npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.23 → 2.0.0-dev.25 - Mend

emilsoftware-utilities 2.0.0-dev.23 → 2.0.0-dev.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (261) hide show

package/dist/accessi-module/Services/ServiceTokenService/ServiceTokenService.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"ServiceTokenService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/ServiceTokenService/ServiceTokenService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgDA,oDAIC;AAGD,8CAiBC;AAGD,wDAEC;AAGD,kEAmBC;AAGD,oDAKC;AA3GD,2CAA4F;AAC5F,mCAAkE;AAClE,gDAA6C;AAC7C,sCAAmC;AACnC,kDAAmD;AAGnD,+FAA+F;AAClF,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAC1C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAC7C,MAAM,oBAAoB,GAAG,KAAM,CAAC;AAoCpC,6FAA6F;AAC7F,SAAgB,oBAAoB;IAClC,MAAM,OAAO,GAAG,GAAG,4BAAoB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,sFAAsF;AACtF,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,0GAA0G;AAC1G,SAAgB,sBAAsB,CAAC,MAAc;IACnD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,0EAA0E;AAC1E,SAAgB,2BAA2B,CAAC,MAA4B;IACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,4BAAmB,CAAC,+CAA+C,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,iGAAiG;AACjG,SAAgB,oBAAoB,CAAC,MAAgB,EAAE,QAA4B;IACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA6B,EAAE,cAAuB;;IAC/E,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QACxF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACxG,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,MAAA,KAAK,CAAC,OAAO,mCAAI,cAAc,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AAGjG,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAAwD,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAE1F,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;IAC7C,CAAC;IAEO,UAAU,CAAC,GAA4B;;QAC7C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC;YAClC,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrD,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;YACjC,UAAU,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACpG,OAAO,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAC9D,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;SACrE,CAAC;IACJ,CAAC;IAEa,OAAO,CAAC,OAAe;;YACnC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,eAAe,EACpB;qDAC+C,EAC/C,CAAC,OAAO,CAAC,EACT,KAAK,CACN,CAAC;YACF,OAAQ,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAoC,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;KAAA;IAED,kGAAkG;IAC5F,KAAK,CAAC,KAA6B,EAAE,SAAkB;;;YAC3D,MAAM,KAAK,GAAG,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAmB,CAAC,sEAAsE,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAA,IAAI,CAAC,cAAc,CAAC,aAAa,0CAAE,cAAc,CAAC,CAAC;YAC9F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;YAE1D,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB;iCAC2B,EAC3B,CAAC,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,IAAI,EAAE,SAAS,CAAC,CACjG,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACxC,uCAAY,IAAI,CAAC,UAAU,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAE,KAAK,IAAG;QAC5F,CAAC;KAAA;IAED,0DAA0D;IACpD,IAAI;6DAAC,cAAc,GAAG,KAAK;YAC/B,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,eAAe,EACpB;oCAC8B,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B;+CACrC,EACzC,EAAE,EACF,KAAK,CACN,CAAC;YACF,OAAQ,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAoC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/H,CAAC;KAAA;IAED,mGAAmG;IAC7F,MAAM,CAAC,OAAe,EAAE,SAAkB;;;YAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,mCAAI,OAAO,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,YAAY,eAAe,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB,oGAAoG,EACpG,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,IAAI,EAAE,YAAY,CAAC,CAClC,CAAC;QACJ,CAAC;KAAA;IAED,+EAA+E;IACzE,MAAM,CAAC,OAAe,EAAE,SAAkB;;;YAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,mCAAI,OAAO,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,YAAY,eAAe,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC,KAAK,CACf;gBACE,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,MAAA,QAAQ,CAAC,SAAS,mCAAI,IAAI;aACtC,EACD,SAAS,CACV,CAAC;QACJ,CAAC;KAAA;IAED;;;OAGG;IACG,MAAM,CAAC,KAAa,EAAE,OAAyB;;YACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1D,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC7D,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC3F,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAE7F,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvF,CAAC;KAAA;IAEO,cAAc,CAAC,SAAiB,EAAE,MAAc;QACtD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IAEa,aAAa,CAAC,OAAe,EAAE,UAAmB,EAAE,EAAW;;YAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,oBAAoB,EAAE,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB,wGAAwG,EACxG,CAAC,EAAE,aAAF,EAAE,cAAF,EAAE,GAAI,IAAI,EAAE,OAAO,CAAC,EACrB,KAAK,CACN,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AArKY,kDAAmB;8BAAnB,mBAAmB;IAF/B,mBAAQ;IACR,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,mBAAmB,CAqK/B","sourcesContent":["import { BadRequestException, Inject, Injectable, NotFoundException } from '@nestjs/common';\nimport { createHash, randomBytes, timingSafeEqual } from 'crypto';\nimport { autobind } from '../../../autobind';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\n\n/** Prefisso riconoscibile dei token di servizio; il formato completo e `st_<id>.<segreto>`. */\nexport const SERVICE_TOKEN_PREFIX = 'st_';\nconst TOKEN_ID_PATTERN = /^st_[a-f0-9]{32}$/;\nconst SCOPE_PATTERN = /^[a-z0-9:_-]{1,40}$/i;\nconst LAST_USED_REFRESH_MS = 60_000;\n\n/** Metadati pubblici di un token (mai il segreto). */\nexport interface ServiceTokenMetadata {\n tokenId: string;\n label: string;\n scopes: string[];\n createdAt?: string;\n expiresAt?: string;\n lastUsedAt?: string;\n lastUsedIp?: string;\n revoked: boolean;\n revokedAt?: string;\n revokedBy?: number;\n}\n\n/** Risultato dell'emissione: contiene il segreto in chiaro, mostrato una sola volta. */\nexport interface IssuedServiceToken extends ServiceTokenMetadata {\n token: string;\n}\n\n/** Risultato della verifica di un token presentato. */\nexport interface VerifiedServiceToken {\n tokenId: string;\n label: string;\n scopes: string[];\n}\n\nexport interface IssueServiceTokenInput {\n label: string;\n scopes?: string[];\n expiresAt?: Date | string | null;\n /** Giorni di validita; ignorato se `expiresAt` e valorizzato. */\n ttlDays?: number;\n}\n\n/** Genera un nuovo token di servizio: identificativo pubblico + segreto ad alta entropia. */\nexport function generateServiceToken(): { token: string; tokenId: string; secret: string } {\n const tokenId = `${SERVICE_TOKEN_PREFIX}${randomBytes(16).toString('hex')}`;\n const secret = randomBytes(32).toString('base64url');\n return { token: `${tokenId}.${secret}`, tokenId, secret };\n}\n\n/** Estrae identificativo e segreto; restituisce `null` se il formato non e valido. */\nexport function parseServiceToken(token: unknown): { tokenId: string; secret: string } | null {\n if (typeof token !== 'string') {\n return null;\n }\n\n const separator = token.indexOf('.');\n if (separator <= 0) {\n return null;\n }\n\n const tokenId = token.slice(0, separator);\n const secret = token.slice(separator + 1);\n if (!TOKEN_ID_PATTERN.test(tokenId) || secret.length < 16) {\n return null;\n }\n\n return { tokenId, secret };\n}\n\n/** Hash del segreto per lo storage at-rest. Il segreto e ad alta entropia (256 bit), non una password. */\nexport function hashServiceTokenSecret(secret: string): string {\n return createHash('sha256').update(secret, 'utf8').digest('hex');\n}\n\n/** Normalizza e valida gli scope: trim, dedup e controllo del formato. */\nexport function normalizeServiceTokenScopes(scopes: string[] | undefined): string[] {\n if (scopes === undefined) {\n return [];\n }\n if (!Array.isArray(scopes)) {\n throw new BadRequestException('Gli scope devono essere un array di stringhe.');\n }\n\n const normalized: string[] = [];\n for (const rawScope of scopes) {\n if (typeof rawScope !== 'string' || !SCOPE_PATTERN.test(rawScope.trim())) {\n throw new BadRequestException(`Scope non valido: ${String(rawScope)}. Usare lettere, numeri, ':', '_' o '-'.`);\n }\n const scope = rawScope.trim().toLowerCase();\n if (!normalized.includes(scope)) {\n normalized.push(scope);\n }\n }\n return normalized;\n}\n\n/** True se l'insieme di scope soddisfa quello richiesto (uno scope vuoto non richiede nulla). */\nexport function serviceTokenHasScope(scopes: string[], required: string | undefined): boolean {\n if (!required) {\n return true;\n }\n return scopes.includes(required.toLowerCase());\n}\n\nfunction toIso(value: unknown): string | undefined {\n if (value === undefined || value === null) {\n return undefined;\n }\n const date = value instanceof Date ? value : new Date(String(value));\n return Number.isNaN(date.getTime()) ? undefined : date.toISOString();\n}\n\nfunction resolveExpiration(input: IssueServiceTokenInput, defaultTtlDays?: number): Date | null {\n if (input.expiresAt !== undefined && input.expiresAt !== null && input.expiresAt !== '') {\n const expiresAt = input.expiresAt instanceof Date ? input.expiresAt : new Date(String(input.expiresAt));\n if (Number.isNaN(expiresAt.getTime())) {\n throw new BadRequestException('Data di scadenza non valida.');\n }\n if (expiresAt.getTime() <= Date.now()) {\n throw new BadRequestException('La data di scadenza deve essere nel futuro.');\n }\n return expiresAt;\n }\n\n const ttlDays = input.ttlDays ?? defaultTtlDays;\n if (typeof ttlDays === 'number' && Number.isFinite(ttlDays) && ttlDays > 0) {\n return new Date(Date.now() + ttlDays * 24 * 60 * 60 * 1000);\n }\n\n return null;\n}\n\n/** Gestisce il ciclo di vita dei token di servizio (emissione, elenco, revoca, rotazione, verifica). */\n@autobind\n@Injectable()\nexport class ServiceTokenService {\n constructor(@Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions) {}\n\n private get databaseOptions() {\n return this.accessiOptions.databaseOptions;\n }\n\n private toMetadata(row: Record<string, unknown>): ServiceTokenMetadata {\n const scopesRaw = typeof row.scopes === 'string' ? row.scopes.trim() : '';\n return {\n tokenId: String(row.tokenId ?? ''),\n label: typeof row.label === 'string' ? row.label : '',\n scopes: scopesRaw === '' ? [] : scopesRaw.split(/\\s+/),\n createdAt: toIso(row.createdAt),\n expiresAt: toIso(row.expiresAt),\n lastUsedAt: toIso(row.lastUsedAt),\n lastUsedIp: typeof row.lastUsedIp === 'string' && row.lastUsedIp !== '' ? row.lastUsedIp : undefined,\n revoked: row.revokedAt !== undefined && row.revokedAt !== null,\n revokedAt: toIso(row.revokedAt),\n revokedBy: row.revokedBy == null ? undefined : Number(row.revokedBy),\n };\n }\n\n private async readRow(tokenId: string): Promise<Record<string, unknown> | undefined> {\n const rows = await Orm.query(\n this.databaseOptions,\n `SELECT TOKEN_ID, TOKEN_HASH, LABEL, SCOPES, CREATED_BY, CREATED_AT, EXPIRES_AT, LAST_USED_AT, LAST_USED_IP, REVOKED_AT, REVOKED_BY\n FROM ACCESSI_SERVICE_TOKEN WHERE TOKEN_ID = ?`,\n [tokenId],\n false,\n );\n return (rows.map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>)[0];\n }\n\n /** Crea un nuovo token. Il segreto in chiaro e restituito una sola volta e non e recuperabile. */\n async issue(input: IssueServiceTokenInput, createdBy?: number): Promise<IssuedServiceToken> {\n const label = typeof input?.label === 'string' ? input.label.trim() : '';\n if (label.length < 1 || label.length > 100) {\n throw new BadRequestException('La descrizione del token deve essere compresa tra 1 e 100 caratteri.');\n }\n\n const scopes = normalizeServiceTokenScopes(input.scopes);\n const expiresAt = resolveExpiration(input, this.accessiOptions.serviceTokens?.defaultTtlDays);\n const { token, tokenId, secret } = generateServiceToken();\n\n await Orm.execute(\n this.databaseOptions,\n `INSERT INTO ACCESSI_SERVICE_TOKEN (TOKEN_ID, TOKEN_HASH, LABEL, SCOPES, CREATED_BY, EXPIRES_AT)\n VALUES (?, ?, ?, ?, ?, ?)`,\n [tokenId, hashServiceTokenSecret(secret), label, scopes.join(' '), createdBy ?? null, expiresAt],\n );\n\n const row = await this.readRow(tokenId);\n return { ...this.toMetadata(row ?? { tokenId, label, scopes: scopes.join(' ') }), token };\n }\n\n /** Elenca i token (metadati soltanto, mai il segreto). */\n async list(includeRevoked = false): Promise<ServiceTokenMetadata[]> {\n const rows = await Orm.query(\n this.databaseOptions,\n `SELECT TOKEN_ID, LABEL, SCOPES, CREATED_BY, CREATED_AT, EXPIRES_AT, LAST_USED_AT, LAST_USED_IP, REVOKED_AT, REVOKED_BY\n FROM ACCESSI_SERVICE_TOKEN ${includeRevoked ? '' : 'WHERE REVOKED_AT IS NULL'}\n ORDER BY CREATED_AT DESC, TOKEN_ID DESC`,\n [],\n false,\n );\n return (rows.map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>).map((row) => this.toMetadata(row));\n }\n\n /** Revoca un token rendendolo immediatamente inutilizzabile. Idempotente su token gia revocati. */\n async revoke(tokenId: string, revokedBy?: number): Promise<void> {\n const parsed = parseServiceToken(tokenId);\n const normalizedId = parsed?.tokenId ?? tokenId;\n const row = await this.readRow(normalizedId);\n if (!row) {\n throw new NotFoundException(`Token di servizio ${normalizedId} non trovato.`);\n }\n if (row.revokedAt !== undefined && row.revokedAt !== null) {\n return;\n }\n await Orm.execute(\n this.databaseOptions,\n 'UPDATE ACCESSI_SERVICE_TOKEN SET REVOKED_AT = CURRENT_TIMESTAMP, REVOKED_BY = ? WHERE TOKEN_ID = ?',\n [revokedBy ?? null, normalizedId],\n );\n }\n\n /** Revoca il token indicato ed emette un sostituto con gli stessi metadati. */\n async rotate(tokenId: string, createdBy?: number): Promise<IssuedServiceToken> {\n const parsed = parseServiceToken(tokenId);\n const normalizedId = parsed?.tokenId ?? tokenId;\n const row = await this.readRow(normalizedId);\n if (!row) {\n throw new NotFoundException(`Token di servizio ${normalizedId} non trovato.`);\n }\n\n const metadata = this.toMetadata(row);\n await this.revoke(normalizedId, createdBy);\n\n return this.issue(\n {\n label: metadata.label,\n scopes: metadata.scopes,\n expiresAt: metadata.expiresAt ?? null,\n },\n createdBy,\n );\n }\n\n /**\n * Verifica un token presentato: formato, esistenza, revoca, scadenza e hash a tempo costante.\n * Aggiorna `LAST_USED_AT` (best-effort, al massimo una volta al minuto).\n */\n async verify(token: string, context?: { ip?: string }): Promise<VerifiedServiceToken | undefined> {\n const parsed = parseServiceToken(token);\n if (!parsed) {\n return undefined;\n }\n\n const row = await this.readRow(parsed.tokenId);\n if (!row) {\n return undefined;\n }\n\n if (row.revokedAt !== undefined && row.revokedAt !== null) {\n return undefined;\n }\n\n const expiresAt = toIso(row.expiresAt);\n if (expiresAt && new Date(expiresAt).getTime() <= Date.now()) {\n return undefined;\n }\n\n const storedHash = typeof row.tokenHash === 'string' ? row.tokenHash : '';\n if (!storedHash || !this.safeHashEquals(hashServiceTokenSecret(parsed.secret), storedHash)) {\n return undefined;\n }\n\n const metadata = this.toMetadata(row);\n await this.touchLastUsed(parsed.tokenId, row.lastUsedAt, context?.ip).catch(() => undefined);\n\n return { tokenId: metadata.tokenId, label: metadata.label, scopes: metadata.scopes };\n }\n\n private safeHashEquals(candidate: string, stored: string): boolean {\n const candidateBuffer = Buffer.from(candidate, 'hex');\n const storedBuffer = Buffer.from(stored, 'hex');\n if (candidateBuffer.length !== storedBuffer.length || candidateBuffer.length === 0) {\n return false;\n }\n return timingSafeEqual(candidateBuffer, storedBuffer);\n }\n\n private async touchLastUsed(tokenId: string, lastUsedAt: unknown, ip?: string): Promise<void> {\n const lastUsed = toIso(lastUsedAt);\n if (lastUsed && Date.now() - new Date(lastUsed).getTime() < LAST_USED_REFRESH_MS) {\n return;\n }\n await Orm.execute(\n this.databaseOptions,\n 'UPDATE ACCESSI_SERVICE_TOKEN SET LAST_USED_AT = CURRENT_TIMESTAMP, LAST_USED_IP = ? WHERE TOKEN_ID = ?',\n [ip ?? null, tokenId],\n false,\n );\n }\n}\n"]}

package/dist/accessi-module/Services/TwoFactorService/TwoFactorService.js CHANGED Viewed

@@ -46,41 +46,37 @@ let TwoFactorService = class TwoFactorService {
         return new common_1.HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);
     }
     hash(id, code) {
-        return (0, crypto_1.createHmac)('sha256', (0, passwordResetToken_1.getAccessiJwtSecret)(this.options)).update(`accessi-2fa:${id}:${code}`).digest('hex');
+        return (0, crypto_1.createHmac)('sha256', (0, passwordResetToken_1.getAccessiJwtSecret)(this.options, '2fa')).update(`accessi-2fa:${id}:${code}`).digest('hex');
     }
     row(result) {
-        var _a, _b, _c;
-        const row = Array.isArray(result) ? result[0] : result;
+        var _a, _b, _c, _d, _e, _f;
+        const row = (Array.isArray(result) ? result[0] : result);
         if (!row)
             return undefined;
         const raw = Utilities_1.RestUtilities.convertKeysToCamelCase(row);
+        const asString = (value) => typeof value === 'string' ? value : undefined;
+        const codiceUtente = Number(raw.codute);
+        if (!codiceUtente)
+            return undefined;
         const converted = {
-            codiceUtente: Number(raw.codute), email: (_a = raw.email) === null || _a === void 0 ? void 0 : _a.trim(), mode: (_b = raw.authmode) === null || _b === void 0 ? void 0 : _b.trim(), identityKey: (_c = raw.idnkey) === null || _c === void 0 ? void 0 : _c.trim(),
-            codeHash: raw.codehash, expiresAt: raw.expiresAt, attempts: Number(raw.attempts), sends: Number(raw.sends), sentAt: raw.sentAt,
+            codiceUtente,
+            email: (_b = (_a = asString(raw.email)) === null || _a === void 0 ? void 0 : _a.trim()) !== null && _b !== void 0 ? _b : '',
+            mode: (_d = (_c = asString(raw.authmode)) === null || _c === void 0 ? void 0 : _c.trim()) !== null && _d !== void 0 ? _d : 'password',
+            identityKey: (_e = asString(raw.idnkey)) === null || _e === void 0 ? void 0 : _e.trim(),
+            codeHash: (_f = asString(raw.codehash)) !== null && _f !== void 0 ? _f : '',
+            expiresAt: raw.expiresAt,
+            attempts: Number(raw.attempts),
+            sends: Number(raw.sends),
+            sentAt: raw.sentAt,
         };
-        return converted.codiceUtente ? converted : undefined;
+        return converted;
     }
     transaction(operation) {
         return __awaiter(this, void 0, void 0, function* () {
-            const db = yield Orm_1.Orm.connect(this.options.databaseOptions);
-            let transaction;
-            try {
-                transaction = yield Orm_1.Orm.startTransaction(db);
-                const query = (sql, params = []) => new Promise((resolve, reject) => {
-                    transaction.query(sql, params, (error, result) => error ? reject(error) : resolve(result));
-                });
-                const result = yield operation(query);
-                yield Orm_1.Orm.commitTransaction(transaction);
-                return result;
-            }
-            catch (error) {
-                if (transaction)
-                    yield Orm_1.Orm.rollbackTransaction(transaction).catch(() => undefined);
-                throw error;
-            }
-            finally {
-                yield new Promise(resolve => db.detach(() => resolve()));
-            }
+            return Orm_1.Orm.withTransaction(this.options.databaseOptions, (transaction) => __awaiter(this, void 0, void 0, function* () {
+                const query = (sql, params = []) => Orm_1.Orm.transactionQuery(transaction, sql, params);
+                return operation(query);
+            }));
         });
     }
     response(id, expiresAt) {
@@ -115,8 +111,8 @@ let TwoFactorService = class TwoFactorService {
                     throw this.limited();
                 yield query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');
                 const created = yield query(`INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`, [id, proof.codiceUtente, proof.email, proof.mode, (_e = proof.identityKey) !== null && _e !== void 0 ? _e : null, this.hash(id, code)]);
-                const row = Array.isArray(created) ? created[0] : created;
-                return (_f = row.EXPIRES_AT) !== null && _f !== void 0 ? _f : row.expires_at;
+                const row = (Array.isArray(created) ? created[0] : created);
+                return ((_f = row === null || row === void 0 ? void 0 : row.EXPIRES_AT) !== null && _f !== void 0 ? _f : row === null || row === void 0 ? void 0 : row.expires_at);
             }));
             yield this.deliver(id, code, proof.email);
             return this.response(id, expiresAt);

package/dist/accessi-module/Services/TwoFactorService/TwoFactorService.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"TwoFactorService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/TwoFactorService/TwoFactorService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAuH;AACvH,mCAA6E;AAC7E,sCAAmC;AACnC,kDAAmD;AAGnD,0EAAwE;AACxE,+DAA4D;AAkB5D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,aAAa,GAAG,iFAAiF,CAAC;AAExG,8GAA8G;AAEvG,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAC8C,OAAuB,EAClD,YAA0B;QADC,YAAO,GAAP,OAAO,CAAgB;QAClD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAEI,OAAO;QACb,OAAO,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAAC,CAAC;IAC3J,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,CAAC;IAEO,IAAI,CAAC,EAAU,EAAE,IAAY;QACnC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAA,wCAAmB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnH,CAAC;IAEO,GAAG,CAAC,MAAW;;QACrB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QACvD,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,GAAG,GAAG,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,SAAS,GAAiB;YAC9B,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAA,GAAG,CAAC,KAAK,0CAAE,IAAI,EAAE,EAAE,IAAI,EAAE,MAAA,GAAG,CAAC,QAAQ,0CAAE,IAAI,EAAE,EAAE,WAAW,EAAE,MAAA,GAAG,CAAC,MAAM,0CAAE,IAAI,EAAE;YACvH,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM;SAC/H,CAAC;QACF,OAAO,SAAS,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;IACxD,CAAC;IAEa,WAAW,CAAI,SAAuC;;YAClE,MAAM,EAAE,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YAC3D,IAAI,WAAyE,CAAC;YAC9E,IAAI,CAAC;gBACH,WAAW,GAAG,MAAM,SAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC;gBAC7C,MAAM,KAAK,GAAU,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;oBACzE,WAAY,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9F,CAAC,CAAC,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;gBACtC,MAAM,SAAG,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;gBACzC,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,WAAW;oBAAE,MAAM,SAAG,CAAC,mBAAmB,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACnF,MAAM,KAAK,CAAC;YACd,CAAC;oBAAS,CAAC;gBACT,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KAAA;IAEO,QAAQ,CAAC,EAAU,EAAE,SAAe;QAC1C,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzJ,CAAC;IAEa,OAAO,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;;YAC3D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,WAAM,CAAC;gBACP,sFAAsF;gBACtF,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5C,6EAA6E,EAC7E,CAAC,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzE,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;YAC9I,CAAC;QACH,CAAC;KAAA;IAEK,KAAK,CAAC,KAAqB;;;YAC/B,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC,CAAC;YAClL,CAAC;YACD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;;gBACrD,gEAAgE;gBAChE,MAAM,KAAK,CAAC,sDAAsD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC1F,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sHAAsH,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;gBACzK,IAAI,MAAM,CAAC,MAAA,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrF,MAAM,KAAK,CAAC,iFAAiF,CAAC,CAAC;gBAC/F,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB,mIAAmI,gBAAgB,qDAAqD,EACxM,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAA,KAAK,CAAC,WAAW,mCAAI,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAClG,CAAC;gBACF,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;gBAC1D,OAAO,MAAA,GAAG,CAAC,UAAU,mCAAI,GAAG,CAAC,UAAU,CAAC;YAC1C,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;KAAA;IAEK,QAAQ,CAAC,EAAU;;YACvB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC/D,UAAU,aAAa,8FAA8F,EAAE,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACrJ,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC;QACb,CAAC;KAAA;IAEK,MAAM,CAAC,EAAU;;YACrB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CACjC,wMAAwM,cAAc,2CAA2C,aAAa,EAAE,EAChR,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CACnD,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;KAAA;IAEK,OAAO,CAAC,EAAU,EAAE,IAAY;;YACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBACjD,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAC9B,uIAAuI,aAAa,EAAE,EACtJ,CAAC,EAAE,EAAE,YAAY,CAAC,CACnB,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzF,MAAM,KAAK,CAAC,4DAA4D,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO,GAAG,CAAC;YACb,CAAC,CAAA,CAAC,CAAC;YACH,kFAAkF;YAClF,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;CACF,CAAA;AAjIY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,gBAAgB,CAiI5B","sourcesContent":["import { HttpException, Inject, Injectable, ServiceUnavailableException, UnauthorizedException } from '@nestjs/common';\nimport { createHmac, randomBytes, randomInt, timingSafeEqual } from 'crypto';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { TwoFactorChallengeDto } from '../../Dtos/TwoFactorDtos';\nimport { getAccessiJwtSecret } from '../../security/passwordResetToken';\nimport { EmailService } from '../EmailService/EmailService';\n\nexport type TwoFactorMode = 'password' \| 'passwordless' \| 'federated';\nexport interface TwoFactorProof {\n codiceUtente: number;\n email: string;\n mode: TwoFactorMode;\n identityKey?: string;\n}\ntype ChallengeRow = TwoFactorProof & {\n codeHash: string;\n expiresAt: Date;\n attempts: number;\n sends: number;\n sentAt: Date;\n};\ntype Query = (sql: string, params?: unknown[]) => Promise<any>;\n\nconst LIFETIME_SECONDS = 600;\nconst MAX_ATTEMPTS = 5;\nconst RESEND_SECONDS = 60;\nconst MAX_SENDS = 3;\nconst RETURN_FIELDS = 'CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT, ATTEMPTS, SENDS, SENT_AT';\n\n/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. /\n@Injectable()\nexport class TwoFactorService {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n private readonly emailService: EmailService,\n ) {}\n\n private invalid(): UnauthorizedException {\n return new UnauthorizedException({ code: 'ACCESSI_2FA_INVALID', message: 'Codice non valido o scaduto. Ripeti l accesso se hai esaurito i tentativi.' });\n }\n\n private limited(): HttpException {\n return new HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);\n }\n\n private hash(id: string, code: string): string {\n return createHmac('sha256', getAccessiJwtSecret(this.options)).update(`accessi-2fa:${id}:${code}`).digest('hex');\n }\n\n private row(result: any): ChallengeRow \| undefined {\n const row = Array.isArray(result) ? result[0] : result;\n if (!row) return undefined;\n const raw = RestUtilities.convertKeysToCamelCase(row);\n const converted: ChallengeRow = {\n codiceUtente: Number(raw.codute), email: raw.email?.trim(), mode: raw.authmode?.trim(), identityKey: raw.idnkey?.trim(),\n codeHash: raw.codehash, expiresAt: raw.expiresAt, attempts: Number(raw.attempts), sends: Number(raw.sends), sentAt: raw.sentAt,\n };\n return converted.codiceUtente ? converted : undefined;\n }\n\n private async transaction<T>(operation: (query: Query) => Promise<T>): Promise<T> {\n const db = await Orm.connect(this.options.databaseOptions);\n let transaction: Awaited<ReturnType<typeof Orm.startTransaction>> \| undefined;\n try {\n transaction = await Orm.startTransaction(db);\n const query: Query = (sql, params = []) => new Promise((resolve, reject) => {\n transaction!.query(sql, params, (error, result) => error ? reject(error) : resolve(result));\n });\n const result = await operation(query);\n await Orm.commitTransaction(transaction);\n return result;\n } catch (error) {\n if (transaction) await Orm.rollbackTransaction(transaction).catch(() => undefined);\n throw error;\n } finally {\n await new Promise<void>(resolve => db.detach(() => resolve()));\n }\n }\n\n private response(id: string, expiresAt: Date): TwoFactorChallengeDto {\n return { twoFactorRequired: true, challengeId: id, expiresAt: new Date(expiresAt).toISOString(), resendAfterSeconds: RESEND_SECONDS, method: 'email' };\n }\n\n private async deliver(id: string, code: string, email: string): Promise<void> {\n try {\n await this.emailService.sendTwoFactorCode(email, code, LIFETIME_SECONDS / 60);\n } catch {\n // Invalidate only the code whose delivery failed, preserving a concurrent newer code.\n await Orm.execute(this.options.databaseOptions,\n 'UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ? AND CODEHASH = ?',\n [MAX_ATTEMPTS, id, this.hash(id, code)], false).catch(() => undefined);\n throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_DELIVERY_FAILED', message: 'Invio del codice non riuscito. Riprova tra poco.' });\n }\n }\n\n async issue(proof: TwoFactorProof): Promise<TwoFactorChallengeDto> {\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(proof.email ?? '')) {\n throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_EMAIL_REQUIRED', message: 'Per il codice di accesso serve un indirizzo email valido. Contatta un amministratore.' });\n }\n const id = randomBytes(32).toString('hex');\n const code = String(randomInt(1000000)).padStart(6, '0');\n const expiresAt = await this.transaction(async query => {\n // Serialize issuance for this account across backend instances.\n await query('SELECT CODUTE FROM UTENTI WHERE CODUTE = ? WITH LOCK', [proof.codiceUtente]);\n const recent = await query('SELECT COUNT() AS TOTAL FROM ACCESSI_2FA WHERE CODUTE = ? AND CREATED_AT > DATEADD(-15 MINUTE TO CURRENT_TIMESTAMP)', [proof.codiceUtente]);\n if (Number(recent?.[0]?.TOTAL ?? recent?.[0]?.total ?? 0) >= 5) throw this.limited();\n await query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');\n const created = await query(\n `INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`,\n [id, proof.codiceUtente, proof.email, proof.mode, proof.identityKey ?? null, this.hash(id, code)],\n );\n const row = Array.isArray(created) ? created[0] : created;\n return row.EXPIRES_AT ?? row.expires_at;\n });\n await this.deliver(id, code, proof.email);\n return this.response(id, expiresAt);\n }\n\n async describe(id: string): Promise<TwoFactorProof> {\n if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n const row = this.row(await Orm.query(this.options.databaseOptions,\n `SELECT ${RETURN_FIELDS} FROM ACCESSI_2FA WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ?`, [id, MAX_ATTEMPTS], false));\n if (!row) throw this.invalid();\n return row;\n }\n\n async resend(id: string): Promise<TwoFactorChallengeDto> {\n if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n const code = String(randomInt(1000000)).padStart(6, '0');\n const row = await this.transaction(async query => {\n const result = this.row(await query(\n `UPDATE ACCESSI_2FA SET CODEHASH = ?, SENDS = SENDS + 1, SENT_AT = CURRENT_TIMESTAMP WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? AND SENDS < ? AND SENT_AT <= DATEADD(-${RESEND_SECONDS} SECOND TO CURRENT_TIMESTAMP) RETURNING ${RETURN_FIELDS}`,\n [this.hash(id, code), id, MAX_ATTEMPTS, MAX_SENDS],\n ));\n if (!result) throw this.limited();\n return result;\n });\n await this.deliver(id, code, row.email);\n return this.response(id, row.expiresAt);\n }\n\n async consume(id: string, code: string): Promise<TwoFactorProof> {\n if (!/^[a-f0-9]{64}$/.test(id) \|\| !/^\\d{6}$/.test(code)) throw this.invalid();\n const proof = await this.transaction(async query => {\n // The conditional write serializes verification and persists failed attempts.\n const row = this.row(await query(\n `UPDATE ACCESSI_2FA SET ATTEMPTS = ATTEMPTS + 1 WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? RETURNING ${RETURN_FIELDS}`,\n [id, MAX_ATTEMPTS],\n ));\n if (!row) return null;\n const expected = Buffer.from(row.codeHash.trim(), 'hex');\n const actual = Buffer.from(this.hash(id, code), 'hex');\n if (expected.length !== actual.length \|\| !timingSafeEqual(expected, actual)) return null;\n await query('UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ?', [MAX_ATTEMPTS, id]);\n return row;\n });\n // Throw after commit, otherwise a wrong code would roll back the attempt counter.\n if (!proof) throw this.invalid();\n return proof;\n }\n}\n"]}
1	+ {"version":3,"file":"TwoFactorService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/TwoFactorService/TwoFactorService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAuH;AACvH,mCAA6E;AAC7E,sCAAmC;AACnC,kDAAmD;AAGnD,0EAAwE;AACxE,+DAA4D;AAkB5D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,aAAa,GAAG,iFAAiF,CAAC;AAExG,8GAA8G;AAEvG,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAC8C,OAAuB,EAClD,YAA0B;QADC,YAAO,GAAP,OAAO,CAAgB;QAClD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAEI,OAAO;QACb,OAAO,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAAC,CAAC;IAC3J,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,CAAC;IAEO,IAAI,CAAC,EAAU,EAAE,IAAY;QACnC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAA,wCAAmB,EAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1H,CAAC;IAEO,GAAG,CAAC,MAAe;;QACzB,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAwC,CAAC;QAChG,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAE3B,MAAM,GAAG,GAAG,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAEpC,MAAM,SAAS,GAAiB;YAC9B,YAAY;YACZ,KAAK,EAAE,MAAA,MAAA,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,0CAAE,IAAI,EAAE,mCAAI,EAAE;YACxC,IAAI,EAAE,MAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,0CAAE,IAAI,EAAgC,mCAAI,UAAU;YACjF,WAAW,EAAE,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,0CAAE,IAAI,EAAE;YACzC,QAAQ,EAAE,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,mCAAI,EAAE;YACtC,SAAS,EAAE,GAAG,CAAC,SAAiB;YAChC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,EAAE,GAAG,CAAC,MAAc;SAC3B,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEa,WAAW,CAAI,SAAuC;;YAClE,OAAO,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;gBAC7E,MAAM,KAAK,GAAU,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,SAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC1F,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAA,CAAC,CAAC;QACL,CAAC;KAAA;IAEO,QAAQ,CAAC,EAAU,EAAE,SAAe;QAC1C,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzJ,CAAC;IAEa,OAAO,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;;YAC3D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,WAAM,CAAC;gBACP,sFAAsF;gBACtF,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5C,6EAA6E,EAC7E,CAAC,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzE,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;YAC9I,CAAC;QACH,CAAC;KAAA;IAEK,KAAK,CAAC,KAAqB;;;YAC/B,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC,CAAC;YAClL,CAAC;YACD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;;gBACrD,gEAAgE;gBAChE,MAAM,KAAK,CAAC,sDAAsD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC1F,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sHAAsH,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAA+C,CAAC;gBACvN,IAAI,MAAM,CAAC,MAAA,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrF,MAAM,KAAK,CAAC,iFAAiF,CAAC,CAAC;gBAC/F,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB,mIAAmI,gBAAgB,qDAAqD,EACxM,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAA,KAAK,CAAC,WAAW,mCAAI,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAClG,CAAC;gBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;gBACnG,OAAO,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAS,CAAC;YACtD,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;KAAA;IAEK,QAAQ,CAAC,EAAU;;YACvB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC/D,UAAU,aAAa,8FAA8F,EAAE,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACrJ,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC;QACb,CAAC;KAAA;IAEK,MAAM,CAAC,EAAU;;YACrB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CACjC,wMAAwM,cAAc,2CAA2C,aAAa,EAAE,EAChR,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CACnD,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;KAAA;IAEK,OAAO,CAAC,EAAU,EAAE,IAAY;;YACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBACjD,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAC9B,uIAAuI,aAAa,EAAE,EACtJ,CAAC,EAAE,EAAE,YAAY,CAAC,CACnB,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzF,MAAM,KAAK,CAAC,4DAA4D,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO,GAAG,CAAC;YACb,CAAC,CAAA,CAAC,CAAC;YACH,kFAAkF;YAClF,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;CACF,CAAA;AAjIY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,gBAAgB,CAiI5B","sourcesContent":["import { HttpException, Inject, Injectable, ServiceUnavailableException, UnauthorizedException } from '@nestjs/common';\nimport { createHmac, randomBytes, randomInt, timingSafeEqual } from 'crypto';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { TwoFactorChallengeDto } from '../../Dtos/TwoFactorDtos';\nimport { getAccessiJwtSecret } from '../../security/passwordResetToken';\nimport { EmailService } from '../EmailService/EmailService';\n\nexport type TwoFactorMode = 'password' \| 'passwordless' \| 'federated';\nexport interface TwoFactorProof {\n codiceUtente: number;\n email: string;\n mode: TwoFactorMode;\n identityKey?: string;\n}\ntype ChallengeRow = TwoFactorProof & {\n codeHash: string;\n expiresAt: Date;\n attempts: number;\n sends: number;\n sentAt: Date;\n};\ntype Query = (sql: string, params?: unknown[]) => Promise<unknown>;\n\nconst LIFETIME_SECONDS = 600;\nconst MAX_ATTEMPTS = 5;\nconst RESEND_SECONDS = 60;\nconst MAX_SENDS = 3;\nconst RETURN_FIELDS = 'CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT, ATTEMPTS, SENDS, SENT_AT';\n\n/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. /\n@Injectable()\nexport class TwoFactorService {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n private readonly emailService: EmailService,\n ) {}\n\n private invalid(): UnauthorizedException {\n return new UnauthorizedException({ code: 'ACCESSI_2FA_INVALID', message: 'Codice non valido o scaduto. Ripeti l accesso se hai esaurito i tentativi.' });\n }\n\n private limited(): HttpException {\n return new HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);\n }\n\n private hash(id: string, code: string): string {\n return createHmac('sha256', getAccessiJwtSecret(this.options, '2fa')).update(`accessi-2fa:${id}:${code}`).digest('hex');\n }\n\n private row(result: unknown): ChallengeRow \| undefined {\n const row = (Array.isArray(result) ? result[0] : result) as Record<string, unknown> \| undefined;\n if (!row) return undefined;\n\n const raw = RestUtilities.convertKeysToCamelCase(row);\n const asString = (value: unknown): string \| undefined => typeof value === 'string' ? value : undefined;\n const codiceUtente = Number(raw.codute);\n if (!codiceUtente) return undefined;\n\n const converted: ChallengeRow = {\n codiceUtente,\n email: asString(raw.email)?.trim() ?? '',\n mode: (asString(raw.authmode)?.trim() as TwoFactorMode \| undefined) ?? 'password',\n identityKey: asString(raw.idnkey)?.trim(),\n codeHash: asString(raw.codehash) ?? '',\n expiresAt: raw.expiresAt as Date,\n attempts: Number(raw.attempts),\n sends: Number(raw.sends),\n sentAt: raw.sentAt as Date,\n };\n return converted;\n }\n\n private async transaction<T>(operation: (query: Query) => Promise<T>): Promise<T> {\n return Orm.withTransaction(this.options.databaseOptions, async (transaction) => {\n const query: Query = (sql, params = []) => Orm.transactionQuery(transaction, sql, params);\n return operation(query);\n });\n }\n\n private response(id: string, expiresAt: Date): TwoFactorChallengeDto {\n return { twoFactorRequired: true, challengeId: id, expiresAt: new Date(expiresAt).toISOString(), resendAfterSeconds: RESEND_SECONDS, method: 'email' };\n }\n\n private async deliver(id: string, code: string, email: string): Promise<void> {\n try {\n await this.emailService.sendTwoFactorCode(email, code, LIFETIME_SECONDS / 60);\n } catch {\n // Invalidate only the code whose delivery failed, preserving a concurrent newer code.\n await Orm.execute(this.options.databaseOptions,\n 'UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ? AND CODEHASH = ?',\n [MAX_ATTEMPTS, id, this.hash(id, code)], false).catch(() => undefined);\n throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_DELIVERY_FAILED', message: 'Invio del codice non riuscito. Riprova tra poco.' });\n }\n }\n\n async issue(proof: TwoFactorProof): Promise<TwoFactorChallengeDto> {\n if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(proof.email ?? '')) {\n throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_EMAIL_REQUIRED', message: 'Per il codice di accesso serve un indirizzo email valido. Contatta un amministratore.' });\n }\n const id = randomBytes(32).toString('hex');\n const code = String(randomInt(1000000)).padStart(6, '0');\n const expiresAt = await this.transaction(async query => {\n // Serialize issuance for this account across backend instances.\n await query('SELECT CODUTE FROM UTENTI WHERE CODUTE = ? WITH LOCK', [proof.codiceUtente]);\n const recent = await query('SELECT COUNT() AS TOTAL FROM ACCESSI_2FA WHERE CODUTE = ? AND CREATED_AT > DATEADD(-15 MINUTE TO CURRENT_TIMESTAMP)', [proof.codiceUtente]) as Array<Record<string, unknown>> \| undefined;\n if (Number(recent?.[0]?.TOTAL ?? recent?.[0]?.total ?? 0) >= 5) throw this.limited();\n await query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');\n const created = await query(\n `INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`,\n [id, proof.codiceUtente, proof.email, proof.mode, proof.identityKey ?? null, this.hash(id, code)],\n );\n const row = (Array.isArray(created) ? created[0] : created) as Record<string, unknown> \| undefined;\n return (row?.EXPIRES_AT ?? row?.expires_at) as Date;\n });\n await this.deliver(id, code, proof.email);\n return this.response(id, expiresAt);\n }\n\n async describe(id: string): Promise<TwoFactorProof> {\n if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n const row = this.row(await Orm.query(this.options.databaseOptions,\n `SELECT ${RETURN_FIELDS} FROM ACCESSI_2FA WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ?`, [id, MAX_ATTEMPTS], false));\n if (!row) throw this.invalid();\n return row;\n }\n\n async resend(id: string): Promise<TwoFactorChallengeDto> {\n if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n const code = String(randomInt(1000000)).padStart(6, '0');\n const row = await this.transaction(async query => {\n const result = this.row(await query(\n `UPDATE ACCESSI_2FA SET CODEHASH = ?, SENDS = SENDS + 1, SENT_AT = CURRENT_TIMESTAMP WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? AND SENDS < ? AND SENT_AT <= DATEADD(-${RESEND_SECONDS} SECOND TO CURRENT_TIMESTAMP) RETURNING ${RETURN_FIELDS}`,\n [this.hash(id, code), id, MAX_ATTEMPTS, MAX_SENDS],\n ));\n if (!result) throw this.limited();\n return result;\n });\n await this.deliver(id, code, row.email);\n return this.response(id, row.expiresAt);\n }\n\n async consume(id: string, code: string): Promise<TwoFactorProof> {\n if (!/^[a-f0-9]{64}$/.test(id) \|\| !/^\\d{6}$/.test(code)) throw this.invalid();\n const proof = await this.transaction(async query => {\n // The conditional write serializes verification and persists failed attempts.\n const row = this.row(await query(\n `UPDATE ACCESSI_2FA SET ATTEMPTS = ATTEMPTS + 1 WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? RETURNING ${RETURN_FIELDS}`,\n [id, MAX_ATTEMPTS],\n ));\n if (!row) return null;\n const expected = Buffer.from(row.codeHash.trim(), 'hex');\n const actual = Buffer.from(this.hash(id, code), 'hex');\n if (expected.length !== actual.length \|\| !timingSafeEqual(expected, actual)) return null;\n await query('UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ?', [MAX_ATTEMPTS, id]);\n return row;\n });\n // Throw after commit, otherwise a wrong code would roll back the attempt counter.\n if (!proof) throw this.invalid();\n return proof;\n }\n}\n"]}

package/dist/accessi-module/Services/UserService/UserService.d.ts CHANGED Viewed

@@ -9,10 +9,9 @@ import { FiltriService } from '../FiltriService/FiltriService';
 import { PermissionService } from '../PermissionService/PermissionService';
 export declare class UserService {
     private readonly accessiOptions;
-    private readonly emailService;
     private readonly permissionService;
     private readonly filtriService;
-    constructor(accessiOptions: AccessiOptions, emailService: EmailService, permissionService: PermissionService, filtriService: FiltriService);
+    constructor(accessiOptions: AccessiOptions, _emailService: EmailService, permissionService: PermissionService, filtriService: FiltriService);
     private validateApplicationFields;
     private normalizeDatabaseBoolean;
     private normalizeUserFlags;
@@ -32,10 +31,19 @@ export declare class UserService {
     getUsers(filters?: {
         email?: string;
         codiceUtente?: number;
+        limit?: number;
+        offset?: number;
     }, options?: {
         includeExtensionFields: boolean;
         includeGrants: boolean;
     }): Promise<GetUsersResult[]>;
+    /** Conteggio utenti con gli stessi filtri di `getUsers`, per la paginazione (header X-Total-Count). */
+    countUsers(filters?: {
+        email?: string;
+        codiceUtente?: number;
+    }): Promise<number>;
+    private loadExtensionFieldsForUsers;
+    private chunkArray;
     /** Cerca il codice interno per email normalizzata. Il chiamante deve gestire il caso senza righe. */
     getCodiceUtenteByEmail(email: string): Promise<{
         codiceUtente: number;
@@ -43,7 +51,6 @@ export declare class UserService {
     /** Recupera il profilo locale usato dal login, compresi filtri Accessi eventualmente presenti. */
     getUserByEmail(email: string): Promise<UserDto | null>;
     insertUserFilters(codiceUtente: number, filterData: RegisterRequest): Promise<void>;
-    private executeInTransaction;
     /**
      * Crea utente, configurazione e filtri. La registrazione pubblica resta in stato `INVIO` e non puo
      * impostare privilegi, ruoli o grant; soltanto flussi backend fidati possono usare `allowPrivilegedFields`.

package/dist/accessi-module/Services/UserService/UserService.js CHANGED Viewed

@@ -20,6 +20,17 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __rest = (this && this.__rest) || function (s, e) {
+    var t = {};
+    for (var p in s) if (Object.prototype.hasOwnProperty.call(s, p) && e.indexOf(p) < 0)
+        t[p] = s[p];
+    if (s != null && typeof Object.getOwnPropertySymbols === "function")
+        for (var i = 0, p = Object.getOwnPropertySymbols(s); i < p.length; i++) {
+            if (e.indexOf(p[i]) < 0 && Object.prototype.propertyIsEnumerable.call(s, p[i]))
+                t[p[i]] = s[p[i]];
+        }
+    return t;
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UserService = void 0;
 const common_1 = require("@nestjs/common");
@@ -33,9 +44,8 @@ const EmailService_1 = require("../EmailService/EmailService");
 const FiltriService_1 = require("../FiltriService/FiltriService");
 const PermissionService_1 = require("../PermissionService/PermissionService");
 let UserService = class UserService {
-    constructor(accessiOptions, emailService, permissionService, filtriService) {
+    constructor(accessiOptions, _emailService, permissionService, filtriService) {
         this.accessiOptions = accessiOptions;
-        this.emailService = emailService;
         this.permissionService = permissionService;
         this.filtriService = filtriService;
     }
@@ -89,7 +99,7 @@ let UserService = class UserService {
             }
             const query = `SELECT FLGADMINCONFIG AS flag_admin_configurator FROM UTENTI_CONFIG WHERE CODUTE = ?`;
             const result = yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, query, [codiceUtente]);
-            if (!result || result === 0) {
+            if (result.length === 0) {
                 return false;
             }
             const mapped = result.map(Utilities_1.RestUtilities.convertKeysToCamelCase);
@@ -141,11 +151,20 @@ let UserService = class UserService {
      */
     getUsers(filters, options) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e;
             try {
                 const configColumns = yield (0, optionalColumns_1.getTableColumns)(this.accessiOptions, 'UTENTI_CONFIG');
                 const filterColumns = yield (0, optionalColumns_1.getTableColumns)(this.accessiOptions, 'FILTRI');
+                // Paginazione opzionale con limiti sani: il default resta "tutti gli utenti".
+                const limit = Number.isInteger(filters === null || filters === void 0 ? void 0 : filters.limit) && ((_a = filters === null || filters === void 0 ? void 0 : filters.limit) !== null && _a !== void 0 ? _a : 0) > 0
+                    ? Math.min(filters === null || filters === void 0 ? void 0 : filters.limit, 1000)
+                    : undefined;
+                const offset = Number.isInteger(filters === null || filters === void 0 ? void 0 : filters.offset) && ((_b = filters === null || filters === void 0 ? void 0 : filters.offset) !== null && _b !== void 0 ? _b : 0) > 0
+                    ? Math.trunc(filters === null || filters === void 0 ? void 0 : filters.offset)
+                    : 0;
+                const pagination = `${limit !== undefined ? ` FIRST ${limit}` : ''}${offset > 0 ? ` SKIP ${offset}` : ''}`;
                 let query = `
-            SELECT
+            SELECT${pagination}
                 U.CODUTE as codice_utente,
                 U.USRNAME as email,
                 U.FLGGDPR as flag_gdpr,
@@ -194,19 +213,25 @@ let UserService = class UserService {
                 let users = (yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, query, queryParams));
                 users = users.map(Utilities_1.RestUtilities.convertKeysToCamelCase).map(user => this.normalizeUserFlags(user));
                 const usersResponse = [];
+                // I campi estensione sono caricati una volta per tabella (non una per utente) in query IN
+                // suddivise in blocchi per non superare i limiti di parametri del driver.
+                const extensionFieldsByUser = (options === null || options === void 0 ? void 0 : options.includeExtensionFields)
+                    ? yield this.loadExtensionFieldsForUsers(users.map((user) => user.codiceUtente))
+                    : undefined;
+                // I grant sono caricati in batch (query IN) invece che utente per utente.
+                const grantsByUser = (options === null || options === void 0 ? void 0 : options.includeGrants)
+                    ? yield this.permissionService.getUsersRolesAndGrants(users.map((user) => user.codiceUtente))
+                    : undefined;
                 for (const user of users) {
                     let userGrants;
                     if (options === null || options === void 0 ? void 0 : options.includeGrants) {
-                        userGrants = yield this.permissionService.getUserRolesAndGrants(user.codiceUtente);
+                        userGrants = grantsByUser === null || grantsByUser === void 0 ? void 0 : grantsByUser.get(user.codiceUtente);
                     }
                     let extensionFields;
                     if (options === null || options === void 0 ? void 0 : options.includeExtensionFields) {
                         extensionFields = {};
-                    }
-                    if (extensionFields && this.accessiOptions.extensionFieldsOptions) {
-                        for (const ext of this.accessiOptions.extensionFieldsOptions) {
-                            const values = (yield Orm_1.Orm.query(ext.databaseOptions, `SELECT ${ext.tableFields.join(',')} FROM ${ext.tableName} WHERE ${ext.tableJoinFieldName} = ?`, [user.codiceUtente])).map(Utilities_1.RestUtilities.convertKeysToCamelCase);
-                            extensionFields[ext.objectKey] = values;
+                        for (const ext of (_c = this.accessiOptions.extensionFieldsOptions) !== null && _c !== void 0 ? _c : []) {
+                            extensionFields[ext.objectKey] = (_e = (_d = extensionFieldsByUser === null || extensionFieldsByUser === void 0 ? void 0 : extensionFieldsByUser.get(ext.objectKey)) === null || _d === void 0 ? void 0 : _d.get(user.codiceUtente)) !== null && _e !== void 0 ? _e : [];
                         }
                     }
                     usersResponse.push({
@@ -222,6 +247,67 @@ let UserService = class UserService {
             }
         });
     }
+    /** Conteggio utenti con gli stessi filtri di `getUsers`, per la paginazione (header X-Total-Count). */
+    countUsers(filters) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const conditions = [];
+            const params = [];
+            if (filters === null || filters === void 0 ? void 0 : filters.email) {
+                conditions.push('LOWER(U.USRNAME) = ?');
+                params.push(filters.email.trim().toLowerCase());
+            }
+            if (filters === null || filters === void 0 ? void 0 : filters.codiceUtente) {
+                conditions.push('U.CODUTE = ?');
+                params.push(filters.codiceUtente);
+            }
+            const query = `SELECT COUNT(*) AS TOTAL FROM UTENTI U INNER JOIN UTENTI_CONFIG G ON U.CODUTE = G.CODUTE WHERE 1=1 ${conditions.map((condition) => `AND ${condition}`).join(' ')}`;
+            const rows = (yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, query, params, false));
+            const row = rows[0];
+            return Number((_b = (_a = row === null || row === void 0 ? void 0 : row.TOTAL) !== null && _a !== void 0 ? _a : row === null || row === void 0 ? void 0 : row.total) !== null && _b !== void 0 ? _b : 0) || 0;
+        });
+    }
+    loadExtensionFieldsForUsers(codiceUtenti) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const byObjectKey = new Map();
+            const extensions = (_a = this.accessiOptions.extensionFieldsOptions) !== null && _a !== void 0 ? _a : [];
+            const uniqueCodes = Array.from(new Set(codiceUtenti));
+            for (const ext of extensions) {
+                const grouped = new Map();
+                for (const chunk of this.chunkArray(uniqueCodes, 500)) {
+                    if (chunk.length === 0) {
+                        continue;
+                    }
+                    const placeholders = chunk.map(() => '?').join(', ');
+                    const rows = (yield Orm_1.Orm.query(ext.databaseOptions, `SELECT ${ext.tableJoinFieldName} AS __joinkey, ${ext.tableFields.join(', ')} FROM ${ext.tableName} WHERE ${ext.tableJoinFieldName} IN (${placeholders})`, chunk)).map(Utilities_1.RestUtilities.convertKeysToCamelCase);
+                    for (const row of rows) {
+                        const { __joinkey } = row, rest = __rest(row, ["__joinkey"]);
+                        const key = Number(__joinkey);
+                        if (!Number.isFinite(key)) {
+                            continue;
+                        }
+                        const bucket = grouped.get(key);
+                        if (bucket) {
+                            bucket.push(rest);
+                        }
+                        else {
+                            grouped.set(key, [rest]);
+                        }
+                    }
+                }
+                byObjectKey.set(ext.objectKey, grouped);
+            }
+            return byObjectKey;
+        });
+    }
+    chunkArray(items, size) {
+        const chunks = [];
+        for (let index = 0; index < items.length; index += size) {
+            chunks.push(items.slice(index, index + size));
+        }
+        return chunks;
+    }
     /** Cerca il codice interno per email normalizzata. Il chiamante deve gestire il caso senza righe. */
     getCodiceUtenteByEmail(email) {
         return __awaiter(this, void 0, void 0, function* () {
@@ -266,12 +352,11 @@ let UserService = class UserService {
             WHERE LOWER(U.USRNAME) = ?
         `;
             const utenti = (yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, query, [email]).then((results) => results.map(Utilities_1.RestUtilities.convertKeysToCamelCase)));
-            if (utenti.length <= 0)
+            const user = utenti[0];
+            if (!user)
                 return null;
-            const filtriUtente = yield this.filtriService.getFiltriUser(utenti[0].codiceUtente);
-            if (utenti.length > 0 && filtriUtente.length > 0) {
-                const user = utenti[0];
-                const filtro = filtriUtente[0];
+            const filtro = (yield this.filtriService.getFiltriUser(user.codiceUtente))[0];
+            if (filtro) {
                 const filterValues = {};
                 Object.entries(FiltriUtente_1.FILTRI_UTENTE_DB_MAPPING).forEach(([key]) => {
                     if (key in filtro) {
@@ -280,7 +365,7 @@ let UserService = class UserService {
                 });
                 Object.assign(user, filterValues);
             }
-            return utenti.length > 0 ? this.normalizeUserFlags(utenti[0]) : null;
+            return this.normalizeUserFlags(user);
         });
     }
     insertUserFilters(codiceUtente, filterData) {
@@ -288,18 +373,13 @@ let UserService = class UserService {
             yield this.filtriService.upsertFiltriUtente(codiceUtente, filterData);
         });
     }
-    executeInTransaction(operation) {
-        return __awaiter(this, void 0, void 0, function* () {
-            yield operation();
-        });
-    }
     /**
      * Crea utente, configurazione e filtri. La registrazione pubblica resta in stato `INVIO` e non puo
      * impostare privilegi, ruoli o grant; soltanto flussi backend fidati possono usare `allowPrivilegedFields`.
      */
     register(registrationData, options) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d;
+            var _a;
             try {
                 const allowPrivilegedFields = (options === null || options === void 0 ? void 0 : options.allowPrivilegedFields) === true;
                 const normalizedEmail = this.normalizeEmail(registrationData.email);
@@ -319,71 +399,77 @@ let UserService = class UserService {
                 }
                 yield this.validateApplicationFields(registrationData);
                 yield this.ensureEmailIsAvailable(normalizedEmail);
-                const queryUtenti = `INSERT INTO UTENTI (USRNAME, STAREG) VALUES (?,?)`;
+                const queryUtenti = `INSERT INTO UTENTI (USRNAME, STAREG) VALUES (?,?) RETURNING CODUTE`;
                 // Public/local registrations keep the historic INVIO state; trusted master or SSO flows may opt into CONF.
                 const paramsUtenti = [normalizedEmail, (_a = options === null || options === void 0 ? void 0 : options.initialState) !== null && _a !== void 0 ? _a : StatoRegistrazione_1.StatoRegistrazione.INVIO];
-                yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, queryUtenti, paramsUtenti);
-                const codiceUtenteResult = yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, 'SELECT FIRST 1 CODUTE FROM UTENTI WHERE USRNAME = ? ORDER BY CODUTE DESC', [normalizedEmail]);
-                const codiceUtente = Number((_c = (_b = codiceUtenteResult === null || codiceUtenteResult === void 0 ? void 0 : codiceUtenteResult[0]) === null || _b === void 0 ? void 0 : _b.CODUTE) !== null && _c !== void 0 ? _c : (_d = codiceUtenteResult === null || codiceUtenteResult === void 0 ? void 0 : codiceUtenteResult[0]) === null || _d === void 0 ? void 0 : _d.codute);
-                if (!codiceUtente) {
-                    throw new Error('Creazione utente non riuscita: impossibile recuperare CODUTE.');
-                }
-                const utentiConfigFields = ['CODUTE', 'COGNOME', 'NOME'];
-                const utentiConfigPlaceholders = ['?', '?', '?'];
-                const utentiConfigParams = [codiceUtente, registrationData.cognome, registrationData.nome];
-                const optionalFields = [
-                    {
-                        key: 'cellulare',
-                        dbField: 'CELLULARE',
-                        transform: (v) => String(v),
-                    },
-                    {
-                        key: 'avatar',
-                        dbField: 'AVATAR',
-                        transform: (v) => String(v),
-                    },
-                    {
-                        key: 'flagDueFattori',
-                        dbField: 'FLG2FATT',
-                        transform: (v) => (v ? 1 : 0),
-                    },
-                    {
-                        key: 'paginaDefault',
-                        dbField: 'PAGDEF',
-                        transform: (v) => String(v),
-                    },
-                    {
-                        key: 'nummac',
-                        dbField: 'NUMMAC',
-                        transform: (v) => Number(v),
-                    },
-                    {
-                        key: 'ragSocCli',
-                        dbField: 'RAGSOCCLI',
-                        transform: (v) => String(v),
-                    },
-                ];
-                if (allowPrivilegedFields) {
-                    optionalFields.push({
-                        key: 'flagSuper',
-                        dbField: 'FLGSUPER',
-                        transform: (v) => (v ? 1 : 0),
-                    }, {
-                        key: 'flagAdminConfigurator',
-                        dbField: 'FLGADMINCONFIG',
-                        transform: (v) => (v ? 1 : 0),
-                    });
-                }
-                for (const field of optionalFields) {
-                    const value = registrationData[field.key];
-                    if (value !== undefined && value !== null) {
-                        utentiConfigFields.push(field.dbField);
-                        utentiConfigPlaceholders.push('?');
-                        utentiConfigParams.push(field.transform ? field.transform(value) : value);
+                // Utente e configurazione sono creati in un'unica transazione; filtri e assegnazioni restano
+                // fuori perché delegati a servizi dedicati.
+                const codiceUtente = yield Orm_1.Orm.withTransaction(this.accessiOptions.databaseOptions, (transaction) => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    const insertedUsers = yield Orm_1.Orm.transactionQuery(transaction, queryUtenti, paramsUtenti);
+                    const insertedUser = (Array.isArray(insertedUsers) ? insertedUsers[0] : insertedUsers);
+                    const newCodiceUtente = Number((_a = insertedUser === null || insertedUser === void 0 ? void 0 : insertedUser.CODUTE) !== null && _a !== void 0 ? _a : insertedUser === null || insertedUser === void 0 ? void 0 : insertedUser.codute);
+                    if (!newCodiceUtente) {
+                        throw new Error('Creazione utente non riuscita: impossibile recuperare CODUTE.');
                     }
-                }
-                const queryUtentiConfig = `INSERT INTO UTENTI_CONFIG (${utentiConfigFields.join(', ')}) VALUES (${utentiConfigPlaceholders.join(', ')})`;
-                yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, queryUtentiConfig, utentiConfigParams);
+                    const utentiConfigFields = ['CODUTE', 'COGNOME', 'NOME'];
+                    const utentiConfigPlaceholders = ['?', '?', '?'];
+                    const utentiConfigParams = [newCodiceUtente, registrationData.cognome, registrationData.nome];
+                    const optionalFields = [
+                        {
+                            key: 'cellulare',
+                            dbField: 'CELLULARE',
+                            transform: (v) => String(v),
+                        },
+                        {
+                            key: 'avatar',
+                            dbField: 'AVATAR',
+                            transform: (v) => String(v),
+                        },
+                        {
+                            key: 'flagDueFattori',
+                            dbField: 'FLG2FATT',
+                            transform: (v) => (v ? 1 : 0),
+                        },
+                        {
+                            key: 'paginaDefault',
+                            dbField: 'PAGDEF',
+                            transform: (v) => String(v),
+                        },
+                        {
+                            key: 'nummac',
+                            dbField: 'NUMMAC',
+                            transform: (v) => Number(v),
+                        },
+                        {
+                            key: 'ragSocCli',
+                            dbField: 'RAGSOCCLI',
+                            transform: (v) => String(v),
+                        },
+                    ];
+                    if (allowPrivilegedFields) {
+                        optionalFields.push({
+                            key: 'flagSuper',
+                            dbField: 'FLGSUPER',
+                            transform: (v) => (v ? 1 : 0),
+                        }, {
+                            key: 'flagAdminConfigurator',
+                            dbField: 'FLGADMINCONFIG',
+                            transform: (v) => (v ? 1 : 0),
+                        });
+                    }
+                    for (const field of optionalFields) {
+                        const value = registrationData[field.key];
+                        if (value !== undefined && value !== null) {
+                            utentiConfigFields.push(field.dbField);
+                            utentiConfigPlaceholders.push('?');
+                            utentiConfigParams.push(field.transform ? field.transform(value) : value);
+                        }
+                    }
+                    const queryUtentiConfig = `INSERT INTO UTENTI_CONFIG (${utentiConfigFields.join(', ')}) VALUES (${utentiConfigPlaceholders.join(', ')})`;
+                    yield Orm_1.Orm.transactionQuery(transaction, queryUtentiConfig, utentiConfigParams);
+                    return newCodiceUtente;
+                }));
                 yield this.filtriService.upsertFiltriUtente(codiceUtente, registrationData);
                 if (allowPrivilegedFields && !!registrationData.roles && registrationData.roles.length > 0) {
                     yield this.permissionService.assignRolesToUser(codiceUtente, registrationData.roles);