emilsoftware-utilities 2.0.0-dev.22 → 2.0.0-dev.24

package/dist/accessi-module/security/publicAuthRateLimit.js

@@ -6,6 +6,8 @@ const common_1 = require("@nestjs/common");
 const Utilities_1 = require("../../Utilities");
 const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
+    twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },
+    twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },
     register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
@@ -49,9 +51,27 @@ function pruneRateLimitBuckets(now) {
         }
     }
 }
+/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */
+function enforceBucketCap() {
+    while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {
+        let oldestKey;
+        let oldestSeen = Number.POSITIVE_INFINITY;
+        for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {
+            if (bucket.lastSeenAt < oldestSeen) {
+                oldestSeen = bucket.lastSeenAt;
+                oldestKey = key;
+            }
+        }
+        if (oldestKey === undefined) {
+            return;
+        }
+        RATE_LIMIT_BUCKETS.delete(oldestKey);
+    }
+}
 function consumeBucket(bucketKey, rule, now) {
     const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);
     if (!existingBucket || existingBucket.resetAt <= now) {
+        enforceBucketCap();
         RATE_LIMIT_BUCKETS.set(bucketKey, {
             count: 1,
             resetAt: now + rule.windowMs,
@@ -69,23 +89,25 @@ function consumeBucket(bucketKey, rule, now) {
 function checkPublicAuthRateLimit(options, scope, req, identifiers = []) {
     var _a, _b, _c, _d, _e;
     if (((_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.enabled) === false) {
-        return { allowed: true };
+        return { allowed: true, retryAfterSeconds: 0 };
     }
     const rule = getRule(options, scope);
     const now = Date.now();
     pruneRateLimitBuckets(now);
     const ipAddress = (_e = normalizeIdentifier((_d = (_b = req.ip) !== null && _b !== void 0 ? _b : (_c = req.socket) === null || _c === void 0 ? void 0 : _c.remoteAddress) !== null && _d !== void 0 ? _d : 'unknown')) !== null && _e !== void 0 ? _e : 'unknown';
-    const bucketKeys = new Set([`${scope}|ip|${ipAddress}`]);
+    // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,
+    // evitando crescita di memoria con identificatori sempre diversi.
+    const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);
+    if (ipRetryAfterSeconds) {
+        return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };
+    }
+    let retryAfterSeconds = 0;
     for (const identifier of identifiers) {
         const normalizedIdentifier = normalizeIdentifier(identifier);
         if (!normalizedIdentifier) {
             continue;
         }
-        bucketKeys.add(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`);
-    }
-    let retryAfterSeconds = 0;
-    for (const bucketKey of bucketKeys) {
-        const bucketRetryAfterSeconds = consumeBucket(bucketKey, rule, now);
+        const bucketRetryAfterSeconds = consumeBucket(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`, rule, now);
         if (bucketRetryAfterSeconds) {
             retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);
         }
@@ -96,7 +118,7 @@ function checkPublicAuthRateLimit(options, scope, req, identifiers = []) {
             retryAfterSeconds,
         };
     }
-    return { allowed: true };
+    return { allowed: true, retryAfterSeconds: 0 };
 }
 function sendPublicAuthRateLimitExceeded(res, retryAfterSeconds) {
     res.setHeader('Retry-After', String(retryAfterSeconds));

package/dist/accessi-module/security/publicAuthRateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA+GA,4DA2CC;AAED,0EAWC;AAvKD,2CAA4C;AAE5C,+CAAgD;AAqBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC7D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IACrF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC;IAEjE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,uBAAuB,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\n\nexport type PublicAuthRateLimitScope =\n  | 'login'\n  | 'register'\n  | 'passwordResetEmail'\n  | 'passwordResetConfirm'\n  | 'getUserByToken';\n\ntype RateLimitBucket = {\n  count: number;\n  resetAt: number;\n  lastSeenAt: number;\n};\n\ntype RateLimitDecision = {\n  allowed: boolean;\n  retryAfterSeconds?: number;\n};\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n  PublicAuthRateLimitScope,\n  PublicAuthRateLimitRuleOptions\n> = {\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n};\n\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\nconst MAX_TRACKED_BUCKETS = 20000;\nconst MAX_WINDOW_MS = Math.max(\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\n);\n\nfunction getRule(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n  const configuredRule = options.publicAuthRateLimit?.[scope];\n\n  if (\n    configuredRule &&\n    Number.isFinite(configuredRule.windowMs) &&\n    configuredRule.windowMs > 0 &&\n    Number.isFinite(configuredRule.maxAttempts) &&\n    configuredRule.maxAttempts > 0\n  ) {\n    return {\n      windowMs: Math.trunc(configuredRule.windowMs),\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\n    };\n  }\n\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nfunction normalizeIdentifier(identifier: string): string | null {\n  if (typeof identifier !== 'string') {\n    return null;\n  }\n\n  const normalized = identifier.trim().toLowerCase();\n  return normalized === '' ? null : normalized;\n}\n\nfunction pruneRateLimitBuckets(now: number): void {\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n    return;\n  }\n\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\n      RATE_LIMIT_BUCKETS.delete(key);\n    }\n\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n      return;\n    }\n  }\n}\n\nfunction consumeBucket(\n  bucketKey: string,\n  rule: PublicAuthRateLimitRuleOptions,\n  now: number,\n): number | null {\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\n  if (!existingBucket || existingBucket.resetAt <= now) {\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\n      count: 1,\n      resetAt: now + rule.windowMs,\n      lastSeenAt: now,\n    });\n    return null;\n  }\n\n  existingBucket.lastSeenAt = now;\n  if (existingBucket.count >= rule.maxAttempts) {\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\n  }\n\n  existingBucket.count += 1;\n  return null;\n}\n\nexport function checkPublicAuthRateLimit(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n  req: Request,\n  identifiers: string[] = [],\n): RateLimitDecision {\n  if (options.publicAuthRateLimit?.enabled === false) {\n    return { allowed: true };\n  }\n\n  const rule = getRule(options, scope);\n  const now = Date.now();\n  pruneRateLimitBuckets(now);\n\n  const ipAddress =\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n  const bucketKeys = new Set<string>([`${scope}|ip|${ipAddress}`]);\n\n  for (const identifier of identifiers) {\n    const normalizedIdentifier = normalizeIdentifier(identifier);\n    if (!normalizedIdentifier) {\n      continue;\n    }\n\n    bucketKeys.add(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`);\n  }\n\n  let retryAfterSeconds = 0;\n  for (const bucketKey of bucketKeys) {\n    const bucketRetryAfterSeconds = consumeBucket(bucketKey, rule, now);\n    if (bucketRetryAfterSeconds) {\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\n    }\n  }\n\n  if (retryAfterSeconds > 0) {\n    return {\n      allowed: false,\n      retryAfterSeconds,\n    };\n  }\n\n  return { allowed: true };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n  res: Response,\n  retryAfterSeconds: number,\n): Response {\n  res.setHeader('Retry-After', String(retryAfterSeconds));\n  return RestUtilities.sendErrorMessage(\n    res,\n    'Troppi tentativi. Riprova piu tardi.',\n    'PublicAuthRateLimit',\n    HttpStatus.TOO_MANY_REQUESTS,\n  );\n}\n"]}
+{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AAyIA,4DAiDC;AAED,0EAWC;AAvMD,2CAA4C;AAE5C,+CAAgD;AAuBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC7D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IAErF,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,aAAa,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,uBAAuB,GAAG,aAAa,CAC3C,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,EACJ,GAAG,CACJ,CAAC;QACF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\r\nimport { Request, Response } from 'express';\r\nimport { RestUtilities } from '../../Utilities';\r\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\r\n\r\nexport type PublicAuthRateLimitScope =\r\n  | 'login'\r\n  | 'twoFactorVerify'\r\n  | 'twoFactorResend'\r\n  | 'register'\r\n  | 'passwordResetEmail'\r\n  | 'passwordResetConfirm'\r\n  | 'getUserByToken';\r\n\r\ntype RateLimitBucket = {\r\n  count: number;\r\n  resetAt: number;\r\n  lastSeenAt: number;\r\n};\r\n\r\ntype RateLimitDecision = {\r\n  allowed: boolean;\r\n  retryAfterSeconds: number;\r\n};\r\n\r\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\r\n  PublicAuthRateLimitScope,\r\n  PublicAuthRateLimitRuleOptions\r\n> = {\r\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\r\n  twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\r\n  twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\r\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\r\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\r\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\r\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\r\n};\r\n\r\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\r\nconst MAX_TRACKED_BUCKETS = 20000;\r\nconst MAX_WINDOW_MS = Math.max(\r\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\r\n);\r\n\r\nfunction getRule(\r\n  options: AccessiOptions,\r\n  scope: PublicAuthRateLimitScope,\r\n): PublicAuthRateLimitRuleOptions {\r\n  const configuredRule = options.publicAuthRateLimit?.[scope];\r\n\r\n  if (\r\n    configuredRule &&\r\n    Number.isFinite(configuredRule.windowMs) &&\r\n    configuredRule.windowMs > 0 &&\r\n    Number.isFinite(configuredRule.maxAttempts) &&\r\n    configuredRule.maxAttempts > 0\r\n  ) {\r\n    return {\r\n      windowMs: Math.trunc(configuredRule.windowMs),\r\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\r\n    };\r\n  }\r\n\r\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\r\n}\r\n\r\nfunction normalizeIdentifier(identifier: string): string | null {\r\n  if (typeof identifier !== 'string') {\r\n    return null;\r\n  }\r\n\r\n  const normalized = identifier.trim().toLowerCase();\r\n  return normalized === '' ? null : normalized;\r\n}\r\n\r\nfunction pruneRateLimitBuckets(now: number): void {\r\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\r\n    return;\r\n  }\r\n\r\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\r\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\r\n      RATE_LIMIT_BUCKETS.delete(key);\r\n    }\r\n\r\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\r\n      return;\r\n    }\r\n  }\r\n}\r\n\r\n/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */\r\nfunction enforceBucketCap(): void {\r\n  while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {\r\n    let oldestKey: string | undefined;\r\n    let oldestSeen = Number.POSITIVE_INFINITY;\r\n\r\n    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\r\n      if (bucket.lastSeenAt < oldestSeen) {\r\n        oldestSeen = bucket.lastSeenAt;\r\n        oldestKey = key;\r\n      }\r\n    }\r\n\r\n    if (oldestKey === undefined) {\r\n      return;\r\n    }\r\n\r\n    RATE_LIMIT_BUCKETS.delete(oldestKey);\r\n  }\r\n}\r\n\r\nfunction consumeBucket(\r\n  bucketKey: string,\r\n  rule: PublicAuthRateLimitRuleOptions,\r\n  now: number,\r\n): number | null {\r\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\r\n  if (!existingBucket || existingBucket.resetAt <= now) {\r\n    enforceBucketCap();\r\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\r\n      count: 1,\r\n      resetAt: now + rule.windowMs,\r\n      lastSeenAt: now,\r\n    });\r\n    return null;\r\n  }\r\n\r\n  existingBucket.lastSeenAt = now;\r\n  if (existingBucket.count >= rule.maxAttempts) {\r\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\r\n  }\r\n\r\n  existingBucket.count += 1;\r\n  return null;\r\n}\r\n\r\nexport function checkPublicAuthRateLimit(\r\n  options: AccessiOptions,\r\n  scope: PublicAuthRateLimitScope,\r\n  req: Request,\r\n  identifiers: string[] = [],\r\n): RateLimitDecision {\r\n  if (options.publicAuthRateLimit?.enabled === false) {\r\n    return { allowed: true, retryAfterSeconds: 0 };\r\n  }\r\n\r\n  const rule = getRule(options, scope);\r\n  const now = Date.now();\r\n  pruneRateLimitBuckets(now);\r\n\r\n  const ipAddress =\r\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\r\n\r\n  // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\r\n  // evitando crescita di memoria con identificatori sempre diversi.\r\n  const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);\r\n  if (ipRetryAfterSeconds) {\r\n    return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };\r\n  }\r\n\r\n  let retryAfterSeconds = 0;\r\n  for (const identifier of identifiers) {\r\n    const normalizedIdentifier = normalizeIdentifier(identifier);\r\n    if (!normalizedIdentifier) {\r\n      continue;\r\n    }\r\n\r\n    const bucketRetryAfterSeconds = consumeBucket(\r\n      `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`,\r\n      rule,\r\n      now,\r\n    );\r\n    if (bucketRetryAfterSeconds) {\r\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\r\n    }\r\n  }\r\n\r\n  if (retryAfterSeconds > 0) {\r\n    return {\r\n      allowed: false,\r\n      retryAfterSeconds,\r\n    };\r\n  }\r\n\r\n  return { allowed: true, retryAfterSeconds: 0 };\r\n}\r\n\r\nexport function sendPublicAuthRateLimitExceeded(\r\n  res: Response,\r\n  retryAfterSeconds: number,\r\n): Response {\r\n  res.setHeader('Retry-After', String(retryAfterSeconds));\r\n  return RestUtilities.sendErrorMessage(\r\n    res,\r\n    'Troppi tentativi. Riprova piu tardi.',\r\n    'PublicAuthRateLimit',\r\n    HttpStatus.TOO_MANY_REQUESTS,\r\n  );\r\n}\r\n"]}

package/dist/accessi-module/security/serviceTokenGuard.d.ts

@@ -0,0 +1,25 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { Request } from 'express';
+import { ServiceTokenService, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';
+/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */
+export declare const SERVICE_TOKEN_SCOPES_METADATA = "accessi:service-token-scopes";
+/** Richiede che il token di servizio presenti tutti gli scope indicati. */
+export declare const RequireServiceTokenScopes: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<string>;
+export type AccessiServiceTokenRequest = Request & {
+    accessiServiceToken?: VerifiedServiceToken;
+};
+/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */
+export declare function getAccessiServiceToken(req: Request): VerifiedServiceToken;
+/**
+ * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.
+ *
+ * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano
+ * con `@RequireServiceTokenScopes('ia')`.
+ */
+export declare class ServiceTokenGuard implements CanActivate {
+    private readonly serviceTokenService;
+    private readonly reflector;
+    constructor(serviceTokenService: ServiceTokenService, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}

package/dist/accessi-module/security/serviceTokenGuard.js

@@ -0,0 +1,85 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceTokenGuard = exports.RequireServiceTokenScopes = exports.SERVICE_TOKEN_SCOPES_METADATA = void 0;
+exports.getAccessiServiceToken = getAccessiServiceToken;
+const common_1 = require("@nestjs/common");
+const core_1 = require("@nestjs/core");
+const ServiceTokenService_1 = require("../Services/ServiceTokenService/ServiceTokenService");
+const authenticatedToken_1 = require("./authenticatedToken");
+const serviceTokenRateLimit_1 = require("./serviceTokenRateLimit");
+/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */
+exports.SERVICE_TOKEN_SCOPES_METADATA = 'accessi:service-token-scopes';
+/** Richiede che il token di servizio presenti tutti gli scope indicati. */
+const RequireServiceTokenScopes = (...scopes) => (0, common_1.SetMetadata)(exports.SERVICE_TOKEN_SCOPES_METADATA, scopes);
+exports.RequireServiceTokenScopes = RequireServiceTokenScopes;
+/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */
+function getAccessiServiceToken(req) {
+    const verified = req.accessiServiceToken;
+    if (!verified) {
+        throw new common_1.UnauthorizedException('Token di servizio non verificato.');
+    }
+    return verified;
+}
+/**
+ * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.
+ *
+ * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano
+ * con `@RequireServiceTokenScopes('ia')`.
+ */
+let ServiceTokenGuard = class ServiceTokenGuard {
+    constructor(serviceTokenService, reflector) {
+        this.serviceTokenService = serviceTokenService;
+        this.reflector = reflector;
+    }
+    canActivate(context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d;
+            const request = context.switchToHttp().getRequest();
+            const ip = (_c = (_a = request.ip) !== null && _a !== void 0 ? _a : (_b = request.socket) === null || _b === void 0 ? void 0 : _b.remoteAddress) !== null && _c !== void 0 ? _c : 'unknown';
+            (0, serviceTokenRateLimit_1.assertServiceTokenRateLimit)(ip);
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(request.headers['authorization']);
+            if (!token) {
+                throw new common_1.UnauthorizedException('Token di servizio mancante.');
+            }
+            const verified = yield this.serviceTokenService.verify(token, { ip });
+            if (!verified) {
+                throw new common_1.UnauthorizedException('Token di servizio non valido, scaduto o revocato.');
+            }
+            request.accessiServiceToken = verified;
+            const requiredScopes = (_d = this.reflector.getAllAndOverride(exports.SERVICE_TOKEN_SCOPES_METADATA, [
+                context.getHandler(),
+                context.getClass(),
+            ])) !== null && _d !== void 0 ? _d : [];
+            const missingScope = requiredScopes.find((scope) => !(0, ServiceTokenService_1.serviceTokenHasScope)(verified.scopes, scope));
+            if (missingScope) {
+                throw new common_1.ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);
+            }
+            return true;
+        });
+    }
+};
+exports.ServiceTokenGuard = ServiceTokenGuard;
+exports.ServiceTokenGuard = ServiceTokenGuard = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [ServiceTokenService_1.ServiceTokenService,
+        core_1.Reflector])
+], ServiceTokenGuard);
+//# sourceMappingURL=serviceTokenGuard.js.map

package/dist/accessi-module/security/serviceTokenGuard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTokenGuard.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenGuard.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuBA,wDAMC;AA7BD,2CAOwB;AACxB,uCAAyC;AAEzC,6FAAsI;AACtI,6DAAiE;AACjE,mEAAsE;AAEtE,iEAAiE;AACpD,QAAA,6BAA6B,GAAG,8BAA8B,CAAC;AAE5E,2EAA2E;AACpE,MAAM,yBAAyB,GAAG,CAAC,GAAG,MAAgB,EAAE,EAAE,CAAC,IAAA,oBAAW,EAAC,qCAA6B,EAAE,MAAM,CAAC,CAAC;AAAxG,QAAA,yBAAyB,6BAA+E;AAIrH,iGAAiG;AACjG,SAAgB,sBAAsB,CAAC,GAAY;IACjD,MAAM,QAAQ,GAAI,GAAkC,CAAC,mBAAmB,CAAC;IACzE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,8BAAqB,CAAC,mCAAmC,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAiB;IAC5B,YACmB,mBAAwC,EACxC,SAAoB;QADpB,wBAAmB,GAAnB,mBAAmB,CAAqB;QACxC,cAAS,GAAT,SAAS,CAAW;IACpC,CAAC;IAEE,WAAW,CAAC,OAAyB;;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAW,CAAC;YAC7D,MAAM,EAAE,GAAG,MAAA,MAAA,OAAO,CAAC,EAAE,mCAAI,MAAA,OAAO,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC;YACpE,IAAA,mDAA2B,EAAC,EAAE,CAAC,CAAC;YAEhC,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;YAC1E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,8BAAqB,CAAC,mDAAmD,CAAC,CAAC;YACvF,CAAC;YAEA,OAAsC,CAAC,mBAAmB,GAAG,QAAQ,CAAC;YAEvE,MAAM,cAAc,GAAG,MAAA,IAAI,CAAC,SAAS,CAAC,iBAAiB,CAAW,qCAA6B,EAAE;gBAC/F,OAAO,CAAC,UAAU,EAAE;gBACpB,OAAO,CAAC,QAAQ,EAAE;aACnB,CAAC,mCAAI,EAAE,CAAC;YACT,MAAM,YAAY,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,IAAA,0CAAoB,EAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,IAAI,2BAAkB,CAAC,UAAU,YAAY,qCAAqC,CAAC,CAAC;YAC5F,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC;KAAA;CACF,CAAA;AAlCY,8CAAiB;4BAAjB,iBAAiB;IAD7B,IAAA,mBAAU,GAAE;qCAG6B,yCAAmB;QAC7B,gBAAS;GAH5B,iBAAiB,CAkC7B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  ForbiddenException,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport { Reflector } from '@nestjs/core';\nimport type { Request } from 'express';\nimport { ServiceTokenService, serviceTokenHasScope, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';\nimport { extractAccessiBearerToken } from './authenticatedToken';\nimport { assertServiceTokenRateLimit } from './serviceTokenRateLimit';\n\n/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */\nexport const SERVICE_TOKEN_SCOPES_METADATA = 'accessi:service-token-scopes';\n\n/** Richiede che il token di servizio presenti tutti gli scope indicati. */\nexport const RequireServiceTokenScopes = (...scopes: string[]) => SetMetadata(SERVICE_TOKEN_SCOPES_METADATA, scopes);\n\nexport type AccessiServiceTokenRequest = Request & { accessiServiceToken?: VerifiedServiceToken };\n\n/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */\nexport function getAccessiServiceToken(req: Request): VerifiedServiceToken {\n  const verified = (req as AccessiServiceTokenRequest).accessiServiceToken;\n  if (!verified) {\n    throw new UnauthorizedException('Token di servizio non verificato.');\n  }\n  return verified;\n}\n\n/**\n * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.\n *\n * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano\n * con `@RequireServiceTokenScopes('ia')`.\n */\n@Injectable()\nexport class ServiceTokenGuard implements CanActivate {\n  constructor(\n    private readonly serviceTokenService: ServiceTokenService,\n    private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest<Request>();\n    const ip = request.ip ?? request.socket?.remoteAddress ?? 'unknown';\n    assertServiceTokenRateLimit(ip);\n\n    const token = extractAccessiBearerToken(request.headers['authorization']);\n    if (!token) {\n      throw new UnauthorizedException('Token di servizio mancante.');\n    }\n\n    const verified = await this.serviceTokenService.verify(token, { ip });\n    if (!verified) {\n      throw new UnauthorizedException('Token di servizio non valido, scaduto o revocato.');\n    }\n\n    (request as AccessiServiceTokenRequest).accessiServiceToken = verified;\n\n    const requiredScopes = this.reflector.getAllAndOverride<string[]>(SERVICE_TOKEN_SCOPES_METADATA, [\n      context.getHandler(),\n      context.getClass(),\n    ]) ?? [];\n    const missingScope = requiredScopes.find((scope) => !serviceTokenHasScope(verified.scopes, scope));\n    if (missingScope) {\n      throw new ForbiddenException(`Scope '${missingScope}' non autorizzato per questo token.`);\n    }\n\n    return true;\n  }\n}\n"]}

package/dist/accessi-module/security/serviceTokenRateLimit.d.ts

@@ -0,0 +1,8 @@
+export declare function checkServiceTokenRateLimit(identifier: string): {
+    allowed: boolean;
+    retryAfterSeconds: number;
+};
+/** Svuota i bucket (usato nei test). */
+export declare function resetServiceTokenRateLimit(): void;
+/** Lancia 429 con `Retry-After` quando il limite e superato. */
+export declare function assertServiceTokenRateLimit(identifier: string): void;

package/dist/accessi-module/security/serviceTokenRateLimit.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkServiceTokenRateLimit = checkServiceTokenRateLimit;
+exports.resetServiceTokenRateLimit = resetServiceTokenRateLimit;
+exports.assertServiceTokenRateLimit = assertServiceTokenRateLimit;
+const common_1 = require("@nestjs/common");
+/**
+ * Limite anti-abuso per la verifica dei token di servizio.
+ *
+ * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita
+ * che un client difettoso o malevolo martelli l'endpoint. In-memory: in cluster va
+ * aggiunto un limite anche al gateway.
+ */
+const WINDOW_MS = 60000;
+const MAX_ATTEMPTS = 120;
+const MAX_BUCKETS = 20000;
+const buckets = new Map();
+function checkServiceTokenRateLimit(identifier) {
+    const now = Date.now();
+    const key = identifier && identifier.trim() !== '' ? identifier : 'unknown';
+    const bucket = buckets.get(key);
+    if (!bucket || bucket.resetAt <= now) {
+        if (buckets.size >= MAX_BUCKETS) {
+            const oldestKey = buckets.keys().next().value;
+            if (oldestKey !== undefined) {
+                buckets.delete(oldestKey);
+            }
+        }
+        buckets.set(key, { count: 1, resetAt: now + WINDOW_MS });
+        return { allowed: true, retryAfterSeconds: 0 };
+    }
+    if (bucket.count >= MAX_ATTEMPTS) {
+        return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil((bucket.resetAt - now) / 1000)) };
+    }
+    bucket.count += 1;
+    return { allowed: true, retryAfterSeconds: 0 };
+}
+/** Svuota i bucket (usato nei test). */
+function resetServiceTokenRateLimit() {
+    buckets.clear();
+}
+/** Lancia 429 con `Retry-After` quando il limite e superato. */
+function assertServiceTokenRateLimit(identifier) {
+    const decision = checkServiceTokenRateLimit(identifier);
+    if (!decision.allowed) {
+        throw new common_1.HttpException({ code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' }, common_1.HttpStatus.TOO_MANY_REQUESTS);
+    }
+}
+//# sourceMappingURL=serviceTokenRateLimit.js.map

package/dist/accessi-module/security/serviceTokenRateLimit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serviceTokenRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/serviceTokenRateLimit.ts"],"names":[],"mappings":";;AAgBA,gEAsBC;AAGD,gEAEC;AAGD,kEAQC;AAtDD,2CAA2D;AAI3D;;;;;;GAMG;AACH,MAAM,SAAS,GAAG,KAAM,CAAC;AACzB,MAAM,YAAY,GAAG,GAAG,CAAC;AACzB,MAAM,WAAW,GAAG,KAAM,CAAC;AAC3B,MAAM,OAAO,GAAG,IAAI,GAAG,EAA2B,CAAC;AAEnD,SAAgB,0BAA0B,CAAC,UAAkB;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,GAAG,GAAG,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAEhC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrC,IAAI,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;YAChC,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,SAAS,EAAE,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,IAAI,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;IACtG,CAAC;IAED,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,wCAAwC;AACxC,SAAgB,0BAA0B;IACxC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC;AAED,gEAAgE;AAChE,SAAgB,2BAA2B,CAAC,UAAkB;IAC5D,MAAM,QAAQ,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;IACxD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,sBAAa,CACrB,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAC/F,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;IACJ,CAAC;AACH,CAAC","sourcesContent":["import { HttpException, HttpStatus } from '@nestjs/common';\n\ntype RateLimitBucket = { count: number; resetAt: number };\n\n/**\n * Limite anti-abuso per la verifica dei token di servizio.\n *\n * Il segreto ha 256 bit di entropia (brute force non praticabile), ma il limite evita\n * che un client difettoso o malevolo martelli l'endpoint. In-memory: in cluster va\n * aggiunto un limite anche al gateway.\n */\nconst WINDOW_MS = 60_000;\nconst MAX_ATTEMPTS = 120;\nconst MAX_BUCKETS = 20_000;\nconst buckets = new Map<string, RateLimitBucket>();\n\nexport function checkServiceTokenRateLimit(identifier: string): { allowed: boolean; retryAfterSeconds: number } {\n  const now = Date.now();\n  const key = identifier && identifier.trim() !== '' ? identifier : 'unknown';\n  const bucket = buckets.get(key);\n\n  if (!bucket || bucket.resetAt <= now) {\n    if (buckets.size >= MAX_BUCKETS) {\n      const oldestKey = buckets.keys().next().value;\n      if (oldestKey !== undefined) {\n        buckets.delete(oldestKey);\n      }\n    }\n    buckets.set(key, { count: 1, resetAt: now + WINDOW_MS });\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  if (bucket.count >= MAX_ATTEMPTS) {\n    return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil((bucket.resetAt - now) / 1000)) };\n  }\n\n  bucket.count += 1;\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\n/** Svuota i bucket (usato nei test). */\nexport function resetServiceTokenRateLimit(): void {\n  buckets.clear();\n}\n\n/** Lancia 429 con `Retry-After` quando il limite e superato. */\nexport function assertServiceTokenRateLimit(identifier: string): void {\n  const decision = checkServiceTokenRateLimit(identifier);\n  if (!decision.allowed) {\n    throw new HttpException(\n      { code: 'ACCESSI_SERVICE_TOKEN_RATE_LIMITED', message: 'Troppi tentativi. Riprova piu tardi.' },\n      HttpStatus.TOO_MANY_REQUESTS,\n    );\n  }\n}\n"]}

package/dist/allegati-module/AllegatiModule.d.ts

@@ -1,7 +1,18 @@
 import { DynamicModule } from "@nestjs/common";
+import { Request } from "express";
 import { Options } from "node-firebird";
 export interface AllegatiOptions {
     databaseOptions: Options;
+    /**
+     * Guard applicato a ogni richiesta dei controller Allegati.
+     * Se definito e restituisce `false`, la richiesta viene rifiutata con 403.
+     */
+    authorize?: (request: Request) => boolean | Promise<boolean>;
+    /**
+     * Sicurezza by default: se `authorize` non e configurato, le richieste vengono rifiutate con 403.
+     * Impostare `false` per ripristinare il comportamento storico (endpoint aperti) durante la migrazione.
+     */
+    requireAuthorization?: boolean;
 }
 export declare class AllegatiModule {
     static forRoot(options: AllegatiOptions): DynamicModule;

package/dist/allegati-module/AllegatiModule.js

@@ -9,10 +9,19 @@ var AllegatiModule_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AllegatiModule = void 0;
 const common_1 = require("@nestjs/common");
+const Logger_1 = require("../Logger");
 const AllegatiService_1 = require("./Services/AllegatiService/AllegatiService");
 const AllegatiController_1 = require("./Controllers/AllegatiController");
+const allegatiAuthorizationGuard_1 = require("./security/allegatiAuthorizationGuard");
 let AllegatiModule = AllegatiModule_1 = class AllegatiModule {
     static forRoot(options) {
+        const logger = new Logger_1.Logger(AllegatiModule_1.name);
+        if ((options === null || options === void 0 ? void 0 : options.requireAuthorization) === false) {
+            logger.warning('Allegati con requireAuthorization: false: gli endpoint sono accessibili senza controllo di autorizzazione. Configurare authorize e rimuovere l opt-out.');
+        }
+        else if (!(options === null || options === void 0 ? void 0 : options.authorize)) {
+            logger.error('Allegati senza authorize: tutte le richieste saranno rifiutate con 403. Configurare allegatiOptions.authorize (oppure requireAuthorization: false per il comportamento storico).');
+        }
         return {
             module: AllegatiModule_1,
             providers: [
@@ -21,6 +30,7 @@ let AllegatiModule = AllegatiModule_1 = class AllegatiModule {
                     useValue: options,
                 },
                 AllegatiService_1.AllegatiService,
+                allegatiAuthorizationGuard_1.AllegatiAuthorizationGuard,
             ],
             exports: ['ALLEGATI_OPTIONS', AllegatiService_1.AllegatiService],
         };
@@ -31,7 +41,7 @@ exports.AllegatiModule = AllegatiModule = AllegatiModule_1 = __decorate([
     (0, common_1.Global)(),
     (0, common_1.Module)({
         controllers: [AllegatiController_1.AllegatiController],
-        providers: [AllegatiService_1.AllegatiService],
+        providers: [AllegatiService_1.AllegatiService, allegatiAuthorizationGuard_1.AllegatiAuthorizationGuard],
         exports: [AllegatiService_1.AllegatiService],
     })
 ], AllegatiModule);

package/dist/allegati-module/AllegatiModule.js.map

@@ -1 +1 @@
-{"version":3,"file":"AllegatiModule.js","sourceRoot":"","sources":["../../src/allegati-module/AllegatiModule.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA+D;AAC/D,gFAA6E;AAC7E,yEAAsE;AAc/D,IAAM,cAAc,sBAApB,MAAM,cAAc;IAEvB,MAAM,CAAC,OAAO,CAAC,OAAwB;QACnC,OAAO;YACH,MAAM,EAAE,gBAAc;YACtB,SAAS,EAAE;gBACP;oBACI,OAAO,EAAE,kBAAkB;oBAC3B,QAAQ,EAAE,OAAO;iBACpB;gBACD,iCAAe;aAClB;YACD,OAAO,EAAE,CAAC,kBAAkB,EAAE,iCAAe,CAAC;SACjD,CAAC;IACN,CAAC;CACJ,CAAA;AAfY,wCAAc;yBAAd,cAAc;IAN1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACJ,WAAW,EAAE,CAAC,uCAAkB,CAAC;QACjC,SAAS,EAAE,CAAC,iCAAe,CAAC;QAC5B,OAAO,EAAE,CAAC,iCAAe,CAAC;KAC7B,CAAC;GACW,cAAc,CAe1B","sourcesContent":["import { DynamicModule, Global, Module } from \"@nestjs/common\";\nimport { AllegatiService } from \"./Services/AllegatiService/AllegatiService\";\nimport { AllegatiController } from \"./Controllers/AllegatiController\";\nimport { Options } from \"node-firebird\";\nimport { Logger } from \"../Logger\";\n\nexport interface AllegatiOptions {\n    databaseOptions: Options;\n}\n\n@Global()\n@Module({\n    controllers: [AllegatiController],\n    providers: [AllegatiService],\n    exports: [AllegatiService],\n})\nexport class AllegatiModule {\n\n    static forRoot(options: AllegatiOptions): DynamicModule {\n        return {\n            module: AllegatiModule,\n            providers: [\n                {\n                    provide: 'ALLEGATI_OPTIONS',\n                    useValue: options,\n                },\n                AllegatiService,\n            ],\n            exports: ['ALLEGATI_OPTIONS', AllegatiService],\n        };\n    }\n}\n"]}
+{"version":3,"file":"AllegatiModule.js","sourceRoot":"","sources":["../../src/allegati-module/AllegatiModule.ts"],"names":[],"mappings":";;;;;;;;;;AAAA,2CAA+D;AAG/D,sCAAmC;AACnC,gFAA6E;AAC7E,yEAAsE;AACtE,sFAAmF;AAsB5E,IAAM,cAAc,sBAApB,MAAM,cAAc;IAEvB,MAAM,CAAC,OAAO,CAAC,OAAwB;QACnC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;QAC/C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,oBAAoB,MAAK,KAAK,EAAE,CAAC;YAC1C,MAAM,CAAC,OAAO,CAAC,yJAAyJ,CAAC,CAAC;QAC9K,CAAC;aAAM,IAAI,CAAC,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,CAAA,EAAE,CAAC;YAC7B,MAAM,CAAC,KAAK,CAAC,kLAAkL,CAAC,CAAC;QACrM,CAAC;QAED,OAAO;YACH,MAAM,EAAE,gBAAc;YACtB,SAAS,EAAE;gBACP;oBACI,OAAO,EAAE,kBAAkB;oBAC3B,QAAQ,EAAE,OAAO;iBACpB;gBACD,iCAAe;gBACf,uDAA0B;aAC7B;YACD,OAAO,EAAE,CAAC,kBAAkB,EAAE,iCAAe,CAAC;SACjD,CAAC;IACN,CAAC;CACJ,CAAA;AAvBY,wCAAc;yBAAd,cAAc;IAN1B,IAAA,eAAM,GAAE;IACR,IAAA,eAAM,EAAC;QACJ,WAAW,EAAE,CAAC,uCAAkB,CAAC;QACjC,SAAS,EAAE,CAAC,iCAAe,EAAE,uDAA0B,CAAC;QACxD,OAAO,EAAE,CAAC,iCAAe,CAAC;KAC7B,CAAC;GACW,cAAc,CAuB1B","sourcesContent":["import { DynamicModule, Global, Module } from \"@nestjs/common\";\r\nimport { Request } from \"express\";\r\nimport { Options } from \"node-firebird\";\r\nimport { Logger } from \"../Logger\";\r\nimport { AllegatiService } from \"./Services/AllegatiService/AllegatiService\";\r\nimport { AllegatiController } from \"./Controllers/AllegatiController\";\r\nimport { AllegatiAuthorizationGuard } from \"./security/allegatiAuthorizationGuard\";\r\n\r\nexport interface AllegatiOptions {\r\n    databaseOptions: Options;\r\n    /**\r\n     * Guard applicato a ogni richiesta dei controller Allegati.\r\n     * Se definito e restituisce `false`, la richiesta viene rifiutata con 403.\r\n     */\r\n    authorize?: (request: Request) => boolean | Promise<boolean>;\r\n    /**\r\n     * Sicurezza by default: se `authorize` non e configurato, le richieste vengono rifiutate con 403.\r\n     * Impostare `false` per ripristinare il comportamento storico (endpoint aperti) durante la migrazione.\r\n     */\r\n    requireAuthorization?: boolean;\r\n}\r\n\r\n@Global()\r\n@Module({\r\n    controllers: [AllegatiController],\r\n    providers: [AllegatiService, AllegatiAuthorizationGuard],\r\n    exports: [AllegatiService],\r\n})\r\nexport class AllegatiModule {\r\n\r\n    static forRoot(options: AllegatiOptions): DynamicModule {\r\n        const logger = new Logger(AllegatiModule.name);\r\n        if (options?.requireAuthorization === false) {\r\n            logger.warning('Allegati con requireAuthorization: false: gli endpoint sono accessibili senza controllo di autorizzazione. Configurare authorize e rimuovere l opt-out.');\r\n        } else if (!options?.authorize) {\r\n            logger.error('Allegati senza authorize: tutte le richieste saranno rifiutate con 403. Configurare allegatiOptions.authorize (oppure requireAuthorization: false per il comportamento storico).');\r\n        }\r\n\r\n        return {\r\n            module: AllegatiModule,\r\n            providers: [\r\n                {\r\n                    provide: 'ALLEGATI_OPTIONS',\r\n                    useValue: options,\r\n                },\r\n                AllegatiService,\r\n                AllegatiAuthorizationGuard,\r\n            ],\r\n            exports: ['ALLEGATI_OPTIONS', AllegatiService],\r\n        };\r\n    }\r\n}\n"]}

package/dist/allegati-module/Controllers/AllegatiController.d.ts

@@ -6,6 +6,7 @@ import { UploadSingleFileRequest } from "../Dtos/UploadSingleFileRequest";
 import e from "express";
 export declare class AllegatiController {
     private readonly allegatiService;
+    private readonly logger;
     constructor(allegatiService: AllegatiService);
     upload(files: Express.Multer.File[], uploadRequest: UploadSingleFileRequest): Promise<UploadAllegatoResponseDto>;
     download(id: number): Promise<DownloadAllegatoResponseDto>;
@@ -23,7 +24,7 @@ export declare class AllegatiController {
         codice?: number;
         docrif?: string;
         idxtipoall?: number;
-    }): Promise<AllegatoDto>;
+    }): Promise<AllegatoDto | null>;
     updateFieldsById(id: number, body: {
         tipcod?: string;
         codice?: number;

package/dist/allegati-module/Controllers/AllegatiController.js

@@ -23,21 +23,25 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
+var AllegatiController_1;
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.AllegatiController = void 0;
 const swagger_1 = require("@nestjs/swagger");
 const common_1 = require("@nestjs/common");
 const platform_express_1 = require("@nestjs/platform-express");
+const allegatiAuthorizationGuard_1 = require("../security/allegatiAuthorizationGuard");
 const AllegatiService_1 = require("../Services/AllegatiService/AllegatiService");
 const UploadAllegatoResponseDto_1 = require("../Dtos/responses/UploadAllegatoResponseDto");
 const AllegatoDto_1 = require("../Dtos/AllegatoDto");
 const DownloadAllegatoResponseDto_1 = require("../Dtos/responses/DownloadAllegatoResponseDto");
 const UploadSingleFileRequest_1 = require("../Dtos/UploadSingleFileRequest");
 const Utilities_1 = require("../../Utilities");
+const Logger_1 = require("../../Logger");
 const express_1 = __importDefault(require("express"));
-let AllegatiController = class AllegatiController {
+let AllegatiController = AllegatiController_1 = class AllegatiController {
     constructor(allegatiService) {
         this.allegatiService = allegatiService;
+        this.logger = new Logger_1.Logger(AllegatiController_1.name);
     }
     upload(files, uploadRequest) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -47,7 +51,11 @@ let AllegatiController = class AllegatiController {
             if (files.length > 1) {
                 throw new common_1.BadRequestException('Questo endpoint accetta un solo file alla volta');
             }
-            return yield this.allegatiService.uploadFile(files[0], uploadRequest);
+            const file = files[0];
+            if (!file) {
+                throw new common_1.BadRequestException('Nessun file fornito');
+            }
+            return yield this.allegatiService.uploadFile(file, uploadRequest);
         });
     }
     download(id) {
@@ -57,28 +65,27 @@ let AllegatiController = class AllegatiController {
     }
     downloadFile(id, res) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a;
             try {
                 const file = yield this.allegatiService.downloadFile(id);
-                // Convert base64 to buffer in chunks
+                // Convert base64 to buffer in chunks; Buffer.concat evita i NUL finali del prealloc.
                 const chunkSize = 1024 * 1024; // 1MB chunks
                 const base64Content = file.contentBase64;
-                const bufferSize = Math.ceil((base64Content.length * 3) / 4);
-                const buffer = Buffer.alloc(bufferSize);
-                let bufferIndex = 0;
+                const chunks = [];
                 for (let i = 0; i < base64Content.length; i += chunkSize) {
                     const chunk = base64Content.slice(i, i + chunkSize);
-                    const chunkBuffer = Buffer.from(chunk, 'base64');
-                    chunkBuffer.copy(buffer, bufferIndex);
-                    bufferIndex += chunkBuffer.length;
+                    chunks.push(Buffer.from(chunk, 'base64'));
                 }
-                // Set headers for file download
-                res.setHeader('Content-Type', file.mimetype);
-                res.setHeader('Content-Disposition', `attachment; filename="${file.filename}"`);
+                const buffer = Buffer.concat(chunks);
+                // Set headers for file download; filename* (RFC 5987) per i nomi non ASCII.
+                const asciiName = file.filename.replace(/[^\x20-\x7e]/g, '_').replace(/["\\]/g, '_');
+                res.setHeader('Content-Type', (_a = file.mimetype) !== null && _a !== void 0 ? _a : 'application/octet-stream');
+                res.setHeader('Content-Disposition', `attachment; filename="${asciiName}"; filename*=UTF-8''${encodeURIComponent(file.filename)}`);
                 res.setHeader('Content-Length', buffer.length);
                 res.status(200).end(buffer);
             }
             catch (error) {
-                console.error('[AllegatiController] downloadFile - Errore:', error);
+                this.logger.error('[AllegatiController] downloadFile - Errore:', error);
                 throw error;
             }
         });
@@ -119,7 +126,7 @@ let AllegatiController = class AllegatiController {
 exports.AllegatiController = AllegatiController;
 __decorate([
     (0, common_1.Post)('upload'),
-    (0, common_1.UseInterceptors)((0, platform_express_1.FilesInterceptor)('file')),
+    (0, common_1.UseInterceptors)((0, platform_express_1.FilesInterceptor)('file', 1, { limits: { fileSize: 90 * 1024 * 1024, files: 1 } })),
     (0, swagger_1.ApiConsumes)('multipart/form-data'),
     (0, swagger_1.ApiResponse)({ status: 201, description: 'File caricato con successo.', type: UploadAllegatoResponseDto_1.UploadAllegatoResponseDto }),
     (0, swagger_1.ApiBody)({
@@ -215,7 +222,8 @@ __decorate([
     __metadata("design:paramtypes", [Number, Object]),
     __metadata("design:returntype", Promise)
 ], AllegatiController.prototype, "updateFieldsById", null);
-exports.AllegatiController = AllegatiController = __decorate([
+exports.AllegatiController = AllegatiController = AllegatiController_1 = __decorate([
+    (0, common_1.UseGuards)(allegatiAuthorizationGuard_1.AllegatiAuthorizationGuard),
     (0, common_1.Controller)('allegati'),
     __metadata("design:paramtypes", [AllegatiService_1.AllegatiService])
 ], AllegatiController);

package/dist/allegati-module/Controllers/AllegatiController.js.map

@@ -1 +1 @@
-{"version":3,"file":"AllegatiController.js","sourceRoot":"","sources":["../../../src/allegati-module/Controllers/AllegatiController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6CAA4E;AAE5E,2CAA8J;AAC9J,+DAA4D;AAC5D,iFAA8E;AAC9E,2FAAsF;AACtF,qDAAgD;AAChD,+FAA0F;AAC1F,6EAA0E;AAC1E,+CAAgD;AAChD,sDAAwB;AAIjB,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAE3B,YAA6B,eAAgC;QAAhC,oBAAe,GAAf,eAAe,CAAiB;IAAG,CAAC;IA2B3D,MAAM,CACS,KAA4B,EACrC,aAAsC;;YAE9C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,4BAAmB,CAAC,iDAAiD,CAAC,CAAC;YACrF,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,CAAC,CAAC;QAC1E,CAAC;KAAA;IAIK,QAAQ,CAAc,EAAU;;YAClC,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;KAAA;IAIK,YAAY,CACD,EAAU,EAChB,GAAe;;YAEtB,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;gBAEzD,qCAAqC;gBACrC,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,aAAa;gBAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;gBACzC,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC7D,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBAExC,IAAI,WAAW,GAAG,CAAC,CAAC;gBACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;oBACvD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;oBACpD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;oBACjD,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;oBACtC,WAAW,IAAI,WAAW,CAAC,MAAM,CAAC;gBACtC,CAAC;gBAED,gCAAgC;gBAChC,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;gBAC7C,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,yBAAyB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAChF,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBAE/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;gBACpE,MAAM,KAAK,CAAC;YAChB,CAAC;QACL,CAAC;KAAA;IAIK,MAAM,CAAc,EAAU,EAAc,GAAe;;YAC7D,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAC3E,CAAC;KAAA;IAQK,IAAI,CACW,MAAe,EACf,MAAe,EACf,MAAe,EACX,UAAmB;;YAExC,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;gBACxC,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;aAC1D,CAAC,CAAC;QACP,CAAC;KAAA;IAIC,cAAc,CAAS,IAAgF;;YACzG,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;KAAA;IAIK,cAAc,CAAS,IAAgF;;YACzG,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;KAAA;IAIK,gBAAgB,CACL,EAAU,EACf,IAAgF;;YAExF,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;QACnD,CAAC;KAAA;CACA,CAAA;AAnIY,gDAAkB;AA6BrB;IAzBL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,wBAAe,EAAC,IAAA,mCAAgB,EAAC,MAAM,CAAC,CAAC;IACzC,IAAA,qBAAW,EAAC,qBAAqB,CAAC;IAClC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,qDAAyB,EAAE,CAAC;IACzG,IAAA,iBAAO,EAAC;QACL,WAAW,EAAE,8CAA8C;QAC3D,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;iBACnB;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;gBACvC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC7C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;gBACxC,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE;gBACzE,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;gBAC7E,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;gBAC3E,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;gBAC/C,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE;aACtE;SACJ;KACJ,CAAC;IAEG,WAAA,IAAA,sBAAa,GAAE,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;;4CAAgB,iDAAuB;;gDASjD;AAIK;IAFL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,IAAI,EAAE,yDAA2B,EAAE,CAAC;IAC7F,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;kDAE1B;AAIK;IAFL,IAAA,YAAG,EAAC,cAAc,CAAC;IACnB,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAErE,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;;;;sDA6BT;AAIK;IAFL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC5D,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IAAc,WAAA,IAAA,iBAAQ,GAAE,CAAA;;;;gDAGhD;AAQK;IANL,IAAA,YAAG,GAAE;IACL,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,yBAAW,CAAC,EAAE,CAAC;IACvF,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IACpF,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IAC/E,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAC9F,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,0BAA0B,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEpG,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,YAAY,CAAC,CAAA;;;;8CAQvB;AAIC;IAFD,IAAA,aAAI,EAAC,QAAQ,CAAC;IAClB,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IACnD,WAAA,IAAA,aAAI,GAAE,CAAA;;;;wDAE3B;AAIK;IAFL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IACtD,WAAA,IAAA,aAAI,GAAE,CAAA;;;;wDAE3B;AAIK;IAFL,IAAA,cAAK,EAAC,mBAAmB,CAAC;IAC1B,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAEzE,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;;;;0DAIV;6BAlIY,kBAAkB;IAD9B,IAAA,mBAAU,EAAC,UAAU,CAAC;qCAG2B,iCAAe;GAFpD,kBAAkB,CAmI9B","sourcesContent":["import {ApiBody, ApiConsumes, ApiResponse, ApiQuery} from \"@nestjs/swagger\";\n\nimport { Controller, Post, Get, Delete, Param, UploadedFiles, UseInterceptors, BadRequestException, Body, Response, Query, Res, Patch } from \"@nestjs/common\";\nimport { FilesInterceptor } from \"@nestjs/platform-express\";\nimport { AllegatiService } from \"../Services/AllegatiService/AllegatiService\";\nimport {UploadAllegatoResponseDto} from \"../Dtos/responses/UploadAllegatoResponseDto\";\nimport {AllegatoDto} from \"../Dtos/AllegatoDto\";\nimport {DownloadAllegatoResponseDto} from \"../Dtos/responses/DownloadAllegatoResponseDto\";\nimport { UploadSingleFileRequest } from \"../Dtos/UploadSingleFileRequest\";\nimport { RestUtilities } from \"../../Utilities\";\nimport e from \"express\";\nimport { GetListResponse } from \"../Dtos/responses/GetListResponse\";\n\n@Controller('allegati')\nexport class AllegatiController {\n\n    constructor(private readonly allegatiService: AllegatiService) {}\n\n    @Post('upload')\n    @UseInterceptors(FilesInterceptor('file'))\n    @ApiConsumes('multipart/form-data')\n    @ApiResponse({ status: 201, description: 'File caricato con successo.', type: UploadAllegatoResponseDto })\n    @ApiBody({\n        description: 'File e metadati per l\\'upload di un allegato',\n        required: true,\n        schema: {\n            type: 'object',\n            properties: {\n                file: {\n                    type: 'string',\n                    format: 'binary',\n                },\n                codice: { type: 'integer', example: 1 },\n                tipoCodice: { type: 'string', example: 'CF' },\n                ordine: { type: 'string', example: '1' },\n                descrizioneAllegato: { type: 'string', example: 'Documento di identità' },\n                dataInizioValidita: { type: 'string', format: 'date', example: '2024-01-01' },\n                dataFineValidita: { type: 'string', format: 'date', example: '2025-01-01' },\n                idTipoAllegato: { type: 'integer', example: 3 },\n                riferimentoDocumento: { type: 'string', example: 'PRAT-2024-0001' }\n            },\n        },\n    })\n    async upload(\n        @UploadedFiles() files: Express.Multer.File[],\n        @Body() uploadRequest: UploadSingleFileRequest\n    ): Promise<UploadAllegatoResponseDto> {\n        if (!files || files.length === 0) {\n            throw new BadRequestException('Nessun file fornito');\n        }\n        if (files.length > 1) {\n            throw new BadRequestException('Questo endpoint accetta un solo file alla volta');\n        }\n        return await this.allegatiService.uploadFile(files[0], uploadRequest);\n    }\n\n    @Get(':id')\n    @ApiResponse({ status: 200, description: 'File scaricato con successo.', type: DownloadAllegatoResponseDto })\n    async download(@Param('id') id: number): Promise<DownloadAllegatoResponseDto> {\n        return await this.allegatiService.downloadFile(id);\n    }\n\n    @Get(':id/download')\n    @ApiResponse({ status: 200, description: 'File scaricato con successo.' })\n    async downloadFile(\n        @Param('id') id: number,\n        @Res() res: e.Response\n    ): Promise<void> {\n        try {\n            const file = await this.allegatiService.downloadFile(id);\n            \n            // Convert base64 to buffer in chunks\n            const chunkSize = 1024 * 1024; // 1MB chunks\n            const base64Content = file.contentBase64;\n            const bufferSize = Math.ceil((base64Content.length * 3) / 4);\n            const buffer = Buffer.alloc(bufferSize);\n            \n            let bufferIndex = 0;\n            for (let i = 0; i < base64Content.length; i += chunkSize) {\n                const chunk = base64Content.slice(i, i + chunkSize);\n                const chunkBuffer = Buffer.from(chunk, 'base64');\n                chunkBuffer.copy(buffer, bufferIndex);\n                bufferIndex += chunkBuffer.length;\n            }\n\n            // Set headers for file download\n            res.setHeader('Content-Type', file.mimetype);\n            res.setHeader('Content-Disposition', `attachment; filename=\"${file.filename}\"`);\n            res.setHeader('Content-Length', buffer.length);\n            \n            res.status(200).end(buffer);\n        } catch (error) {\n            console.error('[AllegatiController] downloadFile - Errore:', error);\n            throw error;\n        }\n    }\n\n    @Delete(':id')\n    @ApiResponse({ status: 200, description: 'File eliminato con successo.' })\n    async delete(@Param('id') id: number, @Response() res: e.Response) {\n        await this.allegatiService.deleteFile(id);\n        return RestUtilities.sendOKMessage(res, \"File eliminato con successo\");\n    }\n\n    @Get()\n    @ApiResponse({ status: 200, description: 'Lista degli allegati.', type: [AllegatoDto] })\n    @ApiQuery({ name: 'tipcod', required: false, description: 'Filtra per tipo codice' })\n    @ApiQuery({ name: 'codice', required: false, description: 'Filtra per codice' })\n    @ApiQuery({ name: 'docrif', required: false, description: 'Filtra per riferimento documento' })\n    @ApiQuery({ name: 'idxtipoall', required: false, description: 'Filtra per tipo allegato', type: Number })\n    async list(\n        @Query('tipcod') tipcod?: string,\n        @Query('codice') codice?: number,\n        @Query('docrif') docrif?: string,\n        @Query('idxtipoall') idxtipoall?: number\n    ): Promise<AllegatoDto[]> {\n        return await this.allegatiService.listFiles({\n            tipcod,\n            codice,\n            docrif,\n            idxtipoall: idxtipoall ? Number(idxtipoall) : undefined\n        });\n    }\n\n    @Post('search')\n@ApiResponse({ status: 200, description: 'Ricerca allegati per campi.' })\nasync searchByFields(@Body() body: { tipcod?: string; codice?: number; docrif?: string; idxtipoall?: number }) {\n    return await this.allegatiService.findByFields(body);\n}\n\n@Post('get-by-fields')\n@ApiResponse({ status: 200, description: 'Ottieni un allegato per campi.' })\nasync getOneByFields(@Body() body: { tipcod?: string; codice?: number; docrif?: string; idxtipoall?: number }) {\n    return await this.allegatiService.getOneByFields(body);\n}\n\n@Patch('update-fields/:id')\n@ApiResponse({ status: 200, description: 'Aggiorna i campi di un allegato.' })\nasync updateFieldsById(\n    @Param('id') id: number,\n    @Body() body: { tipcod?: string; codice?: number; docrif?: string; idxtipoall?: number }\n) {\n    await this.allegatiService.updateFieldsById(Number(id), body);\n    return { message: 'Aggiornamento completato' };\n}\n}"]}
+{"version":3,"file":"AllegatiController.js","sourceRoot":"","sources":["../../../src/allegati-module/Controllers/AllegatiController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,6CAA4E;AAE5E,2CAAyK;AACzK,+DAA4D;AAC5D,uFAAoF;AACpF,iFAA8E;AAC9E,2FAAsF;AACtF,qDAAgD;AAChD,+FAA0F;AAC1F,6EAA0E;AAC1E,+CAAgD;AAChD,yCAAsC;AACtC,sDAAwB;AAIjB,IAAM,kBAAkB,0BAAxB,MAAM,kBAAkB;IAG3B,YAA6B,eAAgC;QAAhC,oBAAe,GAAf,eAAe,CAAiB;QAF5C,WAAM,GAAG,IAAI,eAAM,CAAC,oBAAkB,CAAC,IAAI,CAAC,CAAC;IAEE,CAAC;IA2B3D,MAAM,CACS,KAA4B,EACrC,aAAsC;;YAE9C,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,CAAC,CAAC;YACzD,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACnB,MAAM,IAAI,4BAAmB,CAAC,iDAAiD,CAAC,CAAC;YACrF,CAAC;YACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,IAAI,EAAE,CAAC;gBACR,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,CAAC,CAAC;YACzD,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACtE,CAAC;KAAA;IAIK,QAAQ,CAAc,EAAU;;YAClC,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QACvD,CAAC;KAAA;IAIK,YAAY,CACD,EAAU,EAChB,GAAe;;;YAEtB,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;gBAEzD,qFAAqF;gBACrF,MAAM,SAAS,GAAG,IAAI,GAAG,IAAI,CAAC,CAAC,aAAa;gBAC5C,MAAM,aAAa,GAAG,IAAI,CAAC,aAAa,CAAC;gBACzC,MAAM,MAAM,GAAa,EAAE,CAAC;gBAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,aAAa,CAAC,MAAM,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC;oBACvD,MAAM,KAAK,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,CAAC;oBACpD,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAC9C,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAErC,4EAA4E;gBAC5E,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;gBACrF,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,MAAA,IAAI,CAAC,QAAQ,mCAAI,0BAA0B,CAAC,CAAC;gBAC3E,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,yBAAyB,SAAS,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBACnI,GAAG,CAAC,SAAS,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;gBAE/C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAC;gBACxE,MAAM,KAAK,CAAC;YAChB,CAAC;QACL,CAAC;KAAA;IAIK,MAAM,CAAc,EAAU,EAAc,GAAe;;YAC7D,MAAM,IAAI,CAAC,eAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC1C,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAAC;QAC3E,CAAC;KAAA;IAQK,IAAI,CACW,MAAe,EACf,MAAe,EACf,MAAe,EACX,UAAmB;;YAExC,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC;gBACxC,MAAM;gBACN,MAAM;gBACN,MAAM;gBACN,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS;aAC1D,CAAC,CAAC;QACP,CAAC;KAAA;IAIC,cAAc,CAAS,IAAgF;;YACzG,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;KAAA;IAIK,cAAc,CAAS,IAAgF;;YACzG,OAAO,MAAM,IAAI,CAAC,eAAe,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAC3D,CAAC;KAAA;IAIK,gBAAgB,CACL,EAAU,EACf,IAAgF;;YAExF,MAAM,IAAI,CAAC,eAAe,CAAC,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9D,OAAO,EAAE,OAAO,EAAE,0BAA0B,EAAE,CAAC;QACnD,CAAC;KAAA;CACA,CAAA;AArIY,gDAAkB;AA8BrB;IAzBL,IAAA,aAAI,EAAC,QAAQ,CAAC;IACd,IAAA,wBAAe,EAAC,IAAA,mCAAgB,EAAC,MAAM,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAClG,IAAA,qBAAW,EAAC,qBAAqB,CAAC;IAClC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,6BAA6B,EAAE,IAAI,EAAE,qDAAyB,EAAE,CAAC;IACzG,IAAA,iBAAO,EAAC;QACL,WAAW,EAAE,8CAA8C;QAC3D,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE;YACJ,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE;gBACR,IAAI,EAAE;oBACF,IAAI,EAAE,QAAQ;oBACd,MAAM,EAAE,QAAQ;iBACnB;gBACD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;gBACvC,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE;gBAC7C,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE;gBACxC,mBAAmB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,uBAAuB,EAAE;gBACzE,kBAAkB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;gBAC7E,gBAAgB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,EAAE;gBAC3E,cAAc,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE;gBAC/C,oBAAoB,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE;aACtE;SACJ;KACJ,CAAC;IAEG,WAAA,IAAA,sBAAa,GAAE,CAAA;IACf,WAAA,IAAA,aAAI,GAAE,CAAA;;4CAAgB,iDAAuB;;gDAajD;AAIK;IAFL,IAAA,YAAG,EAAC,KAAK,CAAC;IACV,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,IAAI,EAAE,yDAA2B,EAAE,CAAC;IAC7F,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;;;;kDAE1B;AAIK;IAFL,IAAA,YAAG,EAAC,cAAc,CAAC;IACnB,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAErE,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;;;;sDA0BT;AAIK;IAFL,IAAA,eAAM,EAAC,KAAK,CAAC;IACb,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC5D,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IAAc,WAAA,IAAA,iBAAQ,GAAE,CAAA;;;;gDAGhD;AAQK;IANL,IAAA,YAAG,GAAE;IACL,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,uBAAuB,EAAE,IAAI,EAAE,CAAC,yBAAW,CAAC,EAAE,CAAC;IACvF,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,wBAAwB,EAAE,CAAC;IACpF,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,mBAAmB,EAAE,CAAC;IAC/E,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAC9F,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,0BAA0B,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAEpG,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,QAAQ,CAAC,CAAA;IACf,WAAA,IAAA,cAAK,EAAC,YAAY,CAAC,CAAA;;;;8CAQvB;AAIC;IAFD,IAAA,aAAI,EAAC,QAAQ,CAAC;IAClB,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,6BAA6B,EAAE,CAAC;IACnD,WAAA,IAAA,aAAI,GAAE,CAAA;;;;wDAE3B;AAIK;IAFL,IAAA,aAAI,EAAC,eAAe,CAAC;IACrB,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IACtD,WAAA,IAAA,aAAI,GAAE,CAAA;;;;wDAE3B;AAIK;IAFL,IAAA,cAAK,EAAC,mBAAmB,CAAC;IAC1B,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,CAAC;IAEzE,WAAA,IAAA,cAAK,EAAC,IAAI,CAAC,CAAA;IACX,WAAA,IAAA,aAAI,GAAE,CAAA;;;;0DAIV;6BApIY,kBAAkB;IAF9B,IAAA,kBAAS,EAAC,uDAA0B,CAAC;IACrC,IAAA,mBAAU,EAAC,UAAU,CAAC;qCAI2B,iCAAe;GAHpD,kBAAkB,CAqI9B","sourcesContent":["import {ApiBody, ApiConsumes, ApiResponse, ApiQuery} from \"@nestjs/swagger\";\r\n\r\nimport { Controller, Post, Get, Delete, Param, UploadedFiles, UseGuards, UseInterceptors, BadRequestException, Body, Response, Query, Res, Patch } from \"@nestjs/common\";\r\nimport { FilesInterceptor } from \"@nestjs/platform-express\";\r\nimport { AllegatiAuthorizationGuard } from \"../security/allegatiAuthorizationGuard\";\r\nimport { AllegatiService } from \"../Services/AllegatiService/AllegatiService\";\r\nimport {UploadAllegatoResponseDto} from \"../Dtos/responses/UploadAllegatoResponseDto\";\r\nimport {AllegatoDto} from \"../Dtos/AllegatoDto\";\r\nimport {DownloadAllegatoResponseDto} from \"../Dtos/responses/DownloadAllegatoResponseDto\";\r\nimport { UploadSingleFileRequest } from \"../Dtos/UploadSingleFileRequest\";\r\nimport { RestUtilities } from \"../../Utilities\";\r\nimport { Logger } from \"../../Logger\";\r\nimport e from \"express\";\r\n\r\n@UseGuards(AllegatiAuthorizationGuard)\r\n@Controller('allegati')\r\nexport class AllegatiController {\r\n    private readonly logger = new Logger(AllegatiController.name);\r\n\r\n    constructor(private readonly allegatiService: AllegatiService) {}\r\n\r\n    @Post('upload')\r\n    @UseInterceptors(FilesInterceptor('file', 1, { limits: { fileSize: 90 * 1024 * 1024, files: 1 } }))\r\n    @ApiConsumes('multipart/form-data')\r\n    @ApiResponse({ status: 201, description: 'File caricato con successo.', type: UploadAllegatoResponseDto })\r\n    @ApiBody({\r\n        description: 'File e metadati per l\\'upload di un allegato',\r\n        required: true,\r\n        schema: {\r\n            type: 'object',\r\n            properties: {\r\n                file: {\r\n                    type: 'string',\r\n                    format: 'binary',\r\n                },\r\n                codice: { type: 'integer', example: 1 },\r\n                tipoCodice: { type: 'string', example: 'CF' },\r\n                ordine: { type: 'string', example: '1' },\r\n                descrizioneAllegato: { type: 'string', example: 'Documento di identità' },\r\n                dataInizioValidita: { type: 'string', format: 'date', example: '2024-01-01' },\r\n                dataFineValidita: { type: 'string', format: 'date', example: '2025-01-01' },\r\n                idTipoAllegato: { type: 'integer', example: 3 },\r\n                riferimentoDocumento: { type: 'string', example: 'PRAT-2024-0001' }\r\n            },\r\n        },\r\n    })\r\n    async upload(\r\n        @UploadedFiles() files: Express.Multer.File[],\r\n        @Body() uploadRequest: UploadSingleFileRequest\r\n    ): Promise<UploadAllegatoResponseDto> {\r\n        if (!files || files.length === 0) {\r\n            throw new BadRequestException('Nessun file fornito');\r\n        }\r\n        if (files.length > 1) {\r\n            throw new BadRequestException('Questo endpoint accetta un solo file alla volta');\r\n        }\r\n        const file = files[0];\r\n        if (!file) {\r\n            throw new BadRequestException('Nessun file fornito');\r\n        }\r\n        return await this.allegatiService.uploadFile(file, uploadRequest);\r\n    }\r\n\r\n    @Get(':id')\r\n    @ApiResponse({ status: 200, description: 'File scaricato con successo.', type: DownloadAllegatoResponseDto })\r\n    async download(@Param('id') id: number): Promise<DownloadAllegatoResponseDto> {\r\n        return await this.allegatiService.downloadFile(id);\r\n    }\r\n\r\n    @Get(':id/download')\r\n    @ApiResponse({ status: 200, description: 'File scaricato con successo.' })\r\n    async downloadFile(\r\n        @Param('id') id: number,\r\n        @Res() res: e.Response\r\n    ): Promise<void> {\r\n        try {\r\n            const file = await this.allegatiService.downloadFile(id);\r\n            \r\n            // Convert base64 to buffer in chunks; Buffer.concat evita i NUL finali del prealloc.\r\n            const chunkSize = 1024 * 1024; // 1MB chunks\r\n            const base64Content = file.contentBase64;\r\n            const chunks: Buffer[] = [];\r\n            for (let i = 0; i < base64Content.length; i += chunkSize) {\r\n                const chunk = base64Content.slice(i, i + chunkSize);\r\n                chunks.push(Buffer.from(chunk, 'base64'));\r\n            }\r\n            const buffer = Buffer.concat(chunks);\r\n\r\n            // Set headers for file download; filename* (RFC 5987) per i nomi non ASCII.\r\n            const asciiName = file.filename.replace(/[^\\x20-\\x7e]/g, '_').replace(/[\"\\\\]/g, '_');\r\n            res.setHeader('Content-Type', file.mimetype ?? 'application/octet-stream');\r\n            res.setHeader('Content-Disposition', `attachment; filename=\"${asciiName}\"; filename*=UTF-8''${encodeURIComponent(file.filename)}`);\r\n            res.setHeader('Content-Length', buffer.length);\r\n            \r\n            res.status(200).end(buffer);\r\n        } catch (error) {\r\n            this.logger.error('[AllegatiController] downloadFile - Errore:', error);\r\n            throw error;\r\n        }\r\n    }\r\n\r\n    @Delete(':id')\r\n    @ApiResponse({ status: 200, description: 'File eliminato con successo.' })\r\n    async delete(@Param('id') id: number, @Response() res: e.Response) {\r\n        await this.allegatiService.deleteFile(id);\r\n        return RestUtilities.sendOKMessage(res, \"File eliminato con successo\");\r\n    }\r\n\r\n    @Get()\r\n    @ApiResponse({ status: 200, description: 'Lista degli allegati.', type: [AllegatoDto] })\r\n    @ApiQuery({ name: 'tipcod', required: false, description: 'Filtra per tipo codice' })\r\n    @ApiQuery({ name: 'codice', required: false, description: 'Filtra per codice' })\r\n    @ApiQuery({ name: 'docrif', required: false, description: 'Filtra per riferimento documento' })\r\n    @ApiQuery({ name: 'idxtipoall', required: false, description: 'Filtra per tipo allegato', type: Number })\r\n    async list(\r\n        @Query('tipcod') tipcod?: string,\r\n        @Query('codice') codice?: number,\r\n        @Query('docrif') docrif?: string,\r\n        @Query('idxtipoall') idxtipoall?: number\r\n    ): Promise<AllegatoDto[]> {\r\n        return await this.allegatiService.listFiles({\r\n            tipcod,\r\n            codice,\r\n            docrif,\r\n            idxtipoall: idxtipoall ? Number(idxtipoall) : undefined\r\n        });\r\n    }\r\n\r\n    @Post('search')\r\n@ApiResponse({ status: 200, description: 'Ricerca allegati per campi.' })\r\nasync searchByFields(@Body() body: { tipcod?: string; codice?: number; docrif?: string; idxtipoall?: number }) {\r\n    return await this.allegatiService.findByFields(body);\r\n}\r\n\r\n@Post('get-by-fields')\r\n@ApiResponse({ status: 200, description: 'Ottieni un allegato per campi.' })\r\nasync getOneByFields(@Body() body: { tipcod?: string; codice?: number; docrif?: string; idxtipoall?: number }) {\r\n    return await this.allegatiService.getOneByFields(body);\r\n}\r\n\r\n@Patch('update-fields/:id')\r\n@ApiResponse({ status: 200, description: 'Aggiorna i campi di un allegato.' })\r\nasync updateFieldsById(\r\n    @Param('id') id: number,\r\n    @Body() body: { tipcod?: string; codice?: number; docrif?: string; idxtipoall?: number }\r\n) {\r\n    await this.allegatiService.updateFieldsById(Number(id), body);\r\n    return { message: 'Aggiornamento completato' };\r\n}\r\n}"]}

package/dist/allegati-module/Dtos/AllegatoDto.js.map

@@ -1 +1 @@
-{"version":3,"file":"AllegatoDto.js","sourceRoot":"","sources":["../../../src/allegati-module/Dtos/AllegatoDto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAA6E;AAE7E,MAAa,WAAW;CAgGvB;AAhGD,kCAgGC;AAzFG;IALC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,CAAC;KACb,CAAC;IACD,IAAA,0BAAQ,GAAE;;uCACA;AAQX;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,eAAe;KAC3B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;;6CACvC;AAQjB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,iBAAiB;KAC7B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;;6CACvC;AAQjB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,sBAAsB;KAClC,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;+CAC1C;AAQnB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,GAAG;KACf,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;2CACG;AAQhB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,IAAI;KAChB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACO;AAQpB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE,GAAG;KACf,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;2CACG;AAQhB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,8BAA8B;KAC1C,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;wDACgB;AAQ7B;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,YAAY;KACxB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;uDACe;AAQ5B;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,YAAY;KACxB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;qDACa;AAQ1B;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,CAAC;KACb,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;mDACW;AAQxB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,gBAAgB;KAC5B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;yDACiB","sourcesContent":["import { ApiProperty } from \"@nestjs/swagger\";\nimport { IsString, IsNotEmpty, IsNumber, IsOptional } from \"class-validator\";\n\nexport class AllegatoDto {\n\n    @ApiProperty({\n        description: 'ID univoco dell\\'allegato',\n        example: 1,\n    })\n    @IsNumber()\n    id: number;\n\n    @ApiProperty({\n        description: 'Nome originale del file caricato',\n        example: 'documento.pdf',\n    })\n    @IsString()\n    @IsNotEmpty({ message: \"Il nome file è obbligatorio.\" })\n    filename: string;\n\n    @ApiProperty({\n        description: 'Tipo MIME del file',\n        example: 'application/pdf',\n    })\n    @IsString()\n    @IsNotEmpty({ message: \"Il tipo MIME è obbligatorio.\" })\n    mimetype: string;\n\n    @ApiProperty({\n        description: 'Data di caricamento del file in formato ISO',\n        example: '2025-04-27T12:00:00Z',\n    })\n    @IsString()\n    @IsNotEmpty({ message: \"La data di upload è obbligatoria.\" })\n    uploadDate: string;\n\n    @ApiProperty({\n        description: 'Codice incrementale',\n        example: '1',\n    })\n    @IsString()\n    @IsOptional()\n    codice?: string;\n\n    @ApiProperty({\n        description: 'Tipo del codice fornito',\n        example: 'CF',\n    })\n    @IsString()\n    @IsOptional()\n    tipoCodice?: string;\n\n    @ApiProperty({\n        description: 'Numero o valore usato per ordinare o identificare la sequenza degli allegati',\n        example: '1',\n    })\n    @IsString()\n    @IsOptional()\n    ordine?: string;\n\n    @ApiProperty({\n        description: 'Descrizione testuale dell\\'allegato',\n        example: 'Documento di identità fronte',\n    })\n    @IsString()\n    @IsOptional()\n    descrizioneAllegato?: string;\n\n    @ApiProperty({\n        description: 'Data di inizio validità del documento',\n        example: '2024-01-01',\n    })\n    @IsString()\n    @IsOptional()\n    dataInizioValidita?: string;\n\n    @ApiProperty({\n        description: 'Data di fine validità del documento',\n        example: '2025-01-01',\n    })\n    @IsString()\n    @IsOptional()\n    dataFineValidita?: string;\n\n    @ApiProperty({\n        description: 'ID del tipo di allegato',\n        example: 3,\n    })\n    @IsNumber()\n    @IsOptional()\n    idTipoAllegato?: number;\n\n    @ApiProperty({\n        description: 'Riferimento esterno o identificativo del documento',\n        example: 'PRAT-2024-0001',\n    })\n    @IsString()\n    @IsOptional()\n    riferimentoDocumento?: string;\n}"]}
+{"version":3,"file":"AllegatoDto.js","sourceRoot":"","sources":["../../../src/allegati-module/Dtos/AllegatoDto.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAA6E;AAE7E,MAAa,WAAW;CAgGvB;AAhGD,kCAgGC;AAzFG;IALC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,2BAA2B;QACxC,OAAO,EAAE,CAAC;KACb,CAAC;IACD,IAAA,0BAAQ,GAAE;;uCACC;AAQZ;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,kCAAkC;QAC/C,OAAO,EAAE,eAAe;KAC3B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;;6CACtC;AAQlB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,oBAAoB;QACjC,OAAO,EAAE,iBAAiB;KAC7B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC;;6CACtC;AAQlB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,6CAA6C;QAC1D,OAAO,EAAE,sBAAsB;KAClC,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC;;+CACzC;AAQpB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,qBAAqB;QAClC,OAAO,EAAE,GAAG;KACf,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;2CACG;AAQhB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,IAAI;KAChB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;+CACO;AAQpB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,8EAA8E;QAC3F,OAAO,EAAE,GAAG;KACf,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;2CACG;AAQhB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,8BAA8B;KAC1C,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;wDACgB;AAQ7B;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,uCAAuC;QACpD,OAAO,EAAE,YAAY;KACxB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;uDACe;AAQ5B;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,qCAAqC;QAClD,OAAO,EAAE,YAAY;KACxB,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;qDACa;AAQ1B;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,yBAAyB;QACtC,OAAO,EAAE,CAAC;KACb,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;mDACW;AAQxB;IANC,IAAA,qBAAW,EAAC;QACT,WAAW,EAAE,oDAAoD;QACjE,OAAO,EAAE,gBAAgB;KAC5B,CAAC;IACD,IAAA,0BAAQ,GAAE;IACV,IAAA,4BAAU,GAAE;;yDACiB","sourcesContent":["import { ApiProperty } from \"@nestjs/swagger\";\r\nimport { IsString, IsNotEmpty, IsNumber, IsOptional } from \"class-validator\";\r\n\r\nexport class AllegatoDto {\r\n\r\n    @ApiProperty({\r\n        description: 'ID univoco dell\\'allegato',\r\n        example: 1,\r\n    })\r\n    @IsNumber()\r\n    id!: number;\r\n\r\n    @ApiProperty({\r\n        description: 'Nome originale del file caricato',\r\n        example: 'documento.pdf',\r\n    })\r\n    @IsString()\r\n    @IsNotEmpty({ message: \"Il nome file è obbligatorio.\" })\r\n    filename!: string;\r\n\r\n    @ApiProperty({\r\n        description: 'Tipo MIME del file',\r\n        example: 'application/pdf',\r\n    })\r\n    @IsString()\r\n    @IsNotEmpty({ message: \"Il tipo MIME è obbligatorio.\" })\r\n    mimetype!: string;\r\n\r\n    @ApiProperty({\r\n        description: 'Data di caricamento del file in formato ISO',\r\n        example: '2025-04-27T12:00:00Z',\r\n    })\r\n    @IsString()\r\n    @IsNotEmpty({ message: \"La data di upload è obbligatoria.\" })\r\n    uploadDate!: string;\r\n\r\n    @ApiProperty({\r\n        description: 'Codice incrementale',\r\n        example: '1',\r\n    })\r\n    @IsString()\r\n    @IsOptional()\r\n    codice?: string;\r\n\r\n    @ApiProperty({\r\n        description: 'Tipo del codice fornito',\r\n        example: 'CF',\r\n    })\r\n    @IsString()\r\n    @IsOptional()\r\n    tipoCodice?: string;\r\n\r\n    @ApiProperty({\r\n        description: 'Numero o valore usato per ordinare o identificare la sequenza degli allegati',\r\n        example: '1',\r\n    })\r\n    @IsString()\r\n    @IsOptional()\r\n    ordine?: string;\r\n\r\n    @ApiProperty({\r\n        description: 'Descrizione testuale dell\\'allegato',\r\n        example: 'Documento di identità fronte',\r\n    })\r\n    @IsString()\r\n    @IsOptional()\r\n    descrizioneAllegato?: string;\r\n\r\n    @ApiProperty({\r\n        description: 'Data di inizio validità del documento',\r\n        example: '2024-01-01',\r\n    })\r\n    @IsString()\r\n    @IsOptional()\r\n    dataInizioValidita?: string;\r\n\r\n    @ApiProperty({\r\n        description: 'Data di fine validità del documento',\r\n        example: '2025-01-01',\r\n    })\r\n    @IsString()\r\n    @IsOptional()\r\n    dataFineValidita?: string;\r\n\r\n    @ApiProperty({\r\n        description: 'ID del tipo di allegato',\r\n        example: 3,\r\n    })\r\n    @IsNumber()\r\n    @IsOptional()\r\n    idTipoAllegato?: number;\r\n\r\n    @ApiProperty({\r\n        description: 'Riferimento esterno o identificativo del documento',\r\n        example: 'PRAT-2024-0001',\r\n    })\r\n    @IsString()\r\n    @IsOptional()\r\n    riferimentoDocumento?: string;\r\n}"]}

package/dist/allegati-module/Dtos/BaseResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"BaseResponse.js","sourceRoot":"","sources":["../../../src/allegati-module/Dtos/BaseResponse.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,yDAAyC;AACzC,qDAAqE;AAErE,MAAa,MAAM;CAQlB;AARD,wBAQC;AALC;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;IAC/E,IAAA,0BAAQ,GAAE;;yCACO;AAIlB;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACvF,IAAA,0BAAQ,GAAE;;gDACc;AAG3B,MAAsB,YAAY;CAMjC;AAND,oCAMC;AADC;IAJC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7B,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAClB,IAAA,0BAAQ,GAAE;8BACH,MAAM;4CAAC","sourcesContent":["import { ApiProperty } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsObject, IsString, ValidateNested } from 'class-validator';\n\nexport class Status {\n  @ApiProperty({ example: '0', description: 'Codice di errore, \"0\" se tutto ok' })\n  @IsString()\n  errorCode: string;\n\n  @ApiProperty({ example: 'Success', description: 'Descrizione dell\\'errore o successo' })\n  @IsString()\n  errorDescription: string;\n}\n\nexport abstract class BaseResponse {\n  @ApiProperty({ type: Status })\n  @ValidateNested()\n  @Type(() => Status)\n  @IsObject()\n  Status: Status;\n}\n"]}
+{"version":3,"file":"BaseResponse.js","sourceRoot":"","sources":["../../../src/allegati-module/Dtos/BaseResponse.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,yDAAyC;AACzC,qDAAqE;AAErE,MAAa,MAAM;CAQlB;AARD,wBAQC;AALC;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,GAAG,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;IAC/E,IAAA,0BAAQ,GAAE;;yCACQ;AAInB;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,qCAAqC,EAAE,CAAC;IACvF,IAAA,0BAAQ,GAAE;;gDACe;AAG5B,MAAsB,YAAY;CAMjC;AAND,oCAMC;AADC;IAJC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7B,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,MAAM,CAAC;IAClB,IAAA,0BAAQ,GAAE;8BACF,MAAM;4CAAC","sourcesContent":["import { ApiProperty } from '@nestjs/swagger';\r\nimport { Type } from 'class-transformer';\r\nimport { IsObject, IsString, ValidateNested } from 'class-validator';\r\n\r\nexport class Status {\r\n  @ApiProperty({ example: '0', description: 'Codice di errore, \"0\" se tutto ok' })\r\n  @IsString()\r\n  errorCode!: string;\r\n\r\n  @ApiProperty({ example: 'Success', description: 'Descrizione dell\\'errore o successo' })\r\n  @IsString()\r\n  errorDescription!: string;\r\n}\r\n\r\nexport abstract class BaseResponse {\r\n  @ApiProperty({ type: Status })\r\n  @ValidateNested()\r\n  @Type(() => Status)\r\n  @IsObject()\r\n  Status!: Status;\r\n}\r\n"]}