emilsoftware-utilities 2.0.0-dev.22 → 2.0.0-dev.24

package/dist/accessi-module/middleware/authenticateGen.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuPA,wEAIC;AAED,sDAOC;AAED,sEAKC;AAqDD,4CA0BC;AAzVD,kDAAoC;AACpC,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAIwC;AAExC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;;QAExB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAA,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,UAAU,0CAAE,MAAM,mCAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAChF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,OAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAEA,GAAW,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YACpD,CAAC;YAEA,GAAW,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACxC,GAAW,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACzC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,aAAa,GACjB,OAAO,CAAC,MAAM,KAAK,GAAG;gBACpB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;oBACrB,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,cAAc,CAAC;YACvB,OAAO,GAAG;iBACP,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;iBACtB,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CAAA;AAGM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEC,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AAxBY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CAwBlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,OAAO,GAAG,4BAA4B;gBAC1C,CAAC,CAAC,sDAAsD;gBACxD,CAAC,CAAC,gDAAgD,CAAC;YACrD,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG;iBACP,MAAM,CAAC,MAAM,CAAC;iBACd,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvB,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAEY,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\nimport * as jwt from \"jsonwebtoken\";\nimport { Inject, Injectable } from \"@nestjs/common\";\nimport { AccessiOptions } from \"../AccessiModule\";\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\nimport { UserService } from \"../Services/UserService/UserService\";\nimport { Logger } from \"../../Logger\";\nimport {\n  AccessiAuthorizationOptions,\n  AccessiCustomRequirementContext,\n  GrantsResult,\n  RequirementEvaluationError,\n  buildRequirementTree,\n  evaluateRequirement,\n} from \"./accessiRequirements\";\nimport {\n  buildAuthenticatedTokenPayload,\n  isAuthenticatedUserEnabledForJwt,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../security/authenticatedToken\";\n\nconst logger = new Logger(\"AuthenticateGen\");\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\n\ntype Deferred<T> = {\n  promise: Promise<T>;\n  resolve: (value: T) => void;\n  reject: (reason?: unknown) => void;\n};\n\nclass AuthMiddlewareError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly code: string,\n    message: string,\n    public readonly details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = \"AuthMiddlewareError\";\n  }\n}\n\nfunction authError(\n  status: number,\n  code: string,\n  message: string,\n  details?: Record<string, unknown>\n) {\n  return new AuthMiddlewareError(status, code, message, details);\n}\n\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\n  if (error instanceof AuthMiddlewareError) return error;\n  if (error instanceof RequirementEvaluationError) {\n    return authError(500, error.code, error.message);\n  }\n  if (error instanceof Error) {\n    return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\n      originalError: error.name,\n    });\n  }\n  return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\n}\n\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\n  const payload = {\n    code: authErr.code,\n    status: authErr.status,\n    message: authErr.message,\n    details: authErr.details,\n    method: req.method,\n    path: req.originalUrl ?? req.url,\n    ip: req.ip,\n  };\n\n  const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\n  if (authErr.status >= 500) logger.error(message);\n  else logger.warning(message);\n}\n\nasync function authorizeWithDependencies(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options: AccessiAuthorizationOptions | undefined,\n  accessiOptions: AccessiOptions,\n  permissionService: PermissionService,\n  userService: UserService\n) {\n  try {\n    const authHeader = req.headers.authorization;\n    if (!authHeader) {\n      throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\n    }\n\n    const token = authHeader.split(\" \")[1];\n    if (!token) {\n      throw authError(\n        401,\n        \"AUTH_TOKEN_MISSING\",\n        \"Token not found in Authorization header\"\n      );\n    }\n\n    const secret = accessiOptions?.jwtOptions?.secret ?? process.env.ACC_JWT_SECRET;\n    if (!secret) {\n      throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT secret not configured\");\n    }\n\n    let decoded: any;\n    try {\n      decoded = jwt.verify(token, secret);\n    } catch {\n      throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\n    }\n\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n    if (!codiceUtente) {\n      throw authError(\n        401,\n        \"AUTH_USER_CODE_MISSING\",\n        \"codiceUtente not found in token payload\"\n      );\n    }\n\n    const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\n      throw authError(\n        401,\n        \"AUTH_USER_DISABLED\",\n        \"User is no longer authorized\"\n      );\n    }\n\n    const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\n\n    const requirementTree = buildRequirementTree(options);\n    if (requirementTree) {\n      if (!accessiOptions?.databaseOptions) {\n        throw authError(\n          500,\n          \"AUTH_DATABASE_OPTIONS_MISSING\",\n          \"Database options not configured\"\n        );\n      }\n\n      let grantsResultCache: GrantsResult | null = null;\n      const getGrantsResult = async () => {\n        if (!grantsResultCache) {\n          grantsResultCache = await permissionService.getUserRolesAndGrants(\n            codiceUtente\n          );\n        }\n        return grantsResultCache;\n      };\n\n      const requirementContext: AccessiCustomRequirementContext = {\n        req,\n        decodedToken: authenticatedPayload,\n        userCode: codiceUtente,\n        getGrantsResult,\n      };\n\n      const hasPermissions = await evaluateRequirement(\n        requirementTree,\n        requirementContext,\n        options\n      );\n\n      if (!hasPermissions) {\n        throw authError(\n          403,\n          \"AUTH_INSUFFICIENT_PERMISSIONS\",\n          \"User does not have required permissions\"\n        );\n      }\n\n      (req as any).userGrants = await getGrantsResult();\n    }\n\n    (req as any).user = authenticatedPayload;\n    (req as any).data = authenticatedPayload;\n    return next();\n  } catch (error: unknown) {\n    const authErr = normalizeAuthError(error);\n    logAuthFailure(req, authErr);\n    const publicMessage =\n      authErr.status === 403\n        ? \"Forbidden\"\n        : authErr.status >= 500\n          ? \"Internal server error\"\n          : \"Unauthorized\";\n    return res\n      .status(authErr.status)\n      .json({ message: publicMessage, error: authErr.message, code: authErr.code });\n  }\n}\n\n@Injectable()\nexport class AuthenticateGenService {\n  constructor(\n    @Inject(\"ACCESSI_OPTIONS\")\n    private readonly accessiOptions: AccessiOptions,\n    private readonly permissionService: PermissionService,\n    private readonly userService: UserService\n  ) { }\n\n  async authorize(\n    req: Request,\n    res: Response,\n    next: NextFunction,\n    options?: AccessiAuthorizationOptions\n  ) {\n    return authorizeWithDependencies(\n      req,\n      res,\n      next,\n      options,\n      this.accessiOptions,\n      this.permissionService,\n      this.userService\n    );\n  }\n}\n\nlet authenticateGenServiceRef: AuthenticateGenService | null = null;\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> | null = null;\n\nfunction createDeferred<T>(): Deferred<T> {\n  let resolve!: (value: T) => void;\n  let reject!: (reason?: unknown) => void;\n  const promise = new Promise<T>((res, rej) => {\n    resolve = res;\n    reject = rej;\n  });\n  return { promise, resolve, reject };\n}\n\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\n  return Boolean(\n    value &&\n    typeof (value as { authorize?: unknown }).authorize === \"function\"\n  );\n}\n\nexport function beginAccessiAuthInitialization() {\n  if (!authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\n  }\n}\n\nexport function setAccessiAuthService(service: AuthenticateGenService) {\n  authenticateGenServiceRef = service;\n  (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.resolve(service);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\nexport function failAccessiAuthInitialization(error: unknown) {\n  if (authServiceBootstrapDeferred) {\n    authServiceBootstrapDeferred.reject(error);\n    authServiceBootstrapDeferred = null;\n  }\n}\n\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService | null {\n  const appLocalsService = (req.app?.locals as Record<string, unknown> | undefined)?.[\n    ACCESSI_AUTH_SERVICE_LOCALS_KEY\n  ];\n\n  if (isAuthenticateGenService(appLocalsService)) {\n    return appLocalsService as AuthenticateGenService;\n  }\n\n  const globalService = (globalThis as Record<symbol, unknown>)[\n    ACCESSI_AUTH_SERVICE_GLOBAL_KEY\n  ];\n  if (isAuthenticateGenService(globalService)) {\n    return globalService as AuthenticateGenService;\n  }\n\n  return authenticateGenServiceRef;\n}\n\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService | null> {\n  if (!authServiceBootstrapDeferred) {\n    return null;\n  }\n\n  const bootstrapPromise = authServiceBootstrapDeferred.promise;\n  const timeoutPromise = new Promise<null>((resolve) => {\n    setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\n  });\n\n  try {\n    const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\n    return isAuthenticateGenService(resolved) ? resolved : null;\n  } catch {\n    return null;\n  }\n}\n\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService | null> {\n  const immediateService = getAccessiAuthServiceFromRequest(req);\n  if (immediateService) {\n    return immediateService;\n  }\n\n  const bootstrappedService = await waitForBootstrappedService();\n  if (bootstrappedService) {\n    return bootstrappedService;\n  }\n\n  return getAccessiAuthServiceFromRequest(req);\n}\n\nexport async function authorizeAccessi(\n  req: Request,\n  res: Response,\n  next: NextFunction,\n  options?: AccessiAuthorizationOptions\n) {\n  const authService = await resolveAccessiAuthService(req);\n\n  if (!authService) {\n    const status = authServiceBootstrapDeferred ? 503 : 500;\n    const message = authServiceBootstrapDeferred\n      ? \"Accessi authentication service is still initializing\"\n      : \"Accessi authentication service not initialized\";\n    logger.error(\n      `Authentication service not initialized ${JSON.stringify({\n        method: req.method,\n        path: req.originalUrl ?? req.url,\n        status,\n      })}`\n    );\n    return res\n      .status(status)\n      .json({ message });\n  }\n\n  return authService.authorize(req, res, next, options);\n}\n\nexport const authenticateGen = authorizeAccessi;\n"]}
+{"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqRA,wEAIC;AAGD,sDAOC;AAGD,sEAKC;AA4DD,4CAiCC;AAvYD,kDAAoC;AACpC,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAMwC;AACxC,uEAAqE;AAErE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,GAAa,EAAE,OAA4B;IAC1E,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;YACrB,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,sCAAsC,CAAC;IAE/C,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,sEAAsE;QACtE,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;QAOxB,MAAM,oBAAoB,GAAG,GAA2B,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAA,wCAAmB,EAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YACzD,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,oBAAoB,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5D,CAAC;YAED,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CAAA;AAIM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEL;;;OAGG;IACG,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA5BY,wDAAsB;iCAAtB,sBAAsB;IAFlC,IAAA,mBAAU,GAAE;IACb,gFAAgF;;IAG3E,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CA4BlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED;;;;;;GAMG;AACH,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,IAAI,GAAG,4BAA4B;gBACvC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,8BAA8B,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,CAAC;gBACb,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,sCAAsC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAED,mIAAmI;AACtH,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\r\nimport * as jwt from \"jsonwebtoken\";\r\nimport { Inject, Injectable } from \"@nestjs/common\";\r\nimport type { AccessiOptions } from \"../AccessiModule\";\r\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\r\nimport { UserService } from \"../Services/UserService/UserService\";\r\nimport { Logger } from \"../../Logger\";\r\nimport {\r\n  AccessiAuthorizationOptions,\r\n  AccessiCustomRequirementContext,\r\n  GrantsResult,\r\n  RequirementEvaluationError,\r\n  buildRequirementTree,\r\n  evaluateRequirement,\r\n} from \"./accessiRequirements\";\r\nimport {\r\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\r\n  resolveCodiceUtenteFromTokenPayload,\r\n} from \"../security/authenticatedToken\";\r\nimport { getAccessiJwtSecret } from \"../security/passwordResetToken\";\n\r\nconst logger = new Logger(\"AuthenticateGen\");\r\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\r\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\r\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\r\n\r\ntype Deferred<T> = {\r\n  promise: Promise<T>;\r\n  resolve: (value: T) => void;\r\n  reject: (reason?: unknown) => void;\r\n};\r\n\r\nclass AuthMiddlewareError extends Error {\r\n  constructor(\r\n    public readonly status: number,\r\n    public readonly code: string,\r\n    message: string,\r\n    public readonly details?: Record<string, unknown>\r\n  ) {\r\n    super(message);\r\n    this.name = \"AuthMiddlewareError\";\r\n  }\r\n}\r\n\r\nfunction authError(\r\n  status: number,\r\n  code: string,\r\n  message: string,\r\n  details?: Record<string, unknown>\r\n) {\r\n  return new AuthMiddlewareError(status, code, message, details);\r\n}\r\n\r\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\r\n  if (error instanceof AuthMiddlewareError) return error;\r\n  if (error instanceof RequirementEvaluationError) {\r\n    return authError(500, error.code, error.message);\r\n  }\r\n  if (error instanceof Error) {\r\n    return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\r\n      originalError: error.name,\r\n    });\r\n  }\r\n  return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\r\n}\r\n\r\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\n  const payload = {\r\n    code: authErr.code,\r\n    status: authErr.status,\r\n    message: authErr.message,\r\n    details: authErr.details,\r\n    method: req.method,\r\n    path: req.originalUrl ?? req.url,\r\n    ip: req.ip,\r\n  };\r\n\r\n  const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\r\n  if (authErr.status >= 500) logger.error(message);\r\n  else logger.warning(message);\r\n}\n\n/** Sends the documented Accessi error contract from Express middleware. */\nfunction sendAuthenticationError(res: Response, authErr: AuthMiddlewareError): Response {\n  const message =\n    authErr.status === 403\n      ? 'Operazione non autorizzata.'\n      : authErr.status >= 500\n        ? 'Errore interno del modulo Accessi.'\n        : 'Autenticazione non valida o scaduta.';\n\n  return res.status(authErr.status).json({\n    severity: 'error',\n    status: authErr.status,\n    statusCode: 2,\n    code: authErr.code,\n    // Kept for callers of older versions which already inspected `error`.\n    error: authErr.code,\n    message,\n  });\n}\n\r\nasync function authorizeWithDependencies(\r\n  req: Request,\r\n  res: Response,\r\n  next: NextFunction,\r\n  options: AccessiAuthorizationOptions | undefined,\r\n  accessiOptions: AccessiOptions,\r\n  permissionService: PermissionService,\r\n  userService: UserService\r\n) {\r\n  type AuthenticatedRequest = Request & {\r\n    userGrants?: unknown;\r\n    user?: unknown;\r\n    data?: unknown;\r\n  };\r\n  const authenticatedRequest = req as AuthenticatedRequest;\r\n\r\n  try {\r\n    const authHeader = req.headers.authorization;\r\n    if (!authHeader) {\r\n      throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\r\n    }\r\n\r\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) {\r\n      throw authError(\r\n        401,\r\n        \"AUTH_TOKEN_MISSING\",\r\n        \"Token not found in Authorization header\"\r\n      );\r\n    }\r\n\r\n    let secret: string;\r\n    try {\r\n      secret = getAccessiJwtSecret(accessiOptions, 'access');\r\n    } catch {\r\n      throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT secret not configured\");\r\n    }\n\r\n    let decoded: unknown;\r\n    try {\r\n      decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });\r\n    } catch {\r\n      throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\r\n    }\r\n\r\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\r\n    if (!codiceUtente) {\r\n      throw authError(\r\n        401,\r\n        \"AUTH_USER_CODE_MISSING\",\r\n        \"codiceUtente not found in token payload\"\r\n      );\r\n    }\r\n\r\n    const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\r\n    if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw authError(\r\n        401,\r\n        \"AUTH_USER_DISABLED\",\r\n        \"User is no longer authorized\"\r\n      );\r\n    }\r\n\r\n    const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\r\n\r\n    const requirementTree = buildRequirementTree(options);\r\n    if (requirementTree) {\r\n      if (!accessiOptions?.databaseOptions) {\r\n        throw authError(\r\n          500,\r\n          \"AUTH_DATABASE_OPTIONS_MISSING\",\r\n          \"Database options not configured\"\r\n        );\r\n      }\r\n\r\n      let grantsResultCache: GrantsResult | null = null;\r\n      const getGrantsResult = async () => {\r\n        if (!grantsResultCache) {\r\n          grantsResultCache = await permissionService.getUserRolesAndGrants(\r\n            codiceUtente\r\n          );\r\n        }\r\n        return grantsResultCache;\r\n      };\r\n\r\n      const requirementContext: AccessiCustomRequirementContext = {\r\n        req,\r\n        decodedToken: authenticatedPayload,\r\n        userCode: codiceUtente,\r\n        getGrantsResult,\r\n      };\r\n\r\n      const hasPermissions = await evaluateRequirement(\r\n        requirementTree,\r\n        requirementContext,\r\n        options\r\n      );\r\n\r\n      if (!hasPermissions) {\r\n        throw authError(\r\n          403,\r\n          \"AUTH_INSUFFICIENT_PERMISSIONS\",\r\n          \"User does not have required permissions\"\r\n        );\r\n      }\r\n\r\n      authenticatedRequest.userGrants = await getGrantsResult();\r\n    }\r\n\r\n    authenticatedRequest.user = authenticatedPayload;\r\n    authenticatedRequest.data = authenticatedPayload;\r\n    return next();\r\n  } catch (error: unknown) {\r\n    const authErr = normalizeAuthError(error);\r\n    logAuthFailure(req, authErr);\r\n    return sendAuthenticationError(res, authErr);\n  }\r\n}\r\n\r\n@Injectable()\n/** Nest service behind the Express-compatible `authorizeAccessi` middleware. */\nexport class AuthenticateGenService {\n  constructor(\r\n    @Inject(\"ACCESSI_OPTIONS\")\r\n    private readonly accessiOptions: AccessiOptions,\r\n    private readonly permissionService: PermissionService,\r\n    private readonly userService: UserService\r\n  ) { }\r\n\r\n  /**\n   * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.\n   * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.\n   */\n  async authorize(\n    req: Request,\r\n    res: Response,\r\n    next: NextFunction,\r\n    options?: AccessiAuthorizationOptions\r\n  ) {\r\n    return authorizeWithDependencies(\r\n      req,\r\n      res,\r\n      next,\r\n      options,\r\n      this.accessiOptions,\r\n      this.permissionService,\r\n      this.userService\r\n    );\r\n  }\r\n}\r\n\r\nlet authenticateGenServiceRef: AuthenticateGenService | null = null;\r\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> | null = null;\r\n\r\nfunction createDeferred<T>(): Deferred<T> {\r\n  let resolve!: (value: T) => void;\r\n  let reject!: (reason?: unknown) => void;\r\n  const promise = new Promise<T>((res, rej) => {\r\n    resolve = res;\r\n    reject = rej;\r\n  });\r\n  return { promise, resolve, reject };\r\n}\r\n\r\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\r\n  return Boolean(\r\n    value &&\r\n    typeof (value as { authorize?: unknown }).authorize === \"function\"\r\n  );\r\n}\r\n\r\n/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */\nexport function beginAccessiAuthInitialization() {\n  if (!authServiceBootstrapDeferred) {\r\n    authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\r\n  }\r\n}\r\n\r\n/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */\nexport function setAccessiAuthService(service: AuthenticateGenService) {\n  authenticateGenServiceRef = service;\r\n  (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\r\n  if (authServiceBootstrapDeferred) {\r\n    authServiceBootstrapDeferred.resolve(service);\r\n    authServiceBootstrapDeferred = null;\r\n  }\r\n}\r\n\r\n/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */\nexport function failAccessiAuthInitialization(error: unknown) {\n  if (authServiceBootstrapDeferred) {\r\n    authServiceBootstrapDeferred.reject(error);\r\n    authServiceBootstrapDeferred = null;\r\n  }\r\n}\r\n\r\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService | null {\r\n  const appLocalsService = (req.app?.locals as Record<string, unknown> | undefined)?.[\r\n    ACCESSI_AUTH_SERVICE_LOCALS_KEY\r\n  ];\r\n\r\n  if (isAuthenticateGenService(appLocalsService)) {\r\n    return appLocalsService as AuthenticateGenService;\r\n  }\r\n\r\n  const globalService = (globalThis as Record<symbol, unknown>)[\r\n    ACCESSI_AUTH_SERVICE_GLOBAL_KEY\r\n  ];\r\n  if (isAuthenticateGenService(globalService)) {\r\n    return globalService as AuthenticateGenService;\r\n  }\r\n\r\n  return authenticateGenServiceRef;\r\n}\r\n\r\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService | null> {\r\n  if (!authServiceBootstrapDeferred) {\r\n    return null;\r\n  }\r\n\r\n  const bootstrapPromise = authServiceBootstrapDeferred.promise;\r\n  const timeoutPromise = new Promise<null>((resolve) => {\r\n    setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\r\n  });\r\n\r\n  try {\r\n    const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\r\n    return isAuthenticateGenService(resolved) ? resolved : null;\r\n  } catch {\r\n    return null;\r\n  }\r\n}\r\n\r\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService | null> {\r\n  const immediateService = getAccessiAuthServiceFromRequest(req);\r\n  if (immediateService) {\r\n    return immediateService;\r\n  }\r\n\r\n  const bootstrappedService = await waitForBootstrappedService();\r\n  if (bootstrappedService) {\r\n    return bootstrappedService;\r\n  }\r\n\r\n  return getAccessiAuthServiceFromRequest(req);\r\n}\r\n\r\n/**\n * Middleware Express pubblico di Accessi.\n *\n * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente\n * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente\n * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.\n */\nexport async function authorizeAccessi(\n  req: Request,\r\n  res: Response,\r\n  next: NextFunction,\r\n  options?: AccessiAuthorizationOptions\r\n) {\r\n  const authService = await resolveAccessiAuthService(req);\r\n\r\n  if (!authService) {\r\n    const status = authServiceBootstrapDeferred ? 503 : 500;\r\n    const code = authServiceBootstrapDeferred\n      ? 'ACCESSI_AUTH_INITIALIZING'\n      : 'ACCESSI_AUTH_NOT_INITIALIZED';\n    logger.error(\r\n      `Authentication service not initialized ${JSON.stringify({\r\n        method: req.method,\r\n        path: req.originalUrl ?? req.url,\r\n        status,\r\n      })}`\r\n    );\r\n    return res.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: 2,\n      code,\n      error: code,\n      message: status === 503\n        ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'\n        : 'Il modulo Accessi non e disponibile.',\n    });\n  }\r\n\r\n  return authService.authorize(req, res, next, options);\r\n}\r\n\r\n/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */\nexport const authenticateGen = authorizeAccessi;\n"]}

package/dist/accessi-module/security/AccessiHttpExceptionFilter.d.ts

@@ -0,0 +1,12 @@
+import { ArgumentsHost, ExceptionFilter } from '@nestjs/common';
+/**
+ * Finalizes every exception raised before an Accessi controller can reply.
+ *
+ * This includes invalid JSON, validation-pipe errors and guard failures. The
+ * filter deliberately never return SQL, stack traces or provider diagnostics.
+ */
+export declare class AccessiHttpExceptionFilter implements ExceptionFilter {
+    catch(exception: unknown, host: ArgumentsHost): void;
+    private getPayload;
+    private isInvalidJson;
+}

package/dist/accessi-module/security/AccessiHttpExceptionFilter.js

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiHttpExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+const Utilities_1 = require("../../Utilities");
+/**
+ * Finalizes every exception raised before an Accessi controller can reply.
+ *
+ * This includes invalid JSON, validation-pipe errors and guard failures. The
+ * filter deliberately never return SQL, stack traces or provider diagnostics.
+ */
+let AccessiHttpExceptionFilter = class AccessiHttpExceptionFilter {
+    catch(exception, host) {
+        var _a, _b;
+        const response = host.switchToHttp().getResponse();
+        if (response.headersSent)
+            return;
+        const status = exception instanceof common_1.HttpException
+            ? exception.getStatus()
+            : Utilities_1.RestUtilities.isDatabaseSchemaError(exception)
+                ? common_1.HttpStatus.SERVICE_UNAVAILABLE
+                : common_1.HttpStatus.INTERNAL_SERVER_ERROR;
+        const payload = this.getPayload(exception);
+        const invalidJson = status === common_1.HttpStatus.BAD_REQUEST && this.isInvalidJson(exception, payload);
+        const explicitMessage = typeof payload.message === 'string' ? payload.message : undefined;
+        const code = (_a = payload.code) !== null && _a !== void 0 ? _a : (Utilities_1.RestUtilities.isDatabaseSchemaError(exception)
+            ? 'ACCESSI_DATABASE_SCHEMA_OUTDATED'
+            : invalidJson
+                ? 'ACCESSI_INVALID_JSON'
+                : status === common_1.HttpStatus.BAD_REQUEST
+                    ? 'ACCESSI_REQUEST_ERROR'
+                    : status === common_1.HttpStatus.UNAUTHORIZED
+                        ? 'ACCESSI_UNAUTHORIZED'
+                        : status === common_1.HttpStatus.FORBIDDEN
+                            ? 'ACCESSI_FORBIDDEN'
+                            : 'ACCESSI_INTERNAL_ERROR');
+        const message = code === 'ACCESSI_VALIDATION_ERROR'
+            ? 'La richiesta contiene dati non validi.'
+            : code === 'ACCESSI_DATABASE_SCHEMA_OUTDATED'
+                ? 'Lo schema del database Accessi non e aggiornato. Eseguire la migrazione database e riprovare.'
+                : invalidJson
+                    ? 'Il corpo della richiesta non contiene JSON valido.'
+                    : explicitMessage !== null && explicitMessage !== void 0 ? explicitMessage : (status === common_1.HttpStatus.UNAUTHORIZED
+                        ? 'Autenticazione non valida o scaduta.'
+                        : status === common_1.HttpStatus.FORBIDDEN
+                            ? 'Operazione non autorizzata.'
+                            : status >= common_1.HttpStatus.INTERNAL_SERVER_ERROR
+                                ? 'Errore interno del modulo Accessi.'
+                                : 'Richiesta non valida.');
+        response.status(status).json(Object.assign({ severity: 'error', status, statusCode: Utilities_1.StatusCode.Error, code, error: code, message }, (((_b = payload.details) === null || _b === void 0 ? void 0 : _b.length) ? { details: payload.details } : {})));
+    }
+    getPayload(exception) {
+        if (!(exception instanceof common_1.HttpException))
+            return {};
+        const response = exception.getResponse();
+        return typeof response === 'string' ? { message: response } : response;
+    }
+    isInvalidJson(exception, payload) {
+        const message = exception instanceof Error ? exception.message : payload.message;
+        const text = Array.isArray(message) ? message.join(' ') : String(message !== null && message !== void 0 ? message : '');
+        return /json|unexpected token|expected property name|unterminated string/i.test(text);
+    }
+};
+exports.AccessiHttpExceptionFilter = AccessiHttpExceptionFilter;
+exports.AccessiHttpExceptionFilter = AccessiHttpExceptionFilter = __decorate([
+    (0, common_1.Catch)()
+], AccessiHttpExceptionFilter);
+//# sourceMappingURL=AccessiHttpExceptionFilter.js.map

package/dist/accessi-module/security/AccessiHttpExceptionFilter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessiHttpExceptionFilter.js","sourceRoot":"","sources":["../../../src/accessi-module/security/AccessiHttpExceptionFilter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAkG;AAElG,+CAA4D;AAS5D;;;;;GAKG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,KAAK,CAAC,SAAkB,EAAE,IAAmB;;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;QAC7D,IAAI,QAAQ,CAAC,WAAW;YAAE,OAAO;QAEjC,MAAM,MAAM,GAAG,SAAS,YAAY,sBAAa;YAC/C,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE;YACvB,CAAC,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;gBAC9C,CAAC,CAAC,mBAAU,CAAC,mBAAmB;gBAChC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,KAAK,mBAAU,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChG,MAAM,eAAe,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCACpB,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;YAChD,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,WAAW;oBACjC,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBAClC,CAAC,CAAC,sBAAsB;wBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,mBAAmB;4BACrB,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,KAAK,0BAA0B;YACjD,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,IAAI,KAAK,kCAAkC;gBAC3C,CAAC,CAAC,+FAA+F;gBACjG,CAAC,CAAC,WAAW;oBACX,CAAC,CAAC,oDAAoD;oBACtD,CAAC,CAAC,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBACtD,CAAC,CAAC,sCAAsC;wBACxC,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,6BAA6B;4BAC/B,CAAC,CAAC,MAAM,IAAI,mBAAU,CAAC,qBAAqB;gCAC1C,CAAC,CAAC,oCAAoC;gCACtC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAEvC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,iBAC1B,QAAQ,EAAE,OAAO,EACjB,MAAM,EACN,UAAU,EAAE,sBAAU,CAAC,KAAK,EAC5B,IAAI,EACJ,KAAK,EAAE,IAAI,EACX,OAAO,IACJ,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,MAAM,EAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAChE,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,SAAkB;QACnC,IAAI,CAAC,CAAC,SAAS,YAAY,sBAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAA4B,CAAC;IAC7F,CAAC;IAEO,aAAa,CAAC,SAAkB,EAAE,OAAyB;QACjE,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACjF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;QAChF,OAAO,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;CACF,CAAA;AA9DY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,cAAK,GAAE;GACK,0BAA0B,CA8DtC","sourcesContent":["import { ArgumentsHost, Catch, ExceptionFilter, HttpException, HttpStatus } from '@nestjs/common';\nimport { Response } from 'express';\nimport { RestUtilities, StatusCode } from '../../Utilities';\n\ntype ExceptionPayload = {\n  code?: string;\n  error?: string;\n  message?: string | string[];\n  details?: string[];\n};\n\n/**\n * Finalizes every exception raised before an Accessi controller can reply.\n *\n * This includes invalid JSON, validation-pipe errors and guard failures. The\n * filter deliberately never return SQL, stack traces or provider diagnostics.\n */\n@Catch()\nexport class AccessiHttpExceptionFilter implements ExceptionFilter {\n  catch(exception: unknown, host: ArgumentsHost): void {\n    const response = host.switchToHttp().getResponse<Response>();\n    if (response.headersSent) return;\n\n    const status = exception instanceof HttpException\n      ? exception.getStatus()\n      : RestUtilities.isDatabaseSchemaError(exception)\n        ? HttpStatus.SERVICE_UNAVAILABLE\n        : HttpStatus.INTERNAL_SERVER_ERROR;\n    const payload = this.getPayload(exception);\n    const invalidJson = status === HttpStatus.BAD_REQUEST && this.isInvalidJson(exception, payload);\n    const explicitMessage = typeof payload.message === 'string' ? payload.message : undefined;\n    const code = payload.code\n      ?? (RestUtilities.isDatabaseSchemaError(exception)\n        ? 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n        : invalidJson\n          ? 'ACCESSI_INVALID_JSON'\n          : status === HttpStatus.BAD_REQUEST\n            ? 'ACCESSI_REQUEST_ERROR'\n            : status === HttpStatus.UNAUTHORIZED\n              ? 'ACCESSI_UNAUTHORIZED'\n              : status === HttpStatus.FORBIDDEN\n                ? 'ACCESSI_FORBIDDEN'\n                : 'ACCESSI_INTERNAL_ERROR');\n\n    const message = code === 'ACCESSI_VALIDATION_ERROR'\n      ? 'La richiesta contiene dati non validi.'\n      : code === 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n        ? 'Lo schema del database Accessi non e aggiornato. Eseguire la migrazione database e riprovare.'\n        : invalidJson\n          ? 'Il corpo della richiesta non contiene JSON valido.'\n          : explicitMessage ?? (status === HttpStatus.UNAUTHORIZED\n            ? 'Autenticazione non valida o scaduta.'\n            : status === HttpStatus.FORBIDDEN\n              ? 'Operazione non autorizzata.'\n              : status >= HttpStatus.INTERNAL_SERVER_ERROR\n                ? 'Errore interno del modulo Accessi.'\n                : 'Richiesta non valida.');\n\n    response.status(status).json({\n      severity: 'error',\n      status,\n      statusCode: StatusCode.Error,\n      code,\n      error: code,\n      message,\n      ...(payload.details?.length ? { details: payload.details } : {}),\n    });\n  }\n\n  private getPayload(exception: unknown): ExceptionPayload {\n    if (!(exception instanceof HttpException)) return {};\n    const response = exception.getResponse();\n    return typeof response === 'string' ? { message: response } : response as ExceptionPayload;\n  }\n\n  private isInvalidJson(exception: unknown, payload: ExceptionPayload): boolean {\n    const message = exception instanceof Error ? exception.message : payload.message;\n    const text = Array.isArray(message) ? message.join(' ') : String(message ?? '');\n    return /json|unexpected token|expected property name|unterminated string/i.test(text);\n  }\n}\n"]}

package/dist/accessi-module/security/accessControl.d.ts

@@ -1,17 +1,28 @@
 import { Request } from 'express';
+/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */
 export interface AuthenticatedAccessiUser {
     codiceUtente: number;
     email?: string;
     flagSuper: boolean;
     flagAdminConfigurator: boolean;
 }
+/**
+ * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.
+ * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.
+ */
 export declare function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser;
+/** Impone il flag superutente, necessario per configurazione globale, utenti e catalogo SSO. */
 export declare function ensureSuperUser(user: AuthenticatedAccessiUser, message?: string): void;
+/** Permette l'operazione al proprietario della risorsa o a un superutente. */
 export declare function ensureSelfOrSuperUser(user: AuthenticatedAccessiUser, targetUserCode: number, message?: string): void;
+/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */
 export declare function hasPrivilegedUserChanges(user: {
     statoRegistrazione?: unknown;
     flagSuper?: unknown;
     flagAdminConfigurator?: unknown;
+    passwordLoginEnabled?: unknown;
+    passwordlessLoginEnabled?: unknown;
+    flagDueFattori?: unknown;
     roles?: unknown;
     permissions?: unknown;
 }): boolean;

package/dist/accessi-module/security/accessControl.js

@@ -8,12 +8,21 @@ const common_1 = require("@nestjs/common");
 function normalizeBooleanFlag(value) {
     return value === true || value === 1 || value === '1';
 }
+/**
+ * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.
+ * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.
+ */
 function getAuthenticatedAccessiUser(req) {
-    var _a, _b, _c;
-    const payload = req === null || req === void 0 ? void 0 : req.user;
-    const utente = (_c = (_a = payload === null || payload === void 0 ? void 0 : payload.utente) !== null && _a !== void 0 ? _a : (_b = payload === null || payload === void 0 ? void 0 : payload.userData) === null || _b === void 0 ? void 0 : _b.utente) !== null && _c !== void 0 ? _c : payload;
+    var _a, _b;
+    const payload = req.user;
+    const payloadRecord = payload && typeof payload === 'object' ? payload : undefined;
+    const userData = (payloadRecord === null || payloadRecord === void 0 ? void 0 : payloadRecord.userData) && typeof payloadRecord.userData === 'object'
+        ? payloadRecord.userData
+        : undefined;
+    const rawUser = (_b = (_a = payloadRecord === null || payloadRecord === void 0 ? void 0 : payloadRecord.utente) !== null && _a !== void 0 ? _a : userData === null || userData === void 0 ? void 0 : userData.utente) !== null && _b !== void 0 ? _b : payloadRecord;
+    const utente = rawUser && typeof rawUser === 'object' ? rawUser : undefined;
     const codiceUtente = Number(utente === null || utente === void 0 ? void 0 : utente.codiceUtente);
-    if (!codiceUtente) {
+    if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {
         throw new common_1.UnauthorizedException('Utente non autenticato.');
     }
     return {
@@ -23,21 +32,27 @@ function getAuthenticatedAccessiUser(req) {
         flagAdminConfigurator: normalizeBooleanFlag(utente === null || utente === void 0 ? void 0 : utente.flagAdminConfigurator),
     };
 }
+/** Impone il flag superutente, necessario per configurazione globale, utenti e catalogo SSO. */
 function ensureSuperUser(user, message = 'Operazione riservata agli amministratori.') {
     if (!user.flagSuper) {
         throw new common_1.ForbiddenException(message);
     }
 }
+/** Permette l'operazione al proprietario della risorsa o a un superutente. */
 function ensureSelfOrSuperUser(user, targetUserCode, message = 'Operazione non autorizzata su questo utente.') {
     if (user.flagSuper || user.codiceUtente === targetUserCode) {
         return;
     }
     throw new common_1.ForbiddenException(message);
 }
+/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */
 function hasPrivilegedUserChanges(user) {
     return (user.statoRegistrazione !== undefined ||
         user.flagSuper !== undefined ||
         user.flagAdminConfigurator !== undefined ||
+        user.passwordLoginEnabled !== undefined ||
+        user.passwordlessLoginEnabled !== undefined ||
+        user.flagDueFattori !== undefined ||
         user.roles !== undefined ||
         user.permissions !== undefined);
 }

package/dist/accessi-module/security/accessControl.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAcA,kEAeC;AAED,0CAOC;AAED,sDAUC;AAED,4DAcC;AAlED,2CAA2E;AAU3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAW,aAAX,GAAG,uBAAH,GAAG,CAAU,IAAI,CAAC;IACnC,MAAM,MAAM,GAAG,MAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,MAAM,mCAAI,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,0CAAE,MAAM,mCAAI,OAAO,CAAC;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,qBAAqB,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,qBAAqB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,wBAAwB,CAAC,IAMxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,qBAAqB,KAAK,SAAS;QACxC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\nexport interface AuthenticatedAccessiUser {\n  codiceUtente: number;\n  email?: string;\n  flagSuper: boolean;\n  flagAdminConfigurator: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n  const payload = (req as any)?.user;\n  const utente = payload?.utente ?? payload?.userData?.utente ?? payload;\n  const codiceUtente = Number(utente?.codiceUtente);\n\n  if (!codiceUtente) {\n    throw new UnauthorizedException('Utente non autenticato.');\n  }\n\n  return {\n    codiceUtente,\n    email: typeof utente?.email === 'string' ? utente.email : undefined,\n    flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n    flagAdminConfigurator: normalizeBooleanFlag(utente?.flagAdminConfigurator),\n  };\n}\n\nexport function ensureSuperUser(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori.',\n): void {\n  if (!user.flagSuper) {\n    throw new ForbiddenException(message);\n  }\n}\n\nexport function ensureSelfOrSuperUser(\n  user: AuthenticatedAccessiUser,\n  targetUserCode: number,\n  message = 'Operazione non autorizzata su questo utente.',\n): void {\n  if (user.flagSuper || user.codiceUtente === targetUserCode) {\n    return;\n  }\n\n  throw new ForbiddenException(message);\n}\n\nexport function hasPrivilegedUserChanges(user: {\n  statoRegistrazione?: unknown;\n  flagSuper?: unknown;\n  flagAdminConfigurator?: unknown;\n  roles?: unknown;\n  permissions?: unknown;\n}): boolean {\n  return (\n    user.statoRegistrazione !== undefined ||\n    user.flagSuper !== undefined ||\n    user.flagAdminConfigurator !== undefined ||\n    user.roles !== undefined ||\n    user.permissions !== undefined\n  );\n}\n"]}
+{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,sDAUC;AAGD,4DAoBC;AArFD,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,qBAAqB,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,qBAAqB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,qBAAqB,KAAK,SAAS;QACxC,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\r\nimport { Request } from 'express';\r\n\r\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */\nexport interface AuthenticatedAccessiUser {\n  codiceUtente: number;\r\n  email?: string;\r\n  flagSuper: boolean;\r\n  flagAdminConfigurator: boolean;\r\n}\r\n\r\nfunction normalizeBooleanFlag(value: unknown): boolean {\r\n  return value === true || value === 1 || value === '1';\r\n}\r\n\r\n/**\n * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n */\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n  const payload = (req as Request & { user?: unknown }).user;\r\n  const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\r\n  const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\r\n    ? payloadRecord.userData as Record<string, unknown>\r\n    : undefined;\r\n  const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\r\n  const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\r\n  const codiceUtente = Number(utente?.codiceUtente);\r\n\r\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\r\n    throw new UnauthorizedException('Utente non autenticato.');\r\n  }\r\n\r\n  return {\r\n    codiceUtente,\r\n    email: typeof utente?.email === 'string' ? utente.email : undefined,\r\n    flagSuper: normalizeBooleanFlag(utente?.flagSuper),\r\n    flagAdminConfigurator: normalizeBooleanFlag(utente?.flagAdminConfigurator),\r\n  };\n}\r\n\r\n/** Impone il flag superutente, necessario per configurazione globale, utenti e catalogo SSO. */\nexport function ensureSuperUser(\n  user: AuthenticatedAccessiUser,\r\n  message = 'Operazione riservata agli amministratori.',\r\n): void {\r\n  if (!user.flagSuper) {\r\n    throw new ForbiddenException(message);\r\n  }\r\n}\r\n\r\n/** Permette l'operazione al proprietario della risorsa o a un superutente. */\nexport function ensureSelfOrSuperUser(\n  user: AuthenticatedAccessiUser,\r\n  targetUserCode: number,\r\n  message = 'Operazione non autorizzata su questo utente.',\r\n): void {\r\n  if (user.flagSuper || user.codiceUtente === targetUserCode) {\r\n    return;\r\n  }\r\n\r\n  throw new ForbiddenException(message);\r\n}\r\n\r\n/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n  statoRegistrazione?: unknown;\r\n  flagSuper?: unknown;\r\n  flagAdminConfigurator?: unknown;\n  passwordLoginEnabled?: unknown;\n  passwordlessLoginEnabled?: unknown;\n  flagDueFattori?: unknown;\n  roles?: unknown;\r\n  permissions?: unknown;\r\n}): boolean {\r\n  return (\r\n    user.statoRegistrazione !== undefined ||\r\n    user.flagSuper !== undefined ||\r\n    user.flagAdminConfigurator !== undefined ||\n    user.passwordLoginEnabled !== undefined ||\n    user.passwordlessLoginEnabled !== undefined ||\n    user.flagDueFattori !== undefined ||\n    user.roles !== undefined ||\r\n    user.permissions !== undefined\r\n  );\r\n}\r\n"]}

package/dist/accessi-module/security/accessiValidation.d.ts

@@ -0,0 +1,9 @@
+import { ValidationPipe } from '@nestjs/common';
+/**
+ * Creates the validation pipe used by every Accessi bootstrap path.
+ *
+ * It deliberately returns one stable, documented error contract instead of
+ * Nest's default array. Consumers can branch on `code`; `details` is safe to
+ * display or log because it contains only DTO field names and validation text.
+ */
+export declare function createAccessiValidationPipe(): ValidationPipe;

package/dist/accessi-module/security/accessiValidation.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiValidationPipe = createAccessiValidationPipe;
+const common_1 = require("@nestjs/common");
+const Utilities_1 = require("../../Utilities");
+/**
+ * Creates the validation pipe used by every Accessi bootstrap path.
+ *
+ * It deliberately returns one stable, documented error contract instead of
+ * Nest's default array. Consumers can branch on `code`; `details` is safe to
+ * display or log because it contains only DTO field names and validation text.
+ */
+function createAccessiValidationPipe() {
+    return new common_1.ValidationPipe({
+        whitelist: true,
+        forbidNonWhitelisted: true,
+        transform: true,
+        transformOptions: {
+            enableImplicitConversion: true,
+        },
+        exceptionFactory: (errors) => new common_1.BadRequestException({
+            severity: 'error',
+            status: 400,
+            statusCode: Utilities_1.StatusCode.Error,
+            code: 'ACCESSI_VALIDATION_ERROR',
+            error: 'ACCESSI_VALIDATION_ERROR',
+            message: 'La richiesta contiene dati non validi.',
+            details: flattenValidationErrors(errors),
+        }),
+    });
+}
+/** Converts nested class-validator failures into deterministic client details. */
+function flattenValidationErrors(errors, parentPath = '') {
+    return errors.flatMap((error) => {
+        var _a, _b;
+        const path = parentPath ? `${parentPath}.${error.property}` : error.property;
+        const ownMessages = Object.values((_a = error.constraints) !== null && _a !== void 0 ? _a : {}).map((message) => `${path}: ${message}`);
+        return [...ownMessages, ...flattenValidationErrors((_b = error.children) !== null && _b !== void 0 ? _b : [], path)];
+    });
+}
+//# sourceMappingURL=accessiValidation.js.map

package/dist/accessi-module/security/accessiValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessiValidation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessiValidation.ts"],"names":[],"mappings":";;AAUA,kEAmBC;AA7BD,2CAAsF;AACtF,+CAA6C;AAE7C;;;;;;GAMG;AACH,SAAgB,2BAA2B;IACzC,OAAO,IAAI,uBAAc,CAAC;QACxB,SAAS,EAAE,IAAI;QACf,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE;YAChB,wBAAwB,EAAE,IAAI;SAC/B;QACD,gBAAgB,EAAE,CAAC,MAAyB,EAAE,EAAE,CAC9C,IAAI,4BAAmB,CAAC;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,sBAAU,CAAC,KAAK;YAC5B,IAAI,EAAE,0BAA0B;YAChC,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,wCAAwC;YACjD,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC;SACzC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,uBAAuB,CAAC,MAAyB,EAAE,UAAU,GAAG,EAAE;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,uBAAuB,CAAC,MAAA,KAAK,CAAC,QAAQ,mCAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { BadRequestException, ValidationError, ValidationPipe } from '@nestjs/common';\nimport { StatusCode } from '../../Utilities';\n\n/**\n * Creates the validation pipe used by every Accessi bootstrap path.\n *\n * It deliberately returns one stable, documented error contract instead of\n * Nest's default array. Consumers can branch on `code`; `details` is safe to\n * display or log because it contains only DTO field names and validation text.\n */\nexport function createAccessiValidationPipe(): ValidationPipe {\n  return new ValidationPipe({\n    whitelist: true,\n    forbidNonWhitelisted: true,\n    transform: true,\n    transformOptions: {\n      enableImplicitConversion: true,\n    },\n    exceptionFactory: (errors: ValidationError[]) =>\n      new BadRequestException({\n        severity: 'error',\n        status: 400,\n        statusCode: StatusCode.Error,\n        code: 'ACCESSI_VALIDATION_ERROR',\n        error: 'ACCESSI_VALIDATION_ERROR',\n        message: 'La richiesta contiene dati non validi.',\n        details: flattenValidationErrors(errors),\n      }),\n  });\n}\n\n/** Converts nested class-validator failures into deterministic client details. */\nfunction flattenValidationErrors(errors: ValidationError[], parentPath = ''): string[] {\n  return errors.flatMap((error) => {\n    const path = parentPath ? `${parentPath}.${error.property}` : error.property;\n    const ownMessages = Object.values(error.constraints ?? {}).map((message) => `${path}: ${message}`);\n    return [...ownMessages, ...flattenValidationErrors(error.children ?? [], path)];\n  });\n}\n"]}

package/dist/accessi-module/security/authenticatedToken.d.ts

@@ -1,11 +1,25 @@
 import { StatoRegistrazione } from '../Dtos/StatoRegistrazione';
+/** Stato autorevole minimo riletto dal database per ogni verifica JWT. */
 export interface AccessiAuthenticatedUserSnapshot {
     codiceUtente: number;
     email?: string;
     statoRegistrazione: StatoRegistrazione;
     flagSuper: boolean;
     flagAdminConfigurator: boolean;
+    flagDueFattori?: boolean;
+    passwordlessLoginEnabled?: boolean;
+    passwordLoginEnabled?: boolean;
 }
+/** Shared, strict Bearer parsing for the Nest guard and Express middleware. */
+export declare function extractAccessiBearerToken(header: unknown): string | undefined;
+/** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */
 export declare function resolveCodiceUtenteFromTokenPayload(decoded: unknown): number | undefined;
+/**
+ * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.
+ * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.
+ */
 export declare function buildAuthenticatedTokenPayload(decoded: unknown, utente: AccessiAuthenticatedUserSnapshot): Record<string, unknown>;
-export declare function isAuthenticatedUserEnabledForJwt(utente: AccessiAuthenticatedUserSnapshot | null | undefined): boolean;
+/** Enabling 2FA invalidates sessions which have not completed the required verification. */
+export declare function isAccessiTokenAllowedForUser(decoded: unknown, user: AccessiAuthenticatedUserSnapshot): boolean;
+/** Un JWT puo essere usato soltanto da utenti nello stato confermato, indipendentemente dalla sua scadenza. */
+export declare function isAuthenticatedUserEnabledForJwt(utente: AccessiAuthenticatedUserSnapshot | null | undefined): utente is AccessiAuthenticatedUserSnapshot;

package/dist/accessi-module/security/authenticatedToken.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractAccessiBearerToken = extractAccessiBearerToken;
 exports.resolveCodiceUtenteFromTokenPayload = resolveCodiceUtenteFromTokenPayload;
 exports.buildAuthenticatedTokenPayload = buildAuthenticatedTokenPayload;
+exports.isAccessiTokenAllowedForUser = isAccessiTokenAllowedForUser;
 exports.isAuthenticatedUserEnabledForJwt = isAuthenticatedUserEnabledForJwt;
 const StatoRegistrazione_1 = require("../Dtos/StatoRegistrazione");
 function normalizeBooleanFlag(value) {
@@ -10,9 +12,18 @@ function normalizeBooleanFlag(value) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
+/** Shared, strict Bearer parsing for the Nest guard and Express middleware. */
+function extractAccessiBearerToken(header) {
+    var _a;
+    if (typeof header !== 'string')
+        return undefined;
+    return (_a = /^Bearer[ \t]+([^\s]+)$/i.exec(header.trim())) === null || _a === void 0 ? void 0 : _a[1];
+}
+/** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */
 function resolveCodiceUtenteFromTokenPayload(decoded) {
     var _a;
-    if (!isRecord(decoded)) {
+    // `typ` obbligatorio: un token senza tipo non e un access token Accessi.
+    if (!isRecord(decoded) || decoded.typ !== 'access') {
         return undefined;
     }
     const userData = isRecord(decoded.userData) ? decoded.userData : undefined;
@@ -22,17 +33,33 @@ function resolveCodiceUtenteFromTokenPayload(decoded) {
             ? userData.utente
             : undefined;
     const codiceUtente = Number((_a = utente === null || utente === void 0 ? void 0 : utente.codiceUtente) !== null && _a !== void 0 ? _a : decoded.codiceUtente);
-    if (!Number.isFinite(codiceUtente) || codiceUtente <= 0) {
+    if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {
         return undefined;
     }
     return codiceUtente;
 }
+/**
+ * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.
+ * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.
+ */
 function buildAuthenticatedTokenPayload(decoded, utente) {
     const basePayload = isRecord(decoded) ? Object.assign({}, decoded) : {};
     const userData = isRecord(basePayload.userData) ? Object.assign({}, basePayload.userData) : {};
-    const normalizedUser = Object.assign(Object.assign({}, utente), { flagSuper: normalizeBooleanFlag(utente.flagSuper), flagAdminConfigurator: normalizeBooleanFlag(utente.flagAdminConfigurator) });
-    return Object.assign(Object.assign({}, basePayload), { utente: normalizedUser, userData: Object.assign(Object.assign({}, userData), { utente: normalizedUser }), tokenPayload: decoded });
+    const normalizedUser = Object.assign(Object.assign({}, utente), { flagSuper: normalizeBooleanFlag(utente.flagSuper), flagAdminConfigurator: normalizeBooleanFlag(utente.flagAdminConfigurator), flagDueFattori: normalizeBooleanFlag(utente.flagDueFattori), passwordlessLoginEnabled: normalizeBooleanFlag(utente.passwordlessLoginEnabled) });
+    return Object.assign(Object.assign({}, basePayload), { codiceUtente: normalizedUser.codiceUtente, email: normalizedUser.email, statoRegistrazione: normalizedUser.statoRegistrazione, flagSuper: normalizedUser.flagSuper, flagAdminConfigurator: normalizedUser.flagAdminConfigurator, flagDueFattori: normalizedUser.flagDueFattori, passwordlessLoginEnabled: normalizedUser.passwordlessLoginEnabled, passwordLoginEnabled: normalizedUser.passwordLoginEnabled, utente: normalizedUser, userData: Object.assign(Object.assign({}, userData), { utente: normalizedUser }), tokenPayload: decoded });
+}
+/** Enabling 2FA invalidates sessions which have not completed the required verification. */
+function isAccessiTokenAllowedForUser(decoded, user) {
+    if (!isRecord(decoded))
+        return false;
+    const methods = Array.isArray(decoded.amr) ? decoded.amr : [];
+    if (user.flagDueFattori && !methods.includes('otp'))
+        return false;
+    if (methods.includes('passwordless') && (!user.flagDueFattori || !user.passwordlessLoginEnabled))
+        return false;
+    return true;
 }
+/** Un JWT puo essere usato soltanto da utenti nello stato confermato, indipendentemente dalla sua scadenza. */
 function isAuthenticatedUserEnabledForJwt(utente) {
     return (utente === null || utente === void 0 ? void 0 : utente.statoRegistrazione) === StatoRegistrazione_1.StatoRegistrazione.CONF;
 }

package/dist/accessi-module/security/authenticatedToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticatedToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/authenticatedToken.ts"],"names":[],"mappings":";;AAkBA,kFAkBC;AAED,wEAsBC;AAED,4EAIC;AAlED,mEAAgE;AAUhE,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAgB,mCAAmC,CAAC,OAAgB;;IAClE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,QAAQ,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,mCAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAgB,8BAA8B,CAC5C,OAAgB,EAChB,MAAwC;IAExC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAM,OAAO,EAAG,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAM,WAAW,CAAC,QAAQ,EAAG,CAAC,CAAC,EAAE,CAAC;IAEnF,MAAM,cAAc,mCACf,MAAM,KACT,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,EACjD,qBAAqB,EAAE,oBAAoB,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAC1E,CAAC;IAEF,uCACK,WAAW,KACd,MAAM,EAAE,cAAc,EACtB,QAAQ,kCACH,QAAQ,KACX,MAAM,EAAE,cAAc,KAExB,YAAY,EAAE,OAAO,IACrB;AACJ,CAAC;AAED,SAAgB,gCAAgC,CAC9C,MAA2D;IAE3D,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,kBAAkB,MAAK,uCAAkB,CAAC,IAAI,CAAC;AAChE,CAAC","sourcesContent":["import { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\n\nexport interface AccessiAuthenticatedUserSnapshot {\n  codiceUtente: number;\n  email?: string;\n  statoRegistrazione: StatoRegistrazione;\n  flagSuper: boolean;\n  flagAdminConfigurator: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\nexport function resolveCodiceUtenteFromTokenPayload(decoded: unknown): number | undefined {\n  if (!isRecord(decoded)) {\n    return undefined;\n  }\n\n  const userData = isRecord(decoded.userData) ? decoded.userData : undefined;\n  const utente = isRecord(decoded.utente)\n    ? decoded.utente\n    : isRecord(userData?.utente)\n      ? userData.utente\n      : undefined;\n\n  const codiceUtente = Number(utente?.codiceUtente ?? decoded.codiceUtente);\n  if (!Number.isFinite(codiceUtente) || codiceUtente <= 0) {\n    return undefined;\n  }\n\n  return codiceUtente;\n}\n\nexport function buildAuthenticatedTokenPayload(\n  decoded: unknown,\n  utente: AccessiAuthenticatedUserSnapshot,\n): Record<string, unknown> {\n  const basePayload = isRecord(decoded) ? { ...decoded } : {};\n  const userData = isRecord(basePayload.userData) ? { ...basePayload.userData } : {};\n\n  const normalizedUser = {\n    ...utente,\n    flagSuper: normalizeBooleanFlag(utente.flagSuper),\n    flagAdminConfigurator: normalizeBooleanFlag(utente.flagAdminConfigurator),\n  };\n\n  return {\n    ...basePayload,\n    utente: normalizedUser,\n    userData: {\n      ...userData,\n      utente: normalizedUser,\n    },\n    tokenPayload: decoded,\n  };\n}\n\nexport function isAuthenticatedUserEnabledForJwt(\n  utente: AccessiAuthenticatedUserSnapshot | null | undefined,\n): boolean {\n  return utente?.statoRegistrazione === StatoRegistrazione.CONF;\n}\n"]}
+{"version":3,"file":"authenticatedToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/authenticatedToken.ts"],"names":[],"mappings":";;AAuBA,8DAGC;AAGD,kFAmBC;AAMD,wEAgCC;AAGD,oEAMC;AAGD,4EAIC;AAtGD,mEAAgE;AAchE,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,SAAgB,yBAAyB,CAAC,MAAe;;IACvD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,MAAA,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,0CAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,8FAA8F;AAC9F,SAAgB,mCAAmC,CAAC,OAAgB;;IAClE,yEAAyE;IACzE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,QAAQ,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,mCAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,8BAA8B,CAC5C,OAAgB,EAChB,MAAwC;IAExC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAM,OAAO,EAAG,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAM,WAAW,CAAC,QAAQ,EAAG,CAAC,CAAC,EAAE,CAAC;IAEnF,MAAM,cAAc,mCACf,MAAM,KACT,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,EACjD,qBAAqB,EAAE,oBAAoB,CAAC,MAAM,CAAC,qBAAqB,CAAC,EACzE,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,EAC3D,wBAAwB,EAAE,oBAAoB,CAAC,MAAM,CAAC,wBAAwB,CAAC,GAChF,CAAC;IAEF,uCACK,WAAW,KACd,YAAY,EAAE,cAAc,CAAC,YAAY,EACzC,KAAK,EAAE,cAAc,CAAC,KAAK,EAC3B,kBAAkB,EAAE,cAAc,CAAC,kBAAkB,EACrD,SAAS,EAAE,cAAc,CAAC,SAAS,EACnC,qBAAqB,EAAE,cAAc,CAAC,qBAAqB,EAC3D,cAAc,EAAE,cAAc,CAAC,cAAc,EAC7C,wBAAwB,EAAE,cAAc,CAAC,wBAAwB,EACjE,oBAAoB,EAAE,cAAc,CAAC,oBAAoB,EACzD,MAAM,EAAE,cAAc,EACtB,QAAQ,kCACH,QAAQ,KACX,MAAM,EAAE,cAAc,KAExB,YAAY,EAAE,OAAO,IACrB;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAgB,4BAA4B,CAAC,OAAgB,EAAE,IAAsC;IACnG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+GAA+G;AAC/G,SAAgB,gCAAgC,CAC9C,MAA2D;IAE3D,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,kBAAkB,MAAK,uCAAkB,CAAC,IAAI,CAAC;AAChE,CAAC","sourcesContent":["import { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\r\n\r\n/** Stato autorevole minimo riletto dal database per ogni verifica JWT. */\nexport interface AccessiAuthenticatedUserSnapshot {\n  codiceUtente: number;\r\n  email?: string;\r\n  statoRegistrazione: StatoRegistrazione;\r\n  flagSuper: boolean;\r\n  flagAdminConfigurator: boolean;\n  flagDueFattori?: boolean;\n  passwordlessLoginEnabled?: boolean;\n  passwordLoginEnabled?: boolean;\n}\r\n\r\nfunction normalizeBooleanFlag(value: unknown): boolean {\r\n  return value === true || value === 1 || value === '1';\r\n}\r\n\r\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\r\n}\n\n/** Shared, strict Bearer parsing for the Nest guard and Express middleware. */\nexport function extractAccessiBearerToken(header: unknown): string | undefined {\n  if (typeof header !== 'string') return undefined;\n  return /^Bearer[ \\t]+([^\\s]+)$/i.exec(header.trim())?.[1];\n}\n\r\n/** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */\nexport function resolveCodiceUtenteFromTokenPayload(decoded: unknown): number | undefined {\r\n  // `typ` obbligatorio: un token senza tipo non e un access token Accessi.\r\n  if (!isRecord(decoded) || decoded.typ !== 'access') {\r\n    return undefined;\r\n  }\n\r\n  const userData = isRecord(decoded.userData) ? decoded.userData : undefined;\r\n  const utente = isRecord(decoded.utente)\r\n    ? decoded.utente\r\n    : isRecord(userData?.utente)\r\n      ? userData.utente\r\n      : undefined;\r\n\r\n  const codiceUtente = Number(utente?.codiceUtente ?? decoded.codiceUtente);\r\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n    return undefined;\r\n  }\r\n\r\n  return codiceUtente;\r\n}\r\n\r\n/**\n * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.\n * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.\n */\nexport function buildAuthenticatedTokenPayload(\n  decoded: unknown,\r\n  utente: AccessiAuthenticatedUserSnapshot,\r\n): Record<string, unknown> {\r\n  const basePayload = isRecord(decoded) ? { ...decoded } : {};\r\n  const userData = isRecord(basePayload.userData) ? { ...basePayload.userData } : {};\r\n\r\n  const normalizedUser = {\r\n    ...utente,\r\n    flagSuper: normalizeBooleanFlag(utente.flagSuper),\r\n    flagAdminConfigurator: normalizeBooleanFlag(utente.flagAdminConfigurator),\n    flagDueFattori: normalizeBooleanFlag(utente.flagDueFattori),\n    passwordlessLoginEnabled: normalizeBooleanFlag(utente.passwordlessLoginEnabled),\n  };\r\n\r\n  return {\r\n    ...basePayload,\n    codiceUtente: normalizedUser.codiceUtente,\n    email: normalizedUser.email,\n    statoRegistrazione: normalizedUser.statoRegistrazione,\n    flagSuper: normalizedUser.flagSuper,\n    flagAdminConfigurator: normalizedUser.flagAdminConfigurator,\n    flagDueFattori: normalizedUser.flagDueFattori,\n    passwordlessLoginEnabled: normalizedUser.passwordlessLoginEnabled,\n    passwordLoginEnabled: normalizedUser.passwordLoginEnabled,\n    utente: normalizedUser,\r\n    userData: {\r\n      ...userData,\r\n      utente: normalizedUser,\r\n    },\r\n    tokenPayload: decoded,\r\n  };\r\n}\n\n/** Enabling 2FA invalidates sessions which have not completed the required verification. */\nexport function isAccessiTokenAllowedForUser(decoded: unknown, user: AccessiAuthenticatedUserSnapshot): boolean {\n  if (!isRecord(decoded)) return false;\n  const methods = Array.isArray(decoded.amr) ? decoded.amr : [];\n  if (user.flagDueFattori && !methods.includes('otp')) return false;\n  if (methods.includes('passwordless') && (!user.flagDueFattori || !user.passwordlessLoginEnabled)) return false;\n  return true;\n}\n\r\n/** Un JWT puo essere usato soltanto da utenti nello stato confermato, indipendentemente dalla sua scadenza. */\nexport function isAuthenticatedUserEnabledForJwt(\r\n  utente: AccessiAuthenticatedUserSnapshot | null | undefined,\r\n): utente is AccessiAuthenticatedUserSnapshot {\r\n  return utente?.statoRegistrazione === StatoRegistrazione.CONF;\r\n}\n"]}

package/dist/accessi-module/security/passwordResetToken.d.ts

@@ -1,7 +1,17 @@
-import { AccessiOptions } from '../AccessiModule';
+import * as jwt from 'jsonwebtoken';
+import type { AccessiOptions } from '../AccessiModule';
+/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */
 export declare const DEFAULT_PASSWORD_RESET_EXPIRES_IN = "1h";
-export declare function getAccessiJwtSecret(options: AccessiOptions): string;
-export declare function createPasswordResetToken(codiceUtente: number, nonce: string, secret: string, expiresIn?: string): string;
+/** Scopo della chiave derivata: separa le chiavi di access token, reset password e 2FA. */
+export type AccessiJwtPurpose = 'access' | 'reset' | '2fa';
+/**
+ * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).
+ * Un leak della chiave di reset non compromette gli access token e viceversa.
+ */
+export declare function getAccessiJwtSecret(options: AccessiOptions, purpose?: AccessiJwtPurpose): string;
+/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */
+export declare function createPasswordResetToken(codiceUtente: number, nonce: string, secret: string, expiresIn?: jwt.SignOptions['expiresIn']): string;
+/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */
 export declare function verifyPasswordResetToken(token: string, secret: string): {
     codiceUtente: number;
     nonce: string;

package/dist/accessi-module/security/passwordResetToken.js

@@ -38,15 +38,22 @@ exports.getAccessiJwtSecret = getAccessiJwtSecret;
 exports.createPasswordResetToken = createPasswordResetToken;
 exports.verifyPasswordResetToken = verifyPasswordResetToken;
 const jwt = __importStar(require("jsonwebtoken"));
+const crypto_1 = require("crypto");
+/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */
 exports.DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';
-function getAccessiJwtSecret(options) {
+/**
+ * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).
+ * Un leak della chiave di reset non compromette gli access token e viceversa.
+ */
+function getAccessiJwtSecret(options, purpose = 'access') {
     var _a;
     const secret = ((_a = options === null || options === void 0 ? void 0 : options.jwtOptions) === null || _a === void 0 ? void 0 : _a.secret) || process.env.ACC_JWT_SECRET;
     if (!secret) {
         throw new Error('JWT secret non configurato.');
     }
-    return secret;
+    return (0, crypto_1.createHmac)('sha256', secret).update(`accessi:jwt:${purpose}:v1`).digest('hex');
 }
+/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */
 function createPasswordResetToken(codiceUtente, nonce, secret, expiresIn = exports.DEFAULT_PASSWORD_RESET_EXPIRES_IN) {
     if (!codiceUtente || !nonce) {
         throw new Error('Dati insufficienti per generare il reset token.');
@@ -56,13 +63,14 @@ function createPasswordResetToken(codiceUtente, nonce, secret, expiresIn = expor
         typ: 'password-reset',
     }, secret, {
         subject: `${codiceUtente}`,
-        expiresIn: expiresIn,
+        expiresIn,
     });
 }
+/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */
 function verifyPasswordResetToken(token, secret) {
-    const decoded = jwt.verify(token, secret);
+    const decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
     const codiceUtente = Number(decoded === null || decoded === void 0 ? void 0 : decoded.sub);
-    if ((decoded === null || decoded === void 0 ? void 0 : decoded.typ) !== 'password-reset' || !codiceUtente || typeof (decoded === null || decoded === void 0 ? void 0 : decoded.nonce) !== 'string') {
+    if ((decoded === null || decoded === void 0 ? void 0 : decoded.typ) !== 'password-reset' || !Number.isSafeInteger(codiceUtente) || codiceUtente <= 0 || typeof (decoded === null || decoded === void 0 ? void 0 : decoded.nonce) !== 'string' || !decoded.nonce) {
         throw new Error('Token di reset non valido.');
     }
     return {

package/dist/accessi-module/security/passwordResetToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"passwordResetToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,kDAOC;AAED,4DAqBC;AAED,4DAeC;AAzDD,kDAAoC;AAGvB,QAAA,iCAAiC,GAAG,IAAI,CAAC;AAOtD,SAAgB,mBAAmB,CAAC,OAAuB;;IACzD,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,KAAa,EACb,MAAc,EACd,YAAoB,yCAAiC;IAErD,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CACb;QACE,KAAK;QACL,GAAG,EAAE,gBAAgB;KACtB,EACD,MAAM,EACN;QACE,OAAO,EAAE,GAAG,YAAY,EAAE;QAC1B,SAAS,EAAE,SAAgB;KAC5B,CACF,CAAC;AACJ,CAAC;AAED,SAAgB,wBAAwB,CACtC,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAA8B,CAAC;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,MAAK,gBAAgB,IAAI,CAAC,YAAY,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import * as jwt from 'jsonwebtoken';\nimport { AccessiOptions } from '../AccessiModule';\n\nexport const DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';\n\ninterface PasswordResetTokenPayload extends jwt.JwtPayload {\n  nonce: string;\n  typ: 'password-reset';\n}\n\nexport function getAccessiJwtSecret(options: AccessiOptions): string {\n  const secret = options?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\n  if (!secret) {\n    throw new Error('JWT secret non configurato.');\n  }\n\n  return secret;\n}\n\nexport function createPasswordResetToken(\n  codiceUtente: number,\n  nonce: string,\n  secret: string,\n  expiresIn: string = DEFAULT_PASSWORD_RESET_EXPIRES_IN,\n): string {\n  if (!codiceUtente || !nonce) {\n    throw new Error('Dati insufficienti per generare il reset token.');\n  }\n\n  return jwt.sign(\n    {\n      nonce,\n      typ: 'password-reset',\n    },\n    secret,\n    {\n      subject: `${codiceUtente}`,\n      expiresIn: expiresIn as any,\n    },\n  );\n}\n\nexport function verifyPasswordResetToken(\n  token: string,\n  secret: string,\n): { codiceUtente: number; nonce: string } {\n  const decoded = jwt.verify(token, secret) as PasswordResetTokenPayload;\n  const codiceUtente = Number(decoded?.sub);\n\n  if (decoded?.typ !== 'password-reset' || !codiceUtente || typeof decoded?.nonce !== 'string') {\n    throw new Error('Token di reset non valido.');\n  }\n\n  return {\n    codiceUtente,\n    nonce: decoded.nonce,\n  };\n}\n"]}
+{"version":3,"file":"passwordResetToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,kDAOC;AAGD,4DAqBC;AAGD,4DAeC;AApED,kDAAoC;AACpC,mCAAoC;AAGpC,mHAAmH;AACtG,QAAA,iCAAiC,GAAG,IAAI,CAAC;AAUtD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAuB,EAAE,UAA6B,QAAQ;;IAChG,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,oHAAoH;AACpH,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,KAAa,EACb,MAAc,EACd,YAA0C,yCAAiC;IAE3E,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CACb;QACE,KAAK;QACL,GAAG,EAAE,gBAAgB;KACtB,EACD,MAAM,EACN;QACE,OAAO,EAAE,GAAG,YAAY,EAAE;QAC1B,SAAS;KACV,CACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,wBAAwB,CACtC,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAA8B,CAAC;IAClG,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,MAAK,gBAAgB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1J,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import * as jwt from 'jsonwebtoken';\r\nimport { createHmac } from 'crypto';\r\nimport type { AccessiOptions } from '../AccessiModule';\r\n\r\n/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */\nexport const DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';\n\r\ninterface PasswordResetTokenPayload extends jwt.JwtPayload {\r\n  nonce: string;\r\n  typ: 'password-reset';\r\n}\r\n\r\n/** Scopo della chiave derivata: separa le chiavi di access token, reset password e 2FA. */\r\nexport type AccessiJwtPurpose = 'access' | 'reset' | '2fa';\r\n\r\n/**\r\n * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).\r\n * Un leak della chiave di reset non compromette gli access token e viceversa.\r\n */\r\nexport function getAccessiJwtSecret(options: AccessiOptions, purpose: AccessiJwtPurpose = 'access'): string {\r\n  const secret = options?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\r\n  if (!secret) {\r\n    throw new Error('JWT secret non configurato.');\r\n  }\r\n\r\n  return createHmac('sha256', secret).update(`accessi:jwt:${purpose}:v1`).digest('hex');\r\n}\n\r\n/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */\nexport function createPasswordResetToken(\n  codiceUtente: number,\r\n  nonce: string,\r\n  secret: string,\r\n  expiresIn: jwt.SignOptions['expiresIn'] = DEFAULT_PASSWORD_RESET_EXPIRES_IN,\r\n): string {\r\n  if (!codiceUtente || !nonce) {\r\n    throw new Error('Dati insufficienti per generare il reset token.');\r\n  }\r\n\r\n  return jwt.sign(\r\n    {\r\n      nonce,\r\n      typ: 'password-reset',\r\n    },\r\n    secret,\r\n    {\r\n      subject: `${codiceUtente}`,\r\n      expiresIn,\r\n    },\r\n  );\r\n}\r\n\r\n/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */\nexport function verifyPasswordResetToken(\n  token: string,\r\n  secret: string,\r\n): { codiceUtente: number; nonce: string } {\r\n  const decoded = jwt.verify(token, secret, { algorithms: ['HS256'] }) as PasswordResetTokenPayload;\r\n  const codiceUtente = Number(decoded?.sub);\r\n\r\n  if (decoded?.typ !== 'password-reset' || !Number.isSafeInteger(codiceUtente) || codiceUtente <= 0 || typeof decoded?.nonce !== 'string' || !decoded.nonce) {\n    throw new Error('Token di reset non valido.');\r\n  }\r\n\r\n  return {\r\n    codiceUtente,\r\n    nonce: decoded.nonce,\r\n  };\r\n}\r\n"]}

package/dist/accessi-module/security/publicAuthRateLimit.d.ts

@@ -1,9 +1,9 @@
 import { Request, Response } from 'express';
-import { AccessiOptions } from '../AccessiModule';
-export type PublicAuthRateLimitScope = 'login' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken';
+import type { AccessiOptions } from '../AccessiModule';
+export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken';
 type RateLimitDecision = {
     allowed: boolean;
-    retryAfterSeconds?: number;
+    retryAfterSeconds: number;
 };
 export declare function checkPublicAuthRateLimit(options: AccessiOptions, scope: PublicAuthRateLimitScope, req: Request, identifiers?: string[]): RateLimitDecision;
 export declare function sendPublicAuthRateLimitExceeded(res: Response, retryAfterSeconds: number): Response;