npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.23 → 2.0.0-dev.25 - Mend

emilsoftware-utilities 2.0.0-dev.23 → 2.0.0-dev.25

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (261) hide show

package/dist/accessi-module/federated-auth/FederatedAuthController.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"FederatedAuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAiJ;AACjJ,6CAA0I;AAE1I,+CAAgD;AAChD,uDAAqE;AACrE,yEAA8V;AAC9V,sDAAqD;AACrD,6DAAyF;AACzF,iEAA8D;AAE9D;;;;GAIG;AAKI,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAKrE,YAAY,CAAQ,OAAgB,EAAS,GAAa;;YAC9D,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,cAAc,CAAQ,OAAgB,EAAU,IAAoC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YACvH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAU,IAAoC,EAAS,GAAa;;YACnJ,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,aAAa,CAAQ,OAAgB,EAAuC,YAAoB,EAAS,GAAa;;YAC1H,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,YAAY,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAoC,EAAS,GAAa;;YACvK,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAWK,UAAU,CAAQ,OAAgB,EAAU,IAAgC,EAAS,GAAa;;YACtG,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,iBAAiB,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAmC,EAAS,GAAa;;YAC3K,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACjG,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,eAAe,CAAQ,OAAgB,EAAwB,WAAmB,EAAS,GAAa;;YAC5G,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC7D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAuC,YAAoB,EAAwB,WAAmB,EAAS,GAAa;;YACtK,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAC1E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAwB,WAAmB,EAAU,IAAoC,EAAS,GAAa;;YACzJ,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAEO,SAAS,CAAC,GAAa,EAAE,KAAc;QAC7C,MAAM,MAAM,GAAG,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACrG,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;CACF,CAAA;AA1JY,0DAAuB;AAM5B;IAHL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,8HAA8H,EAAE,CAAC;IAC7O,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,YAAG,EAAC,WAAW,CAAC;IACG,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAOjD;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,8IAA8I,EAAE,CAAC;IAC1P,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,WAAW,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAtC,sDAA8B;;6DAOzF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oIAAoI,EAAE,CAAC;IAC7P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IAClD,IAAA,cAAK,EAAC,qBAAqB,CAAC;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAO9H;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;IACpM,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACjD,IAAA,YAAG,EAAC,gCAAgC,CAAC;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4DAO7G;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;IAC1Q,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,gCAAgC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;2DAQlJ;AAWK;IATL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,qHAAqH,EAAE,CAAC;IACtO,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kDAA0B,EAAE,CAAC;IAC7C,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IACjH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mGAAmG,EAAE,CAAC;IACnK,IAAA,aAAI,EAAC,OAAO,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAlC,kDAA0B;;yDAQjF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,6GAA6G,EAAE,CAAC;IAC1O,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,oCAAoC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAuC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAArC,qDAA6B;;gEAQtJ;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,0BAA0B,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IACxL,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,eAAM,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAQ/F;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,oCAAoC,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC9P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACxF,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IACrH,IAAA,eAAM,EAAC,6CAA6C,CAAC;IAChC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQzJ;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,kHAAkH,EAAE,CAAC;IAClO,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAQpI;kCApJU,uBAAuB;IAJnC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAEgB,2CAAoB;GAD5D,uBAAuB,CA0JnC","sourcesContent":["import { Body, Controller, Delete, Get, HttpException, HttpStatus, Param, ParseIntPipe, Patch, Post, Req, Res, UseGuards } from '@nestjs/common';\nimport { ApiBearerAuth, ApiBody, ApiCreatedResponse, ApiOkResponse, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, FederatedIdentityListResponse, FederatedIdentityResponse, FederatedProviderListResponse, FederatedProviderResponse, SetPasswordLoginPolicyRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest } from '../Dtos/FederatedIdentityDtos';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureSuperUser, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { FederatedAuthService } from './FederatedAuthService';\n\n/*\n Master-only administration API. Authentication itself is intentionally not\n * exposed over HTTP: the hosting backend validates its SSO and calls\n * FederatedAuthService.authenticate({ provider, subject }) directly.\n */\n@ApiTags('Federated authentication')\n@ApiBearerAuth()\n@UseGuards(JwtSimpleGuard)\n@Controller('accessi/federated-auth')\nexport class FederatedAuthController {\n constructor(private readonly federatedAuthService: FederatedAuthService) {}\n\n @ApiOperation({ summary: 'Elenca i provider SSO censiti', operationId: 'getFederatedProviders', description: 'Riservato a superutente. Restituisce solo catalogo e stato Accessi; issuer, secret e configurazioni SSO restano nel backend.' })\n @ApiOkResponse({ type: FederatedProviderListResponse })\n @Get('providers')\n async getProviders(@Req() request: Request, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getProviders());\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Censisce un provider SSO', operationId: 'createFederatedProvider', description: 'Riservato a superutente. La chiave provider deve corrispondere alla configurazione stabile del backend; non salvare segreti, issuer o token.' })\n @ApiBody({ type: CreateFederatedProviderRequest })\n @ApiCreatedResponse({ type: FederatedProviderResponse })\n @Post('providers')\n async createProvider(@Req() request: Request, @Body() body: CreateFederatedProviderRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.createProvider(body), HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider è immutabile: disabilitarla blocca nuovi login SSO ma conserva i collegamenti storici.' })\n @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n @ApiBody({ type: UpdateFederatedProviderRequest })\n @ApiOkResponse({ type: FederatedProviderResponse })\n @Patch('providers/:provider')\n async updateProvider(@Req() request: Request, @Param('provider') provider: string, @Body() body: UpdateFederatedProviderRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.updateProvider(provider, body));\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elenca le identita SSO di un utente', operationId: 'getFederatedIdentities', description: 'Riservato a superutente. Non restituisce token esterni o claim del provider.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiOkResponse({ type: FederatedIdentityListResponse })\n @ApiResponse({ status: 403, type: ErrorResponse })\n @Get('users/:codiceUtente/identities')\n async getIdentities(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getUserIdentities(codiceUtente));\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Associa un SSO gia verificato a un utente esistente', operationId: 'linkFederatedIdentity', description: 'Il master deve fornire un provider e subject ottenuti da una verifica SSO lato backend; questo endpoint non verifica token esterni.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiBody({ type: CreateFederatedIdentityRequest })\n @ApiCreatedResponse({ type: FederatedIdentityResponse })\n @Post('users/:codiceUtente/identities')\n async linkIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: CreateFederatedIdentityRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n const identity = await this.federatedAuthService.linkIdentity(codiceUtente, body, body.note);\n return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Crea un utente gestito e SSO-only', operationId: 'createFederatedUser', description: 'Riservato a superutente. L utente nasce confermato, con identita collegata e senza password salvo opt-in esplicito.' })\n @ApiBody({ type: CreateFederatedUserRequest })\n @ApiCreatedResponse({ type: FederatedIdentityResponse })\n @ApiResponse({ status: 400, type: ErrorResponse, description: 'Provider o subject non validi.' })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider SSO non censito.' })\n @ApiResponse({ status: 409, type: ErrorResponse, description: 'Email o identità SSO già associate a un utente.' })\n @ApiResponse({ status: 503, type: ErrorResponse, description: 'Schema Accessi non aggiornato.' })\n @ApiResponse({ status: 500, type: ErrorResponse, description: 'Errore inatteso durante il provisioning; la risposta contiene FEDERATED_USER_PROVISIONING_FAILED.' })\n @Post('users')\n async createUser(@Req() request: Request, @Body() body: CreateFederatedUserRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n const identity = await this.federatedAuthService.createManagedFederatedUser(body.user, body, body.passwordLoginEnabled === true, body.note);\n return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Abilita o disabilita il login con password', operationId: 'setPasswordLoginPolicy', description: 'Con false il login locale restituisce PASSWORD_LOGIN_DISABLED; le identita SSO attive restano utilizzabili.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiBody({ type: SetPasswordLoginPolicyRequest })\n @ApiOkResponse({ type: ActionResponse })\n @Patch('users/:codiceUtente/password-login')\n async setPasswordPolicy(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: SetPasswordLoginPolicyRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.setPasswordLoginEnabled(codiceUtente, body.passwordLoginEnabled);\n return RestUtilities.sendOKMessage(res, 'Policy di autenticazione aggiornata.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Disabilita un identita SSO', operationId: 'disableFederatedIdentity', description: 'Soft delete: l associazione resta tracciata ma non puo piu autenticare.' })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n @ApiOkResponse({ type: ActionResponse })\n @Delete('identities/:identityKey')\n async disableIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.disableIdentity(identityKey);\n return RestUtilities.sendOKMessage(res, 'Identita SSO disabilitata.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall’utente, senza eliminare l’utente Accessi.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 del collegamento da eliminare.' })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Collegamento assente o non appartenente all’utente.' })\n @Delete('users/:codiceUtente/identities/:identityKey')\n async deleteIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Param('identityKey') identityKey: string, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.deleteIdentity(codiceUtente, identityKey);\n return RestUtilities.sendOKMessage(res, 'Collegamento SSO eliminato definitivamente.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Aggiorna un collegamento SSO', operationId: 'updateFederatedIdentity', description: 'Consente di modificare nota e stato attivo del collegamento. identityKey e una chiave tecnica, non un token SSO.' })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n @ApiBody({ type: UpdateFederatedIdentityRequest })\n @ApiOkResponse({ type: ActionResponse })\n @Patch('identities/:identityKey')\n async updateIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Body() body: UpdateFederatedIdentityRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.updateIdentity(identityKey, body);\n return RestUtilities.sendOKMessage(res, 'Collegamento SSO aggiornato.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n private sendError(res: Response, error: unknown) {\n const status = error instanceof HttpException ? error.getStatus() : HttpStatus.INTERNAL_SERVER_ERROR;\n return RestUtilities.sendErrorMessage(res, error, FederatedAuthController.name, status);\n }\n}\n"]}
1	+ {"version":3,"file":"FederatedAuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAiJ;AACjJ,6CAA0I;AAE1I,+CAAgD;AAChD,uDAAqE;AACrE,yEAA8V;AAC9V,sDAAqD;AACrD,6DAAyF;AACzF,iEAA8D;AAE9D;;;;GAIG;AAKI,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAKrE,YAAY,CAAQ,OAAgB,EAAS,GAAa;;YAC9D,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,cAAc,CAAQ,OAAgB,EAAU,IAAoC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YACvH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAU,IAAoC,EAAS,GAAa;;YACnJ,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACzD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,QAAQ,aAAa,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,aAAa,CAAQ,OAAgB,EAAuC,YAAoB,EAAS,GAAa;;YAC1H,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,YAAY,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAoC,EAAS,GAAa;;YACvK,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAWK,UAAU,CAAQ,OAAgB,EAAU,IAAgC,EAAS,GAAa;;YACtG,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,iBAAiB,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAmC,EAAS,GAAa;;YAC3K,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACjG,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,eAAe,CAAQ,OAAgB,EAAwB,WAAmB,EAAS,GAAa;;YAC5G,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC7D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAuC,YAAoB,EAAwB,WAAmB,EAAS,GAAa;;YACtK,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAC1E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAwB,WAAmB,EAAU,IAAoC,EAAS,GAAa;;YACzJ,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAEO,SAAS,CAAC,GAAa,EAAE,KAAc;QAC7C,MAAM,MAAM,GAAG,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACrG,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;CACF,CAAA;AA1KY,0DAAuB;AAM5B;IAHL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,8HAA8H,EAAE,CAAC;IAC7O,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,YAAG,EAAC,WAAW,CAAC;IACG,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAOjD;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,8IAA8I,EAAE,CAAC;IAC1P,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,WAAW,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAtC,sDAA8B;;6DAOzF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oIAAoI,EAAE,CAAC;IAC7P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IAClD,IAAA,cAAK,EAAC,qBAAqB,CAAC;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAO9H;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC/N,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC1F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;IACnH,IAAA,eAAM,EAAC,qBAAqB,CAAC;IACR,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQxF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;IACpM,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACjD,IAAA,YAAG,EAAC,gCAAgC,CAAC;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4DAO7G;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;IAC1Q,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,gCAAgC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;2DAQlJ;AAWK;IATL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,qHAAqH,EAAE,CAAC;IACtO,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kDAA0B,EAAE,CAAC;IAC7C,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IACjH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mGAAmG,EAAE,CAAC;IACnK,IAAA,aAAI,EAAC,OAAO,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAlC,kDAA0B;;yDAQjF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,6GAA6G,EAAE,CAAC;IAC1O,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,oCAAoC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAuC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAArC,qDAA6B;;gEAQtJ;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,0BAA0B,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IACxL,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,eAAM,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAQ/F;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,oCAAoC,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC9P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACxF,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IACrH,IAAA,eAAM,EAAC,6CAA6C,CAAC;IAChC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQzJ;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,kHAAkH,EAAE,CAAC;IAClO,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAQpI;kCApKU,uBAAuB;IAJnC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAEgB,2CAAoB;GAD5D,uBAAuB,CA0KnC","sourcesContent":["import { Body, Controller, Delete, Get, HttpException, HttpStatus, Param, ParseIntPipe, Patch, Post, Req, Res, UseGuards } from '@nestjs/common';\nimport { ApiBearerAuth, ApiBody, ApiCreatedResponse, ApiOkResponse, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, FederatedIdentityListResponse, FederatedIdentityResponse, FederatedProviderListResponse, FederatedProviderResponse, SetPasswordLoginPolicyRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest } from '../Dtos/FederatedIdentityDtos';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureSuperUser, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { FederatedAuthService } from './FederatedAuthService';\n\n/*\n Master-only administration API. Authentication itself is intentionally not\n * exposed over HTTP: the hosting backend validates its SSO and calls\n * FederatedAuthService.authenticate({ provider, subject }) directly.\n */\n@ApiTags('Federated authentication')\n@ApiBearerAuth()\n@UseGuards(JwtSimpleGuard)\n@Controller('accessi/federated-auth')\nexport class FederatedAuthController {\n constructor(private readonly federatedAuthService: FederatedAuthService) {}\n\n @ApiOperation({ summary: 'Elenca i provider SSO censiti', operationId: 'getFederatedProviders', description: 'Riservato a superutente. Restituisce solo catalogo e stato Accessi; issuer, secret e configurazioni SSO restano nel backend.' })\n @ApiOkResponse({ type: FederatedProviderListResponse })\n @Get('providers')\n async getProviders(@Req() request: Request, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getProviders());\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Censisce un provider SSO', operationId: 'createFederatedProvider', description: 'Riservato a superutente. La chiave provider deve corrispondere alla configurazione stabile del backend; non salvare segreti, issuer o token.' })\n @ApiBody({ type: CreateFederatedProviderRequest })\n @ApiCreatedResponse({ type: FederatedProviderResponse })\n @Post('providers')\n async createProvider(@Req() request: Request, @Body() body: CreateFederatedProviderRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.createProvider(body), HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider è immutabile: disabilitarla blocca nuovi login SSO ma conserva i collegamenti storici.' })\n @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n @ApiBody({ type: UpdateFederatedProviderRequest })\n @ApiOkResponse({ type: FederatedProviderResponse })\n @Patch('providers/:provider')\n async updateProvider(@Req() request: Request, @Param('provider') provider: string, @Body() body: UpdateFederatedProviderRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.updateProvider(provider, body));\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elimina un provider SSO', operationId: 'deleteFederatedProvider', description: 'Riservato a superutente. Consentito solo se nessuna identita e collegata al provider; in alternativa disabilitalo.' })\n @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider non registrato.' })\n @ApiResponse({ status: 409, type: ErrorResponse, description: 'Provider ancora utilizzato da identita collegate.' })\n @Delete('providers/:provider')\n async deleteProvider(@Req() request: Request, @Param('provider') provider: string, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.deleteProvider(provider);\n return RestUtilities.sendOKMessage(res, `Provider SSO ${provider} eliminato.`);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elenca le identita SSO di un utente', operationId: 'getFederatedIdentities', description: 'Riservato a superutente. Non restituisce token esterni o claim del provider.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiOkResponse({ type: FederatedIdentityListResponse })\n @ApiResponse({ status: 403, type: ErrorResponse })\n @Get('users/:codiceUtente/identities')\n async getIdentities(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getUserIdentities(codiceUtente));\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Associa un SSO gia verificato a un utente esistente', operationId: 'linkFederatedIdentity', description: 'Il master deve fornire un provider e subject ottenuti da una verifica SSO lato backend; questo endpoint non verifica token esterni.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiBody({ type: CreateFederatedIdentityRequest })\n @ApiCreatedResponse({ type: FederatedIdentityResponse })\n @Post('users/:codiceUtente/identities')\n async linkIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: CreateFederatedIdentityRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n const identity = await this.federatedAuthService.linkIdentity(codiceUtente, body, body.note);\n return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Crea un utente gestito e SSO-only', operationId: 'createFederatedUser', description: 'Riservato a superutente. L utente nasce confermato, con identita collegata e senza password salvo opt-in esplicito.' })\n @ApiBody({ type: CreateFederatedUserRequest })\n @ApiCreatedResponse({ type: FederatedIdentityResponse })\n @ApiResponse({ status: 400, type: ErrorResponse, description: 'Provider o subject non validi.' })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider SSO non censito.' })\n @ApiResponse({ status: 409, type: ErrorResponse, description: 'Email o identità SSO già associate a un utente.' })\n @ApiResponse({ status: 503, type: ErrorResponse, description: 'Schema Accessi non aggiornato.' })\n @ApiResponse({ status: 500, type: ErrorResponse, description: 'Errore inatteso durante il provisioning; la risposta contiene FEDERATED_USER_PROVISIONING_FAILED.' })\n @Post('users')\n async createUser(@Req() request: Request, @Body() body: CreateFederatedUserRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n const identity = await this.federatedAuthService.createManagedFederatedUser(body.user, body, body.passwordLoginEnabled === true, body.note);\n return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Abilita o disabilita il login con password', operationId: 'setPasswordLoginPolicy', description: 'Con false il login locale restituisce PASSWORD_LOGIN_DISABLED; le identita SSO attive restano utilizzabili.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiBody({ type: SetPasswordLoginPolicyRequest })\n @ApiOkResponse({ type: ActionResponse })\n @Patch('users/:codiceUtente/password-login')\n async setPasswordPolicy(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: SetPasswordLoginPolicyRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.setPasswordLoginEnabled(codiceUtente, body.passwordLoginEnabled);\n return RestUtilities.sendOKMessage(res, 'Policy di autenticazione aggiornata.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Disabilita un identita SSO', operationId: 'disableFederatedIdentity', description: 'Soft delete: l associazione resta tracciata ma non puo piu autenticare.' })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n @ApiOkResponse({ type: ActionResponse })\n @Delete('identities/:identityKey')\n async disableIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.disableIdentity(identityKey);\n return RestUtilities.sendOKMessage(res, 'Identita SSO disabilitata.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall’utente, senza eliminare l’utente Accessi.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 del collegamento da eliminare.' })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Collegamento assente o non appartenente all’utente.' })\n @Delete('users/:codiceUtente/identities/:identityKey')\n async deleteIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Param('identityKey') identityKey: string, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.deleteIdentity(codiceUtente, identityKey);\n return RestUtilities.sendOKMessage(res, 'Collegamento SSO eliminato definitivamente.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Aggiorna un collegamento SSO', operationId: 'updateFederatedIdentity', description: 'Consente di modificare nota e stato attivo del collegamento. identityKey e una chiave tecnica, non un token SSO.' })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n @ApiBody({ type: UpdateFederatedIdentityRequest })\n @ApiOkResponse({ type: ActionResponse })\n @Patch('identities/:identityKey')\n async updateIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Body() body: UpdateFederatedIdentityRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.updateIdentity(identityKey, body);\n return RestUtilities.sendOKMessage(res, 'Collegamento SSO aggiornato.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n private sendError(res: Response, error: unknown) {\n const status = error instanceof HttpException ? error.getStatus() : HttpStatus.INTERNAL_SERVER_ERROR;\n return RestUtilities.sendErrorMessage(res, error, FederatedAuthController.name, status);\n }\n}\n"]}

package/dist/accessi-module/federated-auth/FederatedAuthService.d.ts CHANGED Viewed

@@ -52,6 +52,12 @@ export declare class FederatedAuthService implements OnModuleInit {
         active?: boolean;
         note?: string;
     }): Promise<FederatedProvider>;
+    /**
+     * Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK
+     * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un
+     * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.
+     */
+    deleteProvider(providerValue: string): Promise<void>;
     /** Enables or disables all local password authentication for one user. */
     /**
      * Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso

package/dist/accessi-module/federated-auth/FederatedAuthService.js CHANGED Viewed

@@ -227,6 +227,31 @@ let FederatedAuthService = class FederatedAuthService {
             return (yield this.findProvider(provider));
         });
     }
+    /**
+     * Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK
+     * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un
+     * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.
+     */
+    deleteProvider(providerValue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            this.assertEnabled();
+            const provider = this.normalizeProvider(providerValue);
+            if (!(yield this.findProvider(provider))) {
+                throw new common_1.NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });
+            }
+            const usage = yield Orm_1.Orm.query(this.options.databaseOptions, 'SELECT COUNT(*) AS total FROM UTENTI_IDENTITA_EXT WHERE PROVIDER = ?', [provider]);
+            const rawTotal = (_b = (_a = usage === null || usage === void 0 ? void 0 : usage[0]) === null || _a === void 0 ? void 0 : _a.TOTAL) !== null && _b !== void 0 ? _b : (_c = usage === null || usage === void 0 ? void 0 : usage[0]) === null || _c === void 0 ? void 0 : _c.total;
+            const total = typeof rawTotal === 'number' ? rawTotal : Number.parseInt(`${rawTotal !== null && rawTotal !== void 0 ? rawTotal : '0'}`, 10);
+            if (total > 0) {
+                throw new common_1.ConflictException({
+                    code: 'FEDERATED_PROVIDER_IN_USE',
+                    message: `Impossibile eliminare il provider ${provider}: ${total} identita collegate. Disabilitalo oppure rimuovi prima i collegamenti.`,
+                });
+            }
+            yield Orm_1.Orm.execute(this.options.databaseOptions, 'DELETE FROM SSO_PROVIDER WHERE PROVIDER = ?', [provider]);
+        });
+    }
     /** Enables or disables all local password authentication for one user. */
     /**
      * Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso
@@ -236,7 +261,9 @@ let FederatedAuthService = class FederatedAuthService {
         return __awaiter(this, void 0, void 0, function* () {
             this.assertEnabled();
             yield this.assertUserExists(codiceUtente);
-            yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE UTENTI_CONFIG SET FLGPASSWORD = ? WHERE CODUTE = ?', [enabled ? 1 : 0, codiceUtente]);
+            // Upsert: per utenti legacy senza riga in UTENTI_CONFIG una UPDATE a vuoto
+            // lasciava la policy al default, rendendo la disattivazione un no-op silenzioso.
+            yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE OR INSERT INTO UTENTI_CONFIG (CODUTE, FLGPASSWORD) VALUES (?, ?) MATCHING (CODUTE)', [codiceUtente, enabled ? 1 : 0]);
         });
     }
     /** Returns the effective local password policy. Users without a policy row retain the historic enabled default. */

package/dist/accessi-module/federated-auth/FederatedAuthService.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"FederatedAuthService.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4M;AAC5M,mCAAoC;AACpC,uFAAoF;AACpF,mCAAgC;AAChC,+CAAgD;AAGhD,mEAAgE;AAChE,qEAAkE;AAClE,qEAAkE;AAClE,uEAAkF;AAwBlF;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAC8C,OAAuB,EAClD,WAAwB,EACxB,WAAwB;QAFG,YAAO,GAAP,OAAO,CAAgB;QAClD,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,+FAA+F;IACzF,YAAY;;YAChB,MAAM,+CAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;KAAA;IAED,wFAAwF;IACxF,SAAS;;QACP,OAAO,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI,CAAC;IAChE,CAAC;IAED;;;OAGG;IACG,YAAY,CAAC,QAAmC;;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEjE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YACzI,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACrG,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC9G,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,cAAc,CAAC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;gBACtH,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;YAC9D,CAAC;YAED,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,kFAAkF,EAClF,CAAC,cAAc,CAAC,WAAW,CAAC,CAC7B,CAAC;YACF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,qEAAqE,EACrE,CAAC,cAAc,CAAC,YAAY,CAAC,CAC9B,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACxF,OAAO;gBACL,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;aACxE,CAAC;QACJ,CAAC;KAAA;IAED,4GAA4G;IACtG,YAAY,CAAC,YAAoB,EAAE,QAAmC,EAAE,IAAa;;;YACzF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAE5D,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;YAC3I,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,MAAA,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,IAAI,mCAAI,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,CACtD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;mCAC2B,EAC3B,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,IAAI,CAAC,CACvG,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAE,CAAC;QACvD,CAAC;KAAA;IAED,0GAA0G;IACpG,0BAA0B;6DAC9B,gBAAiC,EACjC,QAAmC,EACnC,oBAAoB,GAAG,KAAK,EAC5B,IAAa;YAEb,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YAC7I,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,IAAI;oBAC3B,YAAY,EAAE,uCAAkB,CAAC,IAAI;iBACtC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;gBACvE,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,4BAAmB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,2BAAkB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,oCAA2B,EAAE,CAAC;oBAC5M,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,+FAA+F,EAAE,CAAC,CAAC;gBAChM,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,oIAAoI,EAAE,CAAC,CAAC;YACxO,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,gCAAgC,CACpC,gBAAiC,EACjC,QAAmC;;;YAEnC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,qBAAqB,MAAK,IAAI,EAAE,CAAC;gBACzE,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnI,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;gBACrE,qBAAqB,EAAE,KAAK;gBAC5B,YAAY,EAAE,uCAAkB,CAAC,IAAI;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;KAAA;IAED,0FAA0F;IACpF,iBAAiB,CAAC,YAAoB;;YAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;;8BAOwB,EACxB,CAAC,YAAY,CAAC,CACf,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,yGAAyG;IACnG,YAAY;;YAChB,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;sDAGgD,CACjD,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,wFAAwF;IAClF,cAAc,CAAC,KAA+D;;;YAClF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,uFAAuF,EACvF,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,IAAI,EAAE,KAAI,IAAI,CAAC,CACpD,CAAC;YACF,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED,gGAAgG;IAChG;;;OAGG;IACG,cAAc,CAAC,aAAqB,EAAE,MAAiE;;YAC3G,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC9H,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED,0EAA0E;IAC1E;;;OAGG;IACG,uBAAuB,CAAC,YAAoB,EAAE,OAAgB;;YAClE,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2DAA2D,EAC3D,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAChC,CAAC;QACJ,CAAC;KAAA;IAED,mHAAmH;IACnH,0GAA0G;IACpG,sBAAsB,CAAC,YAAoB;;YAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,GAAG,CAAC;QACrH,CAAC;KAAA;IAED,4EAA4E;IAC5E,8GAA8G;IACxG,eAAe,CAAC,WAAmB;;YACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,8FAA8F,EAC9F,CAAC,WAAW,CAAC,CACd,CAAC;QACJ,CAAC;KAAA;IAED,oGAAoG;IACpG;;;OAGG;IACG,cAAc,CAAC,YAAoB,EAAE,WAAmB;;YAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;YAC/G,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,iEAAiE,EACjE,CAAC,WAAW,EAAE,YAAY,CAAC,CAC5B,CAAC;QACJ,CAAC;KAAA;IAED,sGAAsG;IACtG,6GAA6G;IACvG,cAAc,CAAC,WAAmB,EAAE,MAA2C;;YACnF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;;oBAC/C,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACjC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACnI,CAAC;KAAA;IAED,uFAAuF;IACjF,YAAY;;YAChB,IAAI,IAAI,CAAC,SAAS,EAAE;gBAAE,MAAM,+CAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;KAAA;IAEa,YAAY,CAAC,QAAmC,EAAE,UAAmB;;YACjF,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;gEAM0D,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,EACpG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEa,gBAAgB,CAAC,YAAoB;;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QACxE,CAAC;KAAA;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;QACzI,CAAC;IACH,CAAC;IAED,uFAAuF;IAC/E,iBAAiB,CAAC,WAAmB;QAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,QAAmC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;QAChK,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAEO,iBAAiB,CAAC,KAAc;QACtC,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC,CAAC;QACnK,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEa,oBAAoB,CAAC,QAAgB;;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KAAA;IAEa,YAAY,CAAC,QAAgB;;YACzC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;0BAGoB,EACpB,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEO,cAAc,CAAC,QAAmC;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAChK,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAEO,UAAU,CAAC,GAAgB;QACjC,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;YACpC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YACtC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,KAAK,KAAK,IAAI,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;YACjI,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAgB;;QACjC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,WAAW,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACjD,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AAvaY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACX,yBAAW;GAJhC,oBAAoB,CAuahC","sourcesContent":["import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, InternalServerErrorException, NotFoundException, OnModuleInit, ServiceUnavailableException } from '@nestjs/common';\nimport { createHash } from 'crypto';\nimport { AccessiDatabaseUpdater } from '../database-updates/AccessiDatabaseUpdater';\nimport { Orm } from '../../Orm';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { isAuthenticatedUserEnabledForJwt } from '../security/authenticatedToken';\nimport { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './FederatedAuthTypes';\n\ntype IdentityRow = {\n identityKey?: string;\n codiceUtente?: number;\n provider?: string;\n subject?: string;\n active?: unknown;\n createdAt?: Date \| string;\n lastLoginAt?: Date \| string;\n disabledAt?: Date \| string;\n note?: string;\n passwordLoginEnabled?: unknown;\n};\n\ntype ProviderRow = {\n provider?: string;\n description?: string;\n active?: unknown;\n createdAt?: Date \| string;\n note?: string;\n};\n\n/*\n Maps externally verified identities to Accessi users and issues the usual\n * Accessi JWT. It deliberately has no provider SDK dependency: validating an\n * Azure, Google, Apple, SAML, or custom token is always the hosting backend's job.\n /\n@Injectable()\nexport class FederatedAuthService implements OnModuleInit {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n private readonly userService: UserService,\n private readonly authService: AuthService,\n ) {}\n\n /* Await the same schema barrier as the module updater; never race two DDL implementations. /\n async onModuleInit(): Promise<void> {\n await AccessiDatabaseUpdater.initialize(this.options);\n }\n\n /* Returns true only when the host application opted in to federated authentication. /\n isEnabled(): boolean {\n return this.options.federatedAuthentication?.enabled === true;\n }\n\n /\n Exchanges a backend-verified identity for the same login result and JWT\n * emitted by the local password endpoint. No raw external token is accepted.\n /\n async authenticate(identity: VerifiedFederatedIdentity): Promise<FederatedAuthenticationResult> {\n this.assertEnabled();\n const normalized = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalized.provider);\n const linkedIdentity = await this.findIdentity(normalized, true);\n\n if (!linkedIdentity) {\n throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_LINKED', message: 'Identita esterna non associata a un utente Accessi.' });\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(linkedIdentity.codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\n throw new ForbiddenException({ code: 'FEDERATED_USER_DISABLED', message: 'Utente Accessi non abilitato.' });\n }\n\n if (currentUser.flagDueFattori) {\n const login = await this.authService.beginFederatedTwoFactor(linkedIdentity.codiceUtente, linkedIdentity.identityKey);\n return { codiceUtente: linkedIdentity.codiceUtente, login };\n }\n\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n [linkedIdentity.identityKey],\n );\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?',\n [linkedIdentity.codiceUtente],\n );\n\n const login = await this.authService.getLoginResultForUser(linkedIdentity.codiceUtente);\n return {\n codiceUtente: linkedIdentity.codiceUtente,\n login,\n token: this.authService.createAccessiToken(login.utente, ['federated']),\n };\n }\n\n /* Links an external identity to an existing Accessi user. It never changes that user's password policy. /\n async linkIdentity(codiceUtente: number, identity: VerifiedFederatedIdentity, note?: string): Promise<FederatedIdentity> {\n this.assertEnabled();\n await this.assertUserExists(codiceUtente);\n const normalized = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalized.provider);\n const existing = await this.findIdentity(normalized, false);\n\n if (existing && existing.codiceUtente !== codiceUtente) {\n throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identita esterna gia associata a un altro utente.' });\n }\n\n if (existing) {\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 1, DATDISATT = NULL, NOTA = ? WHERE IDNKEY = ?',\n [note ?? existing.note ?? null, existing.identityKey],\n );\n } else {\n await Orm.execute(\n this.options.databaseOptions,\n `INSERT INTO UTENTI_IDENTITA_EXT (IDNKEY, CODUTE, PROVIDER, SUBJECT, FLGATTIVO, NOTA)\n VALUES (?, ?, ?, ?, 1, ?)`,\n [this.getIdentityKey(normalized), codiceUtente, normalized.provider, normalized.subject, note ?? null],\n );\n }\n\n return (await this.findIdentity(normalized, false))!;\n }\n\n /* Creates a confirmed Accessi user, associates an SSO identity and defaults the new user to SSO-only. /\n async createManagedFederatedUser(\n registrationData: RegisterRequest,\n identity: VerifiedFederatedIdentity,\n passwordLoginEnabled = false,\n note?: string,\n ): Promise<FederatedIdentity> {\n this.assertEnabled();\n const normalizedIdentity = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalizedIdentity.provider);\n if (await this.findIdentity(normalizedIdentity, false)) {\n throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identità esterna già associata a un utente Accessi.' });\n }\n\n try {\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: true,\n initialState: StatoRegistrazione.CONF,\n });\n await this.setPasswordLoginEnabled(codiceUtente, passwordLoginEnabled);\n return await this.linkIdentity(codiceUtente, normalizedIdentity, note);\n } catch (error) {\n if (error instanceof BadRequestException \|\| error instanceof ConflictException \|\| error instanceof ForbiddenException \|\| error instanceof NotFoundException \|\| error instanceof ServiceUnavailableException) {\n throw error;\n }\n if (RestUtilities.isDatabaseSchemaError(error)) {\n throw new ServiceUnavailableException({ code: 'ACCESSI_DATABASE_SCHEMA_OUTDATED', message: 'Lo schema del database Accessi non è aggiornato. Eseguire la migrazione database e riprovare.' });\n }\n throw new InternalServerErrorException({ code: 'FEDERATED_USER_PROVISIONING_FAILED', message: 'La creazione dell’utente SSO non è stata completata. Verificare il log del backend e l’eventuale utente creato senza identità SSO.' });\n }\n }\n\n /\n Allows self-provisioning only when explicitly enabled. The caller must have\n * verified the external identity and decide which profile fields are trusted.\n /\n async registerSelfServiceFederatedUser(\n registrationData: RegisterRequest,\n identity: VerifiedFederatedIdentity,\n ): Promise<FederatedIdentity> {\n this.assertEnabled();\n if (this.options.federatedAuthentication?.allowSelfRegistration !== true) {\n throw new ForbiddenException({ code: 'FEDERATED_SELF_REGISTRATION_DISABLED', message: 'Auto-registrazione SSO non abilitata.' });\n }\n\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: false,\n initialState: StatoRegistrazione.CONF,\n });\n await this.setPasswordLoginEnabled(codiceUtente, false);\n return this.linkIdentity(codiceUtente, identity);\n }\n\n /* Returns all linked identities for administration; disabled identities are included. /\n async getUserIdentities(codiceUtente: number): Promise<FederatedIdentity[]> {\n this.assertEnabled();\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n I.DATDISATT AS disabled_at, I.NOTA,\n COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n FROM UTENTI_IDENTITA_EXT I\n LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n WHERE I.CODUTE = ?\n ORDER BY I.DATINS DESC`,\n [codiceUtente],\n );\n return rows.map(RestUtilities.convertKeysToCamelCase).map((row: IdentityRow) => this.toIdentity(row));\n }\n\n /* Returns the complete provider catalog, including inactive providers, for superuser administration. /\n async getProviders(): Promise<FederatedProvider[]> {\n this.assertEnabled();\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n DATINS AS created_at, NOTA AS note\n FROM SSO_PROVIDER\n ORDER BY FLGATTIVO DESC, DESCRIZIONE, PROVIDER`,\n );\n return rows.map(RestUtilities.convertKeysToCamelCase).map((row: ProviderRow) => this.toProvider(row));\n }\n\n /* Registers a provider key that must match the backend's SSO configuration exactly. /\n async createProvider(input: { provider: string; description: string; note?: string }): Promise<FederatedProvider> {\n this.assertEnabled();\n const provider = this.normalizeProvider(input.provider);\n const description = this.normalizeDescription(input.description);\n const existing = await this.findProvider(provider);\n if (existing) {\n throw new ConflictException({ code: 'FEDERATED_PROVIDER_ALREADY_EXISTS', message: 'Il provider SSO è già registrato.' });\n }\n await Orm.execute(\n this.options.databaseOptions,\n 'INSERT INTO SSO_PROVIDER (PROVIDER, DESCRIZIONE, FLGATTIVO, NOTA) VALUES (?, ?, 1, ?)',\n [provider, description, input.note?.trim() \|\| null],\n );\n return (await this.findProvider(provider))!;\n }\n\n /* Updates provider metadata or disables the provider without removing its identity history. /\n /\n Aggiorna metadati amministrativi del catalogo. La chiave provider e immutabile perche parte dell'identita\n * persistita e deve coincidere esattamente con la configurazione del backend validante.\n /\n async updateProvider(providerValue: string, update: { description?: string; active?: boolean; note?: string }): Promise<FederatedProvider> {\n this.assertEnabled();\n const provider = this.normalizeProvider(providerValue);\n if (!(await this.findProvider(provider))) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n const changes: string[] = [];\n const params: unknown[] = [];\n if (update.description !== undefined) {\n changes.push('DESCRIZIONE = ?');\n params.push(this.normalizeDescription(update.description));\n }\n if (update.active !== undefined) {\n changes.push('FLGATTIVO = ?');\n params.push(update.active ? 1 : 0);\n }\n if (update.note !== undefined) {\n changes.push('NOTA = ?');\n params.push(update.note.trim() \|\| null);\n }\n if (changes.length > 0) {\n params.push(provider);\n await Orm.execute(this.options.databaseOptions, `UPDATE SSO_PROVIDER SET ${changes.join(', ')} WHERE PROVIDER = ?`, params);\n }\n return (await this.findProvider(provider))!;\n }\n\n /* Enables or disables all local password authentication for one user. /\n /\n Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso\n * email/password, che restituisce `PASSWORD_LOGIN_DISABLED`. L'assenza della riga mantiene il default legacy `true`.\n /\n async setPasswordLoginEnabled(codiceUtente: number, enabled: boolean): Promise<void> {\n this.assertEnabled();\n await this.assertUserExists(codiceUtente);\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_CONFIG SET FLGPASSWORD = ? WHERE CODUTE = ?',\n [enabled ? 1 : 0, codiceUtente],\n );\n }\n\n /* Returns the effective local password policy. Users without a policy row retain the historic enabled default. /\n /* Restituisce la policy effettiva; utenti precedenti alla migrazione restano abilitati alla password. /\n async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n if (!this.isEnabled()) return true;\n const rows = await Orm.query(\n this.options.databaseOptions,\n 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n [codiceUtente],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow \| undefined;\n return row?.passwordLoginEnabled !== false && row?.passwordLoginEnabled !== 0 && row?.passwordLoginEnabled !== '0';\n }\n\n /* Soft-disables a linked identity without deleting operational history. /\n /* Disabilita logicamente un collegamento SSO conservando audit e possibilita di successiva riattivazione. /\n async disableIdentity(identityKey: string): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 0, DATDISATT = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n [identityKey],\n );\n }\n\n /* Permanently removes one identity link from its owning user after administrative confirmation. /\n /\n Elimina fisicamente un collegamento SSO soltanto dopo aver verificato che appartenga all'utente indicato.\n * Non elimina mai l'utente Accessi, password, ruoli o grant associati.\n /\n async deleteIdentity(codiceUtente: number, identityKey: string): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n const identity = (await this.getUserIdentities(codiceUtente)).find((item) => item.identityKey === identityKey);\n if (!identity) {\n throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_FOUND', message: 'Collegamento SSO non trovato per questo utente.' });\n }\n await Orm.execute(\n this.options.databaseOptions,\n 'DELETE FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ? AND CODUTE = ?',\n [identityKey, codiceUtente],\n );\n }\n\n /* Aggiorna lo stato o la nota di un collegamento SSO usando la sua chiave tecnica amministrativa. /\n /* Aggiorna stato o nota amministrativa senza modificare provider e subject, che identificano la persona. /\n async updateIdentity(identityKey: string, update: { active?: boolean; note?: string }): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n const changes: string[] = [];\n const params: unknown[] = [];\n if (update.active !== undefined) {\n changes.push('FLGATTIVO = ?');\n params.push(update.active ? 1 : 0);\n if (update.active) changes.push('DATDISATT = NULL');\n else changes.push('DATDISATT = CURRENT_TIMESTAMP');\n }\n if (update.note !== undefined) {\n changes.push('NOTA = ?');\n params.push(update.note);\n }\n if (changes.length === 0) return;\n params.push(identityKey);\n await Orm.execute(this.options.databaseOptions, `UPDATE UTENTI_IDENTITA_EXT SET ${changes.join(', ')} WHERE IDNKEY = ?`, params);\n }\n\n /* Explicit administrative schema reconciliation, shared with the standard updater. /\n async ensureSchema(): Promise<void> {\n if (this.isEnabled()) await AccessiDatabaseUpdater.run(this.options);\n }\n\n private async findIdentity(identity: VerifiedFederatedIdentity, onlyActive: boolean): Promise<FederatedIdentity \| null> {\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n I.DATDISATT AS disabled_at, I.NOTA,\n COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n FROM UTENTI_IDENTITA_EXT I\n LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n WHERE I.IDNKEY = ? AND I.PROVIDER = ? AND I.SUBJECT = ?${onlyActive ? ' AND I.FLGATTIVO = 1' : ''}`,\n [this.getIdentityKey(identity), identity.provider, identity.subject],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow \| undefined;\n return row ? this.toIdentity(row) : null;\n }\n\n private async assertUserExists(codiceUtente: number): Promise<void> {\n const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!user) throw new NotFoundException('Utente Accessi non trovato.');\n }\n\n private assertEnabled(): void {\n if (!this.isEnabled()) {\n throw new ForbiddenException({ code: 'FEDERATED_AUTH_DISABLED', message: 'Autenticazione federata non abilitata in AccessiOptions.' });\n }\n }\n\n /* Validates the opaque SHA-256 key used only by administrative identity endpoints. */\n private assertIdentityKey(identityKey: string): void {\n if (!/^[a-f0-9]{64}$/i.test(identityKey)) {\n throw new BadRequestException({ code: 'FEDERATED_IDENTITY_KEY_INVALID', message: 'Chiave del collegamento SSO non valida.' });\n }\n }\n\n private normalizeIdentity(identity: VerifiedFederatedIdentity): VerifiedFederatedIdentity {\n const provider = this.normalizeProvider(identity?.provider);\n const subject = typeof identity?.subject === 'string' ? identity.subject.trim() : '';\n if (!subject \|\| Buffer.byteLength(subject, 'utf8') > 512) {\n throw new BadRequestException({ code: 'FEDERATED_SUBJECT_INVALID', message: 'Subject non valido: è obbligatorio e può occupare al massimo 512 byte UTF-8.' });\n }\n return { provider, subject };\n }\n\n private normalizeProvider(value: unknown): string {\n const provider = typeof value === 'string' ? value.trim().toLowerCase() : '';\n if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(provider)) {\n throw new BadRequestException({ code: 'FEDERATED_PROVIDER_INVALID', message: 'Provider non valido: usare un namespace ASCII stabile di massimo 64 caratteri.' });\n }\n return provider;\n }\n\n private normalizeDescription(value: unknown): string {\n const description = typeof value === 'string' ? value.trim() : '';\n if (!description \|\| description.length > 160) {\n throw new BadRequestException({ code: 'FEDERATED_PROVIDER_DESCRIPTION_INVALID', message: 'La descrizione del provider deve contenere da 1 a 160 caratteri.' });\n }\n return description;\n }\n\n private async assertProviderActive(provider: string): Promise<FederatedProvider> {\n const registered = await this.findProvider(provider);\n if (!registered) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n if (!registered.active) {\n throw new ForbiddenException({ code: 'FEDERATED_PROVIDER_DISABLED', message: 'Provider SSO disabilitato.' });\n }\n return registered;\n }\n\n private async findProvider(provider: string): Promise<FederatedProvider \| null> {\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n DATINS AS created_at, NOTA AS note\n FROM SSO_PROVIDER\n WHERE PROVIDER = ?`,\n [provider],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as ProviderRow \| undefined;\n return row ? this.toProvider(row) : null;\n }\n\n private getIdentityKey(identity: VerifiedFederatedIdentity): string {\n const provider = Buffer.from(identity.provider, 'utf8');\n const subject = Buffer.from(identity.subject, 'utf8');\n const payload = Buffer.concat([Buffer.from('accessi:federated:v1:'), Buffer.from(`${provider.length}:`), provider, Buffer.from(`${subject.length}:`), subject]);\n return createHash('sha256').update(payload).digest('hex');\n }\n\n private toIdentity(row: IdentityRow): FederatedIdentity {\n return {\n identityKey: String(row.identityKey),\n codiceUtente: Number(row.codiceUtente),\n provider: String(row.provider).trim(),\n subject: String(row.subject),\n active: row.active === true \|\| row.active === 1 \|\| row.active === '1',\n passwordLoginEnabled: !(row.passwordLoginEnabled === false \|\| row.passwordLoginEnabled === 0 \|\| row.passwordLoginEnabled === '0'),\n createdAt: row.createdAt,\n lastLoginAt: row.lastLoginAt,\n disabledAt: row.disabledAt,\n note: row.note,\n };\n }\n\n private toProvider(row: ProviderRow): FederatedProvider {\n return {\n provider: String(row.provider).trim(),\n description: String(row.description ?? '').trim(),\n active: row.active === true \|\| row.active === 1 \|\| row.active === '1',\n createdAt: row.createdAt,\n note: row.note,\n };\n }\n}\n"]}
1	+ {"version":3,"file":"FederatedAuthService.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4M;AAC5M,mCAAoC;AACpC,uFAAoF;AACpF,mCAAgC;AAChC,+CAAgD;AAGhD,mEAAgE;AAChE,qEAAkE;AAClE,qEAAkE;AAClE,uEAAkF;AAwBlF;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAC8C,OAAuB,EAClD,WAAwB,EACxB,WAAwB;QAFG,YAAO,GAAP,OAAO,CAAgB;QAClD,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,+FAA+F;IACzF,YAAY;;YAChB,MAAM,+CAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;KAAA;IAED,wFAAwF;IACxF,SAAS;;QACP,OAAO,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI,CAAC;IAChE,CAAC;IAED;;;OAGG;IACG,YAAY,CAAC,QAAmC;;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEjE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YACzI,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACrG,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC9G,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,cAAc,CAAC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;gBACtH,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;YAC9D,CAAC;YAED,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,kFAAkF,EAClF,CAAC,cAAc,CAAC,WAAW,CAAC,CAC7B,CAAC;YACF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,qEAAqE,EACrE,CAAC,cAAc,CAAC,YAAY,CAAC,CAC9B,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACxF,OAAO;gBACL,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;aACxE,CAAC;QACJ,CAAC;KAAA;IAED,4GAA4G;IACtG,YAAY,CAAC,YAAoB,EAAE,QAAmC,EAAE,IAAa;;;YACzF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAE5D,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;YAC3I,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,MAAA,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,IAAI,mCAAI,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,CACtD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;mCAC2B,EAC3B,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,IAAI,CAAC,CACvG,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAE,CAAC;QACvD,CAAC;KAAA;IAED,0GAA0G;IACpG,0BAA0B;6DAC9B,gBAAiC,EACjC,QAAmC,EACnC,oBAAoB,GAAG,KAAK,EAC5B,IAAa;YAEb,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YAC7I,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,IAAI;oBAC3B,YAAY,EAAE,uCAAkB,CAAC,IAAI;iBACtC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;gBACvE,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,4BAAmB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,2BAAkB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,oCAA2B,EAAE,CAAC;oBAC5M,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,+FAA+F,EAAE,CAAC,CAAC;gBAChM,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,oIAAoI,EAAE,CAAC,CAAC;YACxO,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,gCAAgC,CACpC,gBAAiC,EACjC,QAAmC;;;YAEnC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,qBAAqB,MAAK,IAAI,EAAE,CAAC;gBACzE,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnI,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;gBACrE,qBAAqB,EAAE,KAAK;gBAC5B,YAAY,EAAE,uCAAkB,CAAC,IAAI;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;KAAA;IAED,0FAA0F;IACpF,iBAAiB,CAAC,YAAoB;;YAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;;8BAOwB,EACxB,CAAC,YAAY,CAAC,CACf,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,yGAAyG;IACnG,YAAY;;YAChB,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;sDAGgD,CACjD,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,wFAAwF;IAClF,cAAc,CAAC,KAA+D;;;YAClF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,uFAAuF,EACvF,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,IAAI,EAAE,KAAI,IAAI,CAAC,CACpD,CAAC;YACF,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED,gGAAgG;IAChG;;;OAGG;IACG,cAAc,CAAC,aAAqB,EAAE,MAAiE;;YAC3G,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC9H,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED;;;;OAIG;IACG,cAAc,CAAC,aAAqB;;;YACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,SAAG,CAAC,KAAK,CAC3B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,sEAAsE,EACtE,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,QAAQ,GAAG,MAAA,MAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAyC,0CAAE,KAAK,mCACtE,MAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAyC,0CAAE,KAAK,CAAC;YAChE,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC;oBAC1B,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,qCAAqC,QAAQ,KAAK,KAAK,wEAAwE;iBACzI,CAAC,CAAC;YACL,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,6CAA6C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7G,CAAC;KAAA;IAED,0EAA0E;IAC1E;;;OAGG;IACG,uBAAuB,CAAC,YAAoB,EAAE,OAAgB;;YAClE,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,2EAA2E;YAC3E,iFAAiF;YACjF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAChC,CAAC;QACJ,CAAC;KAAA;IAED,mHAAmH;IACnH,0GAA0G;IACpG,sBAAsB,CAAC,YAAoB;;YAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,GAAG,CAAC;QACrH,CAAC;KAAA;IAED,4EAA4E;IAC5E,8GAA8G;IACxG,eAAe,CAAC,WAAmB;;YACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,8FAA8F,EAC9F,CAAC,WAAW,CAAC,CACd,CAAC;QACJ,CAAC;KAAA;IAED,oGAAoG;IACpG;;;OAGG;IACG,cAAc,CAAC,YAAoB,EAAE,WAAmB;;YAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;YAC/G,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,iEAAiE,EACjE,CAAC,WAAW,EAAE,YAAY,CAAC,CAC5B,CAAC;QACJ,CAAC;KAAA;IAED,sGAAsG;IACtG,6GAA6G;IACvG,cAAc,CAAC,WAAmB,EAAE,MAA2C;;YACnF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;;oBAC/C,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACjC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACnI,CAAC;KAAA;IAED,uFAAuF;IACjF,YAAY;;YAChB,IAAI,IAAI,CAAC,SAAS,EAAE;gBAAE,MAAM,+CAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;KAAA;IAEa,YAAY,CAAC,QAAmC,EAAE,UAAmB;;YACjF,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;gEAM0D,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,EACpG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEa,gBAAgB,CAAC,YAAoB;;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QACxE,CAAC;KAAA;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;QACzI,CAAC;IACH,CAAC;IAED,uFAAuF;IAC/E,iBAAiB,CAAC,WAAmB;QAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,QAAmC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;QAChK,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAEO,iBAAiB,CAAC,KAAc;QACtC,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC,CAAC;QACnK,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEa,oBAAoB,CAAC,QAAgB;;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KAAA;IAEa,YAAY,CAAC,QAAgB;;YACzC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;0BAGoB,EACpB,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEO,cAAc,CAAC,QAAmC;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAChK,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAEO,UAAU,CAAC,GAAgB;QACjC,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;YACpC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YACtC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,KAAK,KAAK,IAAI,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;YACjI,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAgB;;QACjC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,WAAW,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACjD,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AArcY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACX,yBAAW;GAJhC,oBAAoB,CAqchC","sourcesContent":["import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, InternalServerErrorException, NotFoundException, OnModuleInit, ServiceUnavailableException } from '@nestjs/common';\nimport { createHash } from 'crypto';\nimport { AccessiDatabaseUpdater } from '../database-updates/AccessiDatabaseUpdater';\nimport { Orm } from '../../Orm';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { isAuthenticatedUserEnabledForJwt } from '../security/authenticatedToken';\nimport { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './FederatedAuthTypes';\n\ntype IdentityRow = {\n identityKey?: string;\n codiceUtente?: number;\n provider?: string;\n subject?: string;\n active?: unknown;\n createdAt?: Date \| string;\n lastLoginAt?: Date \| string;\n disabledAt?: Date \| string;\n note?: string;\n passwordLoginEnabled?: unknown;\n};\n\ntype ProviderRow = {\n provider?: string;\n description?: string;\n active?: unknown;\n createdAt?: Date \| string;\n note?: string;\n};\n\n/*\n Maps externally verified identities to Accessi users and issues the usual\n * Accessi JWT. It deliberately has no provider SDK dependency: validating an\n * Azure, Google, Apple, SAML, or custom token is always the hosting backend's job.\n /\n@Injectable()\nexport class FederatedAuthService implements OnModuleInit {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n private readonly userService: UserService,\n private readonly authService: AuthService,\n ) {}\n\n /* Await the same schema barrier as the module updater; never race two DDL implementations. /\n async onModuleInit(): Promise<void> {\n await AccessiDatabaseUpdater.initialize(this.options);\n }\n\n /* Returns true only when the host application opted in to federated authentication. /\n isEnabled(): boolean {\n return this.options.federatedAuthentication?.enabled === true;\n }\n\n /\n Exchanges a backend-verified identity for the same login result and JWT\n * emitted by the local password endpoint. No raw external token is accepted.\n /\n async authenticate(identity: VerifiedFederatedIdentity): Promise<FederatedAuthenticationResult> {\n this.assertEnabled();\n const normalized = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalized.provider);\n const linkedIdentity = await this.findIdentity(normalized, true);\n\n if (!linkedIdentity) {\n throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_LINKED', message: 'Identita esterna non associata a un utente Accessi.' });\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(linkedIdentity.codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\n throw new ForbiddenException({ code: 'FEDERATED_USER_DISABLED', message: 'Utente Accessi non abilitato.' });\n }\n\n if (currentUser.flagDueFattori) {\n const login = await this.authService.beginFederatedTwoFactor(linkedIdentity.codiceUtente, linkedIdentity.identityKey);\n return { codiceUtente: linkedIdentity.codiceUtente, login };\n }\n\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n [linkedIdentity.identityKey],\n );\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?',\n [linkedIdentity.codiceUtente],\n );\n\n const login = await this.authService.getLoginResultForUser(linkedIdentity.codiceUtente);\n return {\n codiceUtente: linkedIdentity.codiceUtente,\n login,\n token: this.authService.createAccessiToken(login.utente, ['federated']),\n };\n }\n\n /* Links an external identity to an existing Accessi user. It never changes that user's password policy. /\n async linkIdentity(codiceUtente: number, identity: VerifiedFederatedIdentity, note?: string): Promise<FederatedIdentity> {\n this.assertEnabled();\n await this.assertUserExists(codiceUtente);\n const normalized = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalized.provider);\n const existing = await this.findIdentity(normalized, false);\n\n if (existing && existing.codiceUtente !== codiceUtente) {\n throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identita esterna gia associata a un altro utente.' });\n }\n\n if (existing) {\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 1, DATDISATT = NULL, NOTA = ? WHERE IDNKEY = ?',\n [note ?? existing.note ?? null, existing.identityKey],\n );\n } else {\n await Orm.execute(\n this.options.databaseOptions,\n `INSERT INTO UTENTI_IDENTITA_EXT (IDNKEY, CODUTE, PROVIDER, SUBJECT, FLGATTIVO, NOTA)\n VALUES (?, ?, ?, ?, 1, ?)`,\n [this.getIdentityKey(normalized), codiceUtente, normalized.provider, normalized.subject, note ?? null],\n );\n }\n\n return (await this.findIdentity(normalized, false))!;\n }\n\n /* Creates a confirmed Accessi user, associates an SSO identity and defaults the new user to SSO-only. /\n async createManagedFederatedUser(\n registrationData: RegisterRequest,\n identity: VerifiedFederatedIdentity,\n passwordLoginEnabled = false,\n note?: string,\n ): Promise<FederatedIdentity> {\n this.assertEnabled();\n const normalizedIdentity = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalizedIdentity.provider);\n if (await this.findIdentity(normalizedIdentity, false)) {\n throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identità esterna già associata a un utente Accessi.' });\n }\n\n try {\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: true,\n initialState: StatoRegistrazione.CONF,\n });\n await this.setPasswordLoginEnabled(codiceUtente, passwordLoginEnabled);\n return await this.linkIdentity(codiceUtente, normalizedIdentity, note);\n } catch (error) {\n if (error instanceof BadRequestException \|\| error instanceof ConflictException \|\| error instanceof ForbiddenException \|\| error instanceof NotFoundException \|\| error instanceof ServiceUnavailableException) {\n throw error;\n }\n if (RestUtilities.isDatabaseSchemaError(error)) {\n throw new ServiceUnavailableException({ code: 'ACCESSI_DATABASE_SCHEMA_OUTDATED', message: 'Lo schema del database Accessi non è aggiornato. Eseguire la migrazione database e riprovare.' });\n }\n throw new InternalServerErrorException({ code: 'FEDERATED_USER_PROVISIONING_FAILED', message: 'La creazione dell’utente SSO non è stata completata. Verificare il log del backend e l’eventuale utente creato senza identità SSO.' });\n }\n }\n\n /\n Allows self-provisioning only when explicitly enabled. The caller must have\n * verified the external identity and decide which profile fields are trusted.\n /\n async registerSelfServiceFederatedUser(\n registrationData: RegisterRequest,\n identity: VerifiedFederatedIdentity,\n ): Promise<FederatedIdentity> {\n this.assertEnabled();\n if (this.options.federatedAuthentication?.allowSelfRegistration !== true) {\n throw new ForbiddenException({ code: 'FEDERATED_SELF_REGISTRATION_DISABLED', message: 'Auto-registrazione SSO non abilitata.' });\n }\n\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: false,\n initialState: StatoRegistrazione.CONF,\n });\n await this.setPasswordLoginEnabled(codiceUtente, false);\n return this.linkIdentity(codiceUtente, identity);\n }\n\n /* Returns all linked identities for administration; disabled identities are included. /\n async getUserIdentities(codiceUtente: number): Promise<FederatedIdentity[]> {\n this.assertEnabled();\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n I.DATDISATT AS disabled_at, I.NOTA,\n COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n FROM UTENTI_IDENTITA_EXT I\n LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n WHERE I.CODUTE = ?\n ORDER BY I.DATINS DESC`,\n [codiceUtente],\n );\n return rows.map(RestUtilities.convertKeysToCamelCase).map((row: IdentityRow) => this.toIdentity(row));\n }\n\n /* Returns the complete provider catalog, including inactive providers, for superuser administration. /\n async getProviders(): Promise<FederatedProvider[]> {\n this.assertEnabled();\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n DATINS AS created_at, NOTA AS note\n FROM SSO_PROVIDER\n ORDER BY FLGATTIVO DESC, DESCRIZIONE, PROVIDER`,\n );\n return rows.map(RestUtilities.convertKeysToCamelCase).map((row: ProviderRow) => this.toProvider(row));\n }\n\n /* Registers a provider key that must match the backend's SSO configuration exactly. /\n async createProvider(input: { provider: string; description: string; note?: string }): Promise<FederatedProvider> {\n this.assertEnabled();\n const provider = this.normalizeProvider(input.provider);\n const description = this.normalizeDescription(input.description);\n const existing = await this.findProvider(provider);\n if (existing) {\n throw new ConflictException({ code: 'FEDERATED_PROVIDER_ALREADY_EXISTS', message: 'Il provider SSO è già registrato.' });\n }\n await Orm.execute(\n this.options.databaseOptions,\n 'INSERT INTO SSO_PROVIDER (PROVIDER, DESCRIZIONE, FLGATTIVO, NOTA) VALUES (?, ?, 1, ?)',\n [provider, description, input.note?.trim() \|\| null],\n );\n return (await this.findProvider(provider))!;\n }\n\n /* Updates provider metadata or disables the provider without removing its identity history. /\n /\n Aggiorna metadati amministrativi del catalogo. La chiave provider e immutabile perche parte dell'identita\n * persistita e deve coincidere esattamente con la configurazione del backend validante.\n /\n async updateProvider(providerValue: string, update: { description?: string; active?: boolean; note?: string }): Promise<FederatedProvider> {\n this.assertEnabled();\n const provider = this.normalizeProvider(providerValue);\n if (!(await this.findProvider(provider))) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n const changes: string[] = [];\n const params: unknown[] = [];\n if (update.description !== undefined) {\n changes.push('DESCRIZIONE = ?');\n params.push(this.normalizeDescription(update.description));\n }\n if (update.active !== undefined) {\n changes.push('FLGATTIVO = ?');\n params.push(update.active ? 1 : 0);\n }\n if (update.note !== undefined) {\n changes.push('NOTA = ?');\n params.push(update.note.trim() \|\| null);\n }\n if (changes.length > 0) {\n params.push(provider);\n await Orm.execute(this.options.databaseOptions, `UPDATE SSO_PROVIDER SET ${changes.join(', ')} WHERE PROVIDER = ?`, params);\n }\n return (await this.findProvider(provider))!;\n }\n\n /\n Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK\n * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un\n * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.\n /\n async deleteProvider(providerValue: string): Promise<void> {\n this.assertEnabled();\n const provider = this.normalizeProvider(providerValue);\n if (!(await this.findProvider(provider))) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n const usage = await Orm.query(\n this.options.databaseOptions,\n 'SELECT COUNT() AS total FROM UTENTI_IDENTITA_EXT WHERE PROVIDER = ?',\n [provider],\n );\n const rawTotal = (usage?.[0] as Record<string, unknown> \| undefined)?.TOTAL\n ?? (usage?.[0] as Record<string, unknown> \| undefined)?.total;\n const total = typeof rawTotal === 'number' ? rawTotal : Number.parseInt(`${rawTotal ?? '0'}`, 10);\n if (total > 0) {\n throw new ConflictException({\n code: 'FEDERATED_PROVIDER_IN_USE',\n message: `Impossibile eliminare il provider ${provider}: ${total} identita collegate. Disabilitalo oppure rimuovi prima i collegamenti.`,\n });\n }\n await Orm.execute(this.options.databaseOptions, 'DELETE FROM SSO_PROVIDER WHERE PROVIDER = ?', [provider]);\n }\n\n /** Enables or disables all local password authentication for one user. /\n /\n Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso\n * email/password, che restituisce `PASSWORD_LOGIN_DISABLED`. L'assenza della riga mantiene il default legacy `true`.\n /\n async setPasswordLoginEnabled(codiceUtente: number, enabled: boolean): Promise<void> {\n this.assertEnabled();\n await this.assertUserExists(codiceUtente);\n // Upsert: per utenti legacy senza riga in UTENTI_CONFIG una UPDATE a vuoto\n // lasciava la policy al default, rendendo la disattivazione un no-op silenzioso.\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE OR INSERT INTO UTENTI_CONFIG (CODUTE, FLGPASSWORD) VALUES (?, ?) MATCHING (CODUTE)',\n [codiceUtente, enabled ? 1 : 0],\n );\n }\n\n /* Returns the effective local password policy. Users without a policy row retain the historic enabled default. /\n /* Restituisce la policy effettiva; utenti precedenti alla migrazione restano abilitati alla password. /\n async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n if (!this.isEnabled()) return true;\n const rows = await Orm.query(\n this.options.databaseOptions,\n 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n [codiceUtente],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow \| undefined;\n return row?.passwordLoginEnabled !== false && row?.passwordLoginEnabled !== 0 && row?.passwordLoginEnabled !== '0';\n }\n\n /* Soft-disables a linked identity without deleting operational history. /\n /* Disabilita logicamente un collegamento SSO conservando audit e possibilita di successiva riattivazione. /\n async disableIdentity(identityKey: string): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 0, DATDISATT = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n [identityKey],\n );\n }\n\n /* Permanently removes one identity link from its owning user after administrative confirmation. /\n /\n Elimina fisicamente un collegamento SSO soltanto dopo aver verificato che appartenga all'utente indicato.\n * Non elimina mai l'utente Accessi, password, ruoli o grant associati.\n /\n async deleteIdentity(codiceUtente: number, identityKey: string): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n const identity = (await this.getUserIdentities(codiceUtente)).find((item) => item.identityKey === identityKey);\n if (!identity) {\n throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_FOUND', message: 'Collegamento SSO non trovato per questo utente.' });\n }\n await Orm.execute(\n this.options.databaseOptions,\n 'DELETE FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ? AND CODUTE = ?',\n [identityKey, codiceUtente],\n );\n }\n\n /* Aggiorna lo stato o la nota di un collegamento SSO usando la sua chiave tecnica amministrativa. /\n /* Aggiorna stato o nota amministrativa senza modificare provider e subject, che identificano la persona. /\n async updateIdentity(identityKey: string, update: { active?: boolean; note?: string }): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n const changes: string[] = [];\n const params: unknown[] = [];\n if (update.active !== undefined) {\n changes.push('FLGATTIVO = ?');\n params.push(update.active ? 1 : 0);\n if (update.active) changes.push('DATDISATT = NULL');\n else changes.push('DATDISATT = CURRENT_TIMESTAMP');\n }\n if (update.note !== undefined) {\n changes.push('NOTA = ?');\n params.push(update.note);\n }\n if (changes.length === 0) return;\n params.push(identityKey);\n await Orm.execute(this.options.databaseOptions, `UPDATE UTENTI_IDENTITA_EXT SET ${changes.join(', ')} WHERE IDNKEY = ?`, params);\n }\n\n /* Explicit administrative schema reconciliation, shared with the standard updater. /\n async ensureSchema(): Promise<void> {\n if (this.isEnabled()) await AccessiDatabaseUpdater.run(this.options);\n }\n\n private async findIdentity(identity: VerifiedFederatedIdentity, onlyActive: boolean): Promise<FederatedIdentity \| null> {\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n I.DATDISATT AS disabled_at, I.NOTA,\n COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n FROM UTENTI_IDENTITA_EXT I\n LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n WHERE I.IDNKEY = ? AND I.PROVIDER = ? AND I.SUBJECT = ?${onlyActive ? ' AND I.FLGATTIVO = 1' : ''}`,\n [this.getIdentityKey(identity), identity.provider, identity.subject],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow \| undefined;\n return row ? this.toIdentity(row) : null;\n }\n\n private async assertUserExists(codiceUtente: number): Promise<void> {\n const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!user) throw new NotFoundException('Utente Accessi non trovato.');\n }\n\n private assertEnabled(): void {\n if (!this.isEnabled()) {\n throw new ForbiddenException({ code: 'FEDERATED_AUTH_DISABLED', message: 'Autenticazione federata non abilitata in AccessiOptions.' });\n }\n }\n\n /* Validates the opaque SHA-256 key used only by administrative identity endpoints. */\n private assertIdentityKey(identityKey: string): void {\n if (!/^[a-f0-9]{64}$/i.test(identityKey)) {\n throw new BadRequestException({ code: 'FEDERATED_IDENTITY_KEY_INVALID', message: 'Chiave del collegamento SSO non valida.' });\n }\n }\n\n private normalizeIdentity(identity: VerifiedFederatedIdentity): VerifiedFederatedIdentity {\n const provider = this.normalizeProvider(identity?.provider);\n const subject = typeof identity?.subject === 'string' ? identity.subject.trim() : '';\n if (!subject \|\| Buffer.byteLength(subject, 'utf8') > 512) {\n throw new BadRequestException({ code: 'FEDERATED_SUBJECT_INVALID', message: 'Subject non valido: è obbligatorio e può occupare al massimo 512 byte UTF-8.' });\n }\n return { provider, subject };\n }\n\n private normalizeProvider(value: unknown): string {\n const provider = typeof value === 'string' ? value.trim().toLowerCase() : '';\n if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(provider)) {\n throw new BadRequestException({ code: 'FEDERATED_PROVIDER_INVALID', message: 'Provider non valido: usare un namespace ASCII stabile di massimo 64 caratteri.' });\n }\n return provider;\n }\n\n private normalizeDescription(value: unknown): string {\n const description = typeof value === 'string' ? value.trim() : '';\n if (!description \|\| description.length > 160) {\n throw new BadRequestException({ code: 'FEDERATED_PROVIDER_DESCRIPTION_INVALID', message: 'La descrizione del provider deve contenere da 1 a 160 caratteri.' });\n }\n return description;\n }\n\n private async assertProviderActive(provider: string): Promise<FederatedProvider> {\n const registered = await this.findProvider(provider);\n if (!registered) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n if (!registered.active) {\n throw new ForbiddenException({ code: 'FEDERATED_PROVIDER_DISABLED', message: 'Provider SSO disabilitato.' });\n }\n return registered;\n }\n\n private async findProvider(provider: string): Promise<FederatedProvider \| null> {\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n DATINS AS created_at, NOTA AS note\n FROM SSO_PROVIDER\n WHERE PROVIDER = ?`,\n [provider],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as ProviderRow \| undefined;\n return row ? this.toProvider(row) : null;\n }\n\n private getIdentityKey(identity: VerifiedFederatedIdentity): string {\n const provider = Buffer.from(identity.provider, 'utf8');\n const subject = Buffer.from(identity.subject, 'utf8');\n const payload = Buffer.concat([Buffer.from('accessi:federated:v1:'), Buffer.from(`${provider.length}:`), provider, Buffer.from(`${subject.length}:`), subject]);\n return createHash('sha256').update(payload).digest('hex');\n }\n\n private toIdentity(row: IdentityRow): FederatedIdentity {\n return {\n identityKey: String(row.identityKey),\n codiceUtente: Number(row.codiceUtente),\n provider: String(row.provider).trim(),\n subject: String(row.subject),\n active: row.active === true \|\| row.active === 1 \|\| row.active === '1',\n passwordLoginEnabled: !(row.passwordLoginEnabled === false \|\| row.passwordLoginEnabled === 0 \|\| row.passwordLoginEnabled === '0'),\n createdAt: row.createdAt,\n lastLoginAt: row.lastLoginAt,\n disabledAt: row.disabledAt,\n note: row.note,\n };\n }\n\n private toProvider(row: ProviderRow): FederatedProvider {\n return {\n provider: String(row.provider).trim(),\n description: String(row.description ?? '').trim(),\n active: row.active === true \|\| row.active === 1 \|\| row.active === '1',\n createdAt: row.createdAt,\n note: row.note,\n };\n }\n}\n"]}

package/dist/accessi-module/index.d.ts CHANGED Viewed

@@ -15,7 +15,10 @@ export declare function initializeAccessiModule(app: Application, options: Acces
 export { AccessiModule } from "./AccessiModule";
 export { AccessiDatabaseUpdater } from "./database-updates/AccessiDatabaseUpdater";
 export type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from "./AccessiModule";
-export type { PublicRegistrationOptions, FederatedAuthenticationOptions } from "./AccessiModule";
+export type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from "./AccessiModule";
+export { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';
+export type { ServiceTokenMetadata, IssuedServiceToken, VerifiedServiceToken, IssueServiceTokenInput } from './Services/ServiceTokenService/ServiceTokenService';
+export { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';
 export { FederatedAuthService } from './federated-auth/FederatedAuthService';
 export type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';
 export * from "./Dtos";

package/dist/accessi-module/index.js CHANGED Viewed

@@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
+exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.ServiceTokenService = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
 exports.initializeAccessiModule = initializeAccessiModule;
 const express_1 = __importDefault(require("express"));
 const core_1 = require("@nestjs/core");
@@ -81,7 +81,7 @@ function initializeAccessiModule(app, options) {
                 bufferLogs: true
             });
             logger.info("Applicazione Nest accessi creata.");
-            nestApp.enableCors();
+            nestApp.enableCors({ exposedHeaders: ['X-Total-Count'] });
             nestApp.useGlobalPipes((0, accessiValidation_1.createAccessiValidationPipe)());
             nestApp.useGlobalFilters(new AccessiHttpExceptionFilter_1.AccessiHttpExceptionFilter());
             nestApp.setGlobalPrefix('api', {
@@ -121,6 +121,12 @@ var AccessiModule_2 = require("./AccessiModule");
 Object.defineProperty(exports, "AccessiModule", { enumerable: true, get: function () { return AccessiModule_2.AccessiModule; } });
 var AccessiDatabaseUpdater_1 = require("./database-updates/AccessiDatabaseUpdater");
 Object.defineProperty(exports, "AccessiDatabaseUpdater", { enumerable: true, get: function () { return AccessiDatabaseUpdater_1.AccessiDatabaseUpdater; } });
+var ServiceTokenService_1 = require("./Services/ServiceTokenService/ServiceTokenService");
+Object.defineProperty(exports, "ServiceTokenService", { enumerable: true, get: function () { return ServiceTokenService_1.ServiceTokenService; } });
+var serviceTokenGuard_1 = require("./security/serviceTokenGuard");
+Object.defineProperty(exports, "ServiceTokenGuard", { enumerable: true, get: function () { return serviceTokenGuard_1.ServiceTokenGuard; } });
+Object.defineProperty(exports, "RequireServiceTokenScopes", { enumerable: true, get: function () { return serviceTokenGuard_1.RequireServiceTokenScopes; } });
+Object.defineProperty(exports, "getAccessiServiceToken", { enumerable: true, get: function () { return serviceTokenGuard_1.getAccessiServiceToken; } });
 var FederatedAuthService_1 = require("./federated-auth/FederatedAuthService");
 Object.defineProperty(exports, "FederatedAuthService", { enumerable: true, get: function () { return FederatedAuthService_1.FederatedAuthService; } });
 __exportStar(require("./Dtos"), exports);

package/dist/accessi-module/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,0DA2EC;AAjHD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAAwD;AACxD,kEAKsC;AACtC,oEAA2E;AAC3E,sFAAmF;AAEnF,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAI,KAAK,kBAAkB;gBAC3B,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBACpC,IAAI,KAAK,uBAAuB;gBAChC,IAAI,KAAK,uBAAuB,CAAC;YAErC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;aACzC,CAAC,CAAC;YAEH,IAAA,4BAAY,EAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,sBAAsB;gBACvC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,wCAAsB,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACnD,IAAA,uCAAqB,EAAC,kBAAkB,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAG/B,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport { setupSwagger } from \"../swagger/SwaggerConfig\";\nimport {\n beginAccessiAuthInitialization,\n failAccessiAuthInitialization,\n AuthenticateGenService,\n setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n const dbOptions = options.databaseOptions as {\n host?: string;\n port?: number;\n database?: string;\n user?: string;\n };\n\n return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/*\n Monta il modulo Accessi in un'applicazione Express gia esistente.\n \n Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,\n * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n \n @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n /\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<void> {\n const logger: Logger = new Logger(\"initializeAccessiModule\");\n beginAccessiAuthInitialization();\n const startedAt = performance.now();\n\n try {\n logger.info(\"Inizializzazione modulo accessi avviata.\");\n logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n logger.info(\n `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n );\n const nestHostApp = express();\n const isNestRoute = (path: string) =>\n path === \"/api/accessi\" \|\|\n path.startsWith(\"/api/accessi/\") \|\|\n path === \"/accessi/swagger\" \|\|\n path.startsWith(\"/accessi/swagger/\") \|\|\n path === \"/accessi/swagger.json\" \|\|\n path === \"/accessi/swagger-json\";\n\n app.use((req: Request, res, next) => {\n if (!isNestRoute(req.path)) {\n return next();\n }\n\n return nestHostApp(req, res, next);\n });\n\n const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n bufferLogs: true\n });\n logger.info(\"Applicazione Nest accessi creata.\");\n\n nestApp.enableCors();\n nestApp.useGlobalPipes(createAccessiValidationPipe());\n nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\n nestApp.setGlobalPrefix('api', {\n exclude: ['/swagger', '/swagger/(.)']\n });\n\n setupSwagger(nestApp, {\n swaggerPath: \"accessi/swagger\",\n swaggerJsonPath: \"accessi/swagger.json\",\n title: \"Accessi API Documentation\",\n description: \"API del modulo accessi\",\n });\n logger.info(\"Avvio init del modulo accessi.\");\n await nestApp.init();\n logger.info(\"Init del modulo accessi completata.\");\n if (options.legacyPasswordMigrationOnStartup !== false) {\n logger.info(\"Avvio migrazione password legacy accessi.\");\n const passwordMigrationService = nestApp.get(AuthService);\n await passwordMigrationService.migrateLegacyEncryptedPasswords();\n logger.info(\"Migrazione password legacy accessi completata.\");\n }\n\n const accessiAuthService = nestApp.get(AuthenticateGenService);\n app.locals.accessiAuthService = accessiAuthService;\n setAccessiAuthService(accessiAuthService);\n const elapsedMs = performance.now() - startedAt;\n logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n } catch (error) {\n failAccessiAuthInitialization(error);\n logger.error(\n \"Errore in initialize AccessiModule:\",\n error instanceof Error\n ? { name: error.name, message: error.message, stack: error.stack }\n : { error: String(error) }\n );\n throw error;\n }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions } from \"./AccessiModule\";\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\n authorizeAccessi,\n authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport type {\n AccessiAuthorizationOptions,\n AccessiRequirementNode,\n AccessiCustomRequirementContext,\n AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsCA,0DA2EC;AAjHD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAAwD;AACxD,kEAKsC;AACtC,oEAA2E;AAC3E,sFAAmF;AAEnF,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAI,KAAK,kBAAkB;gBAC3B,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBACpC,IAAI,KAAK,uBAAuB;gBAChC,IAAI,KAAK,uBAAuB,CAAC;YAErC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;aACzC,CAAC,CAAC;YAEH,IAAA,4BAAY,EAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,sBAAsB;gBACvC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,wCAAsB,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACnD,IAAA,uCAAqB,EAAC,kBAAkB,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAG/B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAO5B,kEAAoH;AAA3G,sHAAA,iBAAiB,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AAAE,2HAAA,sBAAsB,OAAA;AAC7E,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport { setupSwagger } from \"../swagger/SwaggerConfig\";\nimport {\n beginAccessiAuthInitialization,\n failAccessiAuthInitialization,\n AuthenticateGenService,\n setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n const dbOptions = options.databaseOptions as {\n host?: string;\n port?: number;\n database?: string;\n user?: string;\n };\n\n return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/*\n Monta il modulo Accessi in un'applicazione Express gia esistente.\n \n Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,\n * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n \n @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n /\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<void> {\n const logger: Logger = new Logger(\"initializeAccessiModule\");\n beginAccessiAuthInitialization();\n const startedAt = performance.now();\n\n try {\n logger.info(\"Inizializzazione modulo accessi avviata.\");\n logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n logger.info(\n `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n );\n const nestHostApp = express();\n const isNestRoute = (path: string) =>\n path === \"/api/accessi\" \|\|\n path.startsWith(\"/api/accessi/\") \|\|\n path === \"/accessi/swagger\" \|\|\n path.startsWith(\"/accessi/swagger/\") \|\|\n path === \"/accessi/swagger.json\" \|\|\n path === \"/accessi/swagger-json\";\n\n app.use((req: Request, res, next) => {\n if (!isNestRoute(req.path)) {\n return next();\n }\n\n return nestHostApp(req, res, next);\n });\n\n const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n bufferLogs: true\n });\n logger.info(\"Applicazione Nest accessi creata.\");\n\n nestApp.enableCors({ exposedHeaders: ['X-Total-Count'] });\n nestApp.useGlobalPipes(createAccessiValidationPipe());\n nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\n nestApp.setGlobalPrefix('api', {\n exclude: ['/swagger', '/swagger/(.)']\n });\n\n setupSwagger(nestApp, {\n swaggerPath: \"accessi/swagger\",\n swaggerJsonPath: \"accessi/swagger.json\",\n title: \"Accessi API Documentation\",\n description: \"API del modulo accessi\",\n });\n logger.info(\"Avvio init del modulo accessi.\");\n await nestApp.init();\n logger.info(\"Init del modulo accessi completata.\");\n if (options.legacyPasswordMigrationOnStartup !== false) {\n logger.info(\"Avvio migrazione password legacy accessi.\");\n const passwordMigrationService = nestApp.get(AuthService);\n await passwordMigrationService.migrateLegacyEncryptedPasswords();\n logger.info(\"Migrazione password legacy accessi completata.\");\n }\n\n const accessiAuthService = nestApp.get(AuthenticateGenService);\n app.locals.accessiAuthService = accessiAuthService;\n setAccessiAuthService(accessiAuthService);\n const elapsedMs = performance.now() - startedAt;\n logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n } catch (error) {\n failAccessiAuthInitialization(error);\n logger.error(\n \"Errore in initialize AccessiModule:\",\n error instanceof Error\n ? { name: error.name, message: error.message, stack: error.stack }\n : { error: String(error) }\n );\n throw error;\n }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from \"./AccessiModule\";\nexport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nexport type {\n ServiceTokenMetadata,\n IssuedServiceToken,\n VerifiedServiceToken,\n IssueServiceTokenInput\n} from './Services/ServiceTokenService/ServiceTokenService';\nexport { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\n authorizeAccessi,\n authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport type {\n AccessiAuthorizationOptions,\n AccessiRequirementNode,\n AccessiCustomRequirementContext,\n AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n"]}

package/dist/accessi-module/jwt/jwt.strategy.js CHANGED Viewed

@@ -59,6 +59,7 @@ const common_1 = require("@nestjs/common");
 const jwt = __importStar(require("jsonwebtoken"));
 const UserService_1 = require("../Services/UserService/UserService");
 const authenticatedToken_1 = require("../security/authenticatedToken");
+const passwordResetToken_1 = require("../security/passwordResetToken");
 let JwtSimpleGuard = class JwtSimpleGuard {
     constructor(accessiOptions, userService) {
         this.accessiOptions = accessiOptions;
@@ -66,7 +67,6 @@ let JwtSimpleGuard = class JwtSimpleGuard {
     }
     canActivate(context) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
             const request = context.switchToHttp().getRequest();
             const authHeader = request.headers['authorization'];
             if (!authHeader)
@@ -75,15 +75,18 @@ let JwtSimpleGuard = class JwtSimpleGuard {
             if (!token)
                 throw new common_1.UnauthorizedException('Formato token non valido.');
             try {
-                const secret = ((_b = (_a = this.accessiOptions) === null || _a === void 0 ? void 0 : _a.jwtOptions) === null || _b === void 0 ? void 0 : _b.secret) || process.env.ACC_JWT_SECRET;
-                if (!secret) {
+                let secret;
+                try {
+                    secret = (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions, 'access');
+                }
+                catch (_a) {
                     throw new common_1.InternalServerErrorException('JWT secret non configurato.');
                 }
                 let payload;
                 try {
-                    payload = jwt.verify(token, secret);
+                    payload = jwt.verify(token, secret, { algorithms: ['HS256'] });
                 }
-                catch (_c) {
+                catch (_b) {
                     throw new common_1.UnauthorizedException('Token non valido o scaduto.');
                 }
                 const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(payload);

package/dist/accessi-module/jwt/jwt.strategy.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kDAAoC;AAEpC,qEAAkE;AAClE,uEAMwC;~~AAGjC~~,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB~~;;;~~YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,~~MAAM~~,MAAM,GAAG,~~CAAA~~,~~MAAA~~,~~MAAA~~,IAAI,CAAC,cAAc,~~0CAAE~~,~~UAAU~~,~~0CAAE,MAAM,KAAI,OAAO,~~CAAC,~~GAAG,~~CAAC,~~cAAc,~~CAAC;~~gBACrF~~,~~IAAI~~,CAAC~~,MAAM,EAAE,CAAC~~;~~oBACZ~~,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,OAAgC,CAAC;gBACrC,IAAI,CAAC;~~oBACH~~,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;~~gBACtC~~,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,yCAAyC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;~~AA7CY~~,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,~~CA6C1B~~","sourcesContent":["import {\n CanActivate,\n ExecutionContext,\n Inject,\n Injectable,\n InternalServerErrorException,\n UnauthorizedException,\n} from '@nestjs/common';\nimport * as jwt from 'jsonwebtoken';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { UserService } from '../Services/UserService/UserService';\nimport {\n buildAuthenticatedTokenPayload,\n extractAccessiBearerToken,\n isAuthenticatedUserEnabledForJwt,\n isAccessiTokenAllowedForUser,\n resolveCodiceUtenteFromTokenPayload,\n} from '../security/authenticatedToken';\n\n@Injectable()\nexport class JwtSimpleGuard implements CanActivate {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n private readonly userService: UserService,\n ) {}\n\n async canActivate(context: ExecutionContext): Promise<boolean> {\n const request = context.switchToHttp().getRequest();\n\n const authHeader = request.headers['authorization'];\n if (!authHeader) throw new UnauthorizedException('Token mancante.');\n\n const token = extractAccessiBearerToken(authHeader);\n if (!token) throw new UnauthorizedException('Formato token non valido.');\n\n try {\n ~~const~~ secret = this.accessiOptions~~?.jwtOptions?.secret~~ ~~\|\| process.env.ACC_JWT_SECRET~~;\n if ~~(!secret)~~ {\n throw new InternalServerErrorException('JWT secret non configurato.');\n }\n let payload: jwt.JwtPayload \| string;\n try {\n payload = jwt.verify(token, secret);\n } catch {\n throw new UnauthorizedException('Token non valido o scaduto.');\n }\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\n if (!codiceUtente) {\n throw new UnauthorizedException('Token privo di un utente valido.');\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(currentUser) \|\| !isAccessiTokenAllowedForUser(payload, currentUser)) {\n throw new UnauthorizedException('Utente non piu autorizzato.');\n }\n\n request.user = buildAuthenticatedTokenPayload(payload, currentUser);\n return true;\n } catch (error) {\n if (error instanceof InternalServerErrorException \|\| error instanceof UnauthorizedException) {\n throw error;\n }\n throw new InternalServerErrorException('Errore durante la verifica dell utente.');\n }\n }\n}\n"]}
1	+ {"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kDAAoC;AAEpC,qEAAkE;AAClE,uEAMwC;AACxC,uEAAqE;AAG9D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,IAAI,MAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;gBAC9D,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,OAAgC,CAAC;gBACrC,IAAI,CAAC;oBACC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACrE,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,yCAAyC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA/CY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CA+C1B","sourcesContent":["import {\n CanActivate,\n ExecutionContext,\n Inject,\n Injectable,\n InternalServerErrorException,\n UnauthorizedException,\n} from '@nestjs/common';\nimport * as jwt from 'jsonwebtoken';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { UserService } from '../Services/UserService/UserService';\nimport {\n buildAuthenticatedTokenPayload,\n extractAccessiBearerToken,\n isAuthenticatedUserEnabledForJwt,\n isAccessiTokenAllowedForUser,\n resolveCodiceUtenteFromTokenPayload,\n} from '../security/authenticatedToken';\nimport { getAccessiJwtSecret } from '../security/passwordResetToken';\n\n@Injectable()\nexport class JwtSimpleGuard implements CanActivate {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n private readonly userService: UserService,\n ) {}\n\n async canActivate(context: ExecutionContext): Promise<boolean> {\n const request = context.switchToHttp().getRequest();\n\n const authHeader = request.headers['authorization'];\n if (!authHeader) throw new UnauthorizedException('Token mancante.');\n\n const token = extractAccessiBearerToken(authHeader);\n if (!token) throw new UnauthorizedException('Formato token non valido.');\n\n try {\n let secret: string;\n try {\n secret = getAccessiJwtSecret(this.accessiOptions, 'access');\n } catch {\n throw new InternalServerErrorException('JWT secret non configurato.');\n }\n let payload: jwt.JwtPayload \| string;\n try {\n payload = jwt.verify(token, secret, { algorithms: ['HS256'] });\n } catch {\n throw new UnauthorizedException('Token non valido o scaduto.');\n }\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\n if (!codiceUtente) {\n throw new UnauthorizedException('Token privo di un utente valido.');\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(currentUser) \|\| !isAccessiTokenAllowedForUser(payload, currentUser)) {\n throw new UnauthorizedException('Utente non piu autorizzato.');\n }\n\n request.user = buildAuthenticatedTokenPayload(payload, currentUser);\n return true;\n } catch (error) {\n if (error instanceof InternalServerErrorException \|\| error instanceof UnauthorizedException) {\n throw error;\n }\n throw new InternalServerErrorException('Errore durante la verifica dell utente.');\n }\n }\n}\n"]}

package/dist/accessi-module/middleware/accessiRequirements.d.ts CHANGED Viewed

@@ -41,7 +41,7 @@ export type AccessiRequirementNode = AccessiPermissionRequirement | AccessiAllRe
 /** Contesto in sola lettura consegnato a un requisito personalizzato. */
 export type AccessiCustomRequirementContext = {
     req: Request;
-    decodedToken: any;
+    decodedToken: Record<string, unknown>;
     userCode: number;
     getGrantsResult: () => Promise<GrantsResult>;
 };

package/dist/accessi-module/middleware/accessiRequirements.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"accessiRequirements.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/accessiRequirements.ts"],"names":[],"mappings":";;;;;;;;;;;;AAyHA,oDAgBC;AAMD,kDAwDC;AAxHD,gFAAgF;AAChF,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,yGAAyG;AAC5F,QAAA,kBAAkB,GAAG;IAChC,UAAU,EAAE,CACV,QAAgB,EAChB,kBAA0B,EACI,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,kBAAkB;KACnB,CAAC;IACF,GAAG,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,KAAK;QACX,YAAY;KACb,CAAC;IACF,EAAE,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,IAAI;QACV,YAAY;KACb,CAAC;IACF,GAAG,EAAE,CAAC,WAAmC,EAAyB,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,KAAK;QACX,WAAW;KACZ,CAAC;IACF,MAAM,EAAE,CAAC,GAAW,EAAE,OAAiB,EAA4B,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,OAAO;KACR,CAAC;CACH,CAAC;AAEF,0EAA0E;AAC1E,SAAgB,oBAAoB,CAClC,OAAqC;;IAErC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC;IAE7D,MAAM,YAAY,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE,CAAC;IACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,KAAK,GAA6B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACvE,0BAAkB,CAAC,UAAU,CAC3B,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,kBAAkB,CAC/B,CACF,CAAC;IAEF,OAAO,0BAAkB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAsB,mBAAmB,CACvC,WAAmC,EACnC,OAAwC,EACxC,OAAqC;;;QAErC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAA,YAAY,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE;;oBACR,OAAA,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ;wBACxC,MAAM,CAAC,MAAA,KAAK,CAAC,gBAAgB,mCAAI,CAAC,CAAC,IAAI,WAAW,CAAC,kBAAkB,CAAA;iBAAA,CACxE,CAAC;YACJ,CAAC;YACD,KAAK,KAAK;gBACR,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,6DAA6D,CAC9D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAC1E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,KAAK,IAAI;gBACP,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,4DAA4D,CAC7D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtE,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,KAAK,KAAK;gBACR,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,yBAAyB,mCAAI,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,WAAW,CAAC,GAAG,aAAa,CAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD;gBACE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,CAChC,CAAC;QACN,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { Request } from \"express\";\n\n/** Grant effettivo letto da Accessi. Il confronto usa `tipoAbilitazione >= minPermissionLevel`. /\nexport type AccessiGrant = {\n codiceMenu: string;\n tipoAbilitazione?: number;\n};\n\n/* Risultato memoizzato durante una singola autorizzazione. Non modificarlo nel custom handler. /\nexport type GrantsResult = {\n grants?: AccessiGrant[];\n [key: string]: unknown;\n};\n\n/* Richiede l'accesso a un menu con almeno il livello indicato. Valori convenzionali: 10 lettura, 20 scrittura. /\nexport type AccessiPermissionRequirement = {\n type: \"permission\";\n menuCode: string;\n minPermissionLevel: number;\n};\n\n/* Tutti i requisiti figli devono essere soddisfatti. Una lista vuota e una configurazione non valida. /\nexport type AccessiAllRequirement = {\n type: \"and\";\n requirements: AccessiRequirementNode[];\n};\n\n/* Almeno un requisito figlio deve essere soddisfatto. Una lista vuota e una configurazione non valida. /\nexport type AccessiAnyRequirement = {\n type: \"or\";\n requirements: AccessiRequirementNode[];\n};\n\n/* Nega il risultato del requisito figlio. Usarlo con cautela per non creare policy difficili da verificare. /\nexport type AccessiNotRequirement = {\n type: \"not\";\n requirement: AccessiRequirementNode;\n};\n\n/* Delega una condizione applicativa a un handler registrato dal backend. /\nexport type AccessiCustomRequirement = {\n type: \"custom\";\n key: string;\n payload?: unknown;\n};\n\n/* Nodo composabile dell'albero di autorizzazione valutato da `authorizeAccessi`. /\nexport type AccessiRequirementNode =\n \| AccessiPermissionRequirement\n \| AccessiAllRequirement\n \| AccessiAnyRequirement\n \| AccessiNotRequirement\n \| AccessiCustomRequirement;\n\n/* Contesto in sola lettura consegnato a un requisito personalizzato. /\nexport type AccessiCustomRequirementContext = {\n req: Request;\n decodedToken: any;\n userCode: number;\n getGrantsResult: () => Promise<GrantsResult>;\n};\n\n/* Handler applicativo per `accessiRequirement.custom`; `false` nega la richiesta, un errore produce 500. /\nexport type AccessiCustomRequirementHandler = (\n context: AccessiCustomRequirementContext,\n payload?: unknown\n) => boolean \| Promise<boolean>;\n\n/\n Policy passata a `authorizeAccessi`.\n * `requirements` e la forma compatibile storica ed equivale a un AND; `requirementTree`\n * permette policy annidate e ha precedenza quando entrambi sono presenti.\n /\nexport type AccessiAuthorizationOptions = {\n requirements?: { menuCode: string; minPermissionLevel: number }[];\n requirementTree?: AccessiRequirementNode;\n customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;\n};\n\n/* Errore di configurazione di una policy, distinto dal normale diniego 403. /\nexport class RequirementEvaluationError extends Error {\n constructor(public readonly code: string, message: string) {\n super(message);\n this.name = \"RequirementEvaluationError\";\n }\n}\n\nfunction requirementError(code: string, message: string): RequirementEvaluationError {\n return new RequirementEvaluationError(code, message);\n}\n\n/* Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. /\nexport const accessiRequirement = {\n permission: (\n menuCode: string,\n minPermissionLevel: number\n ): AccessiPermissionRequirement => ({\n type: \"permission\",\n menuCode,\n minPermissionLevel,\n }),\n and: (...requirements: AccessiRequirementNode[]): AccessiAllRequirement => ({\n type: \"and\",\n requirements,\n }),\n or: (...requirements: AccessiRequirementNode[]): AccessiAnyRequirement => ({\n type: \"or\",\n requirements,\n }),\n not: (requirement: AccessiRequirementNode): AccessiNotRequirement => ({\n type: \"not\",\n requirement,\n }),\n custom: (key: string, payload?: unknown): AccessiCustomRequirement => ({\n type: \"custom\",\n key,\n payload,\n }),\n};\n\n/* Normalizza la forma compatibile `requirements` nell'albero interno. /\nexport function buildRequirementTree(\n options?: AccessiAuthorizationOptions\n): AccessiRequirementNode \| undefined {\n if (options?.requirementTree) return options.requirementTree;\n\n const requirements = options?.requirements ?? [];\n if (requirements.length === 0) return undefined;\n\n const nodes: AccessiRequirementNode[] = requirements.map((requirement) =>\n accessiRequirement.permission(\n requirement.menuCode,\n requirement.minPermissionLevel\n )\n );\n\n return accessiRequirement.and(...nodes);\n}\n\n/\n Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.\n * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.\n */\nexport async function evaluateRequirement(\n requirement: AccessiRequirementNode,\n context: AccessiCustomRequirementContext,\n options?: AccessiAuthorizationOptions\n): Promise<boolean> {\n switch (requirement.type) {\n case \"permission\": {\n const grantsResult = await context.getGrantsResult();\n const grants = grantsResult.grants ?? [];\n return grants.some(\n (grant) =>\n grant.codiceMenu == requirement.menuCode &&\n Number(grant.tipoAbilitazione ?? 0) >= requirement.minPermissionLevel\n );\n }\n case \"and\":\n if (!requirement.requirements \|\| requirement.requirements.length === 0) {\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n \"AND requirement must contain at least one child requirement\"\n );\n }\n for (const child of requirement.requirements) {\n if (!(await evaluateRequirement(child, context, options))) return false;\n }\n return true;\n case \"or\":\n if (!requirement.requirements \|\| requirement.requirements.length === 0) {\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n \"OR requirement must contain at least one child requirement\"\n );\n }\n for (const child of requirement.requirements) {\n if (await evaluateRequirement(child, context, options)) return true;\n }\n return false;\n case \"not\":\n return !(await evaluateRequirement(requirement.requirement, context, options));\n case \"custom\": {\n const handlers = options?.customRequirementHandlers ?? {};\n const handler = handlers[requirement.key];\n if (!handler) {\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n `Custom requirement handler \"${requirement.key}\" not found`\n );\n }\n return Boolean(await handler(context, requirement.payload));\n }\n default:\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n \"Unknown requirement node type\"\n );\n }\n}\n"]}
1	+ {"version":3,"file":"accessiRequirements.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/accessiRequirements.ts"],"names":[],"mappings":";;;;;;;;;;;;AAyHA,oDAgBC;AAMD,kDAwDC;AAxHD,gFAAgF;AAChF,MAAa,0BAA2B,SAAQ,KAAK;IACnD,YAA4B,IAAY,EAAE,OAAe;QACvD,KAAK,CAAC,OAAO,CAAC,CAAC;QADW,SAAI,GAAJ,IAAI,CAAQ;QAEtC,IAAI,CAAC,IAAI,GAAG,4BAA4B,CAAC;IAC3C,CAAC;CACF;AALD,gEAKC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,OAAe;IACrD,OAAO,IAAI,0BAA0B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AACvD,CAAC;AAED,yGAAyG;AAC5F,QAAA,kBAAkB,GAAG;IAChC,UAAU,EAAE,CACV,QAAgB,EAChB,kBAA0B,EACI,EAAE,CAAC,CAAC;QAClC,IAAI,EAAE,YAAY;QAClB,QAAQ;QACR,kBAAkB;KACnB,CAAC;IACF,GAAG,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QAC1E,IAAI,EAAE,KAAK;QACX,YAAY;KACb,CAAC;IACF,EAAE,EAAE,CAAC,GAAG,YAAsC,EAAyB,EAAE,CAAC,CAAC;QACzE,IAAI,EAAE,IAAI;QACV,YAAY;KACb,CAAC;IACF,GAAG,EAAE,CAAC,WAAmC,EAAyB,EAAE,CAAC,CAAC;QACpE,IAAI,EAAE,KAAK;QACX,WAAW;KACZ,CAAC;IACF,MAAM,EAAE,CAAC,GAAW,EAAE,OAAiB,EAA4B,EAAE,CAAC,CAAC;QACrE,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,OAAO;KACR,CAAC;CACH,CAAC;AAEF,0EAA0E;AAC1E,SAAgB,oBAAoB,CAClC,OAAqC;;IAErC,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,eAAe;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC;IAE7D,MAAM,YAAY,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAAY,mCAAI,EAAE,CAAC;IACjD,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,KAAK,GAA6B,YAAY,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CACvE,0BAAkB,CAAC,UAAU,CAC3B,WAAW,CAAC,QAAQ,EACpB,WAAW,CAAC,kBAAkB,CAC/B,CACF,CAAC;IAEF,OAAO,0BAAkB,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,SAAsB,mBAAmB,CACvC,WAAmC,EACnC,OAAwC,EACxC,OAAqC;;;QAErC,QAAQ,WAAW,CAAC,IAAI,EAAE,CAAC;YACzB,KAAK,YAAY,CAAC,CAAC,CAAC;gBAClB,MAAM,YAAY,GAAG,MAAM,OAAO,CAAC,eAAe,EAAE,CAAC;gBACrD,MAAM,MAAM,GAAG,MAAA,YAAY,CAAC,MAAM,mCAAI,EAAE,CAAC;gBACzC,OAAO,MAAM,CAAC,IAAI,CAChB,CAAC,KAAK,EAAE,EAAE;;oBACR,OAAA,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ;wBACxC,MAAM,CAAC,MAAA,KAAK,CAAC,gBAAgB,mCAAI,CAAC,CAAC,IAAI,WAAW,CAAC,kBAAkB,CAAA;iBAAA,CACxE,CAAC;YACJ,CAAC;YACD,KAAK,KAAK;gBACR,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,6DAA6D,CAC9D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,CAAC,CAAC,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;wBAAE,OAAO,KAAK,CAAC;gBAC1E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,KAAK,IAAI;gBACP,IAAI,CAAC,WAAW,CAAC,YAAY,IAAI,WAAW,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACvE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,4DAA4D,CAC7D,CAAC;gBACJ,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,YAAY,EAAE,CAAC;oBAC7C,IAAI,MAAM,mBAAmB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC;wBAAE,OAAO,IAAI,CAAC;gBACtE,CAAC;gBACD,OAAO,KAAK,CAAC;YACf,KAAK,KAAK;gBACR,OAAO,CAAC,CAAC,MAAM,mBAAmB,CAAC,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACjF,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,yBAAyB,mCAAI,EAAE,CAAC;gBAC1D,MAAM,OAAO,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,WAAW,CAAC,GAAG,aAAa,CAC5D,CAAC;gBACJ,CAAC;gBACD,OAAO,OAAO,CAAC,MAAM,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;YAC9D,CAAC;YACD;gBACE,MAAM,gBAAgB,CACpB,iCAAiC,EACjC,+BAA+B,CAChC,CAAC;QACN,CAAC;IACH,CAAC;CAAA","sourcesContent":["import { Request } from \"express\";\n\n/** Grant effettivo letto da Accessi. Il confronto usa `tipoAbilitazione >= minPermissionLevel`. /\nexport type AccessiGrant = {\n codiceMenu: string;\n tipoAbilitazione?: number;\n};\n\n/* Risultato memoizzato durante una singola autorizzazione. Non modificarlo nel custom handler. /\nexport type GrantsResult = {\n grants?: AccessiGrant[];\n [key: string]: unknown;\n};\n\n/* Richiede l'accesso a un menu con almeno il livello indicato. Valori convenzionali: 10 lettura, 20 scrittura. /\nexport type AccessiPermissionRequirement = {\n type: \"permission\";\n menuCode: string;\n minPermissionLevel: number;\n};\n\n/* Tutti i requisiti figli devono essere soddisfatti. Una lista vuota e una configurazione non valida. /\nexport type AccessiAllRequirement = {\n type: \"and\";\n requirements: AccessiRequirementNode[];\n};\n\n/* Almeno un requisito figlio deve essere soddisfatto. Una lista vuota e una configurazione non valida. /\nexport type AccessiAnyRequirement = {\n type: \"or\";\n requirements: AccessiRequirementNode[];\n};\n\n/* Nega il risultato del requisito figlio. Usarlo con cautela per non creare policy difficili da verificare. /\nexport type AccessiNotRequirement = {\n type: \"not\";\n requirement: AccessiRequirementNode;\n};\n\n/* Delega una condizione applicativa a un handler registrato dal backend. /\nexport type AccessiCustomRequirement = {\n type: \"custom\";\n key: string;\n payload?: unknown;\n};\n\n/* Nodo composabile dell'albero di autorizzazione valutato da `authorizeAccessi`. /\nexport type AccessiRequirementNode =\n \| AccessiPermissionRequirement\n \| AccessiAllRequirement\n \| AccessiAnyRequirement\n \| AccessiNotRequirement\n \| AccessiCustomRequirement;\n\n/* Contesto in sola lettura consegnato a un requisito personalizzato. /\nexport type AccessiCustomRequirementContext = {\n req: Request;\n decodedToken: Record<string, unknown>;\n userCode: number;\n getGrantsResult: () => Promise<GrantsResult>;\n};\n\n/* Handler applicativo per `accessiRequirement.custom`; `false` nega la richiesta, un errore produce 500. /\nexport type AccessiCustomRequirementHandler = (\n context: AccessiCustomRequirementContext,\n payload?: unknown\n) => boolean \| Promise<boolean>;\n\n/\n Policy passata a `authorizeAccessi`.\n * `requirements` e la forma compatibile storica ed equivale a un AND; `requirementTree`\n * permette policy annidate e ha precedenza quando entrambi sono presenti.\n /\nexport type AccessiAuthorizationOptions = {\n requirements?: { menuCode: string; minPermissionLevel: number }[];\n requirementTree?: AccessiRequirementNode;\n customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;\n};\n\n/* Errore di configurazione di una policy, distinto dal normale diniego 403. /\nexport class RequirementEvaluationError extends Error {\n constructor(public readonly code: string, message: string) {\n super(message);\n this.name = \"RequirementEvaluationError\";\n }\n}\n\nfunction requirementError(code: string, message: string): RequirementEvaluationError {\n return new RequirementEvaluationError(code, message);\n}\n\n/* Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. /\nexport const accessiRequirement = {\n permission: (\n menuCode: string,\n minPermissionLevel: number\n ): AccessiPermissionRequirement => ({\n type: \"permission\",\n menuCode,\n minPermissionLevel,\n }),\n and: (...requirements: AccessiRequirementNode[]): AccessiAllRequirement => ({\n type: \"and\",\n requirements,\n }),\n or: (...requirements: AccessiRequirementNode[]): AccessiAnyRequirement => ({\n type: \"or\",\n requirements,\n }),\n not: (requirement: AccessiRequirementNode): AccessiNotRequirement => ({\n type: \"not\",\n requirement,\n }),\n custom: (key: string, payload?: unknown): AccessiCustomRequirement => ({\n type: \"custom\",\n key,\n payload,\n }),\n};\n\n/* Normalizza la forma compatibile `requirements` nell'albero interno. /\nexport function buildRequirementTree(\n options?: AccessiAuthorizationOptions\n): AccessiRequirementNode \| undefined {\n if (options?.requirementTree) return options.requirementTree;\n\n const requirements = options?.requirements ?? [];\n if (requirements.length === 0) return undefined;\n\n const nodes: AccessiRequirementNode[] = requirements.map((requirement) =>\n accessiRequirement.permission(\n requirement.menuCode,\n requirement.minPermissionLevel\n )\n );\n\n return accessiRequirement.and(...nodes);\n}\n\n/\n Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.\n * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.\n */\nexport async function evaluateRequirement(\n requirement: AccessiRequirementNode,\n context: AccessiCustomRequirementContext,\n options?: AccessiAuthorizationOptions\n): Promise<boolean> {\n switch (requirement.type) {\n case \"permission\": {\n const grantsResult = await context.getGrantsResult();\n const grants = grantsResult.grants ?? [];\n return grants.some(\n (grant) =>\n grant.codiceMenu == requirement.menuCode &&\n Number(grant.tipoAbilitazione ?? 0) >= requirement.minPermissionLevel\n );\n }\n case \"and\":\n if (!requirement.requirements \|\| requirement.requirements.length === 0) {\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n \"AND requirement must contain at least one child requirement\"\n );\n }\n for (const child of requirement.requirements) {\n if (!(await evaluateRequirement(child, context, options))) return false;\n }\n return true;\n case \"or\":\n if (!requirement.requirements \|\| requirement.requirements.length === 0) {\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n \"OR requirement must contain at least one child requirement\"\n );\n }\n for (const child of requirement.requirements) {\n if (await evaluateRequirement(child, context, options)) return true;\n }\n return false;\n case \"not\":\n return !(await evaluateRequirement(requirement.requirement, context, options));\n case \"custom\": {\n const handlers = options?.customRequirementHandlers ?? {};\n const handler = handlers[requirement.key];\n if (!handler) {\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n `Custom requirement handler \"${requirement.key}\" not found`\n );\n }\n return Boolean(await handler(context, requirement.payload));\n }\n default:\n throw requirementError(\n \"AUTH_REQUIREMENTS_MISCONFIGURED\",\n \"Unknown requirement node type\"\n );\n }\n}\n"]}