? 'Errore interno del modulo Accessi.'
+            : 'Autenticazione non valida o scaduta.';
+    return res.status(authErr.status).json({
+        severity: 'error',
+        status: authErr.status,
+        statusCode: 2,
+        code: authErr.code,
+        // Kept for callers of older versions which already inspected `error`.
+        error: authErr.code,
+        message,
+    });
+}
 function authorizeWithDependencies(req, res, next, options, accessiOptions, permissionService, userService) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
+        const authenticatedRequest = req;
         try {
             const authHeader = req.headers.authorization;
             if (!authHeader) {
                 throw authError(401, "AUTH_HEADER_MISSING", "Authorization header not found");
             }
-            const token = authHeader.split(" ")[1];
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(authHeader);
             if (!token) {
                 throw authError(401, "AUTH_TOKEN_MISSING", "Token not found in Authorization header");
             }
-            const secret = (_b = (_a = accessiOptions === null || accessiOptions === void 0 ? void 0 : accessiOptions.jwtOptions) === null || _a === void 0 ? void 0 : _a.secret) !== null && _b !== void 0 ? _b : process.env.ACC_JWT_SECRET;
-            if (!secret) {
+            let secret;
+            try {
+                secret = (0, passwordResetToken_1.getAccessiJwtSecret)(accessiOptions, 'access');
+            }
+            catch (_a) {
                 throw authError(500, "AUTH_JWT_SECRET_MISSING", "JWT secret not configured");
             }
             let decoded;
             try {
-                decoded = jwt.verify(token, secret);
+                decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
             }
-            catch (_c) {
+            catch (_b) {
                 throw authError(401, "AUTH_TOKEN_INVALID", "Invalid JWT token");
             }
             const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(decoded);
@@ -140,7 +161,7 @@ function authorizeWithDependencies(req, res, next, options, accessiOptions, perm
                 throw authError(401, "AUTH_USER_CODE_MISSING", "codiceUtente not found in token payload");
             }
             const currentUser = yield userService.getAuthenticatedUserSnapshot(codiceUtente);
-            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(decoded, currentUser)) {
                 throw authError(401, "AUTH_USER_DISABLED", "User is no longer authorized");
             }
             const authenticatedPayload = (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(decoded, currentUser);
@@ -166,23 +187,16 @@ function authorizeWithDependencies(req, res, next, options, accessiOptions, perm
                 if (!hasPermissions) {
                     throw authError(403, "AUTH_INSUFFICIENT_PERMISSIONS", "User does not have required permissions");
                 }
-                req.userGrants = yield getGrantsResult();
+                authenticatedRequest.userGrants = yield getGrantsResult();
             }
-            req.user = authenticatedPayload;
-            req.data = authenticatedPayload;
+            authenticatedRequest.user = authenticatedPayload;
+            authenticatedRequest.data = authenticatedPayload;
             return next();
         }
         catch (error) {
             const authErr = normalizeAuthError(error);
             logAuthFailure(req, authErr);
-            const publicMessage = authErr.status === 403
-                ? "Forbidden"
-                : authErr.status >= 500
-                    ? "Internal server error"
-                    : "Unauthorized";
-            return res
-                .status(authErr.status)
-                .json({ message: publicMessage, error: authErr.message, code: authErr.code });
+            return sendAuthenticationError(res, authErr);
         }
     });
 }
@@ -192,6 +206,10 @@ let AuthenticateGenService = class AuthenticateGenService {
         this.permissionService = permissionService;
         this.userService = userService;
     }
+    /**
+     * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.
+     * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.
+     */
     authorize(req, res, next, options) {
         return __awaiter(this, void 0, void 0, function* () {
             return authorizeWithDependencies(req, res, next, options, this.accessiOptions, this.permissionService, this.userService);
@@ -200,7 +218,9 @@ let AuthenticateGenService = class AuthenticateGenService {
 };
 exports.AuthenticateGenService = AuthenticateGenService;
 exports.AuthenticateGenService = AuthenticateGenService = __decorate([
-    (0, common_1.Injectable)(),
+    (0, common_1.Injectable)()
+    /** Nest service behind the Express-compatible `authorizeAccessi` middleware. */
+    ,
     __param(0, (0, common_1.Inject)("ACCESSI_OPTIONS")),
     __metadata("design:paramtypes", [Object, PermissionService_1.PermissionService,
         UserService_1.UserService])
@@ -220,11 +240,13 @@ function isAuthenticateGenService(value) {
     return Boolean(value &&
         typeof value.authorize === "function");
 }
+/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */
 function beginAccessiAuthInitialization() {
     if (!authServiceBootstrapDeferred) {
         authServiceBootstrapDeferred = createDeferred();
     }
 }
+/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */
 function setAccessiAuthService(service) {
     authenticateGenServiceRef = service;
     globalThis[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;
@@ -233,6 +255,7 @@ function setAccessiAuthService(service) {
         authServiceBootstrapDeferred = null;
     }
 }
+/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */
 function failAccessiAuthInitialization(error) {
     if (authServiceBootstrapDeferred) {
         authServiceBootstrapDeferred.reject(error);
@@ -282,26 +305,41 @@ function resolveAccessiAuthService(req) {
         return getAccessiAuthServiceFromRequest(req);
     });
 }
+/**
+ * Middleware Express pubblico di Accessi.
+ *
+ * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente
+ * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente
+ * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.
+ */
 function authorizeAccessi(req, res, next, options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         const authService = yield resolveAccessiAuthService(req);
         if (!authService) {
             const status = authServiceBootstrapDeferred ? 503 : 500;
-            const message = authServiceBootstrapDeferred
-                ? "Accessi authentication service is still initializing"
-                : "Accessi authentication service not initialized";
+            const code = authServiceBootstrapDeferred
+                ? 'ACCESSI_AUTH_INITIALIZING'
+                : 'ACCESSI_AUTH_NOT_INITIALIZED';
             logger.error(`Authentication service not initialized ${JSON.stringify({
                 method: req.method,
                 path: (_a = req.originalUrl) !== null && _a !== void 0 ? _a : req.url,
                 status,
             })}`);
-            return res
-                .status(status)
-                .json({ message });
+            return res.status(status).json({
+                severity: 'error',
+                status,
+                statusCode: 2,
+                code,
+                error: code,
+                message: status === 503
+                    ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'
+                    : 'Il modulo Accessi non e disponibile.',
+            });
         }
         return authService.authorize(req, res, next, options);
     });
 }
+/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */
 exports.authenticateGen = authorizeAccessi;
 //# sourceMappingURL=authenticateGen.js.map