npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.3 → 2.0.0-dev.30 - Mend

emilsoftware-utilities 2.0.0-dev.3 → 2.0.0-dev.30

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (546) hide show

package/dist/accessi-module/middleware/authenticateGen.js CHANGED Viewed

@@ -66,6 +66,7 @@ const UserService_1 = require("../Services/UserService/UserService");
 const Logger_1 = require("../../Logger");
 const accessiRequirements_1 = require("./accessiRequirements");
 const authenticatedToken_1 = require("../security/authenticatedToken");
+const passwordResetToken_1 = require("../security/passwordResetToken");
 const logger = new Logger_1.Logger("AuthenticateGen");
 const ACCESSI_AUTH_SERVICE_LOCALS_KEY = "accessiAuthService";
 const ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for("emilsoftware.accessiAuthService");
@@ -112,27 +113,47 @@ function logAuthFailure(req, authErr) {
     else
         logger.warning(message);
 }
+/** Sends the documented Accessi error contract from Express middleware. */
+function sendAuthenticationError(res, authErr) {
+    const message = authErr.status === 403
+        ? 'Operazione non autorizzata.'
+        : authErr.status >= 500
+            ? 'Errore interno del modulo Accessi.'
+            : 'Autenticazione non valida o scaduta.';
+    return res.status(authErr.status).json({
+        severity: 'error',
+        status: authErr.status,
+        statusCode: 2,
+        code: authErr.code,
+        // Kept for callers of older versions which already inspected `error`.
+        error: authErr.code,
+        message,
+    });
+}
 function authorizeWithDependencies(req, res, next, options, accessiOptions, permissionService, userService) {
     return __awaiter(this, void 0, void 0, function* () {
-        var _a, _b;
+        const authenticatedRequest = req;
         try {
             const authHeader = req.headers.authorization;
             if (!authHeader) {
                 throw authError(401, "AUTH_HEADER_MISSING", "Authorization header not found");
             }
-            const token = authHeader.split(" ")[1];
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(authHeader);
             if (!token) {
                 throw authError(401, "AUTH_TOKEN_MISSING", "Token not found in Authorization header");
             }
-            const secret = (_b = (_a = accessiOptions === null || accessiOptions === void 0 ? void 0 : accessiOptions.jwtOptions) === null || _a === void 0 ? void 0 : _a.secret) !== null && _b !== void 0 ? _b : process.env.ACC_JWT_SECRET;
-            if (!secret) {
+            let secret;
+            try {
+                secret = (0, passwordResetToken_1.getAccessiJwtSecret)(accessiOptions, 'access');
+            }
+            catch (_a) {
                 throw authError(500, "AUTH_JWT_SECRET_MISSING", "JWT secret not configured");
             }
             let decoded;
             try {
-                decoded = jwt.verify(token, secret);
+                decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
             }
-            catch (_c) {
+            catch (_b) {
                 throw authError(401, "AUTH_TOKEN_INVALID", "Invalid JWT token");
             }
             const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(decoded);
@@ -140,7 +161,7 @@ function authorizeWithDependencies(req, res, next, options, accessiOptions, perm
                 throw authError(401, "AUTH_USER_CODE_MISSING", "codiceUtente not found in token payload");
             }
             const currentUser = yield userService.getAuthenticatedUserSnapshot(codiceUtente);
-            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(decoded, currentUser)) {
                 throw authError(401, "AUTH_USER_DISABLED", "User is no longer authorized");
             }
             const authenticatedPayload = (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(decoded, currentUser);
@@ -166,23 +187,16 @@ function authorizeWithDependencies(req, res, next, options, accessiOptions, perm
                 if (!hasPermissions) {
                     throw authError(403, "AUTH_INSUFFICIENT_PERMISSIONS", "User does not have required permissions");
                 }
-                req.userGrants = yield getGrantsResult();
+                authenticatedRequest.userGrants = yield getGrantsResult();
             }
-            req.user = authenticatedPayload;
-            req.data = authenticatedPayload;
+            authenticatedRequest.user = authenticatedPayload;
+            authenticatedRequest.data = authenticatedPayload;
             return next();
         }
         catch (error) {
             const authErr = normalizeAuthError(error);
             logAuthFailure(req, authErr);
-            const publicMessage = authErr.status === 403
-                ? "Forbidden"
-                : authErr.status >= 500
-                    ? "Internal server error"
-                    : "Unauthorized";
-            return res
-                .status(authErr.status)
-                .json({ message: publicMessage, error: authErr.message, code: authErr.code });
+            return sendAuthenticationError(res, authErr);
         }
     });
 }
@@ -192,6 +206,10 @@ let AuthenticateGenService = class AuthenticateGenService {
         this.permissionService = permissionService;
         this.userService = userService;
     }
+    /**
+     * Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.
+     * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.
+     */
     authorize(req, res, next, options) {
         return __awaiter(this, void 0, void 0, function* () {
             return authorizeWithDependencies(req, res, next, options, this.accessiOptions, this.permissionService, this.userService);
@@ -200,7 +218,9 @@ let AuthenticateGenService = class AuthenticateGenService {
 };
 exports.AuthenticateGenService = AuthenticateGenService;
 exports.AuthenticateGenService = AuthenticateGenService = __decorate([
-    (0, common_1.Injectable)(),
+    (0, common_1.Injectable)()
+    /** Nest service behind the Express-compatible `authorizeAccessi` middleware. */
+    ,
     __param(0, (0, common_1.Inject)("ACCESSI_OPTIONS")),
     __metadata("design:paramtypes", [Object, PermissionService_1.PermissionService,
         UserService_1.UserService])
@@ -220,11 +240,13 @@ function isAuthenticateGenService(value) {
     return Boolean(value &&
         typeof value.authorize === "function");
 }
+/** Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. */
 function beginAccessiAuthInitialization() {
     if (!authServiceBootstrapDeferred) {
         authServiceBootstrapDeferred = createDeferred();
     }
 }
+/** Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. */
 function setAccessiAuthService(service) {
     authenticateGenServiceRef = service;
     globalThis[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;
@@ -233,6 +255,7 @@ function setAccessiAuthService(service) {
         authServiceBootstrapDeferred = null;
     }
 }
+/** Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. */
 function failAccessiAuthInitialization(error) {
     if (authServiceBootstrapDeferred) {
         authServiceBootstrapDeferred.reject(error);
@@ -282,26 +305,41 @@ function resolveAccessiAuthService(req) {
         return getAccessiAuthServiceFromRequest(req);
     });
 }
+/**
+ * Middleware Express pubblico di Accessi.
+ *
+ * Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente
+ * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente
+ * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.
+ */
 function authorizeAccessi(req, res, next, options) {
     return __awaiter(this, void 0, void 0, function* () {
         var _a;
         const authService = yield resolveAccessiAuthService(req);
         if (!authService) {
             const status = authServiceBootstrapDeferred ? 503 : 500;
-            const message = authServiceBootstrapDeferred
-                ? "Accessi authentication service is still initializing"
-                : "Accessi authentication service not initialized";
+            const code = authServiceBootstrapDeferred
+                ? 'ACCESSI_AUTH_INITIALIZING'
+                : 'ACCESSI_AUTH_NOT_INITIALIZED';
             logger.error(`Authentication service not initialized ${JSON.stringify({
                 method: req.method,
                 path: (_a = req.originalUrl) !== null && _a !== void 0 ? _a : req.url,
                 status,
             })}`);
-            return res
-                .status(status)
-                .json({ message });
+            return res.status(status).json({
+                severity: 'error',
+                status,
+                statusCode: 2,
+                code,
+                error: code,
+                message: status === 503
+                    ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'
+                    : 'Il modulo Accessi non e disponibile.',
+            });
         }
         return authService.authorize(req, res, next, options);
     });
 }
+/** Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */
 exports.authenticateGen = authorizeAccessi;
 //# sourceMappingURL=authenticateGen.js.map

package/dist/accessi-module/middleware/authenticateGen.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuPA,wEAIC;AAED,sDAOC;AAED,sEAKC;AAqDD,4CA0BC;AAzVD,kDAAoC;AACpC,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAIwC;AAExC,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;;QAExB,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAAG,MAAA,MAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,UAAU,0CAAE,MAAM,mCAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;YAChF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,OAAY,CAAC;YACjB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACtC,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAEA,GAAW,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YACpD,CAAC;YAEA,GAAW,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACxC,GAAW,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACzC,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,MAAM,aAAa,GACjB,OAAO,CAAC,MAAM,KAAK,GAAG;gBACpB,CAAC,CAAC,WAAW;gBACb,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;oBACrB,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,cAAc,CAAC;YACvB,OAAO,GAAG;iBACP,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;iBACtB,IAAI,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;IACH,CAAC;CAAA;AAGM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEC,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AAxBY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CAwBlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,OAAO,GAAG,4BAA4B;gBAC1C,CAAC,CAAC,sDAAsD;gBACxD,CAAC,CAAC,gDAAgD,CAAC;YACrD,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG;iBACP,MAAM,CAAC,MAAM,CAAC;iBACd,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;QACvB,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAEY,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\r\nimport * as jwt from \"jsonwebtoken\";\r\nimport { Inject, Injectable } from \"@nestjs/common\";\r\nimport { AccessiOptions } from \"../AccessiModule\";\r\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\r\nimport { UserService } from \"../Services/UserService/UserService\";\r\nimport { Logger } from \"../../Logger\";\r\nimport {\r\n AccessiAuthorizationOptions,\r\n AccessiCustomRequirementContext,\r\n GrantsResult,\r\n RequirementEvaluationError,\r\n buildRequirementTree,\r\n evaluateRequirement,\r\n} from \"./accessiRequirements\";\r\nimport {\r\n buildAuthenticatedTokenPayload,\r\n isAuthenticatedUserEnabledForJwt,\r\n resolveCodiceUtenteFromTokenPayload,\r\n} from \"../security/authenticatedToken\";\r\n\r\nconst logger = new Logger(\"AuthenticateGen\");\r\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\r\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\r\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\r\n\r\ntype Deferred<T> = {\r\n promise: Promise<T>;\r\n resolve: (value: T) => void;\r\n reject: (reason?: unknown) => void;\r\n};\r\n\r\nclass AuthMiddlewareError extends Error {\r\n constructor(\r\n public readonly status: number,\r\n public readonly code: string,\r\n message: string,\r\n public readonly details?: Record<string, unknown>\r\n ) {\r\n super(message);\r\n this.name = \"AuthMiddlewareError\";\r\n }\r\n}\r\n\r\nfunction authError(\r\n status: number,\r\n code: string,\r\n message: string,\r\n details?: Record<string, unknown>\r\n) {\r\n return new AuthMiddlewareError(status, code, message, details);\r\n}\r\n\r\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\r\n if (error instanceof AuthMiddlewareError) return error;\r\n if (error instanceof RequirementEvaluationError) {\r\n return authError(500, error.code, error.message);\r\n }\r\n if (error instanceof Error) {\r\n return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\r\n originalError: error.name,\r\n });\r\n }\r\n return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\r\n}\r\n\r\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\r\n const payload = {\r\n code: authErr.code,\r\n status: authErr.status,\r\n message: authErr.message,\r\n details: authErr.details,\r\n method: req.method,\r\n path: req.originalUrl ?? req.url,\r\n ip: req.ip,\r\n };\r\n\r\n const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\r\n if (authErr.status >= 500) logger.error(message);\r\n else logger.warning(message);\r\n}\r\n\r\nasync function authorizeWithDependencies(\r\n req: Request,\r\n res: Response,\r\n next: NextFunction,\r\n options: AccessiAuthorizationOptions \| undefined,\r\n accessiOptions: AccessiOptions,\r\n permissionService: PermissionService,\r\n userService: UserService\r\n) {\r\n try {\r\n const authHeader = req.headers.authorization;\r\n if (!authHeader) {\r\n throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\r\n }\r\n\r\n const token = authHeader.split(\" \")[1];\r\n if (!token) {\r\n throw authError(\r\n 401,\r\n \"AUTH_TOKEN_MISSING\",\r\n \"Token not found in Authorization header\"\r\n );\r\n }\r\n\r\n const secret = accessiOptions?.jwtOptions?.secret ?? process.env.ACC_JWT_SECRET;\r\n if (!secret) {\r\n throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT secret not configured\");\r\n }\r\n\r\n let decoded: any;\r\n try {\r\n decoded = jwt.verify(token, secret);\r\n } catch {\r\n throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\r\n }\r\n\r\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\r\n if (!codiceUtente) {\r\n throw authError(\r\n 401,\r\n \"AUTH_USER_CODE_MISSING\",\r\n \"codiceUtente not found in token payload\"\r\n );\r\n }\r\n\r\n const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\r\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\r\n throw authError(\r\n 401,\r\n \"AUTH_USER_DISABLED\",\r\n \"User is no longer authorized\"\r\n );\r\n }\r\n\r\n const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\r\n\r\n const requirementTree = buildRequirementTree(options);\r\n if (requirementTree) {\r\n if (!accessiOptions?.databaseOptions) {\r\n throw authError(\r\n 500,\r\n \"AUTH_DATABASE_OPTIONS_MISSING\",\r\n \"Database options not configured\"\r\n );\r\n }\r\n\r\n let grantsResultCache: GrantsResult \| null = null;\r\n const getGrantsResult = async () => {\r\n if (!grantsResultCache) {\r\n grantsResultCache = await permissionService.getUserRolesAndGrants(\r\n codiceUtente\r\n );\r\n }\r\n return grantsResultCache;\r\n };\r\n\r\n const requirementContext: AccessiCustomRequirementContext = {\r\n req,\r\n decodedToken: authenticatedPayload,\r\n userCode: codiceUtente,\r\n getGrantsResult,\r\n };\r\n\r\n const hasPermissions = await evaluateRequirement(\r\n requirementTree,\r\n requirementContext,\r\n options\r\n );\r\n\r\n if (!hasPermissions) {\r\n throw authError(\r\n 403,\r\n \"AUTH_INSUFFICIENT_PERMISSIONS\",\r\n \"User does not have required permissions\"\r\n );\r\n }\r\n\r\n (req as any).userGrants = await getGrantsResult();\r\n }\r\n\r\n (req as any).user = authenticatedPayload;\r\n (req as any).data = authenticatedPayload;\r\n return next();\r\n } catch (error: unknown) {\r\n const authErr = normalizeAuthError(error);\r\n logAuthFailure(req, authErr);\r\n const publicMessage =\r\n authErr.status === 403\r\n ? \"Forbidden\"\r\n : authErr.status >= 500\r\n ? \"Internal server error\"\r\n : \"Unauthorized\";\r\n return res\r\n .status(authErr.status)\r\n .json({ message: publicMessage, error: authErr.message, code: authErr.code });\r\n }\r\n}\r\n\r\n@Injectable()\r\nexport class AuthenticateGenService {\r\n constructor(\r\n @Inject(\"ACCESSI_OPTIONS\")\r\n private readonly accessiOptions: AccessiOptions,\r\n private readonly permissionService: PermissionService,\r\n private readonly userService: UserService\r\n ) { }\r\n\r\n async authorize(\r\n req: Request,\r\n res: Response,\r\n next: NextFunction,\r\n options?: AccessiAuthorizationOptions\r\n ) {\r\n return authorizeWithDependencies(\r\n req,\r\n res,\r\n next,\r\n options,\r\n this.accessiOptions,\r\n this.permissionService,\r\n this.userService\r\n );\r\n }\r\n}\r\n\r\nlet authenticateGenServiceRef: AuthenticateGenService \| null = null;\r\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> \| null = null;\r\n\r\nfunction createDeferred<T>(): Deferred<T> {\r\n let resolve!: (value: T) => void;\r\n let reject!: (reason?: unknown) => void;\r\n const promise = new Promise<T>((res, rej) => {\r\n resolve = res;\r\n reject = rej;\r\n });\r\n return { promise, resolve, reject };\r\n}\r\n\r\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\r\n return Boolean(\r\n value &&\r\n typeof (value as { authorize?: unknown }).authorize === \"function\"\r\n );\r\n}\r\n\r\nexport function beginAccessiAuthInitialization() {\r\n if (!authServiceBootstrapDeferred) {\r\n authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\r\n }\r\n}\r\n\r\nexport function setAccessiAuthService(service: AuthenticateGenService) {\r\n authenticateGenServiceRef = service;\r\n (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\r\n if (authServiceBootstrapDeferred) {\r\n authServiceBootstrapDeferred.resolve(service);\r\n authServiceBootstrapDeferred = null;\r\n }\r\n}\r\n\r\nexport function failAccessiAuthInitialization(error: unknown) {\r\n if (authServiceBootstrapDeferred) {\r\n authServiceBootstrapDeferred.reject(error);\r\n authServiceBootstrapDeferred = null;\r\n }\r\n}\r\n\r\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService \| null {\r\n const appLocalsService = (req.app?.locals as Record<string, unknown> \| undefined)?.[\r\n ACCESSI_AUTH_SERVICE_LOCALS_KEY\r\n ];\r\n\r\n if (isAuthenticateGenService(appLocalsService)) {\r\n return appLocalsService as AuthenticateGenService;\r\n }\r\n\r\n const globalService = (globalThis as Record<symbol, unknown>)[\r\n ACCESSI_AUTH_SERVICE_GLOBAL_KEY\r\n ];\r\n if (isAuthenticateGenService(globalService)) {\r\n return globalService as AuthenticateGenService;\r\n }\r\n\r\n return authenticateGenServiceRef;\r\n}\r\n\r\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService \| null> {\r\n if (!authServiceBootstrapDeferred) {\r\n return null;\r\n }\r\n\r\n const bootstrapPromise = authServiceBootstrapDeferred.promise;\r\n const timeoutPromise = new Promise<null>((resolve) => {\r\n setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\r\n });\r\n\r\n try {\r\n const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\r\n return isAuthenticateGenService(resolved) ? resolved : null;\r\n } catch {\r\n return null;\r\n }\r\n}\r\n\r\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService \| null> {\r\n const immediateService = getAccessiAuthServiceFromRequest(req);\r\n if (immediateService) {\r\n return immediateService;\r\n }\r\n\r\n const bootstrappedService = await waitForBootstrappedService();\r\n if (bootstrappedService) {\r\n return bootstrappedService;\r\n }\r\n\r\n return getAccessiAuthServiceFromRequest(req);\r\n}\r\n\r\nexport async function authorizeAccessi(\r\n req: Request,\r\n res: Response,\r\n next: NextFunction,\r\n options?: AccessiAuthorizationOptions\r\n) {\r\n const authService = await resolveAccessiAuthService(req);\r\n\r\n if (!authService) {\r\n const status = authServiceBootstrapDeferred ? 503 : 500;\r\n const message = authServiceBootstrapDeferred\r\n ? \"Accessi authentication service is still initializing\"\r\n : \"Accessi authentication service not initialized\";\r\n logger.error(\r\n `Authentication service not initialized ${JSON.stringify({\r\n method: req.method,\r\n path: req.originalUrl ?? req.url,\r\n status,\r\n })}`\r\n );\r\n return res\r\n .status(status)\r\n .json({ message });\r\n }\r\n\r\n return authService.authorize(req, res, next, options);\r\n}\r\n\r\nexport const authenticateGen = authorizeAccessi;\r\n"]}
1	+ {"version":3,"file":"authenticateGen.js","sourceRoot":"","sources":["../../../src/accessi-module/middleware/authenticateGen.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqRA,wEAIC;AAGD,sDAOC;AAGD,sEAKC;AA4DD,4CAiCC;AAvYD,kDAAoC;AACpC,2CAAoD;AAEpD,uFAAoF;AACpF,qEAAkE;AAClE,yCAAsC;AACtC,+DAO+B;AAC/B,uEAMwC;AACxC,uEAAqE;AAErE,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,iBAAiB,CAAC,CAAC;AAC7C,MAAM,+BAA+B,GAAG,oBAAoB,CAAC;AAC7D,MAAM,+BAA+B,GAAG,MAAM,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;AACtF,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAQ3C,MAAM,mBAAoB,SAAQ,KAAK;IACrC,YACkB,MAAc,EACd,IAAY,EAC5B,OAAe,EACC,OAAiC;QAEjD,KAAK,CAAC,OAAO,CAAC,CAAC;QALC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAQ;QAEZ,YAAO,GAAP,OAAO,CAA0B;QAGjD,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED,SAAS,SAAS,CAChB,MAAc,EACd,IAAY,EACZ,OAAe,EACf,OAAiC;IAEjC,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,IAAI,KAAK,YAAY,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACvD,IAAI,KAAK,YAAY,gDAA0B,EAAE,CAAC;QAChD,OAAO,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,KAAK,YAAY,KAAK,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,OAAO,EAAE;YAC1D,aAAa,EAAE,KAAK,CAAC,IAAI;SAC1B,CAAC,CAAC;IACL,CAAC;IACD,OAAO,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,iCAAiC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,cAAc,CAAC,GAAY,EAAE,OAA4B;;IAChE,MAAM,OAAO,GAAG;QACd,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;QAChC,EAAE,EAAE,GAAG,CAAC,EAAE;KACX,CAAC;IAEF,MAAM,OAAO,GAAG,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uBAAuB,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC;IAC3H,IAAI,OAAO,CAAC,MAAM,IAAI,GAAG;QAAE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;;QAC5C,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AAC/B,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,GAAa,EAAE,OAA4B;IAC1E,MAAM,OAAO,GACX,OAAO,CAAC,MAAM,KAAK,GAAG;QACpB,CAAC,CAAC,6BAA6B;QAC/B,CAAC,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG;YACrB,CAAC,CAAC,oCAAoC;YACtC,CAAC,CAAC,sCAAsC,CAAC;IAE/C,OAAO,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QACrC,QAAQ,EAAE,OAAO;QACjB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU,EAAE,CAAC;QACb,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,sEAAsE;QACtE,KAAK,EAAE,OAAO,CAAC,IAAI;QACnB,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAED,SAAe,yBAAyB,CACtC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAgD,EAChD,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;;QAOxB,MAAM,oBAAoB,GAAG,GAA2B,CAAC;QAEzD,IAAI,CAAC;YACH,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YAC7C,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,SAAS,CAAC,GAAG,EAAE,qBAAqB,EAAE,gCAAgC,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,IAAI,MAAc,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,GAAG,IAAA,wCAAmB,EAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;YACzD,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,yBAAyB,EAAE,2BAA2B,CAAC,CAAC;YAC/E,CAAC;YAED,IAAI,OAAgB,CAAC;YACrB,IAAI,CAAC;gBACH,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YACjE,CAAC;YAAC,WAAM,CAAC;gBACP,MAAM,SAAS,CAAC,GAAG,EAAE,oBAAoB,EAAE,mBAAmB,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAClE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,SAAS,CACb,GAAG,EACH,wBAAwB,EACxB,yCAAyC,CAC1C,CAAC;YACJ,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1G,MAAM,SAAS,CACb,GAAG,EACH,oBAAoB,EACpB,8BAA8B,CAC/B,CAAC;YACJ,CAAC;YAED,MAAM,oBAAoB,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAElF,MAAM,eAAe,GAAG,IAAA,0CAAoB,EAAC,OAAO,CAAC,CAAC;YACtD,IAAI,eAAe,EAAE,CAAC;gBACpB,IAAI,CAAC,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,eAAe,CAAA,EAAE,CAAC;oBACrC,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,iCAAiC,CAClC,CAAC;gBACJ,CAAC;gBAED,IAAI,iBAAiB,GAAwB,IAAI,CAAC;gBAClD,MAAM,eAAe,GAAG,GAAS,EAAE;oBACjC,IAAI,CAAC,iBAAiB,EAAE,CAAC;wBACvB,iBAAiB,GAAG,MAAM,iBAAiB,CAAC,qBAAqB,CAC/D,YAAY,CACb,CAAC;oBACJ,CAAC;oBACD,OAAO,iBAAiB,CAAC;gBAC3B,CAAC,CAAA,CAAC;gBAEF,MAAM,kBAAkB,GAAoC;oBAC1D,GAAG;oBACH,YAAY,EAAE,oBAAoB;oBAClC,QAAQ,EAAE,YAAY;oBACtB,eAAe;iBAChB,CAAC;gBAEF,MAAM,cAAc,GAAG,MAAM,IAAA,yCAAmB,EAC9C,eAAe,EACf,kBAAkB,EAClB,OAAO,CACR,CAAC;gBAEF,IAAI,CAAC,cAAc,EAAE,CAAC;oBACpB,MAAM,SAAS,CACb,GAAG,EACH,+BAA+B,EAC/B,yCAAyC,CAC1C,CAAC;gBACJ,CAAC;gBAED,oBAAoB,CAAC,UAAU,GAAG,MAAM,eAAe,EAAE,CAAC;YAC5D,CAAC;YAED,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,oBAAoB,CAAC,IAAI,GAAG,oBAAoB,CAAC;YACjD,OAAO,IAAI,EAAE,CAAC;QAChB,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;YAC1C,cAAc,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YAC7B,OAAO,uBAAuB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;CAAA;AAIM,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IACjC,YAEmB,cAA8B,EAC9B,iBAAoC,EACpC,WAAwB;QAFxB,mBAAc,GAAd,cAAc,CAAgB;QAC9B,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,gBAAW,GAAX,WAAW,CAAa;IACvC,CAAC;IAEL;;;OAGG;IACG,SAAS,CACb,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;YAErC,OAAO,yBAAyB,CAC9B,GAAG,EACH,GAAG,EACH,IAAI,EACJ,OAAO,EACP,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,iBAAiB,EACtB,IAAI,CAAC,WAAW,CACjB,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AA5BY,wDAAsB;iCAAtB,sBAAsB;IAFlC,IAAA,mBAAU,GAAE;IACb,gFAAgF;;IAG3E,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CAEU,qCAAiB;QACvB,yBAAW;GALhC,sBAAsB,CA4BlC;AAED,IAAI,yBAAyB,GAAkC,IAAI,CAAC;AACpE,IAAI,4BAA4B,GAA4C,IAAI,CAAC;AAEjF,SAAS,cAAc;IACrB,IAAI,OAA4B,CAAC;IACjC,IAAI,MAAmC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAI,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC1C,OAAO,GAAG,GAAG,CAAC;QACd,MAAM,GAAG,GAAG,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC9C,OAAO,OAAO,CACZ,KAAK;QACL,OAAQ,KAAiC,CAAC,SAAS,KAAK,UAAU,CACnE,CAAC;AACJ,CAAC;AAED,mHAAmH;AACnH,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,4BAA4B,EAAE,CAAC;QAClC,4BAA4B,GAAG,cAAc,EAA0B,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,sGAAsG;AACtG,SAAgB,qBAAqB,CAAC,OAA+B;IACnE,yBAAyB,GAAG,OAAO,CAAC;IACnC,UAAsC,CAAC,+BAA+B,CAAC,GAAG,OAAO,CAAC;IACnF,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,SAAgB,6BAA6B,CAAC,KAAc;IAC1D,IAAI,4BAA4B,EAAE,CAAC;QACjC,4BAA4B,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3C,4BAA4B,GAAG,IAAI,CAAC;IACtC,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CAAC,GAAY;;IACpD,MAAM,gBAAgB,GAAG,MAAC,MAAA,GAAG,CAAC,GAAG,0CAAE,MAA8C,0CAC/E,+BAA+B,CAChC,CAAC;IAEF,IAAI,wBAAwB,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/C,OAAO,gBAA0C,CAAC;IACpD,CAAC;IAED,MAAM,aAAa,GAAI,UAAsC,CAC3D,+BAA+B,CAChC,CAAC;IACF,IAAI,wBAAwB,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5C,OAAO,aAAuC,CAAC;IACjD,CAAC;IAED,OAAO,yBAAyB,CAAC;AACnC,CAAC;AAED,SAAe,0BAA0B;;QACvC,IAAI,CAAC,4BAA4B,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,gBAAgB,GAAG,4BAA4B,CAAC,OAAO,CAAC;QAC9D,MAAM,cAAc,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YACnD,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,4BAA4B,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QAEH,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,OAAO,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;QAC9D,CAAC;QAAC,WAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CAAA;AAED,SAAe,yBAAyB,CAAC,GAAY;;QACnD,MAAM,gBAAgB,GAAG,gCAAgC,CAAC,GAAG,CAAC,CAAC;QAC/D,IAAI,gBAAgB,EAAE,CAAC;YACrB,OAAO,gBAAgB,CAAC;QAC1B,CAAC;QAED,MAAM,mBAAmB,GAAG,MAAM,0BAA0B,EAAE,CAAC;QAC/D,IAAI,mBAAmB,EAAE,CAAC;YACxB,OAAO,mBAAmB,CAAC;QAC7B,CAAC;QAED,OAAO,gCAAgC,CAAC,GAAG,CAAC,CAAC;IAC/C,CAAC;CAAA;AAED;;;;;;GAMG;AACH,SAAsB,gBAAgB,CACpC,GAAY,EACZ,GAAa,EACb,IAAkB,EAClB,OAAqC;;;QAErC,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,GAAG,CAAC,CAAC;QAEzD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,MAAM,GAAG,4BAA4B,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;YACxD,MAAM,IAAI,GAAG,4BAA4B;gBACvC,CAAC,CAAC,2BAA2B;gBAC7B,CAAC,CAAC,8BAA8B,CAAC;YACnC,MAAM,CAAC,KAAK,CACV,0CAA0C,IAAI,CAAC,SAAS,CAAC;gBACvD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,IAAI,EAAE,MAAA,GAAG,CAAC,WAAW,mCAAI,GAAG,CAAC,GAAG;gBAChC,MAAM;aACP,CAAC,EAAE,CACL,CAAC;YACF,OAAO,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;gBAC7B,QAAQ,EAAE,OAAO;gBACjB,MAAM;gBACN,UAAU,EAAE,CAAC;gBACb,IAAI;gBACJ,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,MAAM,KAAK,GAAG;oBACrB,CAAC,CAAC,4DAA4D;oBAC9D,CAAC,CAAC,sCAAsC;aAC3C,CAAC,CAAC;QACL,CAAC;QAED,OAAO,WAAW,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACxD,CAAC;CAAA;AAED,mIAAmI;AACtH,QAAA,eAAe,GAAG,gBAAgB,CAAC","sourcesContent":["import { NextFunction, Request, Response } from \"express\";\nimport * as jwt from \"jsonwebtoken\";\nimport { Inject, Injectable } from \"@nestjs/common\";\nimport type { AccessiOptions } from \"../AccessiModule\";\nimport { PermissionService } from \"../Services/PermissionService/PermissionService\";\nimport { UserService } from \"../Services/UserService/UserService\";\nimport { Logger } from \"../../Logger\";\nimport {\n AccessiAuthorizationOptions,\n AccessiCustomRequirementContext,\n GrantsResult,\n RequirementEvaluationError,\n buildRequirementTree,\n evaluateRequirement,\n} from \"./accessiRequirements\";\nimport {\n buildAuthenticatedTokenPayload,\n extractAccessiBearerToken,\n isAuthenticatedUserEnabledForJwt,\n isAccessiTokenAllowedForUser,\n resolveCodiceUtenteFromTokenPayload,\n} from \"../security/authenticatedToken\";\nimport { getAccessiJwtSecret } from \"../security/passwordResetToken\";\n\nconst logger = new Logger(\"AuthenticateGen\");\nconst ACCESSI_AUTH_SERVICE_LOCALS_KEY = \"accessiAuthService\";\nconst ACCESSI_AUTH_SERVICE_GLOBAL_KEY = Symbol.for(\"emilsoftware.accessiAuthService\");\nconst ACCESSI_AUTH_SERVICE_WAIT_MS = 15000;\n\ntype Deferred<T> = {\n promise: Promise<T>;\n resolve: (value: T) => void;\n reject: (reason?: unknown) => void;\n};\n\nclass AuthMiddlewareError extends Error {\n constructor(\n public readonly status: number,\n public readonly code: string,\n message: string,\n public readonly details?: Record<string, unknown>\n ) {\n super(message);\n this.name = \"AuthMiddlewareError\";\n }\n}\n\nfunction authError(\n status: number,\n code: string,\n message: string,\n details?: Record<string, unknown>\n) {\n return new AuthMiddlewareError(status, code, message, details);\n}\n\nfunction normalizeAuthError(error: unknown): AuthMiddlewareError {\n if (error instanceof AuthMiddlewareError) return error;\n if (error instanceof RequirementEvaluationError) {\n return authError(500, error.code, error.message);\n }\n if (error instanceof Error) {\n return authError(500, \"AUTH_INTERNAL_ERROR\", error.message, {\n originalError: error.name,\n });\n }\n return authError(500, \"AUTH_INTERNAL_ERROR\", \"Unexpected authentication error\");\n}\n\nfunction logAuthFailure(req: Request, authErr: AuthMiddlewareError) {\n const payload = {\n code: authErr.code,\n status: authErr.status,\n message: authErr.message,\n details: authErr.details,\n method: req.method,\n path: req.originalUrl ?? req.url,\n ip: req.ip,\n };\n\n const message = `${authErr.status >= 500 ? \"Authentication failure\" : \"Authentication denied\"} ${JSON.stringify(payload)}`;\n if (authErr.status >= 500) logger.error(message);\n else logger.warning(message);\n}\n\n/** Sends the documented Accessi error contract from Express middleware. /\nfunction sendAuthenticationError(res: Response, authErr: AuthMiddlewareError): Response {\n const message =\n authErr.status === 403\n ? 'Operazione non autorizzata.'\n : authErr.status >= 500\n ? 'Errore interno del modulo Accessi.'\n : 'Autenticazione non valida o scaduta.';\n\n return res.status(authErr.status).json({\n severity: 'error',\n status: authErr.status,\n statusCode: 2,\n code: authErr.code,\n // Kept for callers of older versions which already inspected `error`.\n error: authErr.code,\n message,\n });\n}\n\nasync function authorizeWithDependencies(\n req: Request,\n res: Response,\n next: NextFunction,\n options: AccessiAuthorizationOptions \| undefined,\n accessiOptions: AccessiOptions,\n permissionService: PermissionService,\n userService: UserService\n) {\n type AuthenticatedRequest = Request & {\n userGrants?: unknown;\n user?: unknown;\n data?: unknown;\n };\n const authenticatedRequest = req as AuthenticatedRequest;\n\n try {\n const authHeader = req.headers.authorization;\n if (!authHeader) {\n throw authError(401, \"AUTH_HEADER_MISSING\", \"Authorization header not found\");\n }\n\n const token = extractAccessiBearerToken(authHeader);\n if (!token) {\n throw authError(\n 401,\n \"AUTH_TOKEN_MISSING\",\n \"Token not found in Authorization header\"\n );\n }\n\n let secret: string;\n try {\n secret = getAccessiJwtSecret(accessiOptions, 'access');\n } catch {\n throw authError(500, \"AUTH_JWT_SECRET_MISSING\", \"JWT secret not configured\");\n }\n\n let decoded: unknown;\n try {\n decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });\n } catch {\n throw authError(401, \"AUTH_TOKEN_INVALID\", \"Invalid JWT token\");\n }\n\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n if (!codiceUtente) {\n throw authError(\n 401,\n \"AUTH_USER_CODE_MISSING\",\n \"codiceUtente not found in token payload\"\n );\n }\n\n const currentUser = await userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(currentUser) \|\| !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n throw authError(\n 401,\n \"AUTH_USER_DISABLED\",\n \"User is no longer authorized\"\n );\n }\n\n const authenticatedPayload = buildAuthenticatedTokenPayload(decoded, currentUser);\n\n const requirementTree = buildRequirementTree(options);\n if (requirementTree) {\n if (!accessiOptions?.databaseOptions) {\n throw authError(\n 500,\n \"AUTH_DATABASE_OPTIONS_MISSING\",\n \"Database options not configured\"\n );\n }\n\n let grantsResultCache: GrantsResult \| null = null;\n const getGrantsResult = async () => {\n if (!grantsResultCache) {\n grantsResultCache = await permissionService.getUserRolesAndGrants(\n codiceUtente\n );\n }\n return grantsResultCache;\n };\n\n const requirementContext: AccessiCustomRequirementContext = {\n req,\n decodedToken: authenticatedPayload,\n userCode: codiceUtente,\n getGrantsResult,\n };\n\n const hasPermissions = await evaluateRequirement(\n requirementTree,\n requirementContext,\n options\n );\n\n if (!hasPermissions) {\n throw authError(\n 403,\n \"AUTH_INSUFFICIENT_PERMISSIONS\",\n \"User does not have required permissions\"\n );\n }\n\n authenticatedRequest.userGrants = await getGrantsResult();\n }\n\n authenticatedRequest.user = authenticatedPayload;\n authenticatedRequest.data = authenticatedPayload;\n return next();\n } catch (error: unknown) {\n const authErr = normalizeAuthError(error);\n logAuthFailure(req, authErr);\n return sendAuthenticationError(res, authErr);\n }\n}\n\n@Injectable()\n/* Nest service behind the Express-compatible `authorizeAccessi` middleware. /\nexport class AuthenticateGenService {\n constructor(\n @Inject(\"ACCESSI_OPTIONS\")\n private readonly accessiOptions: AccessiOptions,\n private readonly permissionService: PermissionService,\n private readonly userService: UserService\n ) { }\n\n /\n Verifica JWT, stato corrente dell'utente e policy opzionale, poi popola `req.user` e `req.data`.\n * Se una policy richiede grant, popola anche `req.userGrants`; non chiamarlo direttamente fuori da test o adapter.\n /\n async authorize(\n req: Request,\n res: Response,\n next: NextFunction,\n options?: AccessiAuthorizationOptions\n ) {\n return authorizeWithDependencies(\n req,\n res,\n next,\n options,\n this.accessiOptions,\n this.permissionService,\n this.userService\n );\n }\n}\n\nlet authenticateGenServiceRef: AuthenticateGenService \| null = null;\nlet authServiceBootstrapDeferred: Deferred<AuthenticateGenService> \| null = null;\n\nfunction createDeferred<T>(): Deferred<T> {\n let resolve!: (value: T) => void;\n let reject!: (reason?: unknown) => void;\n const promise = new Promise<T>((res, rej) => {\n resolve = res;\n reject = rej;\n });\n return { promise, resolve, reject };\n}\n\nfunction isAuthenticateGenService(value: unknown): value is AuthenticateGenService {\n return Boolean(\n value &&\n typeof (value as { authorize?: unknown }).authorize === \"function\"\n );\n}\n\n/* Segnala al middleware che il bootstrap e in corso, consentendo una risposta 503 temporanea invece di un 500. /\nexport function beginAccessiAuthInitialization() {\n if (!authServiceBootstrapDeferred) {\n authServiceBootstrapDeferred = createDeferred<AuthenticateGenService>();\n }\n}\n\n/* Registra il servizio costruito da Nest nel bridge usato dalle rotte Express dell'app ospitante. /\nexport function setAccessiAuthService(service: AuthenticateGenService) {\n authenticateGenServiceRef = service;\n (globalThis as Record<symbol, unknown>)[ACCESSI_AUTH_SERVICE_GLOBAL_KEY] = service;\n if (authServiceBootstrapDeferred) {\n authServiceBootstrapDeferred.resolve(service);\n authServiceBootstrapDeferred = null;\n }\n}\n\n/* Propaga il fallimento del bootstrap alle richieste che stavano attendendo il bridge di autorizzazione. /\nexport function failAccessiAuthInitialization(error: unknown) {\n if (authServiceBootstrapDeferred) {\n authServiceBootstrapDeferred.reject(error);\n authServiceBootstrapDeferred = null;\n }\n}\n\nfunction getAccessiAuthServiceFromRequest(req: Request): AuthenticateGenService \| null {\n const appLocalsService = (req.app?.locals as Record<string, unknown> \| undefined)?.[\n ACCESSI_AUTH_SERVICE_LOCALS_KEY\n ];\n\n if (isAuthenticateGenService(appLocalsService)) {\n return appLocalsService as AuthenticateGenService;\n }\n\n const globalService = (globalThis as Record<symbol, unknown>)[\n ACCESSI_AUTH_SERVICE_GLOBAL_KEY\n ];\n if (isAuthenticateGenService(globalService)) {\n return globalService as AuthenticateGenService;\n }\n\n return authenticateGenServiceRef;\n}\n\nasync function waitForBootstrappedService(): Promise<AuthenticateGenService \| null> {\n if (!authServiceBootstrapDeferred) {\n return null;\n }\n\n const bootstrapPromise = authServiceBootstrapDeferred.promise;\n const timeoutPromise = new Promise<null>((resolve) => {\n setTimeout(() => resolve(null), ACCESSI_AUTH_SERVICE_WAIT_MS);\n });\n\n try {\n const resolved = await Promise.race([bootstrapPromise, timeoutPromise]);\n return isAuthenticateGenService(resolved) ? resolved : null;\n } catch {\n return null;\n }\n}\n\nasync function resolveAccessiAuthService(req: Request): Promise<AuthenticateGenService \| null> {\n const immediateService = getAccessiAuthServiceFromRequest(req);\n if (immediateService) {\n return immediateService;\n }\n\n const bootstrappedService = await waitForBootstrappedService();\n if (bootstrappedService) {\n return bootstrappedService;\n }\n\n return getAccessiAuthServiceFromRequest(req);\n}\n\n/\n Middleware Express pubblico di Accessi.\n \n Applicarlo dopo `initializeAccessiModule`: legge `Authorization: Bearer <jwt>`, verifica l'utente corrente\n * e applica eventuali requisiti. Su successo valorizza `req.user` e continua; su errore risponde direttamente\n * con il contratto Accessi, quindi il chiamante non deve aggiungere un proprio `next(error)`.\n /\nexport async function authorizeAccessi(\n req: Request,\n res: Response,\n next: NextFunction,\n options?: AccessiAuthorizationOptions\n) {\n const authService = await resolveAccessiAuthService(req);\n\n if (!authService) {\n const status = authServiceBootstrapDeferred ? 503 : 500;\n const code = authServiceBootstrapDeferred\n ? 'ACCESSI_AUTH_INITIALIZING'\n : 'ACCESSI_AUTH_NOT_INITIALIZED';\n logger.error(\n `Authentication service not initialized ${JSON.stringify({\n method: req.method,\n path: req.originalUrl ?? req.url,\n status,\n })}`\n );\n return res.status(status).json({\n severity: 'error',\n status,\n statusCode: 2,\n code,\n error: code,\n message: status === 503\n ? 'Il modulo Accessi e in inizializzazione. Riprova tra poco.'\n : 'Il modulo Accessi non e disponibile.',\n });\n }\n\n return authService.authorize(req, res, next, options);\n}\n\n/* Alias storico di `authorizeAccessi`, mantenuto per retrocompatibilita. Preferire il nome esplicito nelle nuove integrazioni. */\nexport const authenticateGen = authorizeAccessi;\n"]}

package/dist/accessi-module/security/AccessiHttpExceptionFilter.d.ts ADDED Viewed

@@ -0,0 +1,12 @@
+import { ArgumentsHost, ExceptionFilter } from '@nestjs/common';
+/**
+ * Finalizes every exception raised before an Accessi controller can reply.
+ *
+ * This includes invalid JSON, validation-pipe errors and guard failures. The
+ * filter deliberately never return SQL, stack traces or provider diagnostics.
+ */
+export declare class AccessiHttpExceptionFilter implements ExceptionFilter {
+    catch(exception: unknown, host: ArgumentsHost): void;
+    private getPayload;
+    private isInvalidJson;
+}

package/dist/accessi-module/security/AccessiHttpExceptionFilter.js ADDED Viewed

@@ -0,0 +1,74 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiHttpExceptionFilter = void 0;
+const common_1 = require("@nestjs/common");
+const Utilities_1 = require("../../Utilities");
+/**
+ * Finalizes every exception raised before an Accessi controller can reply.
+ *
+ * This includes invalid JSON, validation-pipe errors and guard failures. The
+ * filter deliberately never return SQL, stack traces or provider diagnostics.
+ */
+let AccessiHttpExceptionFilter = class AccessiHttpExceptionFilter {
+    catch(exception, host) {
+        var _a, _b;
+        const response = host.switchToHttp().getResponse();
+        if (response.headersSent)
+            return;
+        const status = exception instanceof common_1.HttpException
+            ? exception.getStatus()
+            : Utilities_1.RestUtilities.isDatabaseSchemaError(exception)
+                ? common_1.HttpStatus.SERVICE_UNAVAILABLE
+                : common_1.HttpStatus.INTERNAL_SERVER_ERROR;
+        const payload = this.getPayload(exception);
+        const invalidJson = status === common_1.HttpStatus.BAD_REQUEST && this.isInvalidJson(exception, payload);
+        const explicitMessage = typeof payload.message === 'string' ? payload.message : undefined;
+        const code = (_a = payload.code) !== null && _a !== void 0 ? _a : (Utilities_1.RestUtilities.isDatabaseSchemaError(exception)
+            ? 'ACCESSI_DATABASE_SCHEMA_OUTDATED'
+            : invalidJson
+                ? 'ACCESSI_INVALID_JSON'
+                : status === common_1.HttpStatus.BAD_REQUEST
+                    ? 'ACCESSI_REQUEST_ERROR'
+                    : status === common_1.HttpStatus.UNAUTHORIZED
+                        ? 'ACCESSI_UNAUTHORIZED'
+                        : status === common_1.HttpStatus.FORBIDDEN
+                            ? 'ACCESSI_FORBIDDEN'
+                            : 'ACCESSI_INTERNAL_ERROR');
+        const message = code === 'ACCESSI_VALIDATION_ERROR'
+            ? 'La richiesta contiene dati non validi.'
+            : code === 'ACCESSI_DATABASE_SCHEMA_OUTDATED'
+                ? 'Lo schema del database Accessi non e aggiornato. Eseguire la migrazione database e riprovare.'
+                : invalidJson
+                    ? 'Il corpo della richiesta non contiene JSON valido.'
+                    : explicitMessage !== null && explicitMessage !== void 0 ? explicitMessage : (status === common_1.HttpStatus.UNAUTHORIZED
+                        ? 'Autenticazione non valida o scaduta.'
+                        : status === common_1.HttpStatus.FORBIDDEN
+                            ? 'Operazione non autorizzata.'
+                            : status >= common_1.HttpStatus.INTERNAL_SERVER_ERROR
+                                ? 'Errore interno del modulo Accessi.'
+                                : 'Richiesta non valida.');
+        response.status(status).json(Object.assign({ severity: 'error', status, statusCode: Utilities_1.StatusCode.Error, code, error: code, message }, (((_b = payload.details) === null || _b === void 0 ? void 0 : _b.length) ? { details: payload.details } : {})));
+    }
+    getPayload(exception) {
+        if (!(exception instanceof common_1.HttpException))
+            return {};
+        const response = exception.getResponse();
+        return typeof response === 'string' ? { message: response } : response;
+    }
+    isInvalidJson(exception, payload) {
+        const message = exception instanceof Error ? exception.message : payload.message;
+        const text = Array.isArray(message) ? message.join(' ') : String(message !== null && message !== void 0 ? message : '');
+        return /json|unexpected token|expected property name|unterminated string/i.test(text);
+    }
+};
+exports.AccessiHttpExceptionFilter = AccessiHttpExceptionFilter;
+exports.AccessiHttpExceptionFilter = AccessiHttpExceptionFilter = __decorate([
+    (0, common_1.Catch)()
+], AccessiHttpExceptionFilter);
+//# sourceMappingURL=AccessiHttpExceptionFilter.js.map

package/dist/accessi-module/security/AccessiHttpExceptionFilter.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"AccessiHttpExceptionFilter.js","sourceRoot":"","sources":["../../../src/accessi-module/security/AccessiHttpExceptionFilter.ts"],"names":[],"mappings":";;;;;;;;;AAAA,2CAAkG;AAElG,+CAA4D;AAS5D;;;;;GAKG;AAEI,IAAM,0BAA0B,GAAhC,MAAM,0BAA0B;IACrC,KAAK,CAAC,SAAkB,EAAE,IAAmB;;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC,WAAW,EAAY,CAAC;QAC7D,IAAI,QAAQ,CAAC,WAAW;YAAE,OAAO;QAEjC,MAAM,MAAM,GAAG,SAAS,YAAY,sBAAa;YAC/C,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE;YACvB,CAAC,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;gBAC9C,CAAC,CAAC,mBAAU,CAAC,mBAAmB;gBAChC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACvC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAC3C,MAAM,WAAW,GAAG,MAAM,KAAK,mBAAU,CAAC,WAAW,IAAI,IAAI,CAAC,aAAa,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAChG,MAAM,eAAe,GAAG,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1F,MAAM,IAAI,GAAG,MAAA,OAAO,CAAC,IAAI,mCACpB,CAAC,yBAAa,CAAC,qBAAqB,CAAC,SAAS,CAAC;YAChD,CAAC,CAAC,kCAAkC;YACpC,CAAC,CAAC,WAAW;gBACX,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,WAAW;oBACjC,CAAC,CAAC,uBAAuB;oBACzB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBAClC,CAAC,CAAC,sBAAsB;wBACxB,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,mBAAmB;4BACrB,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAExC,MAAM,OAAO,GAAG,IAAI,KAAK,0BAA0B;YACjD,CAAC,CAAC,wCAAwC;YAC1C,CAAC,CAAC,IAAI,KAAK,kCAAkC;gBAC3C,CAAC,CAAC,+FAA+F;gBACjG,CAAC,CAAC,WAAW;oBACX,CAAC,CAAC,oDAAoD;oBACtD,CAAC,CAAC,eAAe,aAAf,eAAe,cAAf,eAAe,GAAI,CAAC,MAAM,KAAK,mBAAU,CAAC,YAAY;wBACtD,CAAC,CAAC,sCAAsC;wBACxC,CAAC,CAAC,MAAM,KAAK,mBAAU,CAAC,SAAS;4BAC/B,CAAC,CAAC,6BAA6B;4BAC/B,CAAC,CAAC,MAAM,IAAI,mBAAU,CAAC,qBAAqB;gCAC1C,CAAC,CAAC,oCAAoC;gCACtC,CAAC,CAAC,uBAAuB,CAAC,CAAC;QAEvC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,iBAC1B,QAAQ,EAAE,OAAO,EACjB,MAAM,EACN,UAAU,EAAE,sBAAU,CAAC,KAAK,EAC5B,IAAI,EACJ,KAAK,EAAE,IAAI,EACX,OAAO,IACJ,CAAC,CAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,MAAM,EAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAChE,CAAC;IACL,CAAC;IAEO,UAAU,CAAC,SAAkB;QACnC,IAAI,CAAC,CAAC,SAAS,YAAY,sBAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,SAAS,CAAC,WAAW,EAAE,CAAC;QACzC,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,QAA4B,CAAC;IAC7F,CAAC;IAEO,aAAa,CAAC,SAAkB,EAAE,OAAyB;QACjE,MAAM,OAAO,GAAG,SAAS,YAAY,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QACjF,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,CAAC,CAAC;QAChF,OAAO,mEAAmE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxF,CAAC;CACF,CAAA;AA9DY,gEAA0B;qCAA1B,0BAA0B;IADtC,IAAA,cAAK,GAAE;GACK,0BAA0B,CA8DtC","sourcesContent":["import { ArgumentsHost, Catch, ExceptionFilter, HttpException, HttpStatus } from '@nestjs/common';\nimport { Response } from 'express';\nimport { RestUtilities, StatusCode } from '../../Utilities';\n\ntype ExceptionPayload = {\n code?: string;\n error?: string;\n message?: string | string[];\n details?: string[];\n};\n\n/**\n * Finalizes every exception raised before an Accessi controller can reply.\n *\n * This includes invalid JSON, validation-pipe errors and guard failures. The\n * filter deliberately never return SQL, stack traces or provider diagnostics.\n */\n@Catch()\nexport class AccessiHttpExceptionFilter implements ExceptionFilter {\n catch(exception: unknown, host: ArgumentsHost): void {\n const response = host.switchToHttp().getResponse<Response>();\n if (response.headersSent) return;\n\n const status = exception instanceof HttpException\n ? exception.getStatus()\n : RestUtilities.isDatabaseSchemaError(exception)\n ? HttpStatus.SERVICE_UNAVAILABLE\n : HttpStatus.INTERNAL_SERVER_ERROR;\n const payload = this.getPayload(exception);\n const invalidJson = status === HttpStatus.BAD_REQUEST && this.isInvalidJson(exception, payload);\n const explicitMessage = typeof payload.message === 'string' ? payload.message : undefined;\n const code = payload.code\n ?? (RestUtilities.isDatabaseSchemaError(exception)\n ? 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n : invalidJson\n ? 'ACCESSI_INVALID_JSON'\n : status === HttpStatus.BAD_REQUEST\n ? 'ACCESSI_REQUEST_ERROR'\n : status === HttpStatus.UNAUTHORIZED\n ? 'ACCESSI_UNAUTHORIZED'\n : status === HttpStatus.FORBIDDEN\n ? 'ACCESSI_FORBIDDEN'\n : 'ACCESSI_INTERNAL_ERROR');\n\n const message = code === 'ACCESSI_VALIDATION_ERROR'\n ? 'La richiesta contiene dati non validi.'\n : code === 'ACCESSI_DATABASE_SCHEMA_OUTDATED'\n ? 'Lo schema del database Accessi non e aggiornato. Eseguire la migrazione database e riprovare.'\n : invalidJson\n ? 'Il corpo della richiesta non contiene JSON valido.'\n : explicitMessage ?? (status === HttpStatus.UNAUTHORIZED\n ? 'Autenticazione non valida o scaduta.'\n : status === HttpStatus.FORBIDDEN\n ? 'Operazione non autorizzata.'\n : status >= HttpStatus.INTERNAL_SERVER_ERROR\n ? 'Errore interno del modulo Accessi.'\n : 'Richiesta non valida.');\n\n response.status(status).json({\n severity: 'error',\n status,\n statusCode: StatusCode.Error,\n code,\n error: code,\n message,\n ...(payload.details?.length ? { details: payload.details } : {}),\n });\n }\n\n private getPayload(exception: unknown): ExceptionPayload {\n if (!(exception instanceof HttpException)) return {};\n const response = exception.getResponse();\n return typeof response === 'string' ? { message: response } : response as ExceptionPayload;\n }\n\n private isInvalidJson(exception: unknown, payload: ExceptionPayload): boolean {\n const message = exception instanceof Error ? exception.message : payload.message;\n const text = Array.isArray(message) ? message.join(' ') : String(message ?? '');\n return /json|unexpected token|expected property name|unterminated string/i.test(text);\n }\n}\n"]}

package/dist/accessi-module/security/accessControl.d.ts CHANGED Viewed

@@ -1,17 +1,28 @@
 import { Request } from 'express';
+/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */
 export interface AuthenticatedAccessiUser {
     codiceUtente: number;
     email?: string;
     flagSuper: boolean;
     flagAdminConfigurator: boolean;
 }
+/**
+ * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.
+ * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.
+ */
 export declare function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser;
+/** Impone il flag superutente, necessario per configurazione globale, utenti e catalogo SSO. */
 export declare function ensureSuperUser(user: AuthenticatedAccessiUser, message?: string): void;
+/** Permette l'operazione al proprietario della risorsa o a un superutente. */
 export declare function ensureSelfOrSuperUser(user: AuthenticatedAccessiUser, targetUserCode: number, message?: string): void;
+/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */
 export declare function hasPrivilegedUserChanges(user: {
     statoRegistrazione?: unknown;
     flagSuper?: unknown;
     flagAdminConfigurator?: unknown;
+    passwordLoginEnabled?: unknown;
+    passwordlessLoginEnabled?: unknown;
+    flagDueFattori?: unknown;
     roles?: unknown;
     permissions?: unknown;
 }): boolean;

package/dist/accessi-module/security/accessControl.js CHANGED Viewed

@@ -8,12 +8,21 @@ const common_1 = require("@nestjs/common");
 function normalizeBooleanFlag(value) {
     return value === true || value === 1 || value === '1';
 }
+/**
+ * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.
+ * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.
+ */
 function getAuthenticatedAccessiUser(req) {
-    var _a, _b, _c;
-    const payload = req === null || req === void 0 ? void 0 : req.user;
-    const utente = (_c = (_a = payload === null || payload === void 0 ? void 0 : payload.utente) !== null && _a !== void 0 ? _a : (_b = payload === null || payload === void 0 ? void 0 : payload.userData) === null || _b === void 0 ? void 0 : _b.utente) !== null && _c !== void 0 ? _c : payload;
+    var _a, _b;
+    const payload = req.user;
+    const payloadRecord = payload && typeof payload === 'object' ? payload : undefined;
+    const userData = (payloadRecord === null || payloadRecord === void 0 ? void 0 : payloadRecord.userData) && typeof payloadRecord.userData === 'object'
+        ? payloadRecord.userData
+        : undefined;
+    const rawUser = (_b = (_a = payloadRecord === null || payloadRecord === void 0 ? void 0 : payloadRecord.utente) !== null && _a !== void 0 ? _a : userData === null || userData === void 0 ? void 0 : userData.utente) !== null && _b !== void 0 ? _b : payloadRecord;
+    const utente = rawUser && typeof rawUser === 'object' ? rawUser : undefined;
     const codiceUtente = Number(utente === null || utente === void 0 ? void 0 : utente.codiceUtente);
-    if (!codiceUtente) {
+    if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {
         throw new common_1.UnauthorizedException('Utente non autenticato.');
     }
     return {
@@ -23,21 +32,27 @@ function getAuthenticatedAccessiUser(req) {
         flagAdminConfigurator: normalizeBooleanFlag(utente === null || utente === void 0 ? void 0 : utente.flagAdminConfigurator),
     };
 }
+/** Impone il flag superutente, necessario per configurazione globale, utenti e catalogo SSO. */
 function ensureSuperUser(user, message = 'Operazione riservata agli amministratori.') {
     if (!user.flagSuper) {
         throw new common_1.ForbiddenException(message);
     }
 }
+/** Permette l'operazione al proprietario della risorsa o a un superutente. */
 function ensureSelfOrSuperUser(user, targetUserCode, message = 'Operazione non autorizzata su questo utente.') {
     if (user.flagSuper || user.codiceUtente === targetUserCode) {
         return;
     }
     throw new common_1.ForbiddenException(message);
 }
+/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */
 function hasPrivilegedUserChanges(user) {
     return (user.statoRegistrazione !== undefined ||
         user.flagSuper !== undefined ||
         user.flagAdminConfigurator !== undefined ||
+        user.passwordLoginEnabled !== undefined ||
+        user.passwordlessLoginEnabled !== undefined ||
+        user.flagDueFattori !== undefined ||
         user.roles !== undefined ||
         user.permissions !== undefined);
 }

package/dist/accessi-module/security/accessControl.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;~~AAcA~~,~~kEAeC~~;~~AAED~~,0CAOC;~~AAED~~,sDAUC;~~AAED~~,~~4DAcC~~;~~AAlED~~,2CAA2E;~~AAU3E~~,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,~~GAAW~~,~~aAAX~~,~~GAAG~~,~~uBAAH~~,GAAG,~~CAAU~~,IAAI,CAAC;~~IACnC~~,MAAM,MAAM,GAAG,MAAA,MAAA,~~OAAO~~,~~aAAP~~,~~OAAO~~,~~uBAAP~~,~~OAAO~~,CAAE,MAAM,mCAAI,~~MAAA~~,~~OAAO~~,~~aAAP~~,OAAO,~~uBAAP~~,OAAO,~~CAAE~~,QAAQ,~~0CAAE~~,~~MAAM~~,~~mCAAI~~,~~OAAO~~,CAAC;~~IACvE~~,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,YAAY,EAAE,CAAC;~~QAClB~~,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,qBAAqB,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,qBAAqB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,wBAAwB,CAAC,~~IAMxC~~;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,qBAAqB,KAAK,SAAS;QACxC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\r\nimport { Request } from 'express';\r\n~~\r\~~nexport interface AuthenticatedAccessiUser {\r\n codiceUtente: number;\r\n email?: string;\r\n flagSuper: boolean;\r\n flagAdminConfigurator: boolean;\r\n}\r\n\r\nfunction normalizeBooleanFlag(value: unknown): boolean {\r\n return value === true \|\| value === 1 \|\| value === '1';\r\n}\r\n~~\r\~~nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\r\n const payload = (req as ~~any~~)?.user;\r\n const ~~utente~~ = payload?.utente ?? ~~payload?.~~userData?.utente ?? ~~payload~~;\r\n const codiceUtente = Number(utente?.codiceUtente);\r\n\r\n if (!codiceUtente) {\r\n throw new UnauthorizedException('Utente non autenticato.');\r\n }\r\n\r\n return {\r\n codiceUtente,\r\n email: typeof utente?.email === 'string' ? utente.email : undefined,\r\n flagSuper: normalizeBooleanFlag(utente?.flagSuper),\r\n flagAdminConfigurator: normalizeBooleanFlag(utente?.flagAdminConfigurator),\r\n };\r\n}\r\n~~\r\~~nexport function ensureSuperUser(\r\n user: AuthenticatedAccessiUser,\r\n message = 'Operazione riservata agli amministratori.',\r\n): void {\r\n if (!user.flagSuper) {\r\n throw new ForbiddenException(message);\r\n }\r\n}\r\n~~\r\~~nexport function ensureSelfOrSuperUser(\r\n user: AuthenticatedAccessiUser,\r\n targetUserCode: number,\r\n message = 'Operazione non autorizzata su questo utente.',\r\n): void {\r\n if (user.flagSuper \|\| user.codiceUtente === targetUserCode) {\r\n return;\r\n }\r\n\r\n throw new ForbiddenException(message);\r\n}\r\n~~\r\~~nexport function hasPrivilegedUserChanges(user: {\r\n statoRegistrazione?: unknown;\r\n flagSuper?: unknown;\r\n flagAdminConfigurator?: unknown;\r\n roles?: unknown;\r\n permissions?: unknown;\r\n}): boolean {\r\n return (\r\n user.statoRegistrazione !== undefined \|\|\r\n user.flagSuper !== undefined \|\|\r\n user.flagAdminConfigurator !== undefined \|\|\r\n user.roles !== undefined \|\|\r\n user.permissions !== undefined\r\n );\r\n}\r\n"]}
1	+ {"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,sDAUC;AAGD,4DAoBC;AArFD,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,qBAAqB,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,qBAAqB,CAAC;KAC3E,CAAC;AACJ,CAAC;AAED,gGAAgG;AAChG,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC3D,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,qBAAqB,KAAK,SAAS;QACxC,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. /\nexport interface AuthenticatedAccessiUser {\n codiceUtente: number;\n email?: string;\n flagSuper: boolean;\n flagAdminConfigurator: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n return value === true \|\| value === 1 \|\| value === '1';\n}\n\n/\n Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n /\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n const payload = (req as Request & { user?: unknown }).user;\n const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\n const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\n ? payloadRecord.userData as Record<string, unknown>\n : undefined;\n const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\n const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\n const codiceUtente = Number(utente?.codiceUtente);\n\n if (!Number.isSafeInteger(codiceUtente) \|\| codiceUtente <= 0) {\n throw new UnauthorizedException('Utente non autenticato.');\n }\n\n return {\n codiceUtente,\n email: typeof utente?.email === 'string' ? utente.email : undefined,\n flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n flagAdminConfigurator: normalizeBooleanFlag(utente?.flagAdminConfigurator),\n };\n}\n\n/* Impone il flag superutente, necessario per configurazione globale, utenti e catalogo SSO. /\nexport function ensureSuperUser(\n user: AuthenticatedAccessiUser,\n message = 'Operazione riservata agli amministratori.',\n): void {\n if (!user.flagSuper) {\n throw new ForbiddenException(message);\n }\n}\n\n/* Permette l'operazione al proprietario della risorsa o a un superutente. /\nexport function ensureSelfOrSuperUser(\n user: AuthenticatedAccessiUser,\n targetUserCode: number,\n message = 'Operazione non autorizzata su questo utente.',\n): void {\n if (user.flagSuper \|\| user.codiceUtente === targetUserCode) {\n return;\n }\n\n throw new ForbiddenException(message);\n}\n\n/* Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n statoRegistrazione?: unknown;\n flagSuper?: unknown;\n flagAdminConfigurator?: unknown;\n passwordLoginEnabled?: unknown;\n passwordlessLoginEnabled?: unknown;\n flagDueFattori?: unknown;\n roles?: unknown;\n permissions?: unknown;\n}): boolean {\n return (\n user.statoRegistrazione !== undefined \|\|\n user.flagSuper !== undefined \|\|\n user.flagAdminConfigurator !== undefined \|\|\n user.passwordLoginEnabled !== undefined \|\|\n user.passwordlessLoginEnabled !== undefined \|\|\n user.flagDueFattori !== undefined \|\|\n user.roles !== undefined \|\|\n user.permissions !== undefined\n );\n}\n"]}

package/dist/accessi-module/security/accessiValidation.d.ts ADDED Viewed

@@ -0,0 +1,9 @@
+import { ValidationPipe } from '@nestjs/common';
+/**
+ * Creates the validation pipe used by every Accessi bootstrap path.
+ *
+ * It deliberately returns one stable, documented error contract instead of
+ * Nest's default array. Consumers can branch on `code`; `details` is safe to
+ * display or log because it contains only DTO field names and validation text.
+ */
+export declare function createAccessiValidationPipe(): ValidationPipe;

package/dist/accessi-module/security/accessiValidation.js ADDED Viewed

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiValidationPipe = createAccessiValidationPipe;
+const common_1 = require("@nestjs/common");
+const Utilities_1 = require("../../Utilities");
+/**
+ * Creates the validation pipe used by every Accessi bootstrap path.
+ *
+ * It deliberately returns one stable, documented error contract instead of
+ * Nest's default array. Consumers can branch on `code`; `details` is safe to
+ * display or log because it contains only DTO field names and validation text.
+ */
+function createAccessiValidationPipe() {
+    return new common_1.ValidationPipe({
+        whitelist: true,
+        forbidNonWhitelisted: true,
+        transform: true,
+        transformOptions: {
+            enableImplicitConversion: true,
+        },
+        exceptionFactory: (errors) => new common_1.BadRequestException({
+            severity: 'error',
+            status: 400,
+            statusCode: Utilities_1.StatusCode.Error,
+            code: 'ACCESSI_VALIDATION_ERROR',
+            error: 'ACCESSI_VALIDATION_ERROR',
+            message: 'La richiesta contiene dati non validi.',
+            details: flattenValidationErrors(errors),
+        }),
+    });
+}
+/** Converts nested class-validator failures into deterministic client details. */
+function flattenValidationErrors(errors, parentPath = '') {
+    return errors.flatMap((error) => {
+        var _a, _b;
+        const path = parentPath ? `${parentPath}.${error.property}` : error.property;
+        const ownMessages = Object.values((_a = error.constraints) !== null && _a !== void 0 ? _a : {}).map((message) => `${path}: ${message}`);
+        return [...ownMessages, ...flattenValidationErrors((_b = error.children) !== null && _b !== void 0 ? _b : [], path)];
+    });
+}
+//# sourceMappingURL=accessiValidation.js.map

package/dist/accessi-module/security/accessiValidation.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"accessiValidation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessiValidation.ts"],"names":[],"mappings":";;AAUA,kEAmBC;AA7BD,2CAAsF;AACtF,+CAA6C;AAE7C;;;;;;GAMG;AACH,SAAgB,2BAA2B;IACzC,OAAO,IAAI,uBAAc,CAAC;QACxB,SAAS,EAAE,IAAI;QACf,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE;YAChB,wBAAwB,EAAE,IAAI;SAC/B;QACD,gBAAgB,EAAE,CAAC,MAAyB,EAAE,EAAE,CAC9C,IAAI,4BAAmB,CAAC;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,sBAAU,CAAC,KAAK;YAC5B,IAAI,EAAE,0BAA0B;YAChC,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,wCAAwC;YACjD,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC;SACzC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,uBAAuB,CAAC,MAAyB,EAAE,UAAU,GAAG,EAAE;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,uBAAuB,CAAC,MAAA,KAAK,CAAC,QAAQ,mCAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { BadRequestException, ValidationError, ValidationPipe } from '@nestjs/common';\nimport { StatusCode } from '../../Utilities';\n\n/**\n * Creates the validation pipe used by every Accessi bootstrap path.\n *\n * It deliberately returns one stable, documented error contract instead of\n * Nest's default array. Consumers can branch on `code`; `details` is safe to\n * display or log because it contains only DTO field names and validation text.\n */\nexport function createAccessiValidationPipe(): ValidationPipe {\n return new ValidationPipe({\n whitelist: true,\n forbidNonWhitelisted: true,\n transform: true,\n transformOptions: {\n enableImplicitConversion: true,\n },\n exceptionFactory: (errors: ValidationError[]) =>\n new BadRequestException({\n severity: 'error',\n status: 400,\n statusCode: StatusCode.Error,\n code: 'ACCESSI_VALIDATION_ERROR',\n error: 'ACCESSI_VALIDATION_ERROR',\n message: 'La richiesta contiene dati non validi.',\n details: flattenValidationErrors(errors),\n }),\n });\n}\n\n/** Converts nested class-validator failures into deterministic client details. */\nfunction flattenValidationErrors(errors: ValidationError[], parentPath = ''): string[] {\n return errors.flatMap((error) => {\n const path = parentPath ? `${parentPath}.${error.property}` : error.property;\n const ownMessages = Object.values(error.constraints ?? {}).map((message) => `${path}: ${message}`);\n return [...ownMessages, ...flattenValidationErrors(error.children ?? [], path)];\n });\n}\n"]}

package/dist/accessi-module/security/authenticatedToken.d.ts CHANGED Viewed

@@ -1,11 +1,25 @@
 import { StatoRegistrazione } from '../Dtos/StatoRegistrazione';
+/** Stato autorevole minimo riletto dal database per ogni verifica JWT. */
 export interface AccessiAuthenticatedUserSnapshot {
     codiceUtente: number;
     email?: string;
     statoRegistrazione: StatoRegistrazione;
     flagSuper: boolean;
     flagAdminConfigurator: boolean;
+    flagDueFattori?: boolean;
+    passwordlessLoginEnabled?: boolean;
+    passwordLoginEnabled?: boolean;
 }
+/** Shared, strict Bearer parsing for the Nest guard and Express middleware. */
+export declare function extractAccessiBearerToken(header: unknown): string | undefined;
+/** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */
 export declare function resolveCodiceUtenteFromTokenPayload(decoded: unknown): number | undefined;
+/**
+ * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.
+ * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.
+ */
 export declare function buildAuthenticatedTokenPayload(decoded: unknown, utente: AccessiAuthenticatedUserSnapshot): Record<string, unknown>;
-export declare function isAuthenticatedUserEnabledForJwt(utente: AccessiAuthenticatedUserSnapshot | null | undefined): boolean;
+/** Enabling 2FA invalidates sessions which have not completed the required verification. */
+export declare function isAccessiTokenAllowedForUser(decoded: unknown, user: AccessiAuthenticatedUserSnapshot): boolean;
+/** Un JWT puo essere usato soltanto da utenti nello stato confermato, indipendentemente dalla sua scadenza. */
+export declare function isAuthenticatedUserEnabledForJwt(utente: AccessiAuthenticatedUserSnapshot | null | undefined): utente is AccessiAuthenticatedUserSnapshot;