emilsoftware-utilities 2.0.0-dev.3 → 2.0.0-dev.31

package/dist/accessi-module/Services/TwoFactorService/TwoFactorService.d.ts

@@ -0,0 +1,27 @@
+import type { AccessiOptions } from '../../AccessiModule';
+import { TwoFactorChallengeDto } from '../../Dtos/TwoFactorDtos';
+import { EmailService } from '../EmailService/EmailService';
+export type TwoFactorMode = 'password' | 'passwordless' | 'federated';
+export interface TwoFactorProof {
+    codiceUtente: number;
+    email: string;
+    mode: TwoFactorMode;
+    identityKey?: string;
+}
+/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */
+export declare class TwoFactorService {
+    private readonly options;
+    private readonly emailService;
+    constructor(options: AccessiOptions, emailService: EmailService);
+    private invalid;
+    private limited;
+    private hash;
+    private row;
+    private transaction;
+    private response;
+    private deliver;
+    issue(proof: TwoFactorProof): Promise<TwoFactorChallengeDto>;
+    describe(id: string): Promise<TwoFactorProof>;
+    resend(id: string): Promise<TwoFactorChallengeDto>;
+    consume(id: string, code: string): Promise<TwoFactorProof>;
+}

package/dist/accessi-module/Services/TwoFactorService/TwoFactorService.js

@@ -0,0 +1,175 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const Orm_1 = require("../../../Orm");
+const Utilities_1 = require("../../../Utilities");
+const passwordResetToken_1 = require("../../security/passwordResetToken");
+const EmailService_1 = require("../EmailService/EmailService");
+const LIFETIME_SECONDS = 600;
+const MAX_ATTEMPTS = 5;
+const RESEND_SECONDS = 60;
+const MAX_SENDS = 3;
+const RETURN_FIELDS = 'CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT, ATTEMPTS, SENDS, SENT_AT';
+/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */
+let TwoFactorService = class TwoFactorService {
+    constructor(options, emailService) {
+        this.options = options;
+        this.emailService = emailService;
+    }
+    invalid() {
+        return new common_1.UnauthorizedException({ code: 'ACCESSI_2FA_INVALID', message: 'Codice non valido o scaduto. Ripeti l accesso se hai esaurito i tentativi.' });
+    }
+    limited() {
+        return new common_1.HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);
+    }
+    hash(id, code) {
+        return (0, crypto_1.createHmac)('sha256', (0, passwordResetToken_1.getAccessiJwtSecret)(this.options, '2fa')).update(`accessi-2fa:${id}:${code}`).digest('hex');
+    }
+    row(result) {
+        var _a, _b, _c, _d, _e, _f;
+        const row = (Array.isArray(result) ? result[0] : result);
+        if (!row)
+            return undefined;
+        const raw = Utilities_1.RestUtilities.convertKeysToCamelCase(row);
+        const asString = (value) => typeof value === 'string' ? value : undefined;
+        const codiceUtente = Number(raw.codute);
+        if (!codiceUtente)
+            return undefined;
+        const converted = {
+            codiceUtente,
+            email: (_b = (_a = asString(raw.email)) === null || _a === void 0 ? void 0 : _a.trim()) !== null && _b !== void 0 ? _b : '',
+            mode: (_d = (_c = asString(raw.authmode)) === null || _c === void 0 ? void 0 : _c.trim()) !== null && _d !== void 0 ? _d : 'password',
+            identityKey: (_e = asString(raw.idnkey)) === null || _e === void 0 ? void 0 : _e.trim(),
+            codeHash: (_f = asString(raw.codehash)) !== null && _f !== void 0 ? _f : '',
+            expiresAt: raw.expiresAt,
+            attempts: Number(raw.attempts),
+            sends: Number(raw.sends),
+            sentAt: raw.sentAt,
+        };
+        return converted;
+    }
+    transaction(operation) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return Orm_1.Orm.withTransaction(this.options.databaseOptions, (transaction) => __awaiter(this, void 0, void 0, function* () {
+                const query = (sql, params = []) => Orm_1.Orm.transactionQuery(transaction, sql, params);
+                return operation(query);
+            }));
+        });
+    }
+    response(id, expiresAt) {
+        return { twoFactorRequired: true, challengeId: id, expiresAt: new Date(expiresAt).toISOString(), resendAfterSeconds: RESEND_SECONDS, method: 'email' };
+    }
+    deliver(id, code, email) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield this.emailService.sendTwoFactorCode(email, code, LIFETIME_SECONDS / 60);
+            }
+            catch (_a) {
+                // Invalidate only the code whose delivery failed, preserving a concurrent newer code.
+                yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ? AND CODEHASH = ?', [MAX_ATTEMPTS, id, this.hash(id, code)], false).catch(() => undefined);
+                throw new common_1.ServiceUnavailableException({ code: 'ACCESSI_2FA_DELIVERY_FAILED', message: 'Invio del codice non riuscito. Riprova tra poco.' });
+            }
+        });
+    }
+    issue(proof) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test((_a = proof.email) !== null && _a !== void 0 ? _a : '')) {
+                throw new common_1.ServiceUnavailableException({ code: 'ACCESSI_2FA_EMAIL_REQUIRED', message: 'Per il codice di accesso serve un indirizzo email valido. Contatta un amministratore.' });
+            }
+            const id = (0, crypto_1.randomBytes)(32).toString('hex');
+            const code = String((0, crypto_1.randomInt)(1000000)).padStart(6, '0');
+            const expiresAt = yield this.transaction((query) => __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c, _d, _e, _f;
+                // Serialize issuance for this account across backend instances.
+                yield query('SELECT CODUTE FROM UTENTI WHERE CODUTE = ? WITH LOCK', [proof.codiceUtente]);
+                const recent = yield query('SELECT COUNT(*) AS TOTAL FROM ACCESSI_2FA WHERE CODUTE = ? AND CREATED_AT > DATEADD(-15 MINUTE TO CURRENT_TIMESTAMP)', [proof.codiceUtente]);
+                if (Number((_d = (_b = (_a = recent === null || recent === void 0 ? void 0 : recent[0]) === null || _a === void 0 ? void 0 : _a.TOTAL) !== null && _b !== void 0 ? _b : (_c = recent === null || recent === void 0 ? void 0 : recent[0]) === null || _c === void 0 ? void 0 : _c.total) !== null && _d !== void 0 ? _d : 0) >= 5)
+                    throw this.limited();
+                yield query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');
+                const created = yield query(`INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`, [id, proof.codiceUtente, proof.email, proof.mode, (_e = proof.identityKey) !== null && _e !== void 0 ? _e : null, this.hash(id, code)]);
+                const row = (Array.isArray(created) ? created[0] : created);
+                return ((_f = row === null || row === void 0 ? void 0 : row.EXPIRES_AT) !== null && _f !== void 0 ? _f : row === null || row === void 0 ? void 0 : row.expires_at);
+            }));
+            yield this.deliver(id, code, proof.email);
+            return this.response(id, expiresAt);
+        });
+    }
+    describe(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[a-f0-9]{64}$/.test(id))
+                throw this.invalid();
+            const row = this.row(yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT ${RETURN_FIELDS} FROM ACCESSI_2FA WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ?`, [id, MAX_ATTEMPTS], false));
+            if (!row)
+                throw this.invalid();
+            return row;
+        });
+    }
+    resend(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[a-f0-9]{64}$/.test(id))
+                throw this.invalid();
+            const code = String((0, crypto_1.randomInt)(1000000)).padStart(6, '0');
+            const row = yield this.transaction((query) => __awaiter(this, void 0, void 0, function* () {
+                const result = this.row(yield query(`UPDATE ACCESSI_2FA SET CODEHASH = ?, SENDS = SENDS + 1, SENT_AT = CURRENT_TIMESTAMP WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? AND SENDS < ? AND SENT_AT <= DATEADD(-${RESEND_SECONDS} SECOND TO CURRENT_TIMESTAMP) RETURNING ${RETURN_FIELDS}`, [this.hash(id, code), id, MAX_ATTEMPTS, MAX_SENDS]));
+                if (!result)
+                    throw this.limited();
+                return result;
+            }));
+            yield this.deliver(id, code, row.email);
+            return this.response(id, row.expiresAt);
+        });
+    }
+    consume(id, code) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[a-f0-9]{64}$/.test(id) || !/^\d{6}$/.test(code))
+                throw this.invalid();
+            const proof = yield this.transaction((query) => __awaiter(this, void 0, void 0, function* () {
+                // The conditional write serializes verification and persists failed attempts.
+                const row = this.row(yield query(`UPDATE ACCESSI_2FA SET ATTEMPTS = ATTEMPTS + 1 WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? RETURNING ${RETURN_FIELDS}`, [id, MAX_ATTEMPTS]));
+                if (!row)
+                    return null;
+                const expected = Buffer.from(row.codeHash.trim(), 'hex');
+                const actual = Buffer.from(this.hash(id, code), 'hex');
+                if (expected.length !== actual.length || !(0, crypto_1.timingSafeEqual)(expected, actual))
+                    return null;
+                yield query('UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ?', [MAX_ATTEMPTS, id]);
+                return row;
+            }));
+            // Throw after commit, otherwise a wrong code would roll back the attempt counter.
+            if (!proof)
+                throw this.invalid();
+            return proof;
+        });
+    }
+};
+exports.TwoFactorService = TwoFactorService;
+exports.TwoFactorService = TwoFactorService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object, EmailService_1.EmailService])
+], TwoFactorService);
+//# sourceMappingURL=TwoFactorService.js.map

package/dist/accessi-module/Services/TwoFactorService/TwoFactorService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwoFactorService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/TwoFactorService/TwoFactorService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAuH;AACvH,mCAA6E;AAC7E,sCAAmC;AACnC,kDAAmD;AAGnD,0EAAwE;AACxE,+DAA4D;AAkB5D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,aAAa,GAAG,iFAAiF,CAAC;AAExG,8GAA8G;AAEvG,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAC8C,OAAuB,EAClD,YAA0B;QADC,YAAO,GAAP,OAAO,CAAgB;QAClD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAEI,OAAO;QACb,OAAO,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAAC,CAAC;IAC3J,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,CAAC;IAEO,IAAI,CAAC,EAAU,EAAE,IAAY;QACnC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAA,wCAAmB,EAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1H,CAAC;IAEO,GAAG,CAAC,MAAe;;QACzB,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAwC,CAAC;QAChG,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAE3B,MAAM,GAAG,GAAG,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAEpC,MAAM,SAAS,GAAiB;YAC9B,YAAY;YACZ,KAAK,EAAE,MAAA,MAAA,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,0CAAE,IAAI,EAAE,mCAAI,EAAE;YACxC,IAAI,EAAE,MAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,0CAAE,IAAI,EAAgC,mCAAI,UAAU;YACjF,WAAW,EAAE,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,0CAAE,IAAI,EAAE;YACzC,QAAQ,EAAE,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,mCAAI,EAAE;YACtC,SAAS,EAAE,GAAG,CAAC,SAAiB;YAChC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,EAAE,GAAG,CAAC,MAAc;SAC3B,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEa,WAAW,CAAI,SAAuC;;YAClE,OAAO,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;gBAC7E,MAAM,KAAK,GAAU,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,SAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC1F,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAA,CAAC,CAAC;QACL,CAAC;KAAA;IAEO,QAAQ,CAAC,EAAU,EAAE,SAAe;QAC1C,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzJ,CAAC;IAEa,OAAO,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;;YAC3D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,WAAM,CAAC;gBACP,sFAAsF;gBACtF,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5C,6EAA6E,EAC7E,CAAC,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzE,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;YAC9I,CAAC;QACH,CAAC;KAAA;IAEK,KAAK,CAAC,KAAqB;;;YAC/B,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC,CAAC;YAClL,CAAC;YACD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;;gBACrD,gEAAgE;gBAChE,MAAM,KAAK,CAAC,sDAAsD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC1F,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sHAAsH,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAA+C,CAAC;gBACvN,IAAI,MAAM,CAAC,MAAA,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrF,MAAM,KAAK,CAAC,iFAAiF,CAAC,CAAC;gBAC/F,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB,mIAAmI,gBAAgB,qDAAqD,EACxM,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAA,KAAK,CAAC,WAAW,mCAAI,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAClG,CAAC;gBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;gBACnG,OAAO,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAS,CAAC;YACtD,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;KAAA;IAEK,QAAQ,CAAC,EAAU;;YACvB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC/D,UAAU,aAAa,8FAA8F,EAAE,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACrJ,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC;QACb,CAAC;KAAA;IAEK,MAAM,CAAC,EAAU;;YACrB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CACjC,wMAAwM,cAAc,2CAA2C,aAAa,EAAE,EAChR,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CACnD,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;KAAA;IAEK,OAAO,CAAC,EAAU,EAAE,IAAY;;YACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBACjD,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAC9B,uIAAuI,aAAa,EAAE,EACtJ,CAAC,EAAE,EAAE,YAAY,CAAC,CACnB,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzF,MAAM,KAAK,CAAC,4DAA4D,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO,GAAG,CAAC;YACb,CAAC,CAAA,CAAC,CAAC;YACH,kFAAkF;YAClF,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;CACF,CAAA;AAjIY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,gBAAgB,CAiI5B","sourcesContent":["import { HttpException, Inject, Injectable, ServiceUnavailableException, UnauthorizedException } from '@nestjs/common';\nimport { createHmac, randomBytes, randomInt, timingSafeEqual } from 'crypto';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { TwoFactorChallengeDto } from '../../Dtos/TwoFactorDtos';\nimport { getAccessiJwtSecret } from '../../security/passwordResetToken';\nimport { EmailService } from '../EmailService/EmailService';\n\nexport type TwoFactorMode = 'password' | 'passwordless' | 'federated';\nexport interface TwoFactorProof {\n  codiceUtente: number;\n  email: string;\n  mode: TwoFactorMode;\n  identityKey?: string;\n}\ntype ChallengeRow = TwoFactorProof & {\n  codeHash: string;\n  expiresAt: Date;\n  attempts: number;\n  sends: number;\n  sentAt: Date;\n};\ntype Query = (sql: string, params?: unknown[]) => Promise<unknown>;\n\nconst LIFETIME_SECONDS = 600;\nconst MAX_ATTEMPTS = 5;\nconst RESEND_SECONDS = 60;\nconst MAX_SENDS = 3;\nconst RETURN_FIELDS = 'CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT, ATTEMPTS, SENDS, SENT_AT';\n\n/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */\n@Injectable()\nexport class TwoFactorService {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n    private readonly emailService: EmailService,\n  ) {}\n\n  private invalid(): UnauthorizedException {\n    return new UnauthorizedException({ code: 'ACCESSI_2FA_INVALID', message: 'Codice non valido o scaduto. Ripeti l accesso se hai esaurito i tentativi.' });\n  }\n\n  private limited(): HttpException {\n    return new HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);\n  }\n\n  private hash(id: string, code: string): string {\n    return createHmac('sha256', getAccessiJwtSecret(this.options, '2fa')).update(`accessi-2fa:${id}:${code}`).digest('hex');\n  }\n\n  private row(result: unknown): ChallengeRow | undefined {\n    const row = (Array.isArray(result) ? result[0] : result) as Record<string, unknown> | undefined;\n    if (!row) return undefined;\n\n    const raw = RestUtilities.convertKeysToCamelCase(row);\n    const asString = (value: unknown): string | undefined => typeof value === 'string' ? value : undefined;\n    const codiceUtente = Number(raw.codute);\n    if (!codiceUtente) return undefined;\n\n    const converted: ChallengeRow = {\n      codiceUtente,\n      email: asString(raw.email)?.trim() ?? '',\n      mode: (asString(raw.authmode)?.trim() as TwoFactorMode | undefined) ?? 'password',\n      identityKey: asString(raw.idnkey)?.trim(),\n      codeHash: asString(raw.codehash) ?? '',\n      expiresAt: raw.expiresAt as Date,\n      attempts: Number(raw.attempts),\n      sends: Number(raw.sends),\n      sentAt: raw.sentAt as Date,\n    };\n    return converted;\n  }\n\n  private async transaction<T>(operation: (query: Query) => Promise<T>): Promise<T> {\n    return Orm.withTransaction(this.options.databaseOptions, async (transaction) => {\n      const query: Query = (sql, params = []) => Orm.transactionQuery(transaction, sql, params);\n      return operation(query);\n    });\n  }\n\n  private response(id: string, expiresAt: Date): TwoFactorChallengeDto {\n    return { twoFactorRequired: true, challengeId: id, expiresAt: new Date(expiresAt).toISOString(), resendAfterSeconds: RESEND_SECONDS, method: 'email' };\n  }\n\n  private async deliver(id: string, code: string, email: string): Promise<void> {\n    try {\n      await this.emailService.sendTwoFactorCode(email, code, LIFETIME_SECONDS / 60);\n    } catch {\n      // Invalidate only the code whose delivery failed, preserving a concurrent newer code.\n      await Orm.execute(this.options.databaseOptions,\n        'UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ? AND CODEHASH = ?',\n        [MAX_ATTEMPTS, id, this.hash(id, code)], false).catch(() => undefined);\n      throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_DELIVERY_FAILED', message: 'Invio del codice non riuscito. Riprova tra poco.' });\n    }\n  }\n\n  async issue(proof: TwoFactorProof): Promise<TwoFactorChallengeDto> {\n    if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(proof.email ?? '')) {\n      throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_EMAIL_REQUIRED', message: 'Per il codice di accesso serve un indirizzo email valido. Contatta un amministratore.' });\n    }\n    const id = randomBytes(32).toString('hex');\n    const code = String(randomInt(1000000)).padStart(6, '0');\n    const expiresAt = await this.transaction(async query => {\n      // Serialize issuance for this account across backend instances.\n      await query('SELECT CODUTE FROM UTENTI WHERE CODUTE = ? WITH LOCK', [proof.codiceUtente]);\n      const recent = await query('SELECT COUNT(*) AS TOTAL FROM ACCESSI_2FA WHERE CODUTE = ? AND CREATED_AT > DATEADD(-15 MINUTE TO CURRENT_TIMESTAMP)', [proof.codiceUtente]) as Array<Record<string, unknown>> | undefined;\n      if (Number(recent?.[0]?.TOTAL ?? recent?.[0]?.total ?? 0) >= 5) throw this.limited();\n      await query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');\n      const created = await query(\n        `INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`,\n        [id, proof.codiceUtente, proof.email, proof.mode, proof.identityKey ?? null, this.hash(id, code)],\n      );\n      const row = (Array.isArray(created) ? created[0] : created) as Record<string, unknown> | undefined;\n      return (row?.EXPIRES_AT ?? row?.expires_at) as Date;\n    });\n    await this.deliver(id, code, proof.email);\n    return this.response(id, expiresAt);\n  }\n\n  async describe(id: string): Promise<TwoFactorProof> {\n    if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n    const row = this.row(await Orm.query(this.options.databaseOptions,\n      `SELECT ${RETURN_FIELDS} FROM ACCESSI_2FA WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ?`, [id, MAX_ATTEMPTS], false));\n    if (!row) throw this.invalid();\n    return row;\n  }\n\n  async resend(id: string): Promise<TwoFactorChallengeDto> {\n    if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n    const code = String(randomInt(1000000)).padStart(6, '0');\n    const row = await this.transaction(async query => {\n      const result = this.row(await query(\n        `UPDATE ACCESSI_2FA SET CODEHASH = ?, SENDS = SENDS + 1, SENT_AT = CURRENT_TIMESTAMP WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? AND SENDS < ? AND SENT_AT <= DATEADD(-${RESEND_SECONDS} SECOND TO CURRENT_TIMESTAMP) RETURNING ${RETURN_FIELDS}`,\n        [this.hash(id, code), id, MAX_ATTEMPTS, MAX_SENDS],\n      ));\n      if (!result) throw this.limited();\n      return result;\n    });\n    await this.deliver(id, code, row.email);\n    return this.response(id, row.expiresAt);\n  }\n\n  async consume(id: string, code: string): Promise<TwoFactorProof> {\n    if (!/^[a-f0-9]{64}$/.test(id) || !/^\\d{6}$/.test(code)) throw this.invalid();\n    const proof = await this.transaction(async query => {\n      // The conditional write serializes verification and persists failed attempts.\n      const row = this.row(await query(\n        `UPDATE ACCESSI_2FA SET ATTEMPTS = ATTEMPTS + 1 WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? RETURNING ${RETURN_FIELDS}`,\n        [id, MAX_ATTEMPTS],\n      ));\n      if (!row) return null;\n      const expected = Buffer.from(row.codeHash.trim(), 'hex');\n      const actual = Buffer.from(this.hash(id, code), 'hex');\n      if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) return null;\n      await query('UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ?', [MAX_ATTEMPTS, id]);\n      return row;\n    });\n    // Throw after commit, otherwise a wrong code would roll back the attempt counter.\n    if (!proof) throw this.invalid();\n    return proof;\n  }\n}\n"]}

package/dist/accessi-module/Services/UserService/UserService.d.ts

@@ -1,4 +1,4 @@
-import { AccessiOptions } from '../../AccessiModule';
+import type { AccessiOptions } from '../../AccessiModule';
 import { GetUsersResult } from '../../Dtos/GetUsersResponse';
 import { RegisterRequest } from '../../Dtos/RegisterRequest';
 import { StatoRegistrazione } from '../../Dtos/StatoRegistrazione';
@@ -13,32 +13,82 @@ export declare class UserService {
     private readonly permissionService;
     private readonly filtriService;
     constructor(accessiOptions: AccessiOptions, emailService: EmailService, permissionService: PermissionService, filtriService: FiltriService);
+    private validateApplicationFields;
     private normalizeDatabaseBoolean;
+    private normalizeUserFlags;
     private normalizeEmail;
     private ensureEmailIsAvailable;
+    /** Determina se l'utente puo amministrare il configuratore Accessi (`FLGADMINCONFIG`). */
     isAdminConfigurator(codiceUtente: number): Promise<boolean>;
+    /**
+     * Legge il minimo profilo autorevole usato da JWT e middleware. Restituisce `null` per utenti inesistenti.
+     * Non usare `UserDto` dal token per decisioni di sicurezza: i flag vengono sempre riletti qui.
+     */
     getAuthenticatedUserSnapshot(codiceUtente: number): Promise<AccessiAuthenticatedUserSnapshot | null>;
+    /**
+     * Elenca gli utenti con filtri opzionali. Grant e campi estesi sono costosi e vengono caricati soltanto
+     * quando richiesti esplicitamente nelle opzioni; usare filtri puntuali nei flussi di autenticazione.
+     */
     getUsers(filters?: {
         email?: string;
-        codiceUtente?: number;
+        codiceUtente?: number | number[];
+        numRep?: number | number[];
+        codDipendente?: number;
+        cellulare?: string;
+        cellute?: string;
+        tipFil?: number;
+        flagSuper?: boolean;
+        limit?: number;
+        offset?: number;
     }, options?: {
         includeExtensionFields: boolean;
         includeGrants: boolean;
     }): Promise<GetUsersResult[]>;
+    /** Conteggio utenti con gli stessi filtri di `getUsers`, per la paginazione (header X-Total-Count). */
+    countUsers(filters?: {
+        email?: string;
+        codiceUtente?: number;
+    }): Promise<number>;
+    private loadExtensionFieldsForUsers;
+    private chunkArray;
+    /** Cerca il codice interno per email normalizzata. Il chiamante deve gestire il caso senza righe. */
     getCodiceUtenteByEmail(email: string): Promise<{
         codiceUtente: number;
     }>;
+    /** Recupera il profilo locale usato dal login, compresi filtri Accessi eventualmente presenti. */
     getUserByEmail(email: string): Promise<UserDto | null>;
     insertUserFilters(codiceUtente: number, filterData: RegisterRequest): Promise<void>;
-    private executeInTransaction;
+    /**
+     * Crea utente, configurazione e filtri. La registrazione pubblica resta in stato `INVIO` e non puo
+     * impostare privilegi, ruoli o grant; soltanto flussi backend fidati possono usare `allowPrivilegedFields`.
+     */
     register(registrationData: RegisterRequest, options?: {
         allowPrivilegedFields?: boolean;
+        initialState?: StatoRegistrazione;
     }): Promise<number>;
+    /**
+     * Aggiorna il profilo utente e i filtri. Le modifiche a stato, ruoli, grant e flag amministrativi richiedono
+     * `allowPrivilegedChanges`; gli array ruolo/grant passati in un flusso fidato sostituiscono le assegnazioni.
+     */
     updateUser(codiceUtente: number, user: UserDto, options?: {
         allowPrivilegedChanges?: boolean;
     }): Promise<void>;
     updateUserFilters(codiceUtente: number, user: UserDto): Promise<void>;
+    /** Eliminazione logica: imposta lo stato `DELETE` senza cancellare lo storico o i collegamenti SSO. */
     deleteUser(codiceCliente: number): Promise<void>;
+    /** Cambia esplicitamente lo stato di registrazione; usare questa API per blocco, conferma o eliminazione logica. */
     setStato(codiceCliente: number, statoRegistrazione: StatoRegistrazione): Promise<void>;
-    setGdpr(codiceUtente: number): Promise<any>;
+    setGdpr(codiceUtente: number): Promise<string>;
+    /**
+     * Forza l'invio dell'email di reset password per un utente. Operazione amministrativa.
+     * Richiede un servizio email configurato: altrimenti solleva ACCESSI_EMAIL_NOT_CONFIGURED.
+     */
+    forcePasswordReset(codiceUtente: number): Promise<void>;
+    /**
+     * Forza l'invio dell'email di reset a tutti gli utenti la cui password non e ancora nel formato
+     * moderno (`scrypt$...`), cioe' legacy grezza o `scrypt-legacy` non piu verificabile. Utile quando
+     * la `encryptionKey` storica e perduta. Richiede email configurata. Ritorna quanti utenti hanno
+     * ricevuto l'email.
+     */
+    forcePasswordResetForLegacyPasswords(): Promise<number>;
 }