emilsoftware-utilities 2.0.0-dev.36 → 2.0.0-dev.38

package/dist/accessi-module/Controllers/AuthController.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4G;AAC5G,yDAAuF;AACvF,6CAAwF;AAExF,yCAAsC;AACtC,+CAAgD;AAEhD,kCASiB;AACjB,qEAA2F;AAC3F,yEAGyC;AAQlC,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YACmB,WAAwB,EACd,OAAwC;QADlD,gBAAW,GAAX,WAAW,CAAa;QACG,YAAO,GAAP,OAAO,CAAgB;QAJrE,WAAM,GAAW,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAK9C,CAAC;IAgBE,aAAa,CACV,OAAgB,EAChB,GAAa,EACJ,KAAa,EACrB,IAAiC;;YAEzC,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,sBAAsB,EACtB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;KAAA;IAkBK,cAAc,CACX,OAAgB,EACf,IAA2B,EAC5B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,gBAAgB,EAChB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,EAAE,CAAC;oBACjB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,mBAAmB,EACnB,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7F,MAAM,QAAQ,GAAI,oBAA6C,aAA7C,oBAAoB,uBAApB,oBAAoB,CAA2B,MAAM,CAAC;gBACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;gBAED,2EAA2E;gBAC3E,sFAAsF;gBACtF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;KAAA;IA0BK,KAAK,CAAQ,OAAgB,EAAU,YAA0B,EAAS,GAAa;;YAC3F,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,OAAO,EACP,CAAC,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,CAAC,CACtB,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,gBAAgB;oBAAE,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAE3I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,kBAAkB,EAAE,CAAC;oBACrD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACnE,OAAO,yBAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,KAAK,YAAY,sBAAa,EAAE,CAAC;oBACnC,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5F,CAAC;gBAED,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,qCAAuB,EAAE,CAAC;oBAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;wBAC3C,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;wBAC9D,IAAI,EAAE,qCAAuB;wBAC7B,KAAK,EAAE,qCAAuB;wBAC9B,OAAO,EAAE,+EAA+E;qBACzF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBACpD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;gBACJ,CAAC;gBACD,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBACrG,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAClH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBACrG,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA9MY,wCAAc;AAsBnB;IAdL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kCAA2B,EAAE,CAAC;IAC9C,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kCAAkC;QAC/C,IAAI,EAAE,qBAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,+BAA+B,CAAC;IAEnC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,aAAI,GAAE,CAAA;;6DAAO,kCAA2B;;mDAiB1C;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,gBAAgB;KAC9B,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAsB;KAC7B,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,4BAA4B;QACzC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IAEvB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,4BAAqB;;oDAkCpC;AA0BK;IAxBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,wOAAwO;QAC1O,WAAW,EAAE,OAAO;KACrB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,mBAAY,EAAE,CAAC;IAC/B,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,wBAAwB;QACrC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,8BAAuB;KAC9B,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC9F,IAAA,aAAI,EAAC,OAAO,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAApB,mBAAY;;2CAkDtE;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACnG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACzG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;yBA7MU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAME,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCADI,yBAAW;GAJhC,cAAc,CA8M1B","sourcesContent":["import { Body, Controller, HttpException, HttpStatus, Inject, Param, Post, Req, Res } from '@nestjs/common';\nimport { ResendTwoFactorRequest, VerifyTwoFactorRequest } from '../Dtos/TwoFactorDtos';\nimport { ApiBody, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n  ActionResponse,\n  ConfirmResetPasswordRequest,\n  ErrorResponse,\n  GetUserByTokenRequest,\n  GetUserByTokenResponse,\n  LoginRequest,\n  LoginResponse,\n  PasswordExpiredResponse,\n} from '../Dtos';\nimport { AuthService, PASSWORD_LOGIN_DISABLED } from '../Services/AuthService/AuthService';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n@ApiTags('Auth')\n@Controller('accessi/auth')\n/**\n * Endpoint pubblici di autenticazione locale e verifica sessione.\n * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.\n */\nexport class AuthController {\n  logger: Logger = new Logger(AuthController.name);\n\n  constructor(\n    private readonly authService: AuthService,\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n  ) {}\n\n  @ApiOperation({ summary: 'Conferma il reset della password', operationId: 'resetPassword' })\n  @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\n  @ApiBody({ type: ConfirmResetPasswordRequest })\n  @ApiResponse({\n    status: 200,\n    description: 'Password aggiornata con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nella richiesta o token non valido',\n    type: ErrorResponse,\n  })\n  @Post('confirm-reset-password/:token')\n  async resetPassword(\n    @Req() request: Request,\n    @Res() res: Response,\n    @Param('token') token: string,\n    @Body() body: ConfirmResetPasswordRequest,\n  ) {\n    try {\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.options,\n        'passwordResetConfirm',\n        request,\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      await this.authService.confirmResetPassword(token, body.newPassword);\n      return RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.BAD_REQUEST);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Recupera le informazioni utente dal token JWT',\n    operationId: 'getUserByToken',\n  })\n  @ApiBody({ type: GetUserByTokenRequest })\n  @ApiResponse({\n    status: 200,\n    description: 'Informazioni utente recuperate con successo',\n    type: GetUserByTokenResponse,\n  })\n  @ApiResponse({\n    status: 401,\n    description: 'Token non valido o scaduto',\n    type: ErrorResponse,\n  })\n  @Post('get-user-by-token')\n  async getUserByToken(\n    @Req() request: Request,\n    @Body() body: GetUserByTokenRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.options,\n        'getUserByToken',\n        request,\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      if (!body?.token) {\n        return RestUtilities.sendErrorMessage(\n          res,\n          'Token non fornito',\n          AuthController.name,\n          HttpStatus.BAD_REQUEST,\n        );\n      }\n\n      const authenticatedPayload = await this.authService.getAuthenticatedTokenPayload(body.token);\n      const userData = (authenticatedPayload as { utente?: unknown })?.utente;\n      if (!userData) {\n        throw new Error('Il token non contiene un utente Accessi valido.');\n      }\n\n      // Keep the runtime response aligned with GetUserByTokenResponse and Orval:\n      // Result.userData contains the authenticated user directly, not a nested JWT payload.\n      return RestUtilities.sendBaseResponse(res, { userData });\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.UNAUTHORIZED);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Effettua il login utente',\n    description:\n      \"Con sola email restituisce passwordRequired oppure avvia il codice per utenti passwordless. Con password valida restituisce il login completo o challenge se la 2FA e attiva. Nessun JWT viene emesso prima della verifica del codice.\",\n    operationId: 'login',\n  })\n  @ApiBody({ type: LoginRequest })\n  @ApiResponse({\n    status: 200,\n    description: 'Login effettuato con successo',\n    type: LoginResponse,\n  })\n  @ApiResponse({\n    status: 401,\n    description: 'Credenziali non valide',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: 403,\n    description: 'Password scaduta, e necessario aggiornarla.',\n    type: PasswordExpiredResponse,\n  })\n  @ApiResponse({ status: 403, description: 'Utente abilitato solo a SSO.', type: ErrorResponse })\n  @Post('login')\n  async login(@Req() request: Request, @Body() loginRequest: LoginRequest, @Res() res: Response) {\n    try {\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.options,\n        'login',\n        request,\n        [loginRequest?.email],\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      const userData = await this.authService.login(loginRequest);\n      if (!userData) {\n        return RestUtilities.sendInvalidCredentials(res);\n      }\n\n      if (!userData.challenge && !userData.passwordRequired) userData.token = this.authService.createAccessiToken(userData.utente, ['password']);\n\n      return RestUtilities.sendBaseResponse(res, userData);\n    } catch (error) {\n      if ((error as Error)?.message === 'PASSWORD_EXPIRED') {\n        this.logger.warning('Password scaduta, cambiare password ', error);\n        return RestUtilities.sendPasswordExpired(res);\n      }\n\n      if (error instanceof HttpException) {\n        return RestUtilities.sendErrorMessage(res, error, AuthController.name, error.getStatus());\n      }\n\n      if ((error as Error)?.message === PASSWORD_LOGIN_DISABLED) {\n        return res.status(HttpStatus.FORBIDDEN).json({\n          severity: 'error', status: HttpStatus.FORBIDDEN, statusCode: 2,\n          code: PASSWORD_LOGIN_DISABLED,\n          error: PASSWORD_LOGIN_DISABLED,\n          message: 'Questo utente e abilitato solo tramite SSO. Accedi con un provider collegato.',\n        });\n      }\n\n      this.logger.error('Errore durante il login', error);\n      if (RestUtilities.isDatabaseSchemaError(error)) {\n        return RestUtilities.sendErrorMessage(\n          res,\n          error,\n          AuthController.name,\n          HttpStatus.SERVICE_UNAVAILABLE,\n        );\n      }\n      return RestUtilities.sendInvalidCredentials(res);\n    }\n  }\n\n  @Post('two-factor/verify')\n  @ApiOperation({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' })\n  @ApiBody({ type: VerifyTwoFactorRequest })\n  @ApiResponse({ status: 200, type: LoginResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse })\n  @ApiResponse({ status: 429, type: ErrorResponse })\n  async verifyTwoFactor(@Req() request: Request, @Body() body: VerifyTwoFactorRequest, @Res() res: Response) {\n    try {\n      const limit = checkPublicAuthRateLimit(this.options, 'twoFactorVerify', request, [body.challengeId]);\n      if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n      return RestUtilities.sendBaseResponse(res, await this.authService.verifyTwoFactor(body.challengeId, body.code));\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n    }\n  }\n\n  @Post('two-factor/resend')\n  @ApiOperation({ summary: 'Reinvia il codice, invalidando il precedente', operationId: 'resendTwoFactor' })\n  @ApiBody({ type: ResendTwoFactorRequest })\n  @ApiResponse({ status: 200, type: LoginResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse })\n  @ApiResponse({ status: 429, type: ErrorResponse })\n  async resendTwoFactor(@Req() request: Request, @Body() body: ResendTwoFactorRequest, @Res() res: Response) {\n    try {\n      const limit = checkPublicAuthRateLimit(this.options, 'twoFactorResend', request, [body.challengeId]);\n      if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n      return RestUtilities.sendBaseResponse(res, await this.authService.resendTwoFactor(body.challengeId));\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n    }\n  }\n}\n"]}
+{"version":3,"file":"AuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/AuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4G;AAC5G,yDAAuF;AACvF,6CAAwF;AAExF,yCAAsC;AACtC,+CAAgD;AAEhD,kCAWiB;AACjB,qEAA2F;AAC3F,mGAAgG;AAChG,yEAGyC;AAQlC,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YACmB,WAAwB,EACxB,qBAA4C,EAClC,OAAwC;QAFlD,gBAAW,GAAX,WAAW,CAAa;QACxB,0BAAqB,GAArB,qBAAqB,CAAuB;QACjB,YAAO,GAAP,OAAO,CAAgB;QALrE,WAAM,GAAW,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAM9C,CAAC;IAgBE,aAAa,CACV,OAAgB,EAChB,GAAa,EACJ,KAAa,EACrB,IAAiC;;YAEzC,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,sBAAsB,EACtB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACrE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,mCAAmC,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,WAAW,CAAC,CAAC;YACjG,CAAC;QACH,CAAC;KAAA;IAkBK,cAAc,CACX,OAAgB,EACf,IAA2B,EAC5B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,gBAAgB,EAChB,OAAO,CACR,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAI,CAAC,CAAA,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,KAAK,CAAA,EAAE,CAAC;oBACjB,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,mBAAmB,EACnB,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,WAAW,CACvB,CAAC;gBACJ,CAAC;gBAED,MAAM,oBAAoB,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC7F,MAAM,QAAQ,GAAI,oBAA6C,aAA7C,oBAAoB,uBAApB,oBAAoB,CAA2B,MAAM,CAAC;gBACxE,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;gBACrE,CAAC;gBAED,2EAA2E;gBAC3E,sFAAsF;gBACtF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;YAC3D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,mBAAU,CAAC,YAAY,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;KAAA;IA0BK,KAAK,CAAQ,OAAgB,EAAU,YAA0B,EAAS,GAAa;;YAC3F,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,OAAO,EACZ,OAAO,EACP,OAAO,EACP,CAAC,YAAY,aAAZ,YAAY,uBAAZ,YAAY,CAAE,KAAK,CAAC,CACtB,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAC5D,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;gBACnD,CAAC;gBAED,IAAI,CAAC,QAAQ,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,gBAAgB;oBAAE,QAAQ,CAAC,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;gBAE3I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,kBAAkB,EAAE,CAAC;oBACrD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,sCAAsC,EAAE,KAAK,CAAC,CAAC;oBACnE,OAAO,yBAAa,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC;gBAChD,CAAC;gBAED,IAAI,KAAK,YAAY,sBAAa,EAAE,CAAC;oBACnC,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;gBAC5F,CAAC;gBAED,IAAI,CAAC,KAAe,aAAf,KAAK,uBAAL,KAAK,CAAY,OAAO,MAAK,qCAAuB,EAAE,CAAC;oBAC1D,OAAO,GAAG,CAAC,MAAM,CAAC,mBAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC;wBAC3C,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAU,CAAC,SAAS,EAAE,UAAU,EAAE,CAAC;wBAC9D,IAAI,EAAE,qCAAuB;wBAC7B,KAAK,EAAE,qCAAuB;wBAC9B,OAAO,EAAE,+EAA+E;qBACzF,CAAC,CAAC;gBACL,CAAC;gBAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;gBACpD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,KAAK,EACL,gBAAc,CAAC,IAAI,EACnB,mBAAU,CAAC,mBAAmB,CAC/B,CAAC;gBACJ,CAAC;gBACD,OAAO,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBACrG,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAClH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAQK,eAAe,CAAQ,OAAgB,EAAU,IAA4B,EAAS,GAAa;;YACvG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;gBACrG,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC;YACvG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;IAeK,cAAc,CAAQ,OAAgB,EAAU,IAA2B,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAA,8CAAwB,EAAC,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;gBAChF,IAAI,CAAC,KAAK,CAAC,OAAO;oBAAE,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC;gBACzF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;YAC/F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;YACnI,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAtOY,wCAAc;AAuBnB;IAdL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,kCAAkC,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC7F,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kCAA2B,EAAE,CAAC;IAC9C,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,kCAAkC;QAC/C,IAAI,EAAE,qBAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,+BAA+B,CAAC;IAEnC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,aAAI,GAAE,CAAA;;6DAAO,kCAA2B;;mDAiB1C;AAkBK;IAhBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,gBAAgB;KAC9B,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAsB;KAC7B,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,4BAA4B;QACzC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,mBAAmB,CAAC;IAEvB,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,4BAAqB;;oDAkCpC;AA0BK;IAxBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EACT,wOAAwO;QAC1O,WAAW,EAAE,OAAO;KACrB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,mBAAY,EAAE,CAAC;IAC/B,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,wBAAwB;QACrC,IAAI,EAAE,oBAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,8BAAuB;KAC9B,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,8BAA8B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC9F,IAAA,aAAI,EAAC,OAAO,CAAC;IACD,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA8B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAApB,mBAAY;;2CAkDtE;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,wCAAwC,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACnG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAQK;IANL,IAAA,aAAI,EAAC,mBAAmB,CAAC;IACzB,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8CAA8C,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;IACzG,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sCAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC3B,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAgC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA9B,sCAAsB;;qDAQlF;AAeK;IAbL,IAAA,aAAI,EAAC,iBAAiB,CAAC;IACvB,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,gBAAgB;QAC7B,WAAW,EACT,4FAA4F;YAC5F,mHAAmH;KACtH,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAqB,EAAE,CAAC;IACxC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,6BAAsB,EAAE,CAAC;IAC1D,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC/F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kBAAkB,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IAC7D,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAA+B,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAA7B,4BAAqB;;oDAQhF;yBArOU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAOE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFI,yBAAW;QACD,6CAAqB;GALpD,cAAc,CAsO1B","sourcesContent":["import { Body, Controller, HttpException, HttpStatus, Inject, Param, Post, Req, Res } from '@nestjs/common';\nimport { ResendTwoFactorRequest, VerifyTwoFactorRequest } from '../Dtos/TwoFactorDtos';\nimport { ApiBody, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport {\n  ActionResponse,\n  BootstrapAdminRequest,\n  BootstrapAdminResponse,\n  ConfirmResetPasswordRequest,\n  ErrorResponse,\n  GetUserByTokenRequest,\n  GetUserByTokenResponse,\n  LoginRequest,\n  LoginResponse,\n  PasswordExpiredResponse,\n} from '../Dtos';\nimport { AuthService, PASSWORD_LOGIN_DISABLED } from '../Services/AuthService/AuthService';\nimport { AdminBootstrapService } from '../Services/AdminBootstrapService/AdminBootstrapService';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\n\n@ApiTags('Auth')\n@Controller('accessi/auth')\n/**\n * Endpoint pubblici di autenticazione locale e verifica sessione.\n * Il login SSO non riceve token esterni qui: il backend validante usa `FederatedAuthService.authenticate`.\n */\nexport class AuthController {\n  logger: Logger = new Logger(AuthController.name);\n\n  constructor(\n    private readonly authService: AuthService,\n    private readonly adminBootstrapService: AdminBootstrapService,\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n  ) {}\n\n  @ApiOperation({ summary: 'Conferma il reset della password', operationId: 'resetPassword' })\n  @ApiParam({ name: 'token', description: 'Token per il reset della password', required: true })\n  @ApiBody({ type: ConfirmResetPasswordRequest })\n  @ApiResponse({\n    status: 200,\n    description: 'Password aggiornata con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nella richiesta o token non valido',\n    type: ErrorResponse,\n  })\n  @Post('confirm-reset-password/:token')\n  async resetPassword(\n    @Req() request: Request,\n    @Res() res: Response,\n    @Param('token') token: string,\n    @Body() body: ConfirmResetPasswordRequest,\n  ) {\n    try {\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.options,\n        'passwordResetConfirm',\n        request,\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      await this.authService.confirmResetPassword(token, body.newPassword);\n      return RestUtilities.sendOKMessage(res, 'Password aggiornata con successo!');\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.BAD_REQUEST);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Recupera le informazioni utente dal token JWT',\n    operationId: 'getUserByToken',\n  })\n  @ApiBody({ type: GetUserByTokenRequest })\n  @ApiResponse({\n    status: 200,\n    description: 'Informazioni utente recuperate con successo',\n    type: GetUserByTokenResponse,\n  })\n  @ApiResponse({\n    status: 401,\n    description: 'Token non valido o scaduto',\n    type: ErrorResponse,\n  })\n  @Post('get-user-by-token')\n  async getUserByToken(\n    @Req() request: Request,\n    @Body() body: GetUserByTokenRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.options,\n        'getUserByToken',\n        request,\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      if (!body?.token) {\n        return RestUtilities.sendErrorMessage(\n          res,\n          'Token non fornito',\n          AuthController.name,\n          HttpStatus.BAD_REQUEST,\n        );\n      }\n\n      const authenticatedPayload = await this.authService.getAuthenticatedTokenPayload(body.token);\n      const userData = (authenticatedPayload as { utente?: unknown })?.utente;\n      if (!userData) {\n        throw new Error('Il token non contiene un utente Accessi valido.');\n      }\n\n      // Keep the runtime response aligned with GetUserByTokenResponse and Orval:\n      // Result.userData contains the authenticated user directly, not a nested JWT payload.\n      return RestUtilities.sendBaseResponse(res, { userData });\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, HttpStatus.UNAUTHORIZED);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Effettua il login utente',\n    description:\n      \"Con sola email restituisce passwordRequired oppure avvia il codice per utenti passwordless. Con password valida restituisce il login completo o challenge se la 2FA e attiva. Nessun JWT viene emesso prima della verifica del codice.\",\n    operationId: 'login',\n  })\n  @ApiBody({ type: LoginRequest })\n  @ApiResponse({\n    status: 200,\n    description: 'Login effettuato con successo',\n    type: LoginResponse,\n  })\n  @ApiResponse({\n    status: 401,\n    description: 'Credenziali non valide',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: 403,\n    description: 'Password scaduta, e necessario aggiornarla.',\n    type: PasswordExpiredResponse,\n  })\n  @ApiResponse({ status: 403, description: 'Utente abilitato solo a SSO.', type: ErrorResponse })\n  @Post('login')\n  async login(@Req() request: Request, @Body() loginRequest: LoginRequest, @Res() res: Response) {\n    try {\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.options,\n        'login',\n        request,\n        [loginRequest?.email],\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      const userData = await this.authService.login(loginRequest);\n      if (!userData) {\n        return RestUtilities.sendInvalidCredentials(res);\n      }\n\n      if (!userData.challenge && !userData.passwordRequired) userData.token = this.authService.createAccessiToken(userData.utente, ['password']);\n\n      return RestUtilities.sendBaseResponse(res, userData);\n    } catch (error) {\n      if ((error as Error)?.message === 'PASSWORD_EXPIRED') {\n        this.logger.warning('Password scaduta, cambiare password ', error);\n        return RestUtilities.sendPasswordExpired(res);\n      }\n\n      if (error instanceof HttpException) {\n        return RestUtilities.sendErrorMessage(res, error, AuthController.name, error.getStatus());\n      }\n\n      if ((error as Error)?.message === PASSWORD_LOGIN_DISABLED) {\n        return res.status(HttpStatus.FORBIDDEN).json({\n          severity: 'error', status: HttpStatus.FORBIDDEN, statusCode: 2,\n          code: PASSWORD_LOGIN_DISABLED,\n          error: PASSWORD_LOGIN_DISABLED,\n          message: 'Questo utente e abilitato solo tramite SSO. Accedi con un provider collegato.',\n        });\n      }\n\n      this.logger.error('Errore durante il login', error);\n      if (RestUtilities.isDatabaseSchemaError(error)) {\n        return RestUtilities.sendErrorMessage(\n          res,\n          error,\n          AuthController.name,\n          HttpStatus.SERVICE_UNAVAILABLE,\n        );\n      }\n      return RestUtilities.sendInvalidCredentials(res);\n    }\n  }\n\n  @Post('two-factor/verify')\n  @ApiOperation({ summary: 'Verifica il codice e completa il login', operationId: 'verifyTwoFactor' })\n  @ApiBody({ type: VerifyTwoFactorRequest })\n  @ApiResponse({ status: 200, type: LoginResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse })\n  @ApiResponse({ status: 429, type: ErrorResponse })\n  async verifyTwoFactor(@Req() request: Request, @Body() body: VerifyTwoFactorRequest, @Res() res: Response) {\n    try {\n      const limit = checkPublicAuthRateLimit(this.options, 'twoFactorVerify', request, [body.challengeId]);\n      if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n      return RestUtilities.sendBaseResponse(res, await this.authService.verifyTwoFactor(body.challengeId, body.code));\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n    }\n  }\n\n  @Post('two-factor/resend')\n  @ApiOperation({ summary: 'Reinvia il codice, invalidando il precedente', operationId: 'resendTwoFactor' })\n  @ApiBody({ type: ResendTwoFactorRequest })\n  @ApiResponse({ status: 200, type: LoginResponse })\n  @ApiResponse({ status: 401, type: ErrorResponse })\n  @ApiResponse({ status: 429, type: ErrorResponse })\n  async resendTwoFactor(@Req() request: Request, @Body() body: ResendTwoFactorRequest, @Res() res: Response) {\n    try {\n      const limit = checkPublicAuthRateLimit(this.options, 'twoFactorResend', request, [body.challengeId]);\n      if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n      return RestUtilities.sendBaseResponse(res, await this.authService.resendTwoFactor(body.challengeId));\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n    }\n  }\n\n  @Post('bootstrap-admin')\n  @ApiOperation({\n    summary: 'Crea il primo utente admin (bootstrap)',\n    operationId: 'bootstrapAdmin',\n    description:\n      'Endpoint pubblico ma protetto dal token di avvio: attivo solo con adminBootstrap.enabled. ' +\n      'Crea un utente in stato confermato senza email, con flag admin (e super opzionale) e password fornita o generata.',\n  })\n  @ApiBody({ type: BootstrapAdminRequest })\n  @ApiResponse({ status: 200, type: BootstrapAdminResponse })\n  @ApiResponse({ status: 401, description: 'Token di bootstrap non valido', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Bootstrap admin non abilitato', type: ErrorResponse })\n  @ApiResponse({ status: 429, description: 'Troppi tentativi', type: ErrorResponse })\n  async bootstrapAdmin(@Req() request: Request, @Body() body: BootstrapAdminRequest, @Res() res: Response) {\n    try {\n      const limit = checkPublicAuthRateLimit(this.options, 'adminBootstrap', request);\n      if (!limit.allowed) return sendPublicAuthRateLimitExceeded(res, limit.retryAfterSeconds);\n      return RestUtilities.sendBaseResponse(res, await this.adminBootstrapService.bootstrap(body));\n    } catch (error) {\n      return RestUtilities.sendErrorMessage(res, error, AuthController.name, error instanceof HttpException ? error.getStatus() : 500);\n    }\n  }\n}\n"]}

package/dist/accessi-module/Controllers/SchemaController.d.ts

@@ -0,0 +1,9 @@
+import { Request, Response } from 'express';
+import { Logger } from '../../Logger';
+import { SchemaExportService } from '../Services/SchemaExportService/SchemaExportService';
+export declare class SchemaController {
+    private readonly schemaExportService;
+    logger: Logger;
+    constructor(schemaExportService: SchemaExportService);
+    getSchema(request: Request, res: Response): Promise<Response<any, Record<string, any>>>;
+}

package/dist/accessi-module/Controllers/SchemaController.js

@@ -0,0 +1,79 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var SchemaController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SchemaController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const Logger_1 = require("../../Logger");
+const Utilities_1 = require("../../Utilities");
+const Dtos_1 = require("../Dtos");
+const jwt_strategy_1 = require("../jwt/jwt.strategy");
+const accessControl_1 = require("../security/accessControl");
+const SchemaExportService_1 = require("../Services/SchemaExportService/SchemaExportService");
+let SchemaController = SchemaController_1 = class SchemaController {
+    constructor(schemaExportService) {
+        this.schemaExportService = schemaExportService;
+        this.logger = new Logger_1.Logger(SchemaController_1.name);
+    }
+    getSchema(request, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                const ddl = this.schemaExportService.buildDdl();
+                const entities = yield this.schemaExportService.presentEntities();
+                return Utilities_1.RestUtilities.sendBaseResponse(res, Object.assign(Object.assign({}, ddl), entities));
+            }
+            catch (error) {
+                this.logger.error('Errore durante l esportazione dello schema', error);
+                return Utilities_1.RestUtilities.sendErrorMessage(res, error, SchemaController_1.name);
+            }
+        });
+    }
+};
+exports.SchemaController = SchemaController;
+__decorate([
+    (0, common_1.Get)(),
+    (0, swagger_1.ApiOperation)({
+        operationId: 'getSchema',
+        summary: 'Esporta lo schema DDL e le entita presenti',
+        description: 'Riservato agli admin. Genera il DDL delle entita Accessi e segnala le tabelle presenti fuori schema.',
+    }),
+    (0, swagger_1.ApiResponse)({ status: 200, type: Dtos_1.GetSchemaResponse }),
+    (0, swagger_1.ApiResponse)({ status: 403, type: Dtos_1.ErrorResponse }),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], SchemaController.prototype, "getSchema", null);
+exports.SchemaController = SchemaController = SchemaController_1 = __decorate([
+    (0, swagger_1.ApiTags)('Schema'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.Controller)('accessi/schema'),
+    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard)
+    /** Esporta il DDL delle entita Accessi per replicare il database su altre installazioni. */
+    ,
+    __metadata("design:paramtypes", [SchemaExportService_1.SchemaExportService])
+], SchemaController);
+//# sourceMappingURL=SchemaController.js.map

package/dist/accessi-module/Controllers/SchemaController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SchemaController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/SchemaController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAsE;AACtE,6CAAoF;AAEpF,yCAAsC;AACtC,+CAAgD;AAChD,kCAA2D;AAC3D,sDAAqD;AACrD,6DAAqF;AACrF,6FAA0F;AAOnF,IAAM,gBAAgB,wBAAtB,MAAM,gBAAgB;IAG3B,YAA6B,mBAAwC;QAAxC,wBAAmB,GAAnB,mBAAmB,CAAqB;QAFrE,WAAM,GAAW,IAAI,eAAM,CAAC,kBAAgB,CAAC,IAAI,CAAC,CAAC;IAEqB,CAAC;IAUnE,SAAS,CAAQ,OAAgB,EAAS,GAAa;;YAC3D,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,GAAG,GAAG,IAAI,CAAC,mBAAmB,CAAC,QAAQ,EAAE,CAAC;gBAChD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,eAAe,EAAE,CAAC;gBAClE,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,kCAAO,GAAG,GAAK,QAAQ,EAAG,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,4CAA4C,EAAE,KAAK,CAAC,CAAC;gBACvE,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,kBAAgB,CAAC,IAAI,CAAC,CAAC;YAC3E,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAxBY,4CAAgB;AAarB;IARL,IAAA,YAAG,GAAE;IACL,IAAA,sBAAY,EAAC;QACZ,WAAW,EAAE,WAAW;QACxB,OAAO,EAAE,4CAA4C;QACrD,WAAW,EAAE,sGAAsG;KACpH,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,wBAAiB,EAAE,CAAC;IACrD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,oBAAa,EAAE,CAAC;IACjC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;iDAU9C;2BAvBU,gBAAgB;IAL5B,IAAA,iBAAO,EAAC,QAAQ,CAAC;IACjB,IAAA,uBAAa,GAAE;IACf,IAAA,mBAAU,EAAC,gBAAgB,CAAC;IAC5B,IAAA,kBAAS,EAAC,6BAAc,CAAC;IAC1B,4FAA4F;;qCAIxC,yCAAmB;GAH1D,gBAAgB,CAwB5B","sourcesContent":["import { Controller, Get, Req, Res, UseGuards } from '@nestjs/common';\nimport { ApiBearerAuth, ApiOperation, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport { ErrorResponse, GetSchemaResponse } from '../Dtos';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureAdmin, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { SchemaExportService } from '../Services/SchemaExportService/SchemaExportService';\n\n@ApiTags('Schema')\n@ApiBearerAuth()\n@Controller('accessi/schema')\n@UseGuards(JwtSimpleGuard)\n/** Esporta il DDL delle entita Accessi per replicare il database su altre installazioni. */\nexport class SchemaController {\n  logger: Logger = new Logger(SchemaController.name);\n\n  constructor(private readonly schemaExportService: SchemaExportService) {}\n\n  @Get()\n  @ApiOperation({\n    operationId: 'getSchema',\n    summary: 'Esporta lo schema DDL e le entita presenti',\n    description: 'Riservato agli admin. Genera il DDL delle entita Accessi e segnala le tabelle presenti fuori schema.',\n  })\n  @ApiResponse({ status: 200, type: GetSchemaResponse })\n  @ApiResponse({ status: 403, type: ErrorResponse })\n  async getSchema(@Req() request: Request, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      const ddl = this.schemaExportService.buildDdl();\n      const entities = await this.schemaExportService.presentEntities();\n      return RestUtilities.sendBaseResponse(res, { ...ddl, ...entities });\n    } catch (error) {\n      this.logger.error('Errore durante l esportazione dello schema', error);\n      return RestUtilities.sendErrorMessage(res, error, SchemaController.name);\n    }\n  }\n}\n"]}

package/dist/accessi-module/Dtos/AdminBootstrapDtos.d.ts

@@ -0,0 +1,19 @@
+import { BaseResponse } from './BaseResponse';
+/** Richiesta di bootstrap del primo admin: il token e quello stampato nel log di avvio. */
+export declare class BootstrapAdminRequest {
+    token: string;
+    email: string;
+    nome?: string;
+    cognome?: string;
+    password?: string;
+    superUser?: boolean;
+}
+export declare class BootstrapAdminResultDto {
+    codiceUtente: number;
+    email: string;
+    password?: string;
+    passwordGenerated: boolean;
+}
+export declare class BootstrapAdminResponse extends BaseResponse {
+    Result: BootstrapAdminResultDto;
+}

package/dist/accessi-module/Dtos/AdminBootstrapDtos.js

@@ -0,0 +1,83 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BootstrapAdminResponse = exports.BootstrapAdminResultDto = exports.BootstrapAdminRequest = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const BaseResponse_1 = require("./BaseResponse");
+/** Richiesta di bootstrap del primo admin: il token e quello stampato nel log di avvio. */
+class BootstrapAdminRequest {
+}
+exports.BootstrapAdminRequest = BootstrapAdminRequest;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Token di bootstrap stampato nel log di avvio del backend.' }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], BootstrapAdminRequest.prototype, "token", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'admin@example.com' }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], BootstrapAdminRequest.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 'Mario' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], BootstrapAdminRequest.prototype, "nome", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 'Rossi' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], BootstrapAdminRequest.prototype, "cognome", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Password da impostare. Se assente viene generata e restituita una sola volta.' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], BootstrapAdminRequest.prototype, "password", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Crea anche un superutente (tutte le abilitazioni). Default true.' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], BootstrapAdminRequest.prototype, "superUser", void 0);
+class BootstrapAdminResultDto {
+}
+exports.BootstrapAdminResultDto = BootstrapAdminResultDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 1 }),
+    __metadata("design:type", Number)
+], BootstrapAdminResultDto.prototype, "codiceUtente", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'admin@example.com' }),
+    __metadata("design:type", String)
+], BootstrapAdminResultDto.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Password generata: presente solo se non e stata fornita nella richiesta.' }),
+    __metadata("design:type", String)
+], BootstrapAdminResultDto.prototype, "password", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: true }),
+    __metadata("design:type", Boolean)
+], BootstrapAdminResultDto.prototype, "passwordGenerated", void 0);
+class BootstrapAdminResponse extends BaseResponse_1.BaseResponse {
+}
+exports.BootstrapAdminResponse = BootstrapAdminResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: BootstrapAdminResultDto }),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => BootstrapAdminResultDto),
+    __metadata("design:type", BootstrapAdminResultDto)
+], BootstrapAdminResponse.prototype, "Result", void 0);
+//# sourceMappingURL=AdminBootstrapDtos.js.map

package/dist/accessi-module/Dtos/AdminBootstrapDtos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminBootstrapDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/AdminBootstrapDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,yDAAyC;AACzC,qDAAkF;AAClF,iDAA8C;AAE9C,2FAA2F;AAC3F,MAAa,qBAAqB;CA4BjC;AA5BD,sDA4BC;AAzBC;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;IACzF,IAAA,0BAAQ,GAAE;;oDACI;AAIf;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC7C,IAAA,0BAAQ,GAAE;;oDACI;AAKf;IAHC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACzC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;mDACG;AAKd;IAHC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACzC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;sDACM;AAKjB;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,+EAA+E,EAAE,CAAC;IACrH,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;uDACO;AAKlB;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC;IACxG,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;;wDACQ;AAGtB,MAAa,uBAAuB;CAYnC;AAZD,0DAYC;AAVC;IADC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;6DACN;AAGtB;IADC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;;sDAC/B;AAGf;IADC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;;yDAC/F;AAGlB;IADC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;kEACH;AAG9B,MAAa,sBAAuB,SAAQ,2BAAY;CAKvD;AALD,wDAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IAC9C,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC;8BAC3B,uBAAuB;sDAAC","sourcesContent":["import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsBoolean, IsOptional, IsString, ValidateNested } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\n\n/** Richiesta di bootstrap del primo admin: il token e quello stampato nel log di avvio. */\nexport class BootstrapAdminRequest {\n  @ApiProperty({ description: 'Token di bootstrap stampato nel log di avvio del backend.' })\n  @IsString()\n  token!: string;\n\n  @ApiProperty({ example: 'admin@example.com' })\n  @IsString()\n  email!: string;\n\n  @ApiPropertyOptional({ example: 'Mario' })\n  @IsOptional()\n  @IsString()\n  nome?: string;\n\n  @ApiPropertyOptional({ example: 'Rossi' })\n  @IsOptional()\n  @IsString()\n  cognome?: string;\n\n  @ApiPropertyOptional({ description: 'Password da impostare. Se assente viene generata e restituita una sola volta.' })\n  @IsOptional()\n  @IsString()\n  password?: string;\n\n  @ApiPropertyOptional({ description: 'Crea anche un superutente (tutte le abilitazioni). Default true.' })\n  @IsOptional()\n  @IsBoolean()\n  superUser?: boolean;\n}\n\nexport class BootstrapAdminResultDto {\n  @ApiProperty({ example: 1 })\n  codiceUtente!: number;\n\n  @ApiProperty({ example: 'admin@example.com' })\n  email!: string;\n\n  @ApiPropertyOptional({ description: 'Password generata: presente solo se non e stata fornita nella richiesta.' })\n  password?: string;\n\n  @ApiProperty({ example: true })\n  passwordGenerated!: boolean;\n}\n\nexport class BootstrapAdminResponse extends BaseResponse {\n  @ApiProperty({ type: BootstrapAdminResultDto })\n  @ValidateNested()\n  @Type(() => BootstrapAdminResultDto)\n  Result!: BootstrapAdminResultDto;\n}\n"]}

package/dist/accessi-module/Dtos/SchemaDtos.d.ts

@@ -0,0 +1,19 @@
+import { BaseResponse } from './BaseResponse';
+/** Sezione di DDL (tabelle, generatori, chiavi esterne, indici, check, trigger). */
+export declare class SchemaDdlSection {
+    id: string;
+    title: string;
+    sql: string;
+}
+/** Schema DDL completo + entita presenti nel database. */
+export declare class SchemaDdlResult {
+    version: string;
+    sections: SchemaDdlSection[];
+    script: string;
+    presentTables: string[];
+    extraTables: string[];
+    presentGenerators: string[];
+}
+export declare class GetSchemaResponse extends BaseResponse {
+    Result: SchemaDdlResult;
+}

package/dist/accessi-module/Dtos/SchemaDtos.js

@@ -0,0 +1,84 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GetSchemaResponse = exports.SchemaDdlResult = exports.SchemaDdlSection = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const BaseResponse_1 = require("./BaseResponse");
+/** Sezione di DDL (tabelle, generatori, chiavi esterne, indici, check, trigger). */
+class SchemaDdlSection {
+}
+exports.SchemaDdlSection = SchemaDdlSection;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'tables' }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], SchemaDdlSection.prototype, "id", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'Tabelle (18)' }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], SchemaDdlSection.prototype, "title", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'DDL della sezione.' }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], SchemaDdlSection.prototype, "sql", void 0);
+/** Schema DDL completo + entita presenti nel database. */
+class SchemaDdlResult {
+}
+exports.SchemaDdlResult = SchemaDdlResult;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Versione schema Accessi.', example: '1.11.0' }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], SchemaDdlResult.prototype, "version", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: [SchemaDdlSection] }),
+    (0, class_validator_1.ValidateNested)({ each: true }),
+    (0, class_transformer_1.Type)(() => SchemaDdlSection),
+    (0, class_validator_1.IsArray)(),
+    __metadata("design:type", Array)
+], SchemaDdlResult.prototype, "sections", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Script completo concatenato.' }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], SchemaDdlResult.prototype, "script", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: [String], description: 'Tabelle presenti nel database.' }),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], SchemaDdlResult.prototype, "presentTables", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: [String], description: 'Tabelle presenti ma non di dominio Accessi.' }),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], SchemaDdlResult.prototype, "extraTables", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: [String], description: 'Generatori presenti nel database.' }),
+    (0, class_validator_1.IsArray)(),
+    (0, class_validator_1.IsString)({ each: true }),
+    __metadata("design:type", Array)
+], SchemaDdlResult.prototype, "presentGenerators", void 0);
+class GetSchemaResponse extends BaseResponse_1.BaseResponse {
+}
+exports.GetSchemaResponse = GetSchemaResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: SchemaDdlResult }),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => SchemaDdlResult),
+    __metadata("design:type", SchemaDdlResult)
+], GetSchemaResponse.prototype, "Result", void 0);
+//# sourceMappingURL=SchemaDtos.js.map

package/dist/accessi-module/Dtos/SchemaDtos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SchemaDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/SchemaDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,yDAAyC;AACzC,qDAAoE;AACpE,iDAA8C;AAE9C,oFAAoF;AACpF,MAAa,gBAAgB;CAY5B;AAZD,4CAYC;AATC;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAClC,IAAA,0BAAQ,GAAE;;4CACC;AAIZ;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC;IACxC,IAAA,0BAAQ,GAAE;;+CACI;AAIf;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC;IAClD,IAAA,0BAAQ,GAAE;;6CACE;AAGf,0DAA0D;AAC1D,MAAa,eAAe;CA6B3B;AA7BD,0CA6BC;AA1BC;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;IAC3E,IAAA,0BAAQ,GAAE;;gDACM;AAMjB;IAJC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,CAAC,gBAAgB,CAAC,EAAE,CAAC;IACzC,IAAA,gCAAc,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC;IAC5B,IAAA,yBAAO,GAAE;;iDACoB;AAI9B;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,8BAA8B,EAAE,CAAC;IAC5D,IAAA,0BAAQ,GAAE;;+CACK;AAKhB;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAC9E,IAAA,yBAAO,GAAE;IACT,IAAA,0BAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;sDACA;AAKzB;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,6CAA6C,EAAE,CAAC;IAC3F,IAAA,yBAAO,GAAE;IACT,IAAA,0BAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;oDACF;AAKvB;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,mCAAmC,EAAE,CAAC;IACjF,IAAA,yBAAO,GAAE;IACT,IAAA,0BAAQ,EAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;;0DACI;AAG/B,MAAa,iBAAkB,SAAQ,2BAAY;CAKlD;AALD,8CAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC;IACtC,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,eAAe,CAAC;8BACnB,eAAe;iDAAC","sourcesContent":["import { ApiProperty } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsArray, IsString, ValidateNested } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\n\n/** Sezione di DDL (tabelle, generatori, chiavi esterne, indici, check, trigger). */\nexport class SchemaDdlSection {\n  @ApiProperty({ example: 'tables' })\n  @IsString()\n  id!: string;\n\n  @ApiProperty({ example: 'Tabelle (18)' })\n  @IsString()\n  title!: string;\n\n  @ApiProperty({ description: 'DDL della sezione.' })\n  @IsString()\n  sql!: string;\n}\n\n/** Schema DDL completo + entita presenti nel database. */\nexport class SchemaDdlResult {\n  @ApiProperty({ description: 'Versione schema Accessi.', example: '1.11.0' })\n  @IsString()\n  version!: string;\n\n  @ApiProperty({ type: [SchemaDdlSection] })\n  @ValidateNested({ each: true })\n  @Type(() => SchemaDdlSection)\n  @IsArray()\n  sections!: SchemaDdlSection[];\n\n  @ApiProperty({ description: 'Script completo concatenato.' })\n  @IsString()\n  script!: string;\n\n  @ApiProperty({ type: [String], description: 'Tabelle presenti nel database.' })\n  @IsArray()\n  @IsString({ each: true })\n  presentTables!: string[];\n\n  @ApiProperty({ type: [String], description: 'Tabelle presenti ma non di dominio Accessi.' })\n  @IsArray()\n  @IsString({ each: true })\n  extraTables!: string[];\n\n  @ApiProperty({ type: [String], description: 'Generatori presenti nel database.' })\n  @IsArray()\n  @IsString({ each: true })\n  presentGenerators!: string[];\n}\n\nexport class GetSchemaResponse extends BaseResponse {\n  @ApiProperty({ type: SchemaDdlResult })\n  @ValidateNested()\n  @Type(() => SchemaDdlResult)\n  Result!: SchemaDdlResult;\n}\n"]}

package/dist/accessi-module/Dtos/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./Abilitazione";
+export * from "./AdminBootstrapDtos";
 export * from "./AbilitazioneMenu";
 export * from "./AssignPermissionsToUserRequest";
 export * from "./AssignRolesToUserRequest";
@@ -16,6 +17,7 @@ export * from "./LoginResponse";
 export * from "./Permission";
 export * from "./PublicRegisterRequest";
 export * from "./Role";
+export * from "./SchemaDtos";
 export * from "./SendResetPasswordEmailRequest";
 export * from "./StatoRegistrazione";
 export * from "./TipoAbilitazione";

package/dist/accessi-module/Dtos/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./Abilitazione"), exports);
+__exportStar(require("./AdminBootstrapDtos"), exports);
 __exportStar(require("./AbilitazioneMenu"), exports);
 __exportStar(require("./AssignPermissionsToUserRequest"), exports);
 __exportStar(require("./AssignRolesToUserRequest"), exports);
@@ -32,6 +33,7 @@ __exportStar(require("./LoginResponse"), exports);
 __exportStar(require("./Permission"), exports);
 __exportStar(require("./PublicRegisterRequest"), exports);
 __exportStar(require("./Role"), exports);
+__exportStar(require("./SchemaDtos"), exports);
 __exportStar(require("./SendResetPasswordEmailRequest"), exports);
 __exportStar(require("./StatoRegistrazione"), exports);
 __exportStar(require("./TipoAbilitazione"), exports);

package/dist/accessi-module/Dtos/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,qDAAmC;AACnC,mEAAiD;AACjD,6DAA2C;AAC3C,gEAA8C;AAC9C,iDAA+B;AAC/B,gDAA8B;AAC9B,gEAA8C;AAC9C,+DAA4C;AAE5C,iDAA+B;AAC/B,0DAAwC;AACxC,0DAAwC;AACxC,2DAAyC;AACzC,iDAA+B;AAC/B,kDAAgC;AAChC,+CAA6B;AAC7B,0DAAwC;AACxC,yCAAuB;AACvB,kEAAgD;AAChD,uDAAqC;AACrC,qDAAmC;AACnC,gDAA8B;AAC9B,4CAA0B;AAC1B,uDAAqC;AAErC,8CAA2B;AAE3B,iDAA+B;AAE/B,kDAAgC","sourcesContent":["export * from \"./Abilitazione\";\nexport * from \"./AbilitazioneMenu\";\nexport * from \"./AssignPermissionsToUserRequest\";\nexport * from \"./AssignRolesToUserRequest\";\nexport * from \"./AuthenticatedUserPayloadDto\";\nexport * from \"./BaseResponse\";\nexport * from \"./CatalogDtos\";\nexport * from \"./ConfirmResetPasswordRequest\";\nexport * from \"./UpdateEnabledStatusRequest\"\n\nexport * from \"./FiltriUtente\";\nexport * from \"./FederatedIdentityDtos\";\nexport * from \"./GetUserByTokenRequest\";\nexport * from \"./GetUserByTokenResponse\";\nexport * from \"./LoginRequest\";\nexport * from \"./LoginResponse\";\nexport * from \"./Permission\";\nexport * from \"./PublicRegisterRequest\";\nexport * from \"./Role\";\nexport * from \"./SendResetPasswordEmailRequest\";\nexport * from \"./StatoRegistrazione\";\nexport * from \"./TipoAbilitazione\";\nexport * from \"./TokenResult\";\nexport * from \"./UserDto\";\nexport * from \"./UserGrantsResponse\";\n\nexport * from \"./RuoliMenu\"\n\nexport * from \"./ServiceToken\";\n\nexport * from './TwoFactorDtos';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,mEAAiD;AACjD,6DAA2C;AAC3C,gEAA8C;AAC9C,iDAA+B;AAC/B,gDAA8B;AAC9B,gEAA8C;AAC9C,+DAA4C;AAE5C,iDAA+B;AAC/B,0DAAwC;AACxC,0DAAwC;AACxC,2DAAyC;AACzC,iDAA+B;AAC/B,kDAAgC;AAChC,+CAA6B;AAC7B,0DAAwC;AACxC,yCAAuB;AACvB,+CAA6B;AAC7B,kEAAgD;AAChD,uDAAqC;AACrC,qDAAmC;AACnC,gDAA8B;AAC9B,4CAA0B;AAC1B,uDAAqC;AAErC,8CAA2B;AAE3B,iDAA+B;AAE/B,kDAAgC","sourcesContent":["export * from \"./Abilitazione\";\nexport * from \"./AdminBootstrapDtos\";\nexport * from \"./AbilitazioneMenu\";\nexport * from \"./AssignPermissionsToUserRequest\";\nexport * from \"./AssignRolesToUserRequest\";\nexport * from \"./AuthenticatedUserPayloadDto\";\nexport * from \"./BaseResponse\";\nexport * from \"./CatalogDtos\";\nexport * from \"./ConfirmResetPasswordRequest\";\nexport * from \"./UpdateEnabledStatusRequest\"\n\nexport * from \"./FiltriUtente\";\nexport * from \"./FederatedIdentityDtos\";\nexport * from \"./GetUserByTokenRequest\";\nexport * from \"./GetUserByTokenResponse\";\nexport * from \"./LoginRequest\";\nexport * from \"./LoginResponse\";\nexport * from \"./Permission\";\nexport * from \"./PublicRegisterRequest\";\nexport * from \"./Role\";\nexport * from \"./SchemaDtos\";\nexport * from \"./SendResetPasswordEmailRequest\";\nexport * from \"./StatoRegistrazione\";\nexport * from \"./TipoAbilitazione\";\nexport * from \"./TokenResult\";\nexport * from \"./UserDto\";\nexport * from \"./UserGrantsResponse\";\n\nexport * from \"./RuoliMenu\"\n\nexport * from \"./ServiceToken\";\n\nexport * from './TwoFactorDtos';\n"]}

package/dist/accessi-module/Services/AdminBootstrapService/AdminBootstrapService.d.ts

@@ -0,0 +1,33 @@
+import type { AccessiOptions } from '../../AccessiModule';
+import { AuthService } from '../AuthService/AuthService';
+import { UserService } from '../UserService/UserService';
+export interface BootstrapAdminResult {
+    codiceUtente: number;
+    email: string;
+    /** Presente solo quando la password e stata generata dal server. */
+    password?: string;
+    passwordGenerated: boolean;
+}
+/**
+ * Crea il primo utente admin tramite il token casuale di avvio. Non invia email di conferma:
+ * l'utente nasce in stato CONF e con password impostata (fornita o generata). Il token e monouso
+ * e valido solo per il processo corrente.
+ */
+export declare class AdminBootstrapService {
+    private readonly options;
+    private readonly userService;
+    private readonly authService;
+    private readonly logger;
+    constructor(options: AccessiOptions, userService: UserService, authService: AuthService);
+    /** Indica se il backend ha abilitato l'area "crea utente admin". */
+    isEnabled(): boolean;
+    bootstrap(request: {
+        token?: string;
+        email?: string;
+        nome?: string;
+        cognome?: string;
+        password?: string;
+        superUser?: boolean;
+    }): Promise<BootstrapAdminResult>;
+    private generatePassword;
+}

package/dist/accessi-module/Services/AdminBootstrapService/AdminBootstrapService.js

@@ -0,0 +1,106 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var AdminBootstrapService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminBootstrapService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const Logger_1 = require("../../../Logger");
+const StatoRegistrazione_1 = require("../../Dtos/StatoRegistrazione");
+const AuthService_1 = require("../AuthService/AuthService");
+const UserService_1 = require("../UserService/UserService");
+const adminBootstrap_1 = require("../../security/adminBootstrap");
+/**
+ * Crea il primo utente admin tramite il token casuale di avvio. Non invia email di conferma:
+ * l'utente nasce in stato CONF e con password impostata (fornita o generata). Il token e monouso
+ * e valido solo per il processo corrente.
+ */
+let AdminBootstrapService = AdminBootstrapService_1 = class AdminBootstrapService {
+    constructor(options, userService, authService) {
+        this.options = options;
+        this.userService = userService;
+        this.authService = authService;
+        this.logger = new Logger_1.Logger(AdminBootstrapService_1.name);
+    }
+    /** Indica se il backend ha abilitato l'area "crea utente admin". */
+    isEnabled() {
+        var _a;
+        return ((_a = this.options.adminBootstrap) === null || _a === void 0 ? void 0 : _a.enabled) === true;
+    }
+    bootstrap(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            if (!this.isEnabled()) {
+                throw new common_1.ForbiddenException({
+                    code: 'ACCESSI_ADMIN_BOOTSTRAP_DISABLED',
+                    message: 'Il bootstrap admin non e abilitato in questa istanza Accessi.',
+                });
+            }
+            if (!(0, adminBootstrap_1.isValidAdminBootstrapToken)(request === null || request === void 0 ? void 0 : request.token)) {
+                throw new common_1.UnauthorizedException({
+                    code: 'ACCESSI_ADMIN_BOOTSTRAP_TOKEN_INVALID',
+                    message: 'Token di bootstrap non valido.',
+                });
+            }
+            const email = typeof (request === null || request === void 0 ? void 0 : request.email) === 'string' ? request.email.trim().toLowerCase() : '';
+            if (!email) {
+                throw new common_1.BadRequestException({
+                    code: 'ACCESSI_ADMIN_BOOTSTRAP_EMAIL_REQUIRED',
+                    message: "L'email e obbligatoria per creare l'utente admin.",
+                });
+            }
+            const superUser = (_a = request === null || request === void 0 ? void 0 : request.superUser) !== null && _a !== void 0 ? _a : ((_b = this.options.adminBootstrap) === null || _b === void 0 ? void 0 : _b.superUser) !== false;
+            const providedPassword = typeof (request === null || request === void 0 ? void 0 : request.password) === 'string' ? request.password : '';
+            const password = providedPassword.length > 0 ? providedPassword : this.generatePassword();
+            const passwordGenerated = providedPassword.length === 0;
+            const codiceUtente = yield this.userService.register({
+                email,
+                nome: request === null || request === void 0 ? void 0 : request.nome,
+                cognome: request === null || request === void 0 ? void 0 : request.cognome,
+                flagAdmin: true,
+                flagSuper: superUser,
+            }, { allowPrivilegedFields: true, initialState: StatoRegistrazione_1.StatoRegistrazione.CONF });
+            yield this.authService.setPassword(codiceUtente, password);
+            // Monouso: un bootstrap riuscito invalida il token fino al prossimo riavvio.
+            (0, adminBootstrap_1.clearAdminBootstrapToken)();
+            this.logger.info(`Utente admin di bootstrap creato: ${email} (codice ${codiceUtente}). Token invalidato.`);
+            return {
+                codiceUtente,
+                email,
+                password: passwordGenerated ? password : undefined,
+                passwordGenerated,
+            };
+        });
+    }
+    generatePassword() {
+        return `Aa1!${(0, crypto_1.randomBytes)(9).toString('base64url')}`;
+    }
+};
+exports.AdminBootstrapService = AdminBootstrapService;
+exports.AdminBootstrapService = AdminBootstrapService = AdminBootstrapService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object, UserService_1.UserService,
+        AuthService_1.AuthService])
+], AdminBootstrapService);
+//# sourceMappingURL=AdminBootstrapService.js.map

package/dist/accessi-module/Services/AdminBootstrapService/AdminBootstrapService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminBootstrapService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AdminBootstrapService/AdminBootstrapService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoH;AACpH,mCAAqC;AACrC,4CAAyC;AAEzC,sEAAmE;AACnE,4DAAyD;AACzD,4DAAyD;AACzD,kEAAqG;AAUrG;;;;GAIG;AAEI,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAGhC,YAC6B,OAAwC,EAClD,WAAwB,EACxB,WAAwB;QAFG,YAAO,GAAP,OAAO,CAAgB;QAClD,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;QAL1B,WAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAM9D,CAAC;IAEJ,oEAAoE;IACpE,SAAS;;QACP,OAAO,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,cAAc,0CAAE,OAAO,MAAK,IAAI,CAAC;IACvD,CAAC;IAEK,SAAS,CAAC,OAAoH;;;YAClI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,kCAAkC;oBACxC,OAAO,EAAE,+DAA+D;iBACzE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,IAAA,2CAA0B,EAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,8BAAqB,CAAC;oBAC9B,IAAI,EAAE,uCAAuC;oBAC7C,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,4BAAmB,CAAC;oBAC5B,IAAI,EAAE,wCAAwC;oBAC9C,OAAO,EAAE,mDAAmD;iBAC7D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,SAAS,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,mCAAI,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,cAAc,0CAAE,SAAS,MAAK,KAAK,CAAC;YACzF,MAAM,gBAAgB,GAAG,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1F,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC;YAExD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAClD;gBACE,KAAK;gBACL,IAAI,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI;gBACnB,OAAO,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO;gBACzB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,SAAS;aACrB,EACD,EAAE,qBAAqB,EAAE,IAAI,EAAE,YAAY,EAAE,uCAAkB,CAAC,IAAI,EAAE,CACvE,CAAC;YAEF,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAE3D,6EAA6E;YAC7E,IAAA,yCAAwB,GAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,KAAK,YAAY,YAAY,sBAAsB,CAAC,CAAC;YAE3G,OAAO;gBACL,YAAY;gBACZ,KAAK;gBACL,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAClD,iBAAiB;aAClB,CAAC;QACJ,CAAC;KAAA;IAEO,gBAAgB;QACtB,OAAO,OAAO,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACvD,CAAC;CACF,CAAA;AAtEY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACX,yBAAW;GANhC,qBAAqB,CAsEjC","sourcesContent":["import { BadRequestException, ForbiddenException, Inject, Injectable, UnauthorizedException } from '@nestjs/common';\nimport { randomBytes } from 'crypto';\nimport { Logger } from '../../../Logger';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { StatoRegistrazione } from '../../Dtos/StatoRegistrazione';\nimport { AuthService } from '../AuthService/AuthService';\nimport { UserService } from '../UserService/UserService';\nimport { clearAdminBootstrapToken, isValidAdminBootstrapToken } from '../../security/adminBootstrap';\n\nexport interface BootstrapAdminResult {\n  codiceUtente: number;\n  email: string;\n  /** Presente solo quando la password e stata generata dal server. */\n  password?: string;\n  passwordGenerated: boolean;\n}\n\n/**\n * Crea il primo utente admin tramite il token casuale di avvio. Non invia email di conferma:\n * l'utente nasce in stato CONF e con password impostata (fornita o generata). Il token e monouso\n * e valido solo per il processo corrente.\n */\n@Injectable()\nexport class AdminBootstrapService {\n  private readonly logger = new Logger(AdminBootstrapService.name);\n\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n    private readonly userService: UserService,\n    private readonly authService: AuthService,\n  ) {}\n\n  /** Indica se il backend ha abilitato l'area \"crea utente admin\". */\n  isEnabled(): boolean {\n    return this.options.adminBootstrap?.enabled === true;\n  }\n\n  async bootstrap(request: { token?: string; email?: string; nome?: string; cognome?: string; password?: string; superUser?: boolean }): Promise<BootstrapAdminResult> {\n    if (!this.isEnabled()) {\n      throw new ForbiddenException({\n        code: 'ACCESSI_ADMIN_BOOTSTRAP_DISABLED',\n        message: 'Il bootstrap admin non e abilitato in questa istanza Accessi.',\n      });\n    }\n\n    if (!isValidAdminBootstrapToken(request?.token)) {\n      throw new UnauthorizedException({\n        code: 'ACCESSI_ADMIN_BOOTSTRAP_TOKEN_INVALID',\n        message: 'Token di bootstrap non valido.',\n      });\n    }\n\n    const email = typeof request?.email === 'string' ? request.email.trim().toLowerCase() : '';\n    if (!email) {\n      throw new BadRequestException({\n        code: 'ACCESSI_ADMIN_BOOTSTRAP_EMAIL_REQUIRED',\n        message: \"L'email e obbligatoria per creare l'utente admin.\",\n      });\n    }\n\n    const superUser = request?.superUser ?? this.options.adminBootstrap?.superUser !== false;\n    const providedPassword = typeof request?.password === 'string' ? request.password : '';\n    const password = providedPassword.length > 0 ? providedPassword : this.generatePassword();\n    const passwordGenerated = providedPassword.length === 0;\n\n    const codiceUtente = await this.userService.register(\n      {\n        email,\n        nome: request?.nome,\n        cognome: request?.cognome,\n        flagAdmin: true,\n        flagSuper: superUser,\n      },\n      { allowPrivilegedFields: true, initialState: StatoRegistrazione.CONF },\n    );\n\n    await this.authService.setPassword(codiceUtente, password);\n\n    // Monouso: un bootstrap riuscito invalida il token fino al prossimo riavvio.\n    clearAdminBootstrapToken();\n    this.logger.info(`Utente admin di bootstrap creato: ${email} (codice ${codiceUtente}). Token invalidato.`);\n\n    return {\n      codiceUtente,\n      email,\n      password: passwordGenerated ? password : undefined,\n      passwordGenerated,\n    };\n  }\n\n  private generatePassword(): string {\n    return `Aa1!${randomBytes(9).toString('base64url')}`;\n  }\n}\n"]}