emilsoftware-utilities 2.0.0-dev.23 → 2.0.0-dev.24

package/dist/accessi-module/Services/ServiceTokenService/ServiceTokenService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceTokenService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/ServiceTokenService/ServiceTokenService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgDA,oDAIC;AAGD,8CAiBC;AAGD,wDAEC;AAGD,kEAmBC;AAGD,oDAKC;AA3GD,2CAA4F;AAC5F,mCAAkE;AAClE,gDAA6C;AAC7C,sCAAmC;AACnC,kDAAmD;AAGnD,+FAA+F;AAClF,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAC1C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAC7C,MAAM,oBAAoB,GAAG,KAAM,CAAC;AAoCpC,6FAA6F;AAC7F,SAAgB,oBAAoB;IAClC,MAAM,OAAO,GAAG,GAAG,4BAAoB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,sFAAsF;AACtF,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,0GAA0G;AAC1G,SAAgB,sBAAsB,CAAC,MAAc;IACnD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,0EAA0E;AAC1E,SAAgB,2BAA2B,CAAC,MAA4B;IACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,4BAAmB,CAAC,+CAA+C,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,iGAAiG;AACjG,SAAgB,oBAAoB,CAAC,MAAgB,EAAE,QAA4B;IACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA6B,EAAE,cAAuB;;IAC/E,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QACxF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACxG,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,MAAA,KAAK,CAAC,OAAO,mCAAI,cAAc,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AAGjG,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAAwD,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAE1F,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;IAC7C,CAAC;IAEO,UAAU,CAAC,GAA4B;;QAC7C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC;YAClC,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrD,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;YACjC,UAAU,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACpG,OAAO,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAC9D,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;SACrE,CAAC;IACJ,CAAC;IAEa,OAAO,CAAC,OAAe;;YACnC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,eAAe,EACpB;qDAC+C,EAC/C,CAAC,OAAO,CAAC,EACT,KAAK,CACN,CAAC;YACF,OAAQ,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAoC,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;KAAA;IAED,kGAAkG;IAC5F,KAAK,CAAC,KAA6B,EAAE,SAAkB;;;YAC3D,MAAM,KAAK,GAAG,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAmB,CAAC,sEAAsE,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAA,IAAI,CAAC,cAAc,CAAC,aAAa,0CAAE,cAAc,CAAC,CAAC;YAC9F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;YAE1D,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB;iCAC2B,EAC3B,CAAC,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,IAAI,EAAE,SAAS,CAAC,CACjG,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACxC,uCAAY,IAAI,CAAC,UAAU,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAE,KAAK,IAAG;QAC5F,CAAC;KAAA;IAED,0DAA0D;IACpD,IAAI;6DAAC,cAAc,GAAG,KAAK;YAC/B,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,eAAe,EACpB;oCAC8B,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B;+CACrC,EACzC,EAAE,EACF,KAAK,CACN,CAAC;YACF,OAAQ,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAoC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/H,CAAC;KAAA;IAED,mGAAmG;IAC7F,MAAM,CAAC,OAAe,EAAE,SAAkB;;;YAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,mCAAI,OAAO,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,YAAY,eAAe,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB,oGAAoG,EACpG,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,IAAI,EAAE,YAAY,CAAC,CAClC,CAAC;QACJ,CAAC;KAAA;IAED,+EAA+E;IACzE,MAAM,CAAC,OAAe,EAAE,SAAkB;;;YAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,mCAAI,OAAO,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,YAAY,eAAe,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC,KAAK,CACf;gBACE,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,MAAA,QAAQ,CAAC,SAAS,mCAAI,IAAI;aACtC,EACD,SAAS,CACV,CAAC;QACJ,CAAC;KAAA;IAED;;;OAGG;IACG,MAAM,CAAC,KAAa,EAAE,OAAyB;;YACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1D,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC7D,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC3F,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAE7F,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvF,CAAC;KAAA;IAEO,cAAc,CAAC,SAAiB,EAAE,MAAc;QACtD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IAEa,aAAa,CAAC,OAAe,EAAE,UAAmB,EAAE,EAAW;;YAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,oBAAoB,EAAE,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB,wGAAwG,EACxG,CAAC,EAAE,aAAF,EAAE,cAAF,EAAE,GAAI,IAAI,EAAE,OAAO,CAAC,EACrB,KAAK,CACN,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AArKY,kDAAmB;8BAAnB,mBAAmB;IAF/B,mBAAQ;IACR,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,mBAAmB,CAqK/B","sourcesContent":["import { BadRequestException, Inject, Injectable, NotFoundException } from '@nestjs/common';\r\nimport { createHash, randomBytes, timingSafeEqual } from 'crypto';\r\nimport { autobind } from '../../../autobind';\r\nimport { Orm } from '../../../Orm';\r\nimport { RestUtilities } from '../../../Utilities';\r\nimport type { AccessiOptions } from '../../AccessiModule';\r\n\r\n/** Prefisso riconoscibile dei token di servizio; il formato completo e `st_<id>.<segreto>`. */\r\nexport const SERVICE_TOKEN_PREFIX = 'st_';\r\nconst TOKEN_ID_PATTERN = /^st_[a-f0-9]{32}$/;\r\nconst SCOPE_PATTERN = /^[a-z0-9:_-]{1,40}$/i;\r\nconst LAST_USED_REFRESH_MS = 60_000;\r\n\r\n/** Metadati pubblici di un token (mai il segreto). */\r\nexport interface ServiceTokenMetadata {\r\n  tokenId: string;\r\n  label: string;\r\n  scopes: string[];\r\n  createdAt?: string;\r\n  expiresAt?: string;\r\n  lastUsedAt?: string;\r\n  lastUsedIp?: string;\r\n  revoked: boolean;\r\n  revokedAt?: string;\r\n  revokedBy?: number;\r\n}\r\n\r\n/** Risultato dell'emissione: contiene il segreto in chiaro, mostrato una sola volta. */\r\nexport interface IssuedServiceToken extends ServiceTokenMetadata {\r\n  token: string;\r\n}\r\n\r\n/** Risultato della verifica di un token presentato. */\r\nexport interface VerifiedServiceToken {\r\n  tokenId: string;\r\n  label: string;\r\n  scopes: string[];\r\n}\r\n\r\nexport interface IssueServiceTokenInput {\r\n  label: string;\r\n  scopes?: string[];\r\n  expiresAt?: Date | string | null;\r\n  /** Giorni di validita; ignorato se `expiresAt` e valorizzato. */\r\n  ttlDays?: number;\r\n}\r\n\r\n/** Genera un nuovo token di servizio: identificativo pubblico + segreto ad alta entropia. */\r\nexport function generateServiceToken(): { token: string; tokenId: string; secret: string } {\r\n  const tokenId = `${SERVICE_TOKEN_PREFIX}${randomBytes(16).toString('hex')}`;\r\n  const secret = randomBytes(32).toString('base64url');\r\n  return { token: `${tokenId}.${secret}`, tokenId, secret };\r\n}\r\n\r\n/** Estrae identificativo e segreto; restituisce `null` se il formato non e valido. */\r\nexport function parseServiceToken(token: unknown): { tokenId: string; secret: string } | null {\r\n  if (typeof token !== 'string') {\r\n    return null;\r\n  }\r\n\r\n  const separator = token.indexOf('.');\r\n  if (separator <= 0) {\r\n    return null;\r\n  }\r\n\r\n  const tokenId = token.slice(0, separator);\r\n  const secret = token.slice(separator + 1);\r\n  if (!TOKEN_ID_PATTERN.test(tokenId) || secret.length < 16) {\r\n    return null;\r\n  }\r\n\r\n  return { tokenId, secret };\r\n}\r\n\r\n/** Hash del segreto per lo storage at-rest. Il segreto e ad alta entropia (256 bit), non una password. */\r\nexport function hashServiceTokenSecret(secret: string): string {\r\n  return createHash('sha256').update(secret, 'utf8').digest('hex');\r\n}\r\n\r\n/** Normalizza e valida gli scope: trim, dedup e controllo del formato. */\r\nexport function normalizeServiceTokenScopes(scopes: string[] | undefined): string[] {\r\n  if (scopes === undefined) {\r\n    return [];\r\n  }\r\n  if (!Array.isArray(scopes)) {\r\n    throw new BadRequestException('Gli scope devono essere un array di stringhe.');\r\n  }\r\n\r\n  const normalized: string[] = [];\r\n  for (const rawScope of scopes) {\r\n    if (typeof rawScope !== 'string' || !SCOPE_PATTERN.test(rawScope.trim())) {\r\n      throw new BadRequestException(`Scope non valido: ${String(rawScope)}. Usare lettere, numeri, ':', '_' o '-'.`);\r\n    }\r\n    const scope = rawScope.trim().toLowerCase();\r\n    if (!normalized.includes(scope)) {\r\n      normalized.push(scope);\r\n    }\r\n  }\r\n  return normalized;\r\n}\r\n\r\n/** True se l'insieme di scope soddisfa quello richiesto (uno scope vuoto non richiede nulla). */\r\nexport function serviceTokenHasScope(scopes: string[], required: string | undefined): boolean {\r\n  if (!required) {\r\n    return true;\r\n  }\r\n  return scopes.includes(required.toLowerCase());\r\n}\r\n\r\nfunction toIso(value: unknown): string | undefined {\r\n  if (value === undefined || value === null) {\r\n    return undefined;\r\n  }\r\n  const date = value instanceof Date ? value : new Date(String(value));\r\n  return Number.isNaN(date.getTime()) ? undefined : date.toISOString();\r\n}\r\n\r\nfunction resolveExpiration(input: IssueServiceTokenInput, defaultTtlDays?: number): Date | null {\r\n  if (input.expiresAt !== undefined && input.expiresAt !== null && input.expiresAt !== '') {\r\n    const expiresAt = input.expiresAt instanceof Date ? input.expiresAt : new Date(String(input.expiresAt));\r\n    if (Number.isNaN(expiresAt.getTime())) {\r\n      throw new BadRequestException('Data di scadenza non valida.');\r\n    }\r\n    if (expiresAt.getTime() <= Date.now()) {\r\n      throw new BadRequestException('La data di scadenza deve essere nel futuro.');\r\n    }\r\n    return expiresAt;\r\n  }\r\n\r\n  const ttlDays = input.ttlDays ?? defaultTtlDays;\r\n  if (typeof ttlDays === 'number' && Number.isFinite(ttlDays) && ttlDays > 0) {\r\n    return new Date(Date.now() + ttlDays * 24 * 60 * 60 * 1000);\r\n  }\r\n\r\n  return null;\r\n}\r\n\r\n/** Gestisce il ciclo di vita dei token di servizio (emissione, elenco, revoca, rotazione, verifica). */\r\n@autobind\r\n@Injectable()\r\nexport class ServiceTokenService {\r\n  constructor(@Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions) {}\r\n\r\n  private get databaseOptions() {\r\n    return this.accessiOptions.databaseOptions;\r\n  }\r\n\r\n  private toMetadata(row: Record<string, unknown>): ServiceTokenMetadata {\r\n    const scopesRaw = typeof row.scopes === 'string' ? row.scopes.trim() : '';\r\n    return {\r\n      tokenId: String(row.tokenId ?? ''),\r\n      label: typeof row.label === 'string' ? row.label : '',\r\n      scopes: scopesRaw === '' ? [] : scopesRaw.split(/\\s+/),\r\n      createdAt: toIso(row.createdAt),\r\n      expiresAt: toIso(row.expiresAt),\r\n      lastUsedAt: toIso(row.lastUsedAt),\r\n      lastUsedIp: typeof row.lastUsedIp === 'string' && row.lastUsedIp !== '' ? row.lastUsedIp : undefined,\r\n      revoked: row.revokedAt !== undefined && row.revokedAt !== null,\r\n      revokedAt: toIso(row.revokedAt),\r\n      revokedBy: row.revokedBy == null ? undefined : Number(row.revokedBy),\r\n    };\r\n  }\r\n\r\n  private async readRow(tokenId: string): Promise<Record<string, unknown> | undefined> {\r\n    const rows = await Orm.query(\r\n      this.databaseOptions,\r\n      `SELECT TOKEN_ID, TOKEN_HASH, LABEL, SCOPES, CREATED_BY, CREATED_AT, EXPIRES_AT, LAST_USED_AT, LAST_USED_IP, REVOKED_AT, REVOKED_BY\r\n       FROM ACCESSI_SERVICE_TOKEN WHERE TOKEN_ID = ?`,\r\n      [tokenId],\r\n      false,\r\n    );\r\n    return (rows.map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>)[0];\r\n  }\r\n\r\n  /** Crea un nuovo token. Il segreto in chiaro e restituito una sola volta e non e recuperabile. */\r\n  async issue(input: IssueServiceTokenInput, createdBy?: number): Promise<IssuedServiceToken> {\r\n    const label = typeof input?.label === 'string' ? input.label.trim() : '';\r\n    if (label.length < 1 || label.length > 100) {\r\n      throw new BadRequestException('La descrizione del token deve essere compresa tra 1 e 100 caratteri.');\r\n    }\r\n\r\n    const scopes = normalizeServiceTokenScopes(input.scopes);\r\n    const expiresAt = resolveExpiration(input, this.accessiOptions.serviceTokens?.defaultTtlDays);\r\n    const { token, tokenId, secret } = generateServiceToken();\r\n\r\n    await Orm.execute(\r\n      this.databaseOptions,\r\n      `INSERT INTO ACCESSI_SERVICE_TOKEN (TOKEN_ID, TOKEN_HASH, LABEL, SCOPES, CREATED_BY, EXPIRES_AT)\r\n       VALUES (?, ?, ?, ?, ?, ?)`,\r\n      [tokenId, hashServiceTokenSecret(secret), label, scopes.join(' '), createdBy ?? null, expiresAt],\r\n    );\r\n\r\n    const row = await this.readRow(tokenId);\r\n    return { ...this.toMetadata(row ?? { tokenId, label, scopes: scopes.join(' ') }), token };\r\n  }\r\n\r\n  /** Elenca i token (metadati soltanto, mai il segreto). */\r\n  async list(includeRevoked = false): Promise<ServiceTokenMetadata[]> {\r\n    const rows = await Orm.query(\r\n      this.databaseOptions,\r\n      `SELECT TOKEN_ID, LABEL, SCOPES, CREATED_BY, CREATED_AT, EXPIRES_AT, LAST_USED_AT, LAST_USED_IP, REVOKED_AT, REVOKED_BY\r\n       FROM ACCESSI_SERVICE_TOKEN ${includeRevoked ? '' : 'WHERE REVOKED_AT IS NULL'}\r\n       ORDER BY CREATED_AT DESC, TOKEN_ID DESC`,\r\n      [],\r\n      false,\r\n    );\r\n    return (rows.map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>).map((row) => this.toMetadata(row));\r\n  }\r\n\r\n  /** Revoca un token rendendolo immediatamente inutilizzabile. Idempotente su token gia revocati. */\r\n  async revoke(tokenId: string, revokedBy?: number): Promise<void> {\r\n    const parsed = parseServiceToken(tokenId);\r\n    const normalizedId = parsed?.tokenId ?? tokenId;\r\n    const row = await this.readRow(normalizedId);\r\n    if (!row) {\r\n      throw new NotFoundException(`Token di servizio ${normalizedId} non trovato.`);\r\n    }\r\n    if (row.revokedAt !== undefined && row.revokedAt !== null) {\r\n      return;\r\n    }\r\n    await Orm.execute(\r\n      this.databaseOptions,\r\n      'UPDATE ACCESSI_SERVICE_TOKEN SET REVOKED_AT = CURRENT_TIMESTAMP, REVOKED_BY = ? WHERE TOKEN_ID = ?',\r\n      [revokedBy ?? null, normalizedId],\r\n    );\r\n  }\r\n\r\n  /** Revoca il token indicato ed emette un sostituto con gli stessi metadati. */\r\n  async rotate(tokenId: string, createdBy?: number): Promise<IssuedServiceToken> {\r\n    const parsed = parseServiceToken(tokenId);\r\n    const normalizedId = parsed?.tokenId ?? tokenId;\r\n    const row = await this.readRow(normalizedId);\r\n    if (!row) {\r\n      throw new NotFoundException(`Token di servizio ${normalizedId} non trovato.`);\r\n    }\r\n\r\n    const metadata = this.toMetadata(row);\r\n    await this.revoke(normalizedId, createdBy);\r\n\r\n    return this.issue(\r\n      {\r\n        label: metadata.label,\r\n        scopes: metadata.scopes,\r\n        expiresAt: metadata.expiresAt ?? null,\r\n      },\r\n      createdBy,\r\n    );\r\n  }\r\n\r\n  /**\r\n   * Verifica un token presentato: formato, esistenza, revoca, scadenza e hash a tempo costante.\r\n   * Aggiorna `LAST_USED_AT` (best-effort, al massimo una volta al minuto).\r\n   */\r\n  async verify(token: string, context?: { ip?: string }): Promise<VerifiedServiceToken | undefined> {\r\n    const parsed = parseServiceToken(token);\r\n    if (!parsed) {\r\n      return undefined;\r\n    }\r\n\r\n    const row = await this.readRow(parsed.tokenId);\r\n    if (!row) {\r\n      return undefined;\r\n    }\r\n\r\n    if (row.revokedAt !== undefined && row.revokedAt !== null) {\r\n      return undefined;\r\n    }\r\n\r\n    const expiresAt = toIso(row.expiresAt);\r\n    if (expiresAt && new Date(expiresAt).getTime() <= Date.now()) {\r\n      return undefined;\r\n    }\r\n\r\n    const storedHash = typeof row.tokenHash === 'string' ? row.tokenHash : '';\r\n    if (!storedHash || !this.safeHashEquals(hashServiceTokenSecret(parsed.secret), storedHash)) {\r\n      return undefined;\r\n    }\r\n\r\n    const metadata = this.toMetadata(row);\r\n    await this.touchLastUsed(parsed.tokenId, row.lastUsedAt, context?.ip).catch(() => undefined);\r\n\r\n    return { tokenId: metadata.tokenId, label: metadata.label, scopes: metadata.scopes };\r\n  }\r\n\r\n  private safeHashEquals(candidate: string, stored: string): boolean {\r\n    const candidateBuffer = Buffer.from(candidate, 'hex');\r\n    const storedBuffer = Buffer.from(stored, 'hex');\r\n    if (candidateBuffer.length !== storedBuffer.length || candidateBuffer.length === 0) {\r\n      return false;\r\n    }\r\n    return timingSafeEqual(candidateBuffer, storedBuffer);\r\n  }\r\n\r\n  private async touchLastUsed(tokenId: string, lastUsedAt: unknown, ip?: string): Promise<void> {\r\n    const lastUsed = toIso(lastUsedAt);\r\n    if (lastUsed && Date.now() - new Date(lastUsed).getTime() < LAST_USED_REFRESH_MS) {\r\n      return;\r\n    }\r\n    await Orm.execute(\r\n      this.databaseOptions,\r\n      'UPDATE ACCESSI_SERVICE_TOKEN SET LAST_USED_AT = CURRENT_TIMESTAMP, LAST_USED_IP = ? WHERE TOKEN_ID = ?',\r\n      [ip ?? null, tokenId],\r\n      false,\r\n    );\r\n  }\r\n}\r\n"]}

package/dist/accessi-module/Services/TwoFactorService/TwoFactorService.js

@@ -46,41 +46,37 @@ let TwoFactorService = class TwoFactorService {
         return new common_1.HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);
     }
     hash(id, code) {
-        return (0, crypto_1.createHmac)('sha256', (0, passwordResetToken_1.getAccessiJwtSecret)(this.options)).update(`accessi-2fa:${id}:${code}`).digest('hex');
+        return (0, crypto_1.createHmac)('sha256', (0, passwordResetToken_1.getAccessiJwtSecret)(this.options, '2fa')).update(`accessi-2fa:${id}:${code}`).digest('hex');
     }
     row(result) {
-        var _a, _b, _c;
-        const row = Array.isArray(result) ? result[0] : result;
+        var _a, _b, _c, _d, _e, _f;
+        const row = (Array.isArray(result) ? result[0] : result);
         if (!row)
             return undefined;
         const raw = Utilities_1.RestUtilities.convertKeysToCamelCase(row);
+        const asString = (value) => typeof value === 'string' ? value : undefined;
+        const codiceUtente = Number(raw.codute);
+        if (!codiceUtente)
+            return undefined;
         const converted = {
-            codiceUtente: Number(raw.codute), email: (_a = raw.email) === null || _a === void 0 ? void 0 : _a.trim(), mode: (_b = raw.authmode) === null || _b === void 0 ? void 0 : _b.trim(), identityKey: (_c = raw.idnkey) === null || _c === void 0 ? void 0 : _c.trim(),
-            codeHash: raw.codehash, expiresAt: raw.expiresAt, attempts: Number(raw.attempts), sends: Number(raw.sends), sentAt: raw.sentAt,
+            codiceUtente,
+            email: (_b = (_a = asString(raw.email)) === null || _a === void 0 ? void 0 : _a.trim()) !== null && _b !== void 0 ? _b : '',
+            mode: (_d = (_c = asString(raw.authmode)) === null || _c === void 0 ? void 0 : _c.trim()) !== null && _d !== void 0 ? _d : 'password',
+            identityKey: (_e = asString(raw.idnkey)) === null || _e === void 0 ? void 0 : _e.trim(),
+            codeHash: (_f = asString(raw.codehash)) !== null && _f !== void 0 ? _f : '',
+            expiresAt: raw.expiresAt,
+            attempts: Number(raw.attempts),
+            sends: Number(raw.sends),
+            sentAt: raw.sentAt,
         };
-        return converted.codiceUtente ? converted : undefined;
+        return converted;
     }
     transaction(operation) {
         return __awaiter(this, void 0, void 0, function* () {
-            const db = yield Orm_1.Orm.connect(this.options.databaseOptions);
-            let transaction;
-            try {
-                transaction = yield Orm_1.Orm.startTransaction(db);
-                const query = (sql, params = []) => new Promise((resolve, reject) => {
-                    transaction.query(sql, params, (error, result) => error ? reject(error) : resolve(result));
-                });
-                const result = yield operation(query);
-                yield Orm_1.Orm.commitTransaction(transaction);
-                return result;
-            }
-            catch (error) {
-                if (transaction)
-                    yield Orm_1.Orm.rollbackTransaction(transaction).catch(() => undefined);
-                throw error;
-            }
-            finally {
-                yield new Promise(resolve => db.detach(() => resolve()));
-            }
+            return Orm_1.Orm.withTransaction(this.options.databaseOptions, (transaction) => __awaiter(this, void 0, void 0, function* () {
+                const query = (sql, params = []) => Orm_1.Orm.transactionQuery(transaction, sql, params);
+                return operation(query);
+            }));
         });
     }
     response(id, expiresAt) {
@@ -115,8 +111,8 @@ let TwoFactorService = class TwoFactorService {
                     throw this.limited();
                 yield query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');
                 const created = yield query(`INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`, [id, proof.codiceUtente, proof.email, proof.mode, (_e = proof.identityKey) !== null && _e !== void 0 ? _e : null, this.hash(id, code)]);
-                const row = Array.isArray(created) ? created[0] : created;
-                return (_f = row.EXPIRES_AT) !== null && _f !== void 0 ? _f : row.expires_at;
+                const row = (Array.isArray(created) ? created[0] : created);
+                return ((_f = row === null || row === void 0 ? void 0 : row.EXPIRES_AT) !== null && _f !== void 0 ? _f : row === null || row === void 0 ? void 0 : row.expires_at);
             }));
             yield this.deliver(id, code, proof.email);
             return this.response(id, expiresAt);

package/dist/accessi-module/Services/TwoFactorService/TwoFactorService.js.map

@@ -1 +1 @@
-{"version":3,"file":"TwoFactorService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/TwoFactorService/TwoFactorService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAuH;AACvH,mCAA6E;AAC7E,sCAAmC;AACnC,kDAAmD;AAGnD,0EAAwE;AACxE,+DAA4D;AAkB5D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,aAAa,GAAG,iFAAiF,CAAC;AAExG,8GAA8G;AAEvG,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAC8C,OAAuB,EAClD,YAA0B;QADC,YAAO,GAAP,OAAO,CAAgB;QAClD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAEI,OAAO;QACb,OAAO,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAAC,CAAC;IAC3J,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,CAAC;IAEO,IAAI,CAAC,EAAU,EAAE,IAAY;QACnC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAA,wCAAmB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnH,CAAC;IAEO,GAAG,CAAC,MAAW;;QACrB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,GAAG,GAAG,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,SAAS,GAAiB;YAC9B,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAA,GAAG,CAAC,KAAK,0CAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAA,GAAG,CAAC,QAAQ,0CAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAA,GAAG,CAAC,MAAM,0CAAE,IAAI,EAAE;YACvH,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;SAC/H,CAAC;QACF,OAAO,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAEa,WAAW,CAAI,SAAuC;;YAClE,MAAM,EAAE,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC3D,IAAI,WAAyE,CAAC;YAC9E,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,SAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBAC7C,MAAM,KAAK,GAAU,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBACzE,WAAY,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9F,CAAC,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;gBACtC,MAAM,SAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,WAAW;oBAAE,MAAM,SAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KAAA;IAEO,QAAQ,CAAC,EAAU,EAAE,SAAe;QAC1C,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzJ,CAAC;IAEa,OAAO,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;;YAC3D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,WAAM,CAAC;gBACP,sFAAsF;gBACtF,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5C,6EAA6E,EAC7E,CAAC,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzE,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;YAC9I,CAAC;QACH,CAAC;KAAA;IAEK,KAAK,CAAC,KAAqB;;;YAC/B,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC,CAAC;YAClL,CAAC;YACD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;;gBACrD,gEAAgE;gBAChE,MAAM,KAAK,CAAC,sDAAsD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC1F,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sHAAsH,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;gBACzK,IAAI,MAAM,CAAC,MAAA,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrF,MAAM,KAAK,CAAC,iFAAiF,CAAC,CAAC;gBAC/F,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB,mIAAmI,gBAAgB,qDAAqD,EACxM,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAA,KAAK,CAAC,WAAW,mCAAI,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAClG,CAAC;gBACF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC1D,OAAO,MAAA,GAAG,CAAC,UAAU,mCAAI,GAAG,CAAC,UAAU,CAAC;YAC1C,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;KAAA;IAEK,QAAQ,CAAC,EAAU;;YACvB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC/D,UAAU,aAAa,8FAA8F,EAAE,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACrJ,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC;QACb,CAAC;KAAA;IAEK,MAAM,CAAC,EAAU;;YACrB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CACjC,wMAAwM,cAAc,2CAA2C,aAAa,EAAE,EAChR,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CACnD,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;KAAA;IAEK,OAAO,CAAC,EAAU,EAAE,IAAY;;YACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBACjD,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAC9B,uIAAuI,aAAa,EAAE,EACtJ,CAAC,EAAE,EAAE,YAAY,CAAC,CACnB,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzF,MAAM,KAAK,CAAC,4DAA4D,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO,GAAG,CAAC;YACb,CAAC,CAAA,CAAC,CAAC;YACH,kFAAkF;YAClF,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;CACF,CAAA;AAjIY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,gBAAgB,CAiI5B","sourcesContent":["import { HttpException, Inject, Injectable, ServiceUnavailableException, UnauthorizedException } from '@nestjs/common';\nimport { createHmac, randomBytes, randomInt, timingSafeEqual } from 'crypto';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { TwoFactorChallengeDto } from '../../Dtos/TwoFactorDtos';\nimport { getAccessiJwtSecret } from '../../security/passwordResetToken';\nimport { EmailService } from '../EmailService/EmailService';\n\nexport type TwoFactorMode = 'password' | 'passwordless' | 'federated';\nexport interface TwoFactorProof {\n  codiceUtente: number;\n  email: string;\n  mode: TwoFactorMode;\n  identityKey?: string;\n}\ntype ChallengeRow = TwoFactorProof & {\n  codeHash: string;\n  expiresAt: Date;\n  attempts: number;\n  sends: number;\n  sentAt: Date;\n};\ntype Query = (sql: string, params?: unknown[]) => Promise<any>;\n\nconst LIFETIME_SECONDS = 600;\nconst MAX_ATTEMPTS = 5;\nconst RESEND_SECONDS = 60;\nconst MAX_SENDS = 3;\nconst RETURN_FIELDS = 'CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT, ATTEMPTS, SENDS, SENT_AT';\n\n/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */\n@Injectable()\nexport class TwoFactorService {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n    private readonly emailService: EmailService,\n  ) {}\n\n  private invalid(): UnauthorizedException {\n    return new UnauthorizedException({ code: 'ACCESSI_2FA_INVALID', message: 'Codice non valido o scaduto. Ripeti l accesso se hai esaurito i tentativi.' });\n  }\n\n  private limited(): HttpException {\n    return new HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);\n  }\n\n  private hash(id: string, code: string): string {\n    return createHmac('sha256', getAccessiJwtSecret(this.options)).update(`accessi-2fa:${id}:${code}`).digest('hex');\n  }\n\n  private row(result: any): ChallengeRow | undefined {\n    const row = Array.isArray(result) ? result[0] : result;\n    if (!row) return undefined;\n    const raw = RestUtilities.convertKeysToCamelCase(row);\n    const converted: ChallengeRow = {\n      codiceUtente: Number(raw.codute), email: raw.email?.trim(), mode: raw.authmode?.trim(), identityKey: raw.idnkey?.trim(),\n      codeHash: raw.codehash, expiresAt: raw.expiresAt, attempts: Number(raw.attempts), sends: Number(raw.sends), sentAt: raw.sentAt,\n    };\n    return converted.codiceUtente ? converted : undefined;\n  }\n\n  private async transaction<T>(operation: (query: Query) => Promise<T>): Promise<T> {\n    const db = await Orm.connect(this.options.databaseOptions);\n    let transaction: Awaited<ReturnType<typeof Orm.startTransaction>> | undefined;\n    try {\n      transaction = await Orm.startTransaction(db);\n      const query: Query = (sql, params = []) => new Promise((resolve, reject) => {\n        transaction!.query(sql, params, (error, result) => error ? reject(error) : resolve(result));\n      });\n      const result = await operation(query);\n      await Orm.commitTransaction(transaction);\n      return result;\n    } catch (error) {\n      if (transaction) await Orm.rollbackTransaction(transaction).catch(() => undefined);\n      throw error;\n    } finally {\n      await new Promise<void>(resolve => db.detach(() => resolve()));\n    }\n  }\n\n  private response(id: string, expiresAt: Date): TwoFactorChallengeDto {\n    return { twoFactorRequired: true, challengeId: id, expiresAt: new Date(expiresAt).toISOString(), resendAfterSeconds: RESEND_SECONDS, method: 'email' };\n  }\n\n  private async deliver(id: string, code: string, email: string): Promise<void> {\n    try {\n      await this.emailService.sendTwoFactorCode(email, code, LIFETIME_SECONDS / 60);\n    } catch {\n      // Invalidate only the code whose delivery failed, preserving a concurrent newer code.\n      await Orm.execute(this.options.databaseOptions,\n        'UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ? AND CODEHASH = ?',\n        [MAX_ATTEMPTS, id, this.hash(id, code)], false).catch(() => undefined);\n      throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_DELIVERY_FAILED', message: 'Invio del codice non riuscito. Riprova tra poco.' });\n    }\n  }\n\n  async issue(proof: TwoFactorProof): Promise<TwoFactorChallengeDto> {\n    if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(proof.email ?? '')) {\n      throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_EMAIL_REQUIRED', message: 'Per il codice di accesso serve un indirizzo email valido. Contatta un amministratore.' });\n    }\n    const id = randomBytes(32).toString('hex');\n    const code = String(randomInt(1000000)).padStart(6, '0');\n    const expiresAt = await this.transaction(async query => {\n      // Serialize issuance for this account across backend instances.\n      await query('SELECT CODUTE FROM UTENTI WHERE CODUTE = ? WITH LOCK', [proof.codiceUtente]);\n      const recent = await query('SELECT COUNT(*) AS TOTAL FROM ACCESSI_2FA WHERE CODUTE = ? AND CREATED_AT > DATEADD(-15 MINUTE TO CURRENT_TIMESTAMP)', [proof.codiceUtente]);\n      if (Number(recent?.[0]?.TOTAL ?? recent?.[0]?.total ?? 0) >= 5) throw this.limited();\n      await query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');\n      const created = await query(\n        `INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`,\n        [id, proof.codiceUtente, proof.email, proof.mode, proof.identityKey ?? null, this.hash(id, code)],\n      );\n      const row = Array.isArray(created) ? created[0] : created;\n      return row.EXPIRES_AT ?? row.expires_at;\n    });\n    await this.deliver(id, code, proof.email);\n    return this.response(id, expiresAt);\n  }\n\n  async describe(id: string): Promise<TwoFactorProof> {\n    if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n    const row = this.row(await Orm.query(this.options.databaseOptions,\n      `SELECT ${RETURN_FIELDS} FROM ACCESSI_2FA WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ?`, [id, MAX_ATTEMPTS], false));\n    if (!row) throw this.invalid();\n    return row;\n  }\n\n  async resend(id: string): Promise<TwoFactorChallengeDto> {\n    if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n    const code = String(randomInt(1000000)).padStart(6, '0');\n    const row = await this.transaction(async query => {\n      const result = this.row(await query(\n        `UPDATE ACCESSI_2FA SET CODEHASH = ?, SENDS = SENDS + 1, SENT_AT = CURRENT_TIMESTAMP WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? AND SENDS < ? AND SENT_AT <= DATEADD(-${RESEND_SECONDS} SECOND TO CURRENT_TIMESTAMP) RETURNING ${RETURN_FIELDS}`,\n        [this.hash(id, code), id, MAX_ATTEMPTS, MAX_SENDS],\n      ));\n      if (!result) throw this.limited();\n      return result;\n    });\n    await this.deliver(id, code, row.email);\n    return this.response(id, row.expiresAt);\n  }\n\n  async consume(id: string, code: string): Promise<TwoFactorProof> {\n    if (!/^[a-f0-9]{64}$/.test(id) || !/^\\d{6}$/.test(code)) throw this.invalid();\n    const proof = await this.transaction(async query => {\n      // The conditional write serializes verification and persists failed attempts.\n      const row = this.row(await query(\n        `UPDATE ACCESSI_2FA SET ATTEMPTS = ATTEMPTS + 1 WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? RETURNING ${RETURN_FIELDS}`,\n        [id, MAX_ATTEMPTS],\n      ));\n      if (!row) return null;\n      const expected = Buffer.from(row.codeHash.trim(), 'hex');\n      const actual = Buffer.from(this.hash(id, code), 'hex');\n      if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) return null;\n      await query('UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ?', [MAX_ATTEMPTS, id]);\n      return row;\n    });\n    // Throw after commit, otherwise a wrong code would roll back the attempt counter.\n    if (!proof) throw this.invalid();\n    return proof;\n  }\n}\n"]}
+{"version":3,"file":"TwoFactorService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/TwoFactorService/TwoFactorService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAuH;AACvH,mCAA6E;AAC7E,sCAAmC;AACnC,kDAAmD;AAGnD,0EAAwE;AACxE,+DAA4D;AAkB5D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,aAAa,GAAG,iFAAiF,CAAC;AAExG,8GAA8G;AAEvG,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAC8C,OAAuB,EAClD,YAA0B;QADC,YAAO,GAAP,OAAO,CAAgB;QAClD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAEI,OAAO;QACb,OAAO,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAAC,CAAC;IAC3J,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,CAAC;IAEO,IAAI,CAAC,EAAU,EAAE,IAAY;QACnC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAA,wCAAmB,EAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1H,CAAC;IAEO,GAAG,CAAC,MAAe;;QACzB,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAwC,CAAC;QAChG,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAE3B,MAAM,GAAG,GAAG,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAEpC,MAAM,SAAS,GAAiB;YAC9B,YAAY;YACZ,KAAK,EAAE,MAAA,MAAA,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,0CAAE,IAAI,EAAE,mCAAI,EAAE;YACxC,IAAI,EAAE,MAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,0CAAE,IAAI,EAAgC,mCAAI,UAAU;YACjF,WAAW,EAAE,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,0CAAE,IAAI,EAAE;YACzC,QAAQ,EAAE,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,mCAAI,EAAE;YACtC,SAAS,EAAE,GAAG,CAAC,SAAiB;YAChC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,EAAE,GAAG,CAAC,MAAc;SAC3B,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEa,WAAW,CAAI,SAAuC;;YAClE,OAAO,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;gBAC7E,MAAM,KAAK,GAAU,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,SAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC1F,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAA,CAAC,CAAC;QACL,CAAC;KAAA;IAEO,QAAQ,CAAC,EAAU,EAAE,SAAe;QAC1C,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzJ,CAAC;IAEa,OAAO,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;;YAC3D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,WAAM,CAAC;gBACP,sFAAsF;gBACtF,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5C,6EAA6E,EAC7E,CAAC,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzE,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;YAC9I,CAAC;QACH,CAAC;KAAA;IAEK,KAAK,CAAC,KAAqB;;;YAC/B,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC,CAAC;YAClL,CAAC;YACD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;;gBACrD,gEAAgE;gBAChE,MAAM,KAAK,CAAC,sDAAsD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC1F,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sHAAsH,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAA+C,CAAC;gBACvN,IAAI,MAAM,CAAC,MAAA,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrF,MAAM,KAAK,CAAC,iFAAiF,CAAC,CAAC;gBAC/F,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB,mIAAmI,gBAAgB,qDAAqD,EACxM,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAA,KAAK,CAAC,WAAW,mCAAI,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAClG,CAAC;gBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;gBACnG,OAAO,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAS,CAAC;YACtD,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;KAAA;IAEK,QAAQ,CAAC,EAAU;;YACvB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC/D,UAAU,aAAa,8FAA8F,EAAE,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACrJ,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC;QACb,CAAC;KAAA;IAEK,MAAM,CAAC,EAAU;;YACrB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CACjC,wMAAwM,cAAc,2CAA2C,aAAa,EAAE,EAChR,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CACnD,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;KAAA;IAEK,OAAO,CAAC,EAAU,EAAE,IAAY;;YACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBACjD,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAC9B,uIAAuI,aAAa,EAAE,EACtJ,CAAC,EAAE,EAAE,YAAY,CAAC,CACnB,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzF,MAAM,KAAK,CAAC,4DAA4D,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO,GAAG,CAAC;YACb,CAAC,CAAA,CAAC,CAAC;YACH,kFAAkF;YAClF,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;CACF,CAAA;AAjIY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,gBAAgB,CAiI5B","sourcesContent":["import { HttpException, Inject, Injectable, ServiceUnavailableException, UnauthorizedException } from '@nestjs/common';\nimport { createHmac, randomBytes, randomInt, timingSafeEqual } from 'crypto';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { TwoFactorChallengeDto } from '../../Dtos/TwoFactorDtos';\nimport { getAccessiJwtSecret } from '../../security/passwordResetToken';\nimport { EmailService } from '../EmailService/EmailService';\n\nexport type TwoFactorMode = 'password' | 'passwordless' | 'federated';\nexport interface TwoFactorProof {\n  codiceUtente: number;\n  email: string;\n  mode: TwoFactorMode;\n  identityKey?: string;\n}\ntype ChallengeRow = TwoFactorProof & {\n  codeHash: string;\n  expiresAt: Date;\n  attempts: number;\n  sends: number;\n  sentAt: Date;\n};\ntype Query = (sql: string, params?: unknown[]) => Promise<unknown>;\n\nconst LIFETIME_SECONDS = 600;\nconst MAX_ATTEMPTS = 5;\nconst RESEND_SECONDS = 60;\nconst MAX_SENDS = 3;\nconst RETURN_FIELDS = 'CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT, ATTEMPTS, SENDS, SENT_AT';\n\n/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */\n@Injectable()\nexport class TwoFactorService {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n    private readonly emailService: EmailService,\n  ) {}\n\n  private invalid(): UnauthorizedException {\n    return new UnauthorizedException({ code: 'ACCESSI_2FA_INVALID', message: 'Codice non valido o scaduto. Ripeti l accesso se hai esaurito i tentativi.' });\n  }\n\n  private limited(): HttpException {\n    return new HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);\n  }\n\n  private hash(id: string, code: string): string {\n    return createHmac('sha256', getAccessiJwtSecret(this.options, '2fa')).update(`accessi-2fa:${id}:${code}`).digest('hex');\n  }\n\n  private row(result: unknown): ChallengeRow | undefined {\n    const row = (Array.isArray(result) ? result[0] : result) as Record<string, unknown> | undefined;\n    if (!row) return undefined;\n\n    const raw = RestUtilities.convertKeysToCamelCase(row);\n    const asString = (value: unknown): string | undefined => typeof value === 'string' ? value : undefined;\n    const codiceUtente = Number(raw.codute);\n    if (!codiceUtente) return undefined;\n\n    const converted: ChallengeRow = {\n      codiceUtente,\n      email: asString(raw.email)?.trim() ?? '',\n      mode: (asString(raw.authmode)?.trim() as TwoFactorMode | undefined) ?? 'password',\n      identityKey: asString(raw.idnkey)?.trim(),\n      codeHash: asString(raw.codehash) ?? '',\n      expiresAt: raw.expiresAt as Date,\n      attempts: Number(raw.attempts),\n      sends: Number(raw.sends),\n      sentAt: raw.sentAt as Date,\n    };\n    return converted;\n  }\n\n  private async transaction<T>(operation: (query: Query) => Promise<T>): Promise<T> {\n    return Orm.withTransaction(this.options.databaseOptions, async (transaction) => {\n      const query: Query = (sql, params = []) => Orm.transactionQuery(transaction, sql, params);\n      return operation(query);\n    });\n  }\n\n  private response(id: string, expiresAt: Date): TwoFactorChallengeDto {\n    return { twoFactorRequired: true, challengeId: id, expiresAt: new Date(expiresAt).toISOString(), resendAfterSeconds: RESEND_SECONDS, method: 'email' };\n  }\n\n  private async deliver(id: string, code: string, email: string): Promise<void> {\n    try {\n      await this.emailService.sendTwoFactorCode(email, code, LIFETIME_SECONDS / 60);\n    } catch {\n      // Invalidate only the code whose delivery failed, preserving a concurrent newer code.\n      await Orm.execute(this.options.databaseOptions,\n        'UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ? AND CODEHASH = ?',\n        [MAX_ATTEMPTS, id, this.hash(id, code)], false).catch(() => undefined);\n      throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_DELIVERY_FAILED', message: 'Invio del codice non riuscito. Riprova tra poco.' });\n    }\n  }\n\n  async issue(proof: TwoFactorProof): Promise<TwoFactorChallengeDto> {\n    if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(proof.email ?? '')) {\n      throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_EMAIL_REQUIRED', message: 'Per il codice di accesso serve un indirizzo email valido. Contatta un amministratore.' });\n    }\n    const id = randomBytes(32).toString('hex');\n    const code = String(randomInt(1000000)).padStart(6, '0');\n    const expiresAt = await this.transaction(async query => {\n      // Serialize issuance for this account across backend instances.\n      await query('SELECT CODUTE FROM UTENTI WHERE CODUTE = ? WITH LOCK', [proof.codiceUtente]);\n      const recent = await query('SELECT COUNT(*) AS TOTAL FROM ACCESSI_2FA WHERE CODUTE = ? AND CREATED_AT > DATEADD(-15 MINUTE TO CURRENT_TIMESTAMP)', [proof.codiceUtente]) as Array<Record<string, unknown>> | undefined;\n      if (Number(recent?.[0]?.TOTAL ?? recent?.[0]?.total ?? 0) >= 5) throw this.limited();\n      await query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');\n      const created = await query(\n        `INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`,\n        [id, proof.codiceUtente, proof.email, proof.mode, proof.identityKey ?? null, this.hash(id, code)],\n      );\n      const row = (Array.isArray(created) ? created[0] : created) as Record<string, unknown> | undefined;\n      return (row?.EXPIRES_AT ?? row?.expires_at) as Date;\n    });\n    await this.deliver(id, code, proof.email);\n    return this.response(id, expiresAt);\n  }\n\n  async describe(id: string): Promise<TwoFactorProof> {\n    if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n    const row = this.row(await Orm.query(this.options.databaseOptions,\n      `SELECT ${RETURN_FIELDS} FROM ACCESSI_2FA WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ?`, [id, MAX_ATTEMPTS], false));\n    if (!row) throw this.invalid();\n    return row;\n  }\n\n  async resend(id: string): Promise<TwoFactorChallengeDto> {\n    if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n    const code = String(randomInt(1000000)).padStart(6, '0');\n    const row = await this.transaction(async query => {\n      const result = this.row(await query(\n        `UPDATE ACCESSI_2FA SET CODEHASH = ?, SENDS = SENDS + 1, SENT_AT = CURRENT_TIMESTAMP WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? AND SENDS < ? AND SENT_AT <= DATEADD(-${RESEND_SECONDS} SECOND TO CURRENT_TIMESTAMP) RETURNING ${RETURN_FIELDS}`,\n        [this.hash(id, code), id, MAX_ATTEMPTS, MAX_SENDS],\n      ));\n      if (!result) throw this.limited();\n      return result;\n    });\n    await this.deliver(id, code, row.email);\n    return this.response(id, row.expiresAt);\n  }\n\n  async consume(id: string, code: string): Promise<TwoFactorProof> {\n    if (!/^[a-f0-9]{64}$/.test(id) || !/^\\d{6}$/.test(code)) throw this.invalid();\n    const proof = await this.transaction(async query => {\n      // The conditional write serializes verification and persists failed attempts.\n      const row = this.row(await query(\n        `UPDATE ACCESSI_2FA SET ATTEMPTS = ATTEMPTS + 1 WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? RETURNING ${RETURN_FIELDS}`,\n        [id, MAX_ATTEMPTS],\n      ));\n      if (!row) return null;\n      const expected = Buffer.from(row.codeHash.trim(), 'hex');\n      const actual = Buffer.from(this.hash(id, code), 'hex');\n      if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) return null;\n      await query('UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ?', [MAX_ATTEMPTS, id]);\n      return row;\n    });\n    // Throw after commit, otherwise a wrong code would roll back the attempt counter.\n    if (!proof) throw this.invalid();\n    return proof;\n  }\n}\n"]}

package/dist/accessi-module/Services/UserService/UserService.d.ts

@@ -9,10 +9,9 @@ import { FiltriService } from '../FiltriService/FiltriService';
 import { PermissionService } from '../PermissionService/PermissionService';
 export declare class UserService {
     private readonly accessiOptions;
-    private readonly emailService;
     private readonly permissionService;
     private readonly filtriService;
-    constructor(accessiOptions: AccessiOptions, emailService: EmailService, permissionService: PermissionService, filtriService: FiltriService);
+    constructor(accessiOptions: AccessiOptions, _emailService: EmailService, permissionService: PermissionService, filtriService: FiltriService);
     private validateApplicationFields;
     private normalizeDatabaseBoolean;
     private normalizeUserFlags;
@@ -32,10 +31,19 @@ export declare class UserService {
     getUsers(filters?: {
         email?: string;
         codiceUtente?: number;
+        limit?: number;
+        offset?: number;
     }, options?: {
         includeExtensionFields: boolean;
         includeGrants: boolean;
     }): Promise<GetUsersResult[]>;
+    /** Conteggio utenti con gli stessi filtri di `getUsers`, per la paginazione (header X-Total-Count). */
+    countUsers(filters?: {
+        email?: string;
+        codiceUtente?: number;
+    }): Promise<number>;
+    private loadExtensionFieldsForUsers;
+    private chunkArray;
     /** Cerca il codice interno per email normalizzata. Il chiamante deve gestire il caso senza righe. */
     getCodiceUtenteByEmail(email: string): Promise<{
         codiceUtente: number;
@@ -43,7 +51,6 @@ export declare class UserService {
     /** Recupera il profilo locale usato dal login, compresi filtri Accessi eventualmente presenti. */
     getUserByEmail(email: string): Promise<UserDto | null>;
     insertUserFilters(codiceUtente: number, filterData: RegisterRequest): Promise<void>;
-    private executeInTransaction;
     /**
      * Crea utente, configurazione e filtri. La registrazione pubblica resta in stato `INVIO` e non puo
      * impostare privilegi, ruoli o grant; soltanto flussi backend fidati possono usare `allowPrivilegedFields`.