emilsoftware-utilities 2.0.0-dev.33 → 2.0.0-dev.35
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.MD +14 -0
- package/dist/accessi-module/AccessiModule.d.ts +24 -0
- package/dist/accessi-module/AccessiModule.js.map +1 -1
- package/dist/accessi-module/Console/console.css +10 -0
- package/dist/accessi-module/Console/console.js +133 -11
- package/dist/accessi-module/Console/console.js.map +1 -1
- package/dist/accessi-module/Console/generated/accessiApi.d.ts +2 -2
- package/dist/accessi-module/Console/generated/accessiApi.js.map +1 -1
- package/dist/accessi-module/Console/index.html +6 -0
- package/dist/accessi-module/Console/wiki.js +34 -3
- package/dist/accessi-module/Console/wiki.js.map +1 -1
- package/dist/accessi-module/Controllers/ConfiguratorController.d.ts +1 -3
- package/dist/accessi-module/Controllers/ConfiguratorController.js +4 -17
- package/dist/accessi-module/Controllers/ConfiguratorController.js.map +1 -1
- package/dist/accessi-module/Controllers/FiltriController.js +4 -4
- package/dist/accessi-module/Controllers/FiltriController.js.map +1 -1
- package/dist/accessi-module/Controllers/PermissionController.js +14 -14
- package/dist/accessi-module/Controllers/PermissionController.js.map +1 -1
- package/dist/accessi-module/Controllers/ServiceTokenController.js +1 -1
- package/dist/accessi-module/Controllers/ServiceTokenController.js.map +1 -1
- package/dist/accessi-module/Controllers/UserController.js +8 -8
- package/dist/accessi-module/Controllers/UserController.js.map +1 -1
- package/dist/accessi-module/Services/UserService/UserService.d.ts +0 -2
- package/dist/accessi-module/Services/UserService/UserService.js +0 -16
- package/dist/accessi-module/Services/UserService/UserService.js.map +1 -1
- package/dist/accessi-module/database-updates/AccessiCatalogMigrator.d.ts +64 -0
- package/dist/accessi-module/database-updates/AccessiCatalogMigrator.js +288 -0
- package/dist/accessi-module/database-updates/AccessiCatalogMigrator.js.map +1 -0
- package/dist/accessi-module/database-updates/AccessiDatabaseUpdater.d.ts +6 -0
- package/dist/accessi-module/database-updates/AccessiDatabaseUpdater.js +20 -1
- package/dist/accessi-module/database-updates/AccessiDatabaseUpdater.js.map +1 -1
- package/dist/accessi-module/database-updates/accessiOptionsFromEnv.d.ts +5 -0
- package/dist/accessi-module/database-updates/accessiOptionsFromEnv.js +79 -0
- package/dist/accessi-module/database-updates/accessiOptionsFromEnv.js.map +1 -0
- package/dist/accessi-module/database-updates/accessiSchema.d.ts +1 -1
- package/dist/accessi-module/database-updates/accessiSchema.js +10 -1
- package/dist/accessi-module/database-updates/accessiSchema.js.map +1 -1
- package/dist/accessi-module/database-updates/runAccessiCatalogMigrations.d.ts +1 -0
- package/dist/accessi-module/database-updates/runAccessiCatalogMigrations.js +57 -0
- package/dist/accessi-module/database-updates/runAccessiCatalogMigrations.js.map +1 -0
- package/dist/accessi-module/database-updates/runAccessiDbUpdate.js +2 -58
- package/dist/accessi-module/database-updates/runAccessiDbUpdate.js.map +1 -1
- package/dist/accessi-module/federated-auth/FederatedAuthController.js +15 -15
- package/dist/accessi-module/federated-auth/FederatedAuthController.js.map +1 -1
- package/dist/accessi-module/index.d.ts +3 -0
- package/dist/accessi-module/index.js +8 -1
- package/dist/accessi-module/index.js.map +1 -1
- package/dist/accessi-module/security/accessControl.d.ts +11 -2
- package/dist/accessi-module/security/accessControl.js +28 -4
- package/dist/accessi-module/security/accessControl.js.map +1 -1
- package/dist/emilsoftware-utilities-2.0.0-dev.35.tgz +0 -0
- package/package.json +6 -4
- package/dist/emilsoftware-utilities-2.0.0-dev.33.tgz +0 -0
|
@@ -10,67 +10,11 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
|
|
|
10
10
|
};
|
|
11
11
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
12
12
|
const AccessiDatabaseUpdater_1 = require("./AccessiDatabaseUpdater");
|
|
13
|
-
const
|
|
13
|
+
const accessiOptionsFromEnv_1 = require("./accessiOptionsFromEnv");
|
|
14
14
|
const Orm_1 = require("../../Orm");
|
|
15
|
-
function getEnv(names, fallback) {
|
|
16
|
-
var _a;
|
|
17
|
-
const candidates = Array.isArray(names) ? names : [names];
|
|
18
|
-
const value = (_a = candidates.map((name) => process.env[name]).find((candidate) => candidate !== undefined && candidate !== "")) !== null && _a !== void 0 ? _a : fallback;
|
|
19
|
-
if (!value) {
|
|
20
|
-
throw new Error(`Variabile ambiente mancante: ${candidates.join(" oppure ")}`);
|
|
21
|
-
}
|
|
22
|
-
return value;
|
|
23
|
-
}
|
|
24
|
-
function getOptionalBoolean(name, fallback) {
|
|
25
|
-
const value = process.env[name];
|
|
26
|
-
if (value === undefined) {
|
|
27
|
-
return fallback;
|
|
28
|
-
}
|
|
29
|
-
return value.toLowerCase() === "true";
|
|
30
|
-
}
|
|
31
|
-
function createAccessiOptionsFromEnv() {
|
|
32
|
-
const databaseOptions = Utilities_1.DatabaseUtilities.createOption(getEnv(["ACCESSI_DB_HOST", "ACCESSI_FIREBIRD_HOST"]), Number(getEnv(["ACCESSI_DB_PORT", "ACCESSI_FIREBIRD_PORT"], "3050")), getEnv(["ACCESSI_DB_DATABASE", "ACCESSI_FIREBIRD_DATABASE"]), getEnv(["ACCESSI_DB_USER", "ACCESSI_FIREBIRD_USER"], "SYSDBA"), getEnv(["ACCESSI_DB_PASSWORD", "ACCESSI_FIREBIRD_PASSWORD"], "masterkey"));
|
|
33
|
-
// Firebird 2.5 richiede Legacy_Auth e non supporta la cifratura del wire: override opzionale via env.
|
|
34
|
-
const wireCrypt = process.env.ACCESSI_DB_WIRE_CRYPT;
|
|
35
|
-
const authPlugin = process.env.ACCESSI_DB_AUTH_PLUGIN;
|
|
36
|
-
if (wireCrypt)
|
|
37
|
-
databaseOptions.wireCrypt = wireCrypt;
|
|
38
|
-
if (authPlugin)
|
|
39
|
-
databaseOptions.pluginName = authPlugin;
|
|
40
|
-
return {
|
|
41
|
-
databaseOptions,
|
|
42
|
-
confirmationEmailUrl: getEnv("ACCESSI_CONFIRMATION_EMAIL_URL", "http://localhost"),
|
|
43
|
-
confirmationEmailReturnUrl: getEnv("ACCESSI_CONFIRMATION_RETURN_EMAIL_URL", "http://localhost"),
|
|
44
|
-
confirmationEmailPrefix: process.env.ACCESSI_CONFIRMATION_EMAIL_PREFIX,
|
|
45
|
-
customResetPage: process.env.ACCESSI_CUSTOM_RESET_PAGE,
|
|
46
|
-
encryptionKey: getEnv("ACCESSI_ENCRYPTION_KEY", "1234567890ABCDEF"),
|
|
47
|
-
mockDemoUser: getOptionalBoolean("ACCESSI_MOCK_DEMO_USER", false),
|
|
48
|
-
passwordExpiration: getOptionalBoolean("ACCESSI_PASSWORD_EXPIRATION", false),
|
|
49
|
-
autoUpdateDatabase: true,
|
|
50
|
-
jwtOptions: {
|
|
51
|
-
secret: getEnv("ACCESSI_JWT_SECRET", "local-accessi-update"),
|
|
52
|
-
expiresIn: getEnv("ACCESSI_JWT_EXPIRES", "24h"),
|
|
53
|
-
},
|
|
54
|
-
emailOptions: {
|
|
55
|
-
host: getEnv("ACCESSI_EMAIL_HOST", "localhost"),
|
|
56
|
-
port: Number(getEnv("ACCESSI_EMAIL_PORT", "25")),
|
|
57
|
-
secure: getOptionalBoolean("ACCESSI_EMAIL_SECURE", false),
|
|
58
|
-
requireTLS: getOptionalBoolean("ACCESSI_EMAIL_REQUIRE_TLS", false),
|
|
59
|
-
tls: {
|
|
60
|
-
rejectUnauthorized: getOptionalBoolean("ACCESSI_EMAIL_TLS_REJECT_UNAUTHORIZED", false),
|
|
61
|
-
},
|
|
62
|
-
from: getEnv("ACCESSI_EMAIL_FROM", "noreply@example.local"),
|
|
63
|
-
auth: {
|
|
64
|
-
user: getEnv("ACCESSI_EMAIL_USER", "local-user"),
|
|
65
|
-
pass: getEnv("ACCESSI_EMAIL_PASSWORD", "local-password"),
|
|
66
|
-
},
|
|
67
|
-
},
|
|
68
|
-
extensionFieldsOptions: [],
|
|
69
|
-
};
|
|
70
|
-
}
|
|
71
15
|
function main() {
|
|
72
16
|
return __awaiter(this, void 0, void 0, function* () {
|
|
73
|
-
const options = createAccessiOptionsFromEnv();
|
|
17
|
+
const options = (0, accessiOptionsFromEnv_1.createAccessiOptionsFromEnv)();
|
|
74
18
|
const checkOnly = process.argv.includes('--check');
|
|
75
19
|
console.log(checkOnly ? '[Accessi DB Update] Verifica schema in sola lettura...' : '[Accessi DB Update] Avvio aggiornamento database...');
|
|
76
20
|
console.log(`[Accessi DB Update] Target: ${options.databaseOptions.host}:${options.databaseOptions.port} -> ${options.databaseOptions.database}`);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"runAccessiDbUpdate.js","sourceRoot":"","sources":["../../../src/accessi-module/database-updates/runAccessiDbUpdate.ts"],"names":[],"mappings":";;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"runAccessiDbUpdate.js","sourceRoot":"","sources":["../../../src/accessi-module/database-updates/runAccessiDbUpdate.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,qEAAkE;AAClE,mEAAsE;AACtE,mCAAgC;AAEhC,SAAe,IAAI;;QACjB,MAAM,OAAO,GAAG,IAAA,mDAA2B,GAAE,CAAC;QAE9C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC;QAC1I,OAAO,CAAC,GAAG,CACT,+BAA+B,OAAO,CAAC,eAAe,CAAC,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,CACrI,CAAC;QAEF,IAAI,SAAS;YAAE,MAAM,+CAAsB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;;YACjE,MAAM,+CAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,cAAc,GAAG,MAAM,+CAAsB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CACT,sDAAsD,cAAc,aAAd,cAAc,cAAd,cAAc,GAAI,KAAK,0BAA0B,+CAAsB,CAAC,gBAAgB,EAAE,EAAE,CACnJ,CAAC;IACJ,CAAC;CAAA;AAED,IAAI,EAAE;KACH,IAAI,CAAC,GAAG,EAAE,CAAC,SAAG,CAAC,UAAU,EAAE,CAAC;KAC5B,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC3B,KAAK,CAAC,CAAO,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;IAC5E,MAAM,SAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAA,CAAC,CAAC","sourcesContent":["import { AccessiDatabaseUpdater } from \"./AccessiDatabaseUpdater\";\nimport { createAccessiOptionsFromEnv } from \"./accessiOptionsFromEnv\";\nimport { Orm } from \"../../Orm\";\n\nasync function main(): Promise<void> {\n const options = createAccessiOptionsFromEnv();\n\n const checkOnly = process.argv.includes('--check');\n console.log(checkOnly ? '[Accessi DB Update] Verifica schema in sola lettura...' : '[Accessi DB Update] Avvio aggiornamento database...');\n console.log(\n `[Accessi DB Update] Target: ${options.databaseOptions.host}:${options.databaseOptions.port} -> ${options.databaseOptions.database}`\n );\n\n if (checkOnly) await AccessiDatabaseUpdater.assertCompatible(options);\n else await AccessiDatabaseUpdater.run(options);\n\n const currentVersion = await AccessiDatabaseUpdater.getCurrentVersion(options);\n console.log(\n `[Accessi DB Update] Completato. Versione corrente: ${currentVersion ?? \"N/D\"} | Ultima disponibile: ${AccessiDatabaseUpdater.getLatestVersion()}`\n );\n}\n\nmain()\n .then(() => Orm.closePools())\n .then(() => process.exit(0))\n .catch(async (error) => {\n console.error(\"[Accessi DB Update] Errore durante l'aggiornamento:\", error);\n await Orm.closePools().catch(() => undefined);\n process.exit(1);\n });\n"]}
|
|
@@ -43,7 +43,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
43
43
|
getProviders(request, res) {
|
|
44
44
|
return __awaiter(this, void 0, void 0, function* () {
|
|
45
45
|
try {
|
|
46
|
-
(0, accessControl_1.
|
|
46
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
47
47
|
return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.getProviders());
|
|
48
48
|
}
|
|
49
49
|
catch (error) {
|
|
@@ -54,7 +54,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
54
54
|
createProvider(request, body, res) {
|
|
55
55
|
return __awaiter(this, void 0, void 0, function* () {
|
|
56
56
|
try {
|
|
57
|
-
(0, accessControl_1.
|
|
57
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
58
58
|
return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.createProvider(body), common_1.HttpStatus.CREATED);
|
|
59
59
|
}
|
|
60
60
|
catch (error) {
|
|
@@ -65,7 +65,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
65
65
|
updateProvider(request, provider, body, res) {
|
|
66
66
|
return __awaiter(this, void 0, void 0, function* () {
|
|
67
67
|
try {
|
|
68
|
-
(0, accessControl_1.
|
|
68
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
69
69
|
return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.updateProvider(provider, body));
|
|
70
70
|
}
|
|
71
71
|
catch (error) {
|
|
@@ -76,7 +76,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
76
76
|
deleteProvider(request, provider, res) {
|
|
77
77
|
return __awaiter(this, void 0, void 0, function* () {
|
|
78
78
|
try {
|
|
79
|
-
(0, accessControl_1.
|
|
79
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
80
80
|
yield this.federatedAuthService.deleteProvider(provider);
|
|
81
81
|
return Utilities_1.RestUtilities.sendOKMessage(res, `Provider SSO ${provider} eliminato.`);
|
|
82
82
|
}
|
|
@@ -88,7 +88,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
88
88
|
getIdentities(request, codiceUtente, res) {
|
|
89
89
|
return __awaiter(this, void 0, void 0, function* () {
|
|
90
90
|
try {
|
|
91
|
-
(0, accessControl_1.
|
|
91
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
92
92
|
return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.getUserIdentities(codiceUtente));
|
|
93
93
|
}
|
|
94
94
|
catch (error) {
|
|
@@ -99,7 +99,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
99
99
|
linkIdentity(request, codiceUtente, body, res) {
|
|
100
100
|
return __awaiter(this, void 0, void 0, function* () {
|
|
101
101
|
try {
|
|
102
|
-
(0, accessControl_1.
|
|
102
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
103
103
|
const identity = yield this.federatedAuthService.linkIdentity(codiceUtente, body, body.note);
|
|
104
104
|
return Utilities_1.RestUtilities.sendBaseResponse(res, identity, common_1.HttpStatus.CREATED);
|
|
105
105
|
}
|
|
@@ -111,7 +111,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
111
111
|
createUser(request, body, res) {
|
|
112
112
|
return __awaiter(this, void 0, void 0, function* () {
|
|
113
113
|
try {
|
|
114
|
-
(0, accessControl_1.
|
|
114
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
115
115
|
const identity = yield this.federatedAuthService.createManagedFederatedUser(body.user, body, body.passwordLoginEnabled === true, body.note);
|
|
116
116
|
return Utilities_1.RestUtilities.sendBaseResponse(res, identity, common_1.HttpStatus.CREATED);
|
|
117
117
|
}
|
|
@@ -123,7 +123,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
123
123
|
setPasswordPolicy(request, codiceUtente, body, res) {
|
|
124
124
|
return __awaiter(this, void 0, void 0, function* () {
|
|
125
125
|
try {
|
|
126
|
-
(0, accessControl_1.
|
|
126
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
127
127
|
yield this.federatedAuthService.setPasswordLoginEnabled(codiceUtente, body.passwordLoginEnabled);
|
|
128
128
|
return Utilities_1.RestUtilities.sendOKMessage(res, 'Policy di autenticazione aggiornata.');
|
|
129
129
|
}
|
|
@@ -135,7 +135,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
135
135
|
disableIdentity(request, identityKey, res) {
|
|
136
136
|
return __awaiter(this, void 0, void 0, function* () {
|
|
137
137
|
try {
|
|
138
|
-
(0, accessControl_1.
|
|
138
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
139
139
|
yield this.federatedAuthService.disableIdentity(identityKey);
|
|
140
140
|
return Utilities_1.RestUtilities.sendOKMessage(res, 'Identita SSO disabilitata.');
|
|
141
141
|
}
|
|
@@ -147,7 +147,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
147
147
|
deleteIdentity(request, codiceUtente, identityKey, res) {
|
|
148
148
|
return __awaiter(this, void 0, void 0, function* () {
|
|
149
149
|
try {
|
|
150
|
-
(0, accessControl_1.
|
|
150
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
151
151
|
yield this.federatedAuthService.deleteIdentity(codiceUtente, identityKey);
|
|
152
152
|
return Utilities_1.RestUtilities.sendOKMessage(res, 'Collegamento SSO eliminato definitivamente.');
|
|
153
153
|
}
|
|
@@ -159,7 +159,7 @@ let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthCon
|
|
|
159
159
|
updateIdentity(request, identityKey, body, res) {
|
|
160
160
|
return __awaiter(this, void 0, void 0, function* () {
|
|
161
161
|
try {
|
|
162
|
-
(0, accessControl_1.
|
|
162
|
+
(0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
|
|
163
163
|
yield this.federatedAuthService.updateIdentity(identityKey, body);
|
|
164
164
|
return Utilities_1.RestUtilities.sendOKMessage(res, 'Collegamento SSO aggiornato.');
|
|
165
165
|
}
|
|
@@ -197,7 +197,7 @@ __decorate([
|
|
|
197
197
|
__metadata("design:returntype", Promise)
|
|
198
198
|
], FederatedAuthController.prototype, "createProvider", null);
|
|
199
199
|
__decorate([
|
|
200
|
-
(0, swagger_1.ApiOperation)({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider
|
|
200
|
+
(0, swagger_1.ApiOperation)({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider è immutabile: disabilitarla blocca nuovi login SSO ma conserva i collegamenti storici.' }),
|
|
201
201
|
(0, swagger_1.ApiParam)({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' }),
|
|
202
202
|
(0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.UpdateFederatedProviderRequest }),
|
|
203
203
|
(0, swagger_1.ApiOkResponse)({ type: FederatedIdentityDtos_1.FederatedProviderResponse }),
|
|
@@ -257,7 +257,7 @@ __decorate([
|
|
|
257
257
|
(0, swagger_1.ApiCreatedResponse)({ type: FederatedIdentityDtos_1.FederatedIdentityResponse }),
|
|
258
258
|
(0, swagger_1.ApiResponse)({ status: 400, type: BaseResponse_1.ErrorResponse, description: 'Provider o subject non validi.' }),
|
|
259
259
|
(0, swagger_1.ApiResponse)({ status: 404, type: BaseResponse_1.ErrorResponse, description: 'Provider SSO non censito.' }),
|
|
260
|
-
(0, swagger_1.ApiResponse)({ status: 409, type: BaseResponse_1.ErrorResponse, description: 'Email o
|
|
260
|
+
(0, swagger_1.ApiResponse)({ status: 409, type: BaseResponse_1.ErrorResponse, description: 'Email o identità SSO già associate a un utente.' }),
|
|
261
261
|
(0, swagger_1.ApiResponse)({ status: 503, type: BaseResponse_1.ErrorResponse, description: 'Schema Accessi non aggiornato.' }),
|
|
262
262
|
(0, swagger_1.ApiResponse)({ status: 500, type: BaseResponse_1.ErrorResponse, description: 'Errore inatteso durante il provisioning; la risposta contiene FEDERATED_USER_PROVISIONING_FAILED.' }),
|
|
263
263
|
(0, common_1.Post)('users'),
|
|
@@ -295,11 +295,11 @@ __decorate([
|
|
|
295
295
|
__metadata("design:returntype", Promise)
|
|
296
296
|
], FederatedAuthController.prototype, "disableIdentity", null);
|
|
297
297
|
__decorate([
|
|
298
|
-
(0, swagger_1.ApiOperation)({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall
|
|
298
|
+
(0, swagger_1.ApiOperation)({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall’utente, senza eliminare l’utente Accessi.' }),
|
|
299
299
|
(0, swagger_1.ApiParam)({ name: 'codiceUtente', example: 123 }),
|
|
300
300
|
(0, swagger_1.ApiParam)({ name: 'identityKey', description: 'SHA-256 del collegamento da eliminare.' }),
|
|
301
301
|
(0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
|
|
302
|
-
(0, swagger_1.ApiResponse)({ status: 404, type: BaseResponse_1.ErrorResponse, description: 'Collegamento assente o non appartenente all
|
|
302
|
+
(0, swagger_1.ApiResponse)({ status: 404, type: BaseResponse_1.ErrorResponse, description: 'Collegamento assente o non appartenente all’utente.' }),
|
|
303
303
|
(0, common_1.Delete)('users/:codiceUtente/identities/:identityKey'),
|
|
304
304
|
__param(0, (0, common_1.Req)()),
|
|
305
305
|
__param(1, (0, common_1.Param)('codiceUtente', common_1.ParseIntPipe)),
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"FederatedAuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAiJ;AACjJ,6CAA0I;AAE1I,+CAAgD;AAChD,uDAAqE;AACrE,yEAA8V;AAC9V,sDAAqD;AACrD,6DAAyF;AACzF,iEAA8D;AAE9D;;;;GAIG;AAKI,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAKrE,YAAY,CAAQ,OAAgB,EAAS,GAAa;;YAC9D,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,cAAc,CAAQ,OAAgB,EAAU,IAAoC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YACvH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAU,IAAoC,EAAS,GAAa;;YACnJ,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACzD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,QAAQ,aAAa,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,aAAa,CAAQ,OAAgB,EAAuC,YAAoB,EAAS,GAAa;;YAC1H,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,YAAY,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAoC,EAAS,GAAa;;YACvK,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAWK,UAAU,CAAQ,OAAgB,EAAU,IAAgC,EAAS,GAAa;;YACtG,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,iBAAiB,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAmC,EAAS,GAAa;;YAC3K,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACjG,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,eAAe,CAAQ,OAAgB,EAAwB,WAAmB,EAAS,GAAa;;YAC5G,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC7D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAuC,YAAoB,EAAwB,WAAmB,EAAS,GAAa;;YACtK,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAC1E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAwB,WAAmB,EAAU,IAAoC,EAAS,GAAa;;YACzJ,IAAI,CAAC;gBACH,IAAA,+BAAe,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBACtD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAEO,SAAS,CAAC,GAAa,EAAE,KAAc;QAC7C,MAAM,MAAM,GAAG,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACrG,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;CACF,CAAA;AA1KY,0DAAuB;AAM5B;IAHL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,8HAA8H,EAAE,CAAC;IAC7O,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,YAAG,EAAC,WAAW,CAAC;IACG,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAOjD;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,8IAA8I,EAAE,CAAC;IAC1P,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,WAAW,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAtC,sDAA8B;;6DAOzF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oIAAoI,EAAE,CAAC;IAC7P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IAClD,IAAA,cAAK,EAAC,qBAAqB,CAAC;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAO9H;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC/N,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC1F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;IACnH,IAAA,eAAM,EAAC,qBAAqB,CAAC;IACR,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQxF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;IACpM,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACjD,IAAA,YAAG,EAAC,gCAAgC,CAAC;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4DAO7G;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;IAC1Q,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,gCAAgC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;2DAQlJ;AAWK;IATL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,qHAAqH,EAAE,CAAC;IACtO,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kDAA0B,EAAE,CAAC;IAC7C,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IACjH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mGAAmG,EAAE,CAAC;IACnK,IAAA,aAAI,EAAC,OAAO,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAlC,kDAA0B;;yDAQjF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,6GAA6G,EAAE,CAAC;IAC1O,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,oCAAoC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAuC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAArC,qDAA6B;;gEAQtJ;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,0BAA0B,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IACxL,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,eAAM,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAQ/F;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,oCAAoC,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC9P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACxF,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IACrH,IAAA,eAAM,EAAC,6CAA6C,CAAC;IAChC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQzJ;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,kHAAkH,EAAE,CAAC;IAClO,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAQpI;kCApKU,uBAAuB;IAJnC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAEgB,2CAAoB;GAD5D,uBAAuB,CA0KnC","sourcesContent":["import { Body, Controller, Delete, Get, HttpException, HttpStatus, Param, ParseIntPipe, Patch, Post, Req, Res, UseGuards } from '@nestjs/common';\nimport { ApiBearerAuth, ApiBody, ApiCreatedResponse, ApiOkResponse, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, FederatedIdentityListResponse, FederatedIdentityResponse, FederatedProviderListResponse, FederatedProviderResponse, SetPasswordLoginPolicyRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest } from '../Dtos/FederatedIdentityDtos';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureSuperUser, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { FederatedAuthService } from './FederatedAuthService';\n\n/**\n * Master-only administration API. Authentication itself is intentionally not\n * exposed over HTTP: the hosting backend validates its SSO and calls\n * FederatedAuthService.authenticate({ provider, subject }) directly.\n */\n@ApiTags('Federated authentication')\n@ApiBearerAuth()\n@UseGuards(JwtSimpleGuard)\n@Controller('accessi/federated-auth')\nexport class FederatedAuthController {\n constructor(private readonly federatedAuthService: FederatedAuthService) {}\n\n @ApiOperation({ summary: 'Elenca i provider SSO censiti', operationId: 'getFederatedProviders', description: 'Riservato a superutente. Restituisce solo catalogo e stato Accessi; issuer, secret e configurazioni SSO restano nel backend.' })\n @ApiOkResponse({ type: FederatedProviderListResponse })\n @Get('providers')\n async getProviders(@Req() request: Request, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getProviders());\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Censisce un provider SSO', operationId: 'createFederatedProvider', description: 'Riservato a superutente. La chiave provider deve corrispondere alla configurazione stabile del backend; non salvare segreti, issuer o token.' })\n @ApiBody({ type: CreateFederatedProviderRequest })\n @ApiCreatedResponse({ type: FederatedProviderResponse })\n @Post('providers')\n async createProvider(@Req() request: Request, @Body() body: CreateFederatedProviderRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.createProvider(body), HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider è immutabile: disabilitarla blocca nuovi login SSO ma conserva i collegamenti storici.' })\n @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n @ApiBody({ type: UpdateFederatedProviderRequest })\n @ApiOkResponse({ type: FederatedProviderResponse })\n @Patch('providers/:provider')\n async updateProvider(@Req() request: Request, @Param('provider') provider: string, @Body() body: UpdateFederatedProviderRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.updateProvider(provider, body));\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elimina un provider SSO', operationId: 'deleteFederatedProvider', description: 'Riservato a superutente. Consentito solo se nessuna identita e collegata al provider; in alternativa disabilitalo.' })\n @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider non registrato.' })\n @ApiResponse({ status: 409, type: ErrorResponse, description: 'Provider ancora utilizzato da identita collegate.' })\n @Delete('providers/:provider')\n async deleteProvider(@Req() request: Request, @Param('provider') provider: string, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.deleteProvider(provider);\n return RestUtilities.sendOKMessage(res, `Provider SSO ${provider} eliminato.`);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elenca le identita SSO di un utente', operationId: 'getFederatedIdentities', description: 'Riservato a superutente. Non restituisce token esterni o claim del provider.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiOkResponse({ type: FederatedIdentityListResponse })\n @ApiResponse({ status: 403, type: ErrorResponse })\n @Get('users/:codiceUtente/identities')\n async getIdentities(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getUserIdentities(codiceUtente));\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Associa un SSO gia verificato a un utente esistente', operationId: 'linkFederatedIdentity', description: 'Il master deve fornire un provider e subject ottenuti da una verifica SSO lato backend; questo endpoint non verifica token esterni.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiBody({ type: CreateFederatedIdentityRequest })\n @ApiCreatedResponse({ type: FederatedIdentityResponse })\n @Post('users/:codiceUtente/identities')\n async linkIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: CreateFederatedIdentityRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n const identity = await this.federatedAuthService.linkIdentity(codiceUtente, body, body.note);\n return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Crea un utente gestito e SSO-only', operationId: 'createFederatedUser', description: 'Riservato a superutente. L utente nasce confermato, con identita collegata e senza password salvo opt-in esplicito.' })\n @ApiBody({ type: CreateFederatedUserRequest })\n @ApiCreatedResponse({ type: FederatedIdentityResponse })\n @ApiResponse({ status: 400, type: ErrorResponse, description: 'Provider o subject non validi.' })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider SSO non censito.' })\n @ApiResponse({ status: 409, type: ErrorResponse, description: 'Email o identità SSO già associate a un utente.' })\n @ApiResponse({ status: 503, type: ErrorResponse, description: 'Schema Accessi non aggiornato.' })\n @ApiResponse({ status: 500, type: ErrorResponse, description: 'Errore inatteso durante il provisioning; la risposta contiene FEDERATED_USER_PROVISIONING_FAILED.' })\n @Post('users')\n async createUser(@Req() request: Request, @Body() body: CreateFederatedUserRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n const identity = await this.federatedAuthService.createManagedFederatedUser(body.user, body, body.passwordLoginEnabled === true, body.note);\n return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Abilita o disabilita il login con password', operationId: 'setPasswordLoginPolicy', description: 'Con false il login locale restituisce PASSWORD_LOGIN_DISABLED; le identita SSO attive restano utilizzabili.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiBody({ type: SetPasswordLoginPolicyRequest })\n @ApiOkResponse({ type: ActionResponse })\n @Patch('users/:codiceUtente/password-login')\n async setPasswordPolicy(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: SetPasswordLoginPolicyRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.setPasswordLoginEnabled(codiceUtente, body.passwordLoginEnabled);\n return RestUtilities.sendOKMessage(res, 'Policy di autenticazione aggiornata.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Disabilita un identita SSO', operationId: 'disableFederatedIdentity', description: 'Soft delete: l associazione resta tracciata ma non puo piu autenticare.' })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n @ApiOkResponse({ type: ActionResponse })\n @Delete('identities/:identityKey')\n async disableIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.disableIdentity(identityKey);\n return RestUtilities.sendOKMessage(res, 'Identita SSO disabilitata.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall’utente, senza eliminare l’utente Accessi.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 del collegamento da eliminare.' })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Collegamento assente o non appartenente all’utente.' })\n @Delete('users/:codiceUtente/identities/:identityKey')\n async deleteIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Param('identityKey') identityKey: string, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.deleteIdentity(codiceUtente, identityKey);\n return RestUtilities.sendOKMessage(res, 'Collegamento SSO eliminato definitivamente.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Aggiorna un collegamento SSO', operationId: 'updateFederatedIdentity', description: 'Consente di modificare nota e stato attivo del collegamento. identityKey e una chiave tecnica, non un token SSO.' })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n @ApiBody({ type: UpdateFederatedIdentityRequest })\n @ApiOkResponse({ type: ActionResponse })\n @Patch('identities/:identityKey')\n async updateIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Body() body: UpdateFederatedIdentityRequest, @Res() res: Response) {\n try {\n ensureSuperUser(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.updateIdentity(identityKey, body);\n return RestUtilities.sendOKMessage(res, 'Collegamento SSO aggiornato.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n private sendError(res: Response, error: unknown) {\n const status = error instanceof HttpException ? error.getStatus() : HttpStatus.INTERNAL_SERVER_ERROR;\n return RestUtilities.sendErrorMessage(res, error, FederatedAuthController.name, status);\n }\n}\n"]}
|
|
1
|
+
{"version":3,"file":"FederatedAuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAiJ;AACjJ,6CAA0I;AAE1I,+CAAgD;AAChD,uDAAqE;AACrE,yEAA8V;AAC9V,sDAAqD;AACrD,6DAAqF;AACrF,iEAA8D;AAE9D;;;;GAIG;AAKI,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAKrE,YAAY,CAAQ,OAAgB,EAAS,GAAa;;YAC9D,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,cAAc,CAAQ,OAAgB,EAAU,IAAoC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YACvH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAU,IAAoC,EAAS,GAAa;;YACnJ,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACzD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,QAAQ,aAAa,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,aAAa,CAAQ,OAAgB,EAAuC,YAAoB,EAAS,GAAa;;YAC1H,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,YAAY,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAoC,EAAS,GAAa;;YACvK,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAWK,UAAU,CAAQ,OAAgB,EAAU,IAAgC,EAAS,GAAa;;YACtG,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,iBAAiB,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAmC,EAAS,GAAa;;YAC3K,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACjG,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,eAAe,CAAQ,OAAgB,EAAwB,WAAmB,EAAS,GAAa;;YAC5G,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC7D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAuC,YAAoB,EAAwB,WAAmB,EAAS,GAAa;;YACtK,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAC1E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAwB,WAAmB,EAAU,IAAoC,EAAS,GAAa;;YACzJ,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAEO,SAAS,CAAC,GAAa,EAAE,KAAc;QAC7C,MAAM,MAAM,GAAG,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACrG,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;CACF,CAAA;AA1KY,0DAAuB;AAM5B;IAHL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,8HAA8H,EAAE,CAAC;IAC7O,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,YAAG,EAAC,WAAW,CAAC;IACG,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAOjD;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,8IAA8I,EAAE,CAAC;IAC1P,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,WAAW,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAtC,sDAA8B;;6DAOzF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;IAC9P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IAClD,IAAA,cAAK,EAAC,qBAAqB,CAAC;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAO9H;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC/N,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC1F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;IACnH,IAAA,eAAM,EAAC,qBAAqB,CAAC;IACR,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQxF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;IACpM,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACjD,IAAA,YAAG,EAAC,gCAAgC,CAAC;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4DAO7G;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;IAC1Q,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,gCAAgC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;2DAQlJ;AAWK;IATL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,qHAAqH,EAAE,CAAC;IACtO,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kDAA0B,EAAE,CAAC;IAC7C,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;IACnH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mGAAmG,EAAE,CAAC;IACnK,IAAA,aAAI,EAAC,OAAO,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAlC,kDAA0B;;yDAQjF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,6GAA6G,EAAE,CAAC;IAC1O,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,oCAAoC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAuC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAArC,qDAA6B;;gEAQtJ;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,0BAA0B,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IACxL,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,eAAM,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAQ/F;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,oCAAoC,EAAE,WAAW,EAAE,wHAAwH,EAAE,CAAC;IAClQ,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACxF,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;IACvH,IAAA,eAAM,EAAC,6CAA6C,CAAC;IAChC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQzJ;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,kHAAkH,EAAE,CAAC;IAClO,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAQpI;kCApKU,uBAAuB;IAJnC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAEgB,2CAAoB;GAD5D,uBAAuB,CA0KnC","sourcesContent":["import { Body, Controller, Delete, Get, HttpException, HttpStatus, Param, ParseIntPipe, Patch, Post, Req, Res, UseGuards } from '@nestjs/common';\nimport { ApiBearerAuth, ApiBody, ApiCreatedResponse, ApiOkResponse, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, FederatedIdentityListResponse, FederatedIdentityResponse, FederatedProviderListResponse, FederatedProviderResponse, SetPasswordLoginPolicyRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest } from '../Dtos/FederatedIdentityDtos';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureAdmin, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { FederatedAuthService } from './FederatedAuthService';\n\n/**\n * Master-only administration API. Authentication itself is intentionally not\n * exposed over HTTP: the hosting backend validates its SSO and calls\n * FederatedAuthService.authenticate({ provider, subject }) directly.\n */\n@ApiTags('Federated authentication')\n@ApiBearerAuth()\n@UseGuards(JwtSimpleGuard)\n@Controller('accessi/federated-auth')\nexport class FederatedAuthController {\n constructor(private readonly federatedAuthService: FederatedAuthService) {}\n\n @ApiOperation({ summary: 'Elenca i provider SSO censiti', operationId: 'getFederatedProviders', description: 'Riservato a superutente. Restituisce solo catalogo e stato Accessi; issuer, secret e configurazioni SSO restano nel backend.' })\n @ApiOkResponse({ type: FederatedProviderListResponse })\n @Get('providers')\n async getProviders(@Req() request: Request, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getProviders());\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Censisce un provider SSO', operationId: 'createFederatedProvider', description: 'Riservato a superutente. La chiave provider deve corrispondere alla configurazione stabile del backend; non salvare segreti, issuer o token.' })\n @ApiBody({ type: CreateFederatedProviderRequest })\n @ApiCreatedResponse({ type: FederatedProviderResponse })\n @Post('providers')\n async createProvider(@Req() request: Request, @Body() body: CreateFederatedProviderRequest, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.createProvider(body), HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider è immutabile: disabilitarla blocca nuovi login SSO ma conserva i collegamenti storici.' })\n @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n @ApiBody({ type: UpdateFederatedProviderRequest })\n @ApiOkResponse({ type: FederatedProviderResponse })\n @Patch('providers/:provider')\n async updateProvider(@Req() request: Request, @Param('provider') provider: string, @Body() body: UpdateFederatedProviderRequest, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.updateProvider(provider, body));\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elimina un provider SSO', operationId: 'deleteFederatedProvider', description: 'Riservato a superutente. Consentito solo se nessuna identita e collegata al provider; in alternativa disabilitalo.' })\n @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider non registrato.' })\n @ApiResponse({ status: 409, type: ErrorResponse, description: 'Provider ancora utilizzato da identita collegate.' })\n @Delete('providers/:provider')\n async deleteProvider(@Req() request: Request, @Param('provider') provider: string, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.deleteProvider(provider);\n return RestUtilities.sendOKMessage(res, `Provider SSO ${provider} eliminato.`);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elenca le identita SSO di un utente', operationId: 'getFederatedIdentities', description: 'Riservato a superutente. Non restituisce token esterni o claim del provider.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiOkResponse({ type: FederatedIdentityListResponse })\n @ApiResponse({ status: 403, type: ErrorResponse })\n @Get('users/:codiceUtente/identities')\n async getIdentities(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getUserIdentities(codiceUtente));\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Associa un SSO gia verificato a un utente esistente', operationId: 'linkFederatedIdentity', description: 'Il master deve fornire un provider e subject ottenuti da una verifica SSO lato backend; questo endpoint non verifica token esterni.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiBody({ type: CreateFederatedIdentityRequest })\n @ApiCreatedResponse({ type: FederatedIdentityResponse })\n @Post('users/:codiceUtente/identities')\n async linkIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: CreateFederatedIdentityRequest, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n const identity = await this.federatedAuthService.linkIdentity(codiceUtente, body, body.note);\n return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Crea un utente gestito e SSO-only', operationId: 'createFederatedUser', description: 'Riservato a superutente. L utente nasce confermato, con identita collegata e senza password salvo opt-in esplicito.' })\n @ApiBody({ type: CreateFederatedUserRequest })\n @ApiCreatedResponse({ type: FederatedIdentityResponse })\n @ApiResponse({ status: 400, type: ErrorResponse, description: 'Provider o subject non validi.' })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider SSO non censito.' })\n @ApiResponse({ status: 409, type: ErrorResponse, description: 'Email o identità SSO già associate a un utente.' })\n @ApiResponse({ status: 503, type: ErrorResponse, description: 'Schema Accessi non aggiornato.' })\n @ApiResponse({ status: 500, type: ErrorResponse, description: 'Errore inatteso durante il provisioning; la risposta contiene FEDERATED_USER_PROVISIONING_FAILED.' })\n @Post('users')\n async createUser(@Req() request: Request, @Body() body: CreateFederatedUserRequest, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n const identity = await this.federatedAuthService.createManagedFederatedUser(body.user, body, body.passwordLoginEnabled === true, body.note);\n return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Abilita o disabilita il login con password', operationId: 'setPasswordLoginPolicy', description: 'Con false il login locale restituisce PASSWORD_LOGIN_DISABLED; le identita SSO attive restano utilizzabili.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiBody({ type: SetPasswordLoginPolicyRequest })\n @ApiOkResponse({ type: ActionResponse })\n @Patch('users/:codiceUtente/password-login')\n async setPasswordPolicy(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: SetPasswordLoginPolicyRequest, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.setPasswordLoginEnabled(codiceUtente, body.passwordLoginEnabled);\n return RestUtilities.sendOKMessage(res, 'Policy di autenticazione aggiornata.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Disabilita un identita SSO', operationId: 'disableFederatedIdentity', description: 'Soft delete: l associazione resta tracciata ma non puo piu autenticare.' })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n @ApiOkResponse({ type: ActionResponse })\n @Delete('identities/:identityKey')\n async disableIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.disableIdentity(identityKey);\n return RestUtilities.sendOKMessage(res, 'Identita SSO disabilitata.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall’utente, senza eliminare l’utente Accessi.' })\n @ApiParam({ name: 'codiceUtente', example: 123 })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 del collegamento da eliminare.' })\n @ApiOkResponse({ type: ActionResponse })\n @ApiResponse({ status: 404, type: ErrorResponse, description: 'Collegamento assente o non appartenente all’utente.' })\n @Delete('users/:codiceUtente/identities/:identityKey')\n async deleteIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Param('identityKey') identityKey: string, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.deleteIdentity(codiceUtente, identityKey);\n return RestUtilities.sendOKMessage(res, 'Collegamento SSO eliminato definitivamente.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n @ApiOperation({ summary: 'Aggiorna un collegamento SSO', operationId: 'updateFederatedIdentity', description: 'Consente di modificare nota e stato attivo del collegamento. identityKey e una chiave tecnica, non un token SSO.' })\n @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n @ApiBody({ type: UpdateFederatedIdentityRequest })\n @ApiOkResponse({ type: ActionResponse })\n @Patch('identities/:identityKey')\n async updateIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Body() body: UpdateFederatedIdentityRequest, @Res() res: Response) {\n try {\n ensureAdmin(getAuthenticatedAccessiUser(request));\n await this.federatedAuthService.updateIdentity(identityKey, body);\n return RestUtilities.sendOKMessage(res, 'Collegamento SSO aggiornato.');\n } catch (error) {\n return this.sendError(res, error);\n }\n }\n\n private sendError(res: Response, error: unknown) {\n const status = error instanceof HttpException ? error.getStatus() : HttpStatus.INTERNAL_SERVER_ERROR;\n return RestUtilities.sendErrorMessage(res, error, FederatedAuthController.name, status);\n }\n}\n"]}
|
|
@@ -16,6 +16,9 @@ export { AccessiModule } from "./AccessiModule";
|
|
|
16
16
|
export { AccessiDatabaseUpdater } from "./database-updates/AccessiDatabaseUpdater";
|
|
17
17
|
export type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from "./AccessiModule";
|
|
18
18
|
export type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from "./AccessiModule";
|
|
19
|
+
export type { CatalogScriptsOptions, CatalogScriptChecksumPolicy } from "./AccessiModule";
|
|
20
|
+
export { AccessiCatalogMigrator, applyCatalogScripts, listPendingCatalogScripts, splitSqlStatements, computeCatalogScriptChecksum, discoverCatalogScripts } from "./database-updates/AccessiCatalogMigrator";
|
|
21
|
+
export type { CatalogMigrationReport, CatalogScriptMigration } from "./database-updates/AccessiCatalogMigrator";
|
|
19
22
|
export { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';
|
|
20
23
|
export type { ServiceTokenMetadata, IssuedServiceToken, VerifiedServiceToken, IssueServiceTokenInput } from './Services/ServiceTokenService/ServiceTokenService';
|
|
21
24
|
export { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';
|
|
@@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
|
|
|
26
26
|
return (mod && mod.__esModule) ? mod : { "default": mod };
|
|
27
27
|
};
|
|
28
28
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
29
|
-
exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.ServiceTokenService = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
|
|
29
|
+
exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
|
|
30
30
|
exports.initializeAccessiModule = initializeAccessiModule;
|
|
31
31
|
const express_1 = __importDefault(require("express"));
|
|
32
32
|
const core_1 = require("@nestjs/core");
|
|
@@ -125,6 +125,13 @@ var AccessiModule_2 = require("./AccessiModule");
|
|
|
125
125
|
Object.defineProperty(exports, "AccessiModule", { enumerable: true, get: function () { return AccessiModule_2.AccessiModule; } });
|
|
126
126
|
var AccessiDatabaseUpdater_1 = require("./database-updates/AccessiDatabaseUpdater");
|
|
127
127
|
Object.defineProperty(exports, "AccessiDatabaseUpdater", { enumerable: true, get: function () { return AccessiDatabaseUpdater_1.AccessiDatabaseUpdater; } });
|
|
128
|
+
var AccessiCatalogMigrator_1 = require("./database-updates/AccessiCatalogMigrator");
|
|
129
|
+
Object.defineProperty(exports, "AccessiCatalogMigrator", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.AccessiCatalogMigrator; } });
|
|
130
|
+
Object.defineProperty(exports, "applyCatalogScripts", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.applyCatalogScripts; } });
|
|
131
|
+
Object.defineProperty(exports, "listPendingCatalogScripts", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.listPendingCatalogScripts; } });
|
|
132
|
+
Object.defineProperty(exports, "splitSqlStatements", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.splitSqlStatements; } });
|
|
133
|
+
Object.defineProperty(exports, "computeCatalogScriptChecksum", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.computeCatalogScriptChecksum; } });
|
|
134
|
+
Object.defineProperty(exports, "discoverCatalogScripts", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.discoverCatalogScripts; } });
|
|
128
135
|
var ServiceTokenService_1 = require("./Services/ServiceTokenService/ServiceTokenService");
|
|
129
136
|
Object.defineProperty(exports, "ServiceTokenService", { enumerable: true, get: function () { return ServiceTokenService_1.ServiceTokenService; } });
|
|
130
137
|
var serviceTokenGuard_1 = require("./security/serviceTokenGuard");
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,0DA6EC;AApHD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAAwD;AACxD,kEAIsC;AACtC,qDAAiE;AACjE,oEAA2E;AAC3E,sFAAmF;AACnF,sEAAsE;AAEtE,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,yFAAyF;QACzF,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAI,KAAK,kBAAkB;gBAC3B,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBACpC,IAAI,KAAK,uBAAuB;gBAChC,IAAI,KAAK,uBAAuB,CAAC;YAErC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;aACzC,CAAC,CAAC;YAEH,IAAA,4BAAY,EAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,sBAAsB;gBACvC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,eAAe,GAAG,IAAA,8CAA6B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,eAAe,CAAC,sBAAsB,CAAC;YACvE,IAAA,uCAAqB,EAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAG/B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAO5B,kEAAoH;AAA3G,sHAAA,iBAAiB,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AAAE,2HAAA,sBAAsB,OAAA;AAC7E,oEAAuJ;AAA9I,2HAAA,qBAAqB,OAAA;AAAE,uHAAA,iBAAiB,OAAA;AAAE,oIAAA,8BAA8B,OAAA;AAAE,kIAAA,4BAA4B,OAAA;AAC/G,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA;AAC3B,mDAI0B;AAHtB,+HAAA,6BAA6B,OAAA;AAC7B,0HAAA,wBAAwB,OAAA;AACxB,oIAAA,kCAAkC,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport { setupSwagger } from \"../swagger/SwaggerConfig\";\nimport {\n beginAccessiAuthInitialization,\n failAccessiAuthInitialization,\n setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { registerAccessiModuleServices } from \"./accessiRuntime\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\nimport { assertEmailConfigured } from './security/emailConfiguration';\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n const dbOptions = options.databaseOptions as {\n host?: string;\n port?: number;\n database?: string;\n user?: string;\n };\n\n return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/**\n * Monta il modulo Accessi in un'applicazione Express gia esistente.\n *\n * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,\n * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n *\n * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n */\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<void> {\n // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.\n assertEmailConfigured(options);\n const logger: Logger = new Logger(\"initializeAccessiModule\");\n beginAccessiAuthInitialization();\n const startedAt = performance.now();\n\n try {\n logger.info(\"Inizializzazione modulo accessi avviata.\");\n logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n logger.info(\n `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n );\n const nestHostApp = express();\n const isNestRoute = (path: string) =>\n path === \"/api/accessi\" ||\n path.startsWith(\"/api/accessi/\") ||\n path === \"/accessi/swagger\" ||\n path.startsWith(\"/accessi/swagger/\") ||\n path === \"/accessi/swagger.json\" ||\n path === \"/accessi/swagger-json\";\n\n app.use((req: Request, res, next) => {\n if (!isNestRoute(req.path)) {\n return next();\n }\n\n return nestHostApp(req, res, next);\n });\n\n const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n bufferLogs: true\n });\n logger.info(\"Applicazione Nest accessi creata.\");\n\n nestApp.enableCors({ exposedHeaders: ['X-Total-Count'] });\n nestApp.useGlobalPipes(createAccessiValidationPipe());\n nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\n nestApp.setGlobalPrefix('api', {\n exclude: ['/swagger', '/swagger/(.*)']\n });\n\n setupSwagger(nestApp, {\n swaggerPath: \"accessi/swagger\",\n swaggerJsonPath: \"accessi/swagger.json\",\n title: \"Accessi API Documentation\",\n description: \"API del modulo accessi\",\n });\n logger.info(\"Avvio init del modulo accessi.\");\n await nestApp.init();\n logger.info(\"Init del modulo accessi completata.\");\n if (options.legacyPasswordMigrationOnStartup !== false) {\n logger.info(\"Avvio migrazione password legacy accessi.\");\n const passwordMigrationService = nestApp.get(AuthService);\n await passwordMigrationService.migrateLegacyEncryptedPasswords();\n logger.info(\"Migrazione password legacy accessi completata.\");\n }\n\n const accessiServices = registerAccessiModuleServices(app, nestApp);\n app.locals.accessiAuthService = accessiServices.authenticateGenService;\n setAccessiAuthService(accessiServices.authenticateGenService);\n const elapsedMs = performance.now() - startedAt;\n logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n } catch (error) {\n failAccessiAuthInitialization(error);\n logger.error(\n \"Errore in initialize AccessiModule:\",\n error instanceof Error\n ? { name: error.name, message: error.message, stack: error.stack }\n : { error: String(error) }\n );\n throw error;\n }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from \"./AccessiModule\";\nexport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nexport type {\n ServiceTokenMetadata,\n IssuedServiceToken,\n VerifiedServiceToken,\n IssueServiceTokenInput\n} from './Services/ServiceTokenService/ServiceTokenService';\nexport { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';\nexport { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\n authorizeAccessi,\n authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport {\n registerAccessiModuleServices,\n getAccessiModuleServices,\n ACCESSI_MODULE_SERVICES_LOCALS_KEY\n} from \"./accessiRuntime\";\nexport type { AccessiModuleServices } from \"./accessiRuntime\";\nexport type {\n AccessiAuthorizationOptions,\n AccessiRequirementNode,\n AccessiCustomRequirementContext,\n AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n"]}
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,0DA6EC;AApHD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAAwD;AACxD,kEAIsC;AACtC,qDAAiE;AACjE,oEAA2E;AAC3E,sFAAmF;AACnF,sEAAsE;AAEtE,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,yFAAyF;QACzF,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAI,KAAK,kBAAkB;gBAC3B,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBACpC,IAAI,KAAK,uBAAuB;gBAChC,IAAI,KAAK,uBAAuB,CAAC;YAErC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;aACzC,CAAC,CAAC;YAEH,IAAA,4BAAY,EAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,sBAAsB;gBACvC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,eAAe,GAAG,IAAA,8CAA6B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,eAAe,CAAC,sBAAsB,CAAC;YACvE,IAAA,uCAAqB,EAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAI/B,oFAOmD;AAN/C,gIAAA,sBAAsB,OAAA;AACtB,6HAAA,mBAAmB,OAAA;AACnB,mIAAA,yBAAyB,OAAA;AACzB,4HAAA,kBAAkB,OAAA;AAClB,sIAAA,4BAA4B,OAAA;AAC5B,gIAAA,sBAAsB,OAAA;AAG1B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAO5B,kEAAoH;AAA3G,sHAAA,iBAAiB,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AAAE,2HAAA,sBAAsB,OAAA;AAC7E,oEAAuJ;AAA9I,2HAAA,qBAAqB,OAAA;AAAE,uHAAA,iBAAiB,OAAA;AAAE,oIAAA,8BAA8B,OAAA;AAAE,kIAAA,4BAA4B,OAAA;AAC/G,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA;AAC3B,mDAI0B;AAHtB,+HAAA,6BAA6B,OAAA;AAC7B,0HAAA,wBAAwB,OAAA;AACxB,oIAAA,kCAAkC,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport { setupSwagger } from \"../swagger/SwaggerConfig\";\nimport {\n beginAccessiAuthInitialization,\n failAccessiAuthInitialization,\n setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { registerAccessiModuleServices } from \"./accessiRuntime\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\nimport { assertEmailConfigured } from './security/emailConfiguration';\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n const dbOptions = options.databaseOptions as {\n host?: string;\n port?: number;\n database?: string;\n user?: string;\n };\n\n return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/**\n * Monta il modulo Accessi in un'applicazione Express gia esistente.\n *\n * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,\n * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n *\n * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n */\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<void> {\n // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.\n assertEmailConfigured(options);\n const logger: Logger = new Logger(\"initializeAccessiModule\");\n beginAccessiAuthInitialization();\n const startedAt = performance.now();\n\n try {\n logger.info(\"Inizializzazione modulo accessi avviata.\");\n logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n logger.info(\n `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n );\n const nestHostApp = express();\n const isNestRoute = (path: string) =>\n path === \"/api/accessi\" ||\n path.startsWith(\"/api/accessi/\") ||\n path === \"/accessi/swagger\" ||\n path.startsWith(\"/accessi/swagger/\") ||\n path === \"/accessi/swagger.json\" ||\n path === \"/accessi/swagger-json\";\n\n app.use((req: Request, res, next) => {\n if (!isNestRoute(req.path)) {\n return next();\n }\n\n return nestHostApp(req, res, next);\n });\n\n const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n bufferLogs: true\n });\n logger.info(\"Applicazione Nest accessi creata.\");\n\n nestApp.enableCors({ exposedHeaders: ['X-Total-Count'] });\n nestApp.useGlobalPipes(createAccessiValidationPipe());\n nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\n nestApp.setGlobalPrefix('api', {\n exclude: ['/swagger', '/swagger/(.*)']\n });\n\n setupSwagger(nestApp, {\n swaggerPath: \"accessi/swagger\",\n swaggerJsonPath: \"accessi/swagger.json\",\n title: \"Accessi API Documentation\",\n description: \"API del modulo accessi\",\n });\n logger.info(\"Avvio init del modulo accessi.\");\n await nestApp.init();\n logger.info(\"Init del modulo accessi completata.\");\n if (options.legacyPasswordMigrationOnStartup !== false) {\n logger.info(\"Avvio migrazione password legacy accessi.\");\n const passwordMigrationService = nestApp.get(AuthService);\n await passwordMigrationService.migrateLegacyEncryptedPasswords();\n logger.info(\"Migrazione password legacy accessi completata.\");\n }\n\n const accessiServices = registerAccessiModuleServices(app, nestApp);\n app.locals.accessiAuthService = accessiServices.authenticateGenService;\n setAccessiAuthService(accessiServices.authenticateGenService);\n const elapsedMs = performance.now() - startedAt;\n logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n } catch (error) {\n failAccessiAuthInitialization(error);\n logger.error(\n \"Errore in initialize AccessiModule:\",\n error instanceof Error\n ? { name: error.name, message: error.message, stack: error.stack }\n : { error: String(error) }\n );\n throw error;\n }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from \"./AccessiModule\";\nexport type { CatalogScriptsOptions, CatalogScriptChecksumPolicy } from \"./AccessiModule\";\nexport {\n AccessiCatalogMigrator,\n applyCatalogScripts,\n listPendingCatalogScripts,\n splitSqlStatements,\n computeCatalogScriptChecksum,\n discoverCatalogScripts\n} from \"./database-updates/AccessiCatalogMigrator\";\nexport type { CatalogMigrationReport, CatalogScriptMigration } from \"./database-updates/AccessiCatalogMigrator\";\nexport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nexport type {\n ServiceTokenMetadata,\n IssuedServiceToken,\n VerifiedServiceToken,\n IssueServiceTokenInput\n} from './Services/ServiceTokenService/ServiceTokenService';\nexport { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';\nexport { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\n authorizeAccessi,\n authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport {\n registerAccessiModuleServices,\n getAccessiModuleServices,\n ACCESSI_MODULE_SERVICES_LOCALS_KEY\n} from \"./accessiRuntime\";\nexport type { AccessiModuleServices } from \"./accessiRuntime\";\nexport type {\n AccessiAuthorizationOptions,\n AccessiRequirementNode,\n AccessiCustomRequirementContext,\n AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n"]}
|
|
@@ -11,9 +11,18 @@ export interface AuthenticatedAccessiUser {
|
|
|
11
11
|
* Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.
|
|
12
12
|
*/
|
|
13
13
|
export declare function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser;
|
|
14
|
-
/** Impone il flag superutente
|
|
14
|
+
/** Impone il flag superutente: gestione utenti e dei loro grant. */
|
|
15
15
|
export declare function ensureSuperUser(user: AuthenticatedAccessiUser, message?: string): void;
|
|
16
|
-
/**
|
|
16
|
+
/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */
|
|
17
|
+
export declare function ensureAdmin(user: AuthenticatedAccessiUser, message?: string): void;
|
|
18
|
+
/**
|
|
19
|
+
* Gestione utenti e assegnazioni: consentita a superutenti e admin.
|
|
20
|
+
* `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.
|
|
21
|
+
*/
|
|
22
|
+
export declare function ensureUserManagement(user: AuthenticatedAccessiUser, message?: string): void;
|
|
23
|
+
/** Accesso alla console: superutenti e admin. */
|
|
24
|
+
export declare function ensureConsoleAccess(user: AuthenticatedAccessiUser, message?: string): void;
|
|
25
|
+
/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */
|
|
17
26
|
export declare function ensureSelfOrSuperUser(user: AuthenticatedAccessiUser, targetUserCode: number, message?: string): void;
|
|
18
27
|
/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */
|
|
19
28
|
export declare function hasPrivilegedUserChanges(user: {
|
|
@@ -2,6 +2,9 @@
|
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
3
|
exports.getAuthenticatedAccessiUser = getAuthenticatedAccessiUser;
|
|
4
4
|
exports.ensureSuperUser = ensureSuperUser;
|
|
5
|
+
exports.ensureAdmin = ensureAdmin;
|
|
6
|
+
exports.ensureUserManagement = ensureUserManagement;
|
|
7
|
+
exports.ensureConsoleAccess = ensureConsoleAccess;
|
|
5
8
|
exports.ensureSelfOrSuperUser = ensureSelfOrSuperUser;
|
|
6
9
|
exports.hasPrivilegedUserChanges = hasPrivilegedUserChanges;
|
|
7
10
|
const common_1 = require("@nestjs/common");
|
|
@@ -32,15 +35,36 @@ function getAuthenticatedAccessiUser(req) {
|
|
|
32
35
|
flagAdmin: normalizeBooleanFlag(utente === null || utente === void 0 ? void 0 : utente.flagAdmin),
|
|
33
36
|
};
|
|
34
37
|
}
|
|
35
|
-
/** Impone il flag superutente
|
|
36
|
-
function ensureSuperUser(user, message = 'Operazione riservata
|
|
38
|
+
/** Impone il flag superutente: gestione utenti e dei loro grant. */
|
|
39
|
+
function ensureSuperUser(user, message = 'Operazione riservata ai superutenti.') {
|
|
37
40
|
if (!user.flagSuper) {
|
|
38
41
|
throw new common_1.ForbiddenException(message);
|
|
39
42
|
}
|
|
40
43
|
}
|
|
41
|
-
/**
|
|
44
|
+
/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */
|
|
45
|
+
function ensureAdmin(user, message = 'Operazione riservata agli amministratori.') {
|
|
46
|
+
if (!user.flagAdmin) {
|
|
47
|
+
throw new common_1.ForbiddenException(message);
|
|
48
|
+
}
|
|
49
|
+
}
|
|
50
|
+
/**
|
|
51
|
+
* Gestione utenti e assegnazioni: consentita a superutenti e admin.
|
|
52
|
+
* `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.
|
|
53
|
+
*/
|
|
54
|
+
function ensureUserManagement(user, message = 'Operazione riservata agli amministratori degli utenti.') {
|
|
55
|
+
if (!user.flagSuper && !user.flagAdmin) {
|
|
56
|
+
throw new common_1.ForbiddenException(message);
|
|
57
|
+
}
|
|
58
|
+
}
|
|
59
|
+
/** Accesso alla console: superutenti e admin. */
|
|
60
|
+
function ensureConsoleAccess(user, message = 'La console richiede un superutente o un admin Accessi.') {
|
|
61
|
+
if (!user.flagSuper && !user.flagAdmin) {
|
|
62
|
+
throw new common_1.ForbiddenException(message);
|
|
63
|
+
}
|
|
64
|
+
}
|
|
65
|
+
/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */
|
|
42
66
|
function ensureSelfOrSuperUser(user, targetUserCode, message = 'Operazione non autorizzata su questo utente.') {
|
|
43
|
-
if (user.flagSuper || user.codiceUtente === targetUserCode) {
|
|
67
|
+
if (user.flagSuper || user.flagAdmin || user.codiceUtente === targetUserCode) {
|
|
44
68
|
return;
|
|
45
69
|
}
|
|
46
70
|
throw new common_1.ForbiddenException(message);
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,sDAUC;AAGD,4DAoBC;
|
|
1
|
+
{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,kCAOC;AAMD,oDAOC;AAGD,kDAOC;AAGD,sDAUC;AAGD,4DAoBC;AAtHD,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,sCAAsC;IAEhD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,WAAW,CACzB,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,mBAAmB,CACjC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */\nexport interface AuthenticatedAccessiUser {\n codiceUtente: number;\n email?: string;\n flagSuper: boolean;\n flagAdmin: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n return value === true || value === 1 || value === '1';\n}\n\n/**\n * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n */\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n const payload = (req as Request & { user?: unknown }).user;\n const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\n const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\n ? payloadRecord.userData as Record<string, unknown>\n : undefined;\n const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\n const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\n const codiceUtente = Number(utente?.codiceUtente);\n\n if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n throw new UnauthorizedException('Utente non autenticato.');\n }\n\n return {\n codiceUtente,\n email: typeof utente?.email === 'string' ? utente.email : undefined,\n flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n flagAdmin: normalizeBooleanFlag(utente?.flagAdmin),\n };\n}\n\n/** Impone il flag superutente: gestione utenti e dei loro grant. */\nexport function ensureSuperUser(\n user: AuthenticatedAccessiUser,\n message = 'Operazione riservata ai superutenti.',\n): void {\n if (!user.flagSuper) {\n throw new ForbiddenException(message);\n }\n}\n\n/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */\nexport function ensureAdmin(\n user: AuthenticatedAccessiUser,\n message = 'Operazione riservata agli amministratori.',\n): void {\n if (!user.flagAdmin) {\n throw new ForbiddenException(message);\n }\n}\n\n/**\n * Gestione utenti e assegnazioni: consentita a superutenti e admin.\n * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.\n */\nexport function ensureUserManagement(\n user: AuthenticatedAccessiUser,\n message = 'Operazione riservata agli amministratori degli utenti.',\n): void {\n if (!user.flagSuper && !user.flagAdmin) {\n throw new ForbiddenException(message);\n }\n}\n\n/** Accesso alla console: superutenti e admin. */\nexport function ensureConsoleAccess(\n user: AuthenticatedAccessiUser,\n message = 'La console richiede un superutente o un admin Accessi.',\n): void {\n if (!user.flagSuper && !user.flagAdmin) {\n throw new ForbiddenException(message);\n }\n}\n\n/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */\nexport function ensureSelfOrSuperUser(\n user: AuthenticatedAccessiUser,\n targetUserCode: number,\n message = 'Operazione non autorizzata su questo utente.',\n): void {\n if (user.flagSuper || user.flagAdmin || user.codiceUtente === targetUserCode) {\n return;\n }\n\n throw new ForbiddenException(message);\n}\n\n/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n statoRegistrazione?: unknown;\n flagSuper?: unknown;\n flagAdmin?: unknown;\n passwordLoginEnabled?: unknown;\n passwordlessLoginEnabled?: unknown;\n flagDueFattori?: unknown;\n roles?: unknown;\n permissions?: unknown;\n}): boolean {\n return (\n user.statoRegistrazione !== undefined ||\n user.flagSuper !== undefined ||\n user.flagAdmin !== undefined ||\n user.passwordLoginEnabled !== undefined ||\n user.passwordlessLoginEnabled !== undefined ||\n user.flagDueFattori !== undefined ||\n user.roles !== undefined ||\n user.permissions !== undefined\n );\n}\n"]}
|
|
Binary file
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "emilsoftware-utilities",
|
|
3
|
-
"version": "2.0.0-dev.
|
|
3
|
+
"version": "2.0.0-dev.35",
|
|
4
4
|
"description": "Utilities for EmilSoftware",
|
|
5
5
|
"main": "dist/index.js",
|
|
6
6
|
"module": "dist/index.js",
|
|
@@ -11,16 +11,18 @@
|
|
|
11
11
|
"generate:accessi-openapi": "ts-node --transpile-only src/scripts/generateAccessiOpenApi.ts",
|
|
12
12
|
"generate:accessi-client": "orval --config orval.config.ts",
|
|
13
13
|
"generate:accessi-wiki": "ts-node --transpile-only src/scripts/generateAccessiWiki.ts",
|
|
14
|
-
"build:accessi-console": "esbuild src/accessi-module/Console/console.ts --bundle --platform=browser --format=esm --target=es2020 --outfile=dist/accessi-module/Console/console.js",
|
|
14
|
+
"build:accessi-console": "esbuild src/accessi-module/Console/console.ts --bundle --platform=browser --format=esm --target=es2020 --loader:.md=text --outfile=dist/accessi-module/Console/console.js",
|
|
15
15
|
"copy-views": "node copy-views.js",
|
|
16
16
|
"db:update:accessi": "ts-node src/accessi-module/database-updates/runAccessiDbUpdate.ts",
|
|
17
17
|
"db:update:accessi:dist": "npm run build && node dist/accessi-module/database-updates/runAccessiDbUpdate.js",
|
|
18
|
+
"db:catalog:accessi": "ts-node src/accessi-module/database-updates/runAccessiCatalogMigrations.ts",
|
|
19
|
+
"db:catalog:accessi:check": "ts-node src/accessi-module/database-updates/runAccessiCatalogMigrations.ts --check",
|
|
18
20
|
"prepublishOnly": "npm run build",
|
|
19
21
|
"typecheck": "tsc --noEmit",
|
|
20
22
|
"lint": "node scripts/lint.cjs",
|
|
21
23
|
"test": "npm run typecheck && npm run lint && npm run test:unit",
|
|
22
|
-
"test:unit": "node --test test/accessi-regressions.cjs test/password-reset-regressions.cjs test/two-factor.cjs test/accessi-schema.cjs test/utilities-regressions.cjs test/service-token-regressions.cjs test/accessi-email-config.cjs",
|
|
23
|
-
"test:coverage": "node --experimental-test-coverage --test-coverage-lines=50 --test-coverage-functions=60 --test-coverage-branches=60 --test test/accessi-regressions.cjs test/password-reset-regressions.cjs test/two-factor.cjs test/accessi-schema.cjs test/utilities-regressions.cjs test/service-token-regressions.cjs test/accessi-email-config.cjs",
|
|
24
|
+
"test:unit": "node --test test/accessi-regressions.cjs test/password-reset-regressions.cjs test/two-factor.cjs test/accessi-schema.cjs test/utilities-regressions.cjs test/service-token-regressions.cjs test/accessi-email-config.cjs test/accessi-catalog-scripts.cjs",
|
|
25
|
+
"test:coverage": "node --experimental-test-coverage --test-coverage-lines=50 --test-coverage-functions=60 --test-coverage-branches=60 --test test/accessi-regressions.cjs test/password-reset-regressions.cjs test/two-factor.cjs test/accessi-schema.cjs test/utilities-regressions.cjs test/service-token-regressions.cjs test/accessi-email-config.cjs test/accessi-catalog-scripts.cjs",
|
|
24
26
|
"test:accessi": "npm run test:unit",
|
|
25
27
|
"test:all": "npm test && npm run test:integration",
|
|
26
28
|
"test:integration": "node test/integration/run-firebird.cjs 5",
|
|
Binary file
|