emilsoftware-utilities 2.0.0-dev.37 → 2.0.0-dev.38

package/dist/accessi-module/Dtos/AdminBootstrapDtos.js

@@ -0,0 +1,83 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BootstrapAdminResponse = exports.BootstrapAdminResultDto = exports.BootstrapAdminRequest = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_transformer_1 = require("class-transformer");
+const class_validator_1 = require("class-validator");
+const BaseResponse_1 = require("./BaseResponse");
+/** Richiesta di bootstrap del primo admin: il token e quello stampato nel log di avvio. */
+class BootstrapAdminRequest {
+}
+exports.BootstrapAdminRequest = BootstrapAdminRequest;
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Token di bootstrap stampato nel log di avvio del backend.' }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], BootstrapAdminRequest.prototype, "token", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'admin@example.com' }),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], BootstrapAdminRequest.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 'Mario' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], BootstrapAdminRequest.prototype, "nome", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ example: 'Rossi' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], BootstrapAdminRequest.prototype, "cognome", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Password da impostare. Se assente viene generata e restituita una sola volta.' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsString)(),
+    __metadata("design:type", String)
+], BootstrapAdminRequest.prototype, "password", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Crea anche un superutente (tutte le abilitazioni). Default true.' }),
+    (0, class_validator_1.IsOptional)(),
+    (0, class_validator_1.IsBoolean)(),
+    __metadata("design:type", Boolean)
+], BootstrapAdminRequest.prototype, "superUser", void 0);
+class BootstrapAdminResultDto {
+}
+exports.BootstrapAdminResultDto = BootstrapAdminResultDto;
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 1 }),
+    __metadata("design:type", Number)
+], BootstrapAdminResultDto.prototype, "codiceUtente", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: 'admin@example.com' }),
+    __metadata("design:type", String)
+], BootstrapAdminResultDto.prototype, "email", void 0);
+__decorate([
+    (0, swagger_1.ApiPropertyOptional)({ description: 'Password generata: presente solo se non e stata fornita nella richiesta.' }),
+    __metadata("design:type", String)
+], BootstrapAdminResultDto.prototype, "password", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ example: true }),
+    __metadata("design:type", Boolean)
+], BootstrapAdminResultDto.prototype, "passwordGenerated", void 0);
+class BootstrapAdminResponse extends BaseResponse_1.BaseResponse {
+}
+exports.BootstrapAdminResponse = BootstrapAdminResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: BootstrapAdminResultDto }),
+    (0, class_validator_1.ValidateNested)(),
+    (0, class_transformer_1.Type)(() => BootstrapAdminResultDto),
+    __metadata("design:type", BootstrapAdminResultDto)
+], BootstrapAdminResponse.prototype, "Result", void 0);
+//# sourceMappingURL=AdminBootstrapDtos.js.map

package/dist/accessi-module/Dtos/AdminBootstrapDtos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminBootstrapDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/AdminBootstrapDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAmE;AACnE,yDAAyC;AACzC,qDAAkF;AAClF,iDAA8C;AAE9C,2FAA2F;AAC3F,MAAa,qBAAqB;CA4BjC;AA5BD,sDA4BC;AAzBC;IAFC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,2DAA2D,EAAE,CAAC;IACzF,IAAA,0BAAQ,GAAE;;oDACI;AAIf;IAFC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;IAC7C,IAAA,0BAAQ,GAAE;;oDACI;AAKf;IAHC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACzC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;mDACG;AAKd;IAHC,IAAA,6BAAmB,EAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;IACzC,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;sDACM;AAKjB;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,+EAA+E,EAAE,CAAC;IACrH,IAAA,4BAAU,GAAE;IACZ,IAAA,0BAAQ,GAAE;;uDACO;AAKlB;IAHC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,kEAAkE,EAAE,CAAC;IACxG,IAAA,4BAAU,GAAE;IACZ,IAAA,2BAAS,GAAE;;wDACQ;AAGtB,MAAa,uBAAuB;CAYnC;AAZD,0DAYC;AAVC;IADC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;6DACN;AAGtB;IADC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC;;sDAC/B;AAGf;IADC,IAAA,6BAAmB,EAAC,EAAE,WAAW,EAAE,0EAA0E,EAAE,CAAC;;yDAC/F;AAGlB;IADC,IAAA,qBAAW,EAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;kEACH;AAG9B,MAAa,sBAAuB,SAAQ,2BAAY;CAKvD;AALD,wDAKC;AADC;IAHC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,CAAC;IAC9C,IAAA,gCAAc,GAAE;IAChB,IAAA,wBAAI,EAAC,GAAG,EAAE,CAAC,uBAAuB,CAAC;8BAC3B,uBAAuB;sDAAC","sourcesContent":["import { ApiProperty, ApiPropertyOptional } from '@nestjs/swagger';\nimport { Type } from 'class-transformer';\nimport { IsBoolean, IsOptional, IsString, ValidateNested } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\n\n/** Richiesta di bootstrap del primo admin: il token e quello stampato nel log di avvio. */\nexport class BootstrapAdminRequest {\n  @ApiProperty({ description: 'Token di bootstrap stampato nel log di avvio del backend.' })\n  @IsString()\n  token!: string;\n\n  @ApiProperty({ example: 'admin@example.com' })\n  @IsString()\n  email!: string;\n\n  @ApiPropertyOptional({ example: 'Mario' })\n  @IsOptional()\n  @IsString()\n  nome?: string;\n\n  @ApiPropertyOptional({ example: 'Rossi' })\n  @IsOptional()\n  @IsString()\n  cognome?: string;\n\n  @ApiPropertyOptional({ description: 'Password da impostare. Se assente viene generata e restituita una sola volta.' })\n  @IsOptional()\n  @IsString()\n  password?: string;\n\n  @ApiPropertyOptional({ description: 'Crea anche un superutente (tutte le abilitazioni). Default true.' })\n  @IsOptional()\n  @IsBoolean()\n  superUser?: boolean;\n}\n\nexport class BootstrapAdminResultDto {\n  @ApiProperty({ example: 1 })\n  codiceUtente!: number;\n\n  @ApiProperty({ example: 'admin@example.com' })\n  email!: string;\n\n  @ApiPropertyOptional({ description: 'Password generata: presente solo se non e stata fornita nella richiesta.' })\n  password?: string;\n\n  @ApiProperty({ example: true })\n  passwordGenerated!: boolean;\n}\n\nexport class BootstrapAdminResponse extends BaseResponse {\n  @ApiProperty({ type: BootstrapAdminResultDto })\n  @ValidateNested()\n  @Type(() => BootstrapAdminResultDto)\n  Result!: BootstrapAdminResultDto;\n}\n"]}

package/dist/accessi-module/Dtos/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./Abilitazione";
+export * from "./AdminBootstrapDtos";
 export * from "./AbilitazioneMenu";
 export * from "./AssignPermissionsToUserRequest";
 export * from "./AssignRolesToUserRequest";

package/dist/accessi-module/Dtos/index.js

@@ -15,6 +15,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./Abilitazione"), exports);
+__exportStar(require("./AdminBootstrapDtos"), exports);
 __exportStar(require("./AbilitazioneMenu"), exports);
 __exportStar(require("./AssignPermissionsToUserRequest"), exports);
 __exportStar(require("./AssignRolesToUserRequest"), exports);

package/dist/accessi-module/Dtos/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,qDAAmC;AACnC,mEAAiD;AACjD,6DAA2C;AAC3C,gEAA8C;AAC9C,iDAA+B;AAC/B,gDAA8B;AAC9B,gEAA8C;AAC9C,+DAA4C;AAE5C,iDAA+B;AAC/B,0DAAwC;AACxC,0DAAwC;AACxC,2DAAyC;AACzC,iDAA+B;AAC/B,kDAAgC;AAChC,+CAA6B;AAC7B,0DAAwC;AACxC,yCAAuB;AACvB,+CAA6B;AAC7B,kEAAgD;AAChD,uDAAqC;AACrC,qDAAmC;AACnC,gDAA8B;AAC9B,4CAA0B;AAC1B,uDAAqC;AAErC,8CAA2B;AAE3B,iDAA+B;AAE/B,kDAAgC","sourcesContent":["export * from \"./Abilitazione\";\nexport * from \"./AbilitazioneMenu\";\nexport * from \"./AssignPermissionsToUserRequest\";\nexport * from \"./AssignRolesToUserRequest\";\nexport * from \"./AuthenticatedUserPayloadDto\";\nexport * from \"./BaseResponse\";\nexport * from \"./CatalogDtos\";\nexport * from \"./ConfirmResetPasswordRequest\";\nexport * from \"./UpdateEnabledStatusRequest\"\n\nexport * from \"./FiltriUtente\";\nexport * from \"./FederatedIdentityDtos\";\nexport * from \"./GetUserByTokenRequest\";\nexport * from \"./GetUserByTokenResponse\";\nexport * from \"./LoginRequest\";\nexport * from \"./LoginResponse\";\nexport * from \"./Permission\";\nexport * from \"./PublicRegisterRequest\";\nexport * from \"./Role\";\nexport * from \"./SchemaDtos\";\nexport * from \"./SendResetPasswordEmailRequest\";\nexport * from \"./StatoRegistrazione\";\nexport * from \"./TipoAbilitazione\";\nexport * from \"./TokenResult\";\nexport * from \"./UserDto\";\nexport * from \"./UserGrantsResponse\";\n\nexport * from \"./RuoliMenu\"\n\nexport * from \"./ServiceToken\";\n\nexport * from './TwoFactorDtos';\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,mEAAiD;AACjD,6DAA2C;AAC3C,gEAA8C;AAC9C,iDAA+B;AAC/B,gDAA8B;AAC9B,gEAA8C;AAC9C,+DAA4C;AAE5C,iDAA+B;AAC/B,0DAAwC;AACxC,0DAAwC;AACxC,2DAAyC;AACzC,iDAA+B;AAC/B,kDAAgC;AAChC,+CAA6B;AAC7B,0DAAwC;AACxC,yCAAuB;AACvB,+CAA6B;AAC7B,kEAAgD;AAChD,uDAAqC;AACrC,qDAAmC;AACnC,gDAA8B;AAC9B,4CAA0B;AAC1B,uDAAqC;AAErC,8CAA2B;AAE3B,iDAA+B;AAE/B,kDAAgC","sourcesContent":["export * from \"./Abilitazione\";\nexport * from \"./AdminBootstrapDtos\";\nexport * from \"./AbilitazioneMenu\";\nexport * from \"./AssignPermissionsToUserRequest\";\nexport * from \"./AssignRolesToUserRequest\";\nexport * from \"./AuthenticatedUserPayloadDto\";\nexport * from \"./BaseResponse\";\nexport * from \"./CatalogDtos\";\nexport * from \"./ConfirmResetPasswordRequest\";\nexport * from \"./UpdateEnabledStatusRequest\"\n\nexport * from \"./FiltriUtente\";\nexport * from \"./FederatedIdentityDtos\";\nexport * from \"./GetUserByTokenRequest\";\nexport * from \"./GetUserByTokenResponse\";\nexport * from \"./LoginRequest\";\nexport * from \"./LoginResponse\";\nexport * from \"./Permission\";\nexport * from \"./PublicRegisterRequest\";\nexport * from \"./Role\";\nexport * from \"./SchemaDtos\";\nexport * from \"./SendResetPasswordEmailRequest\";\nexport * from \"./StatoRegistrazione\";\nexport * from \"./TipoAbilitazione\";\nexport * from \"./TokenResult\";\nexport * from \"./UserDto\";\nexport * from \"./UserGrantsResponse\";\n\nexport * from \"./RuoliMenu\"\n\nexport * from \"./ServiceToken\";\n\nexport * from './TwoFactorDtos';\n"]}

package/dist/accessi-module/Services/AdminBootstrapService/AdminBootstrapService.d.ts

@@ -0,0 +1,33 @@
+import type { AccessiOptions } from '../../AccessiModule';
+import { AuthService } from '../AuthService/AuthService';
+import { UserService } from '../UserService/UserService';
+export interface BootstrapAdminResult {
+    codiceUtente: number;
+    email: string;
+    /** Presente solo quando la password e stata generata dal server. */
+    password?: string;
+    passwordGenerated: boolean;
+}
+/**
+ * Crea il primo utente admin tramite il token casuale di avvio. Non invia email di conferma:
+ * l'utente nasce in stato CONF e con password impostata (fornita o generata). Il token e monouso
+ * e valido solo per il processo corrente.
+ */
+export declare class AdminBootstrapService {
+    private readonly options;
+    private readonly userService;
+    private readonly authService;
+    private readonly logger;
+    constructor(options: AccessiOptions, userService: UserService, authService: AuthService);
+    /** Indica se il backend ha abilitato l'area "crea utente admin". */
+    isEnabled(): boolean;
+    bootstrap(request: {
+        token?: string;
+        email?: string;
+        nome?: string;
+        cognome?: string;
+        password?: string;
+        superUser?: boolean;
+    }): Promise<BootstrapAdminResult>;
+    private generatePassword;
+}

package/dist/accessi-module/Services/AdminBootstrapService/AdminBootstrapService.js

@@ -0,0 +1,106 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var AdminBootstrapService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AdminBootstrapService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const Logger_1 = require("../../../Logger");
+const StatoRegistrazione_1 = require("../../Dtos/StatoRegistrazione");
+const AuthService_1 = require("../AuthService/AuthService");
+const UserService_1 = require("../UserService/UserService");
+const adminBootstrap_1 = require("../../security/adminBootstrap");
+/**
+ * Crea il primo utente admin tramite il token casuale di avvio. Non invia email di conferma:
+ * l'utente nasce in stato CONF e con password impostata (fornita o generata). Il token e monouso
+ * e valido solo per il processo corrente.
+ */
+let AdminBootstrapService = AdminBootstrapService_1 = class AdminBootstrapService {
+    constructor(options, userService, authService) {
+        this.options = options;
+        this.userService = userService;
+        this.authService = authService;
+        this.logger = new Logger_1.Logger(AdminBootstrapService_1.name);
+    }
+    /** Indica se il backend ha abilitato l'area "crea utente admin". */
+    isEnabled() {
+        var _a;
+        return ((_a = this.options.adminBootstrap) === null || _a === void 0 ? void 0 : _a.enabled) === true;
+    }
+    bootstrap(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            if (!this.isEnabled()) {
+                throw new common_1.ForbiddenException({
+                    code: 'ACCESSI_ADMIN_BOOTSTRAP_DISABLED',
+                    message: 'Il bootstrap admin non e abilitato in questa istanza Accessi.',
+                });
+            }
+            if (!(0, adminBootstrap_1.isValidAdminBootstrapToken)(request === null || request === void 0 ? void 0 : request.token)) {
+                throw new common_1.UnauthorizedException({
+                    code: 'ACCESSI_ADMIN_BOOTSTRAP_TOKEN_INVALID',
+                    message: 'Token di bootstrap non valido.',
+                });
+            }
+            const email = typeof (request === null || request === void 0 ? void 0 : request.email) === 'string' ? request.email.trim().toLowerCase() : '';
+            if (!email) {
+                throw new common_1.BadRequestException({
+                    code: 'ACCESSI_ADMIN_BOOTSTRAP_EMAIL_REQUIRED',
+                    message: "L'email e obbligatoria per creare l'utente admin.",
+                });
+            }
+            const superUser = (_a = request === null || request === void 0 ? void 0 : request.superUser) !== null && _a !== void 0 ? _a : ((_b = this.options.adminBootstrap) === null || _b === void 0 ? void 0 : _b.superUser) !== false;
+            const providedPassword = typeof (request === null || request === void 0 ? void 0 : request.password) === 'string' ? request.password : '';
+            const password = providedPassword.length > 0 ? providedPassword : this.generatePassword();
+            const passwordGenerated = providedPassword.length === 0;
+            const codiceUtente = yield this.userService.register({
+                email,
+                nome: request === null || request === void 0 ? void 0 : request.nome,
+                cognome: request === null || request === void 0 ? void 0 : request.cognome,
+                flagAdmin: true,
+                flagSuper: superUser,
+            }, { allowPrivilegedFields: true, initialState: StatoRegistrazione_1.StatoRegistrazione.CONF });
+            yield this.authService.setPassword(codiceUtente, password);
+            // Monouso: un bootstrap riuscito invalida il token fino al prossimo riavvio.
+            (0, adminBootstrap_1.clearAdminBootstrapToken)();
+            this.logger.info(`Utente admin di bootstrap creato: ${email} (codice ${codiceUtente}). Token invalidato.`);
+            return {
+                codiceUtente,
+                email,
+                password: passwordGenerated ? password : undefined,
+                passwordGenerated,
+            };
+        });
+    }
+    generatePassword() {
+        return `Aa1!${(0, crypto_1.randomBytes)(9).toString('base64url')}`;
+    }
+};
+exports.AdminBootstrapService = AdminBootstrapService;
+exports.AdminBootstrapService = AdminBootstrapService = AdminBootstrapService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object, UserService_1.UserService,
+        AuthService_1.AuthService])
+], AdminBootstrapService);
+//# sourceMappingURL=AdminBootstrapService.js.map

package/dist/accessi-module/Services/AdminBootstrapService/AdminBootstrapService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AdminBootstrapService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AdminBootstrapService/AdminBootstrapService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoH;AACpH,mCAAqC;AACrC,4CAAyC;AAEzC,sEAAmE;AACnE,4DAAyD;AACzD,4DAAyD;AACzD,kEAAqG;AAUrG;;;;GAIG;AAEI,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAGhC,YAC6B,OAAwC,EAClD,WAAwB,EACxB,WAAwB;QAFG,YAAO,GAAP,OAAO,CAAgB;QAClD,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;QAL1B,WAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAM9D,CAAC;IAEJ,oEAAoE;IACpE,SAAS;;QACP,OAAO,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,cAAc,0CAAE,OAAO,MAAK,IAAI,CAAC;IACvD,CAAC;IAEK,SAAS,CAAC,OAAoH;;;YAClI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;gBACtB,MAAM,IAAI,2BAAkB,CAAC;oBAC3B,IAAI,EAAE,kCAAkC;oBACxC,OAAO,EAAE,+DAA+D;iBACzE,CAAC,CAAC;YACL,CAAC;YAED,IAAI,CAAC,IAAA,2CAA0B,EAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAC,EAAE,CAAC;gBAChD,MAAM,IAAI,8BAAqB,CAAC;oBAC9B,IAAI,EAAE,uCAAuC;oBAC7C,OAAO,EAAE,gCAAgC;iBAC1C,CAAC,CAAC;YACL,CAAC;YAED,MAAM,KAAK,GAAG,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3F,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,4BAAmB,CAAC;oBAC5B,IAAI,EAAE,wCAAwC;oBAC9C,OAAO,EAAE,mDAAmD;iBAC7D,CAAC,CAAC;YACL,CAAC;YAED,MAAM,SAAS,GAAG,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,SAAS,mCAAI,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,cAAc,0CAAE,SAAS,MAAK,KAAK,CAAC;YACzF,MAAM,gBAAgB,GAAG,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,QAAQ,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,MAAM,QAAQ,GAAG,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC1F,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,KAAK,CAAC,CAAC;YAExD,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAClD;gBACE,KAAK;gBACL,IAAI,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,IAAI;gBACnB,OAAO,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,OAAO;gBACzB,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,SAAS;aACrB,EACD,EAAE,qBAAqB,EAAE,IAAI,EAAE,YAAY,EAAE,uCAAkB,CAAC,IAAI,EAAE,CACvE,CAAC;YAEF,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAE3D,6EAA6E;YAC7E,IAAA,yCAAwB,GAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,qCAAqC,KAAK,YAAY,YAAY,sBAAsB,CAAC,CAAC;YAE3G,OAAO;gBACL,YAAY;gBACZ,KAAK;gBACL,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;gBAClD,iBAAiB;aAClB,CAAC;QACJ,CAAC;KAAA;IAEO,gBAAgB;QACtB,OAAO,OAAO,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IACvD,CAAC;CACF,CAAA;AAtEY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACX,yBAAW;GANhC,qBAAqB,CAsEjC","sourcesContent":["import { BadRequestException, ForbiddenException, Inject, Injectable, UnauthorizedException } from '@nestjs/common';\nimport { randomBytes } from 'crypto';\nimport { Logger } from '../../../Logger';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { StatoRegistrazione } from '../../Dtos/StatoRegistrazione';\nimport { AuthService } from '../AuthService/AuthService';\nimport { UserService } from '../UserService/UserService';\nimport { clearAdminBootstrapToken, isValidAdminBootstrapToken } from '../../security/adminBootstrap';\n\nexport interface BootstrapAdminResult {\n  codiceUtente: number;\n  email: string;\n  /** Presente solo quando la password e stata generata dal server. */\n  password?: string;\n  passwordGenerated: boolean;\n}\n\n/**\n * Crea il primo utente admin tramite il token casuale di avvio. Non invia email di conferma:\n * l'utente nasce in stato CONF e con password impostata (fornita o generata). Il token e monouso\n * e valido solo per il processo corrente.\n */\n@Injectable()\nexport class AdminBootstrapService {\n  private readonly logger = new Logger(AdminBootstrapService.name);\n\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n    private readonly userService: UserService,\n    private readonly authService: AuthService,\n  ) {}\n\n  /** Indica se il backend ha abilitato l'area \"crea utente admin\". */\n  isEnabled(): boolean {\n    return this.options.adminBootstrap?.enabled === true;\n  }\n\n  async bootstrap(request: { token?: string; email?: string; nome?: string; cognome?: string; password?: string; superUser?: boolean }): Promise<BootstrapAdminResult> {\n    if (!this.isEnabled()) {\n      throw new ForbiddenException({\n        code: 'ACCESSI_ADMIN_BOOTSTRAP_DISABLED',\n        message: 'Il bootstrap admin non e abilitato in questa istanza Accessi.',\n      });\n    }\n\n    if (!isValidAdminBootstrapToken(request?.token)) {\n      throw new UnauthorizedException({\n        code: 'ACCESSI_ADMIN_BOOTSTRAP_TOKEN_INVALID',\n        message: 'Token di bootstrap non valido.',\n      });\n    }\n\n    const email = typeof request?.email === 'string' ? request.email.trim().toLowerCase() : '';\n    if (!email) {\n      throw new BadRequestException({\n        code: 'ACCESSI_ADMIN_BOOTSTRAP_EMAIL_REQUIRED',\n        message: \"L'email e obbligatoria per creare l'utente admin.\",\n      });\n    }\n\n    const superUser = request?.superUser ?? this.options.adminBootstrap?.superUser !== false;\n    const providedPassword = typeof request?.password === 'string' ? request.password : '';\n    const password = providedPassword.length > 0 ? providedPassword : this.generatePassword();\n    const passwordGenerated = providedPassword.length === 0;\n\n    const codiceUtente = await this.userService.register(\n      {\n        email,\n        nome: request?.nome,\n        cognome: request?.cognome,\n        flagAdmin: true,\n        flagSuper: superUser,\n      },\n      { allowPrivilegedFields: true, initialState: StatoRegistrazione.CONF },\n    );\n\n    await this.authService.setPassword(codiceUtente, password);\n\n    // Monouso: un bootstrap riuscito invalida il token fino al prossimo riavvio.\n    clearAdminBootstrapToken();\n    this.logger.info(`Utente admin di bootstrap creato: ${email} (codice ${codiceUtente}). Token invalidato.`);\n\n    return {\n      codiceUtente,\n      email,\n      password: passwordGenerated ? password : undefined,\n      passwordGenerated,\n    };\n  }\n\n  private generatePassword(): string {\n    return `Aa1!${randomBytes(9).toString('base64url')}`;\n  }\n}\n"]}

package/dist/accessi-module/index.d.ts

@@ -23,6 +23,9 @@ export { ServiceTokenService } from './Services/ServiceTokenService/ServiceToken
 export type { ServiceTokenMetadata, IssuedServiceToken, VerifiedServiceToken, IssueServiceTokenInput } from './Services/ServiceTokenService/ServiceTokenService';
 export { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';
 export type { SchemaDdlResult, SchemaDdlSection, SchemaEntitiesResult } from './Services/SchemaExportService/SchemaExportService';
+export { AdminBootstrapService } from './Services/AdminBootstrapService/AdminBootstrapService';
+export type { BootstrapAdminResult } from './Services/AdminBootstrapService/AdminBootstrapService';
+export { getOrCreateAdminBootstrapToken, getAdminBootstrapToken, clearAdminBootstrapToken, isValidAdminBootstrapToken } from './security/adminBootstrap';
 export { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';
 export { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';
 export { FederatedAuthService } from './federated-auth/FederatedAuthService';

package/dist/accessi-module/index.js

@@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.SchemaExportService = exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.leadingStatementKeyword = exports.analyzeCatalogScript = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
+exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.isValidAdminBootstrapToken = exports.clearAdminBootstrapToken = exports.getAdminBootstrapToken = exports.getOrCreateAdminBootstrapToken = exports.AdminBootstrapService = exports.SchemaExportService = exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.leadingStatementKeyword = exports.analyzeCatalogScript = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
 exports.initializeAccessiModule = initializeAccessiModule;
 const express_1 = __importDefault(require("express"));
 const core_1 = require("@nestjs/core");
@@ -37,6 +37,7 @@ const AuthService_1 = require("./Services/AuthService/AuthService");
 const SwaggerConfig_1 = require("../swagger/SwaggerConfig");
 const authenticateGen_1 = require("./middleware/authenticateGen");
 const accessiRuntime_1 = require("./accessiRuntime");
+const startupLog_1 = require("./startupLog");
 const accessiValidation_1 = require("./security/accessiValidation");
 const AccessiHttpExceptionFilter_1 = require("./security/AccessiHttpExceptionFilter");
 const emailConfiguration_1 = require("./security/emailConfiguration");
@@ -109,6 +110,7 @@ function initializeAccessiModule(app, options) {
             const accessiServices = (0, accessiRuntime_1.registerAccessiModuleServices)(app, nestApp);
             app.locals.accessiAuthService = accessiServices.authenticateGenService;
             (0, authenticateGen_1.setAccessiAuthService)(accessiServices.authenticateGenService);
+            (0, startupLog_1.logAccessiStartup)(options);
             const elapsedMs = performance.now() - startedAt;
             logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);
         }
@@ -138,6 +140,13 @@ var ServiceTokenService_1 = require("./Services/ServiceTokenService/ServiceToken
 Object.defineProperty(exports, "ServiceTokenService", { enumerable: true, get: function () { return ServiceTokenService_1.ServiceTokenService; } });
 var SchemaExportService_1 = require("./Services/SchemaExportService/SchemaExportService");
 Object.defineProperty(exports, "SchemaExportService", { enumerable: true, get: function () { return SchemaExportService_1.SchemaExportService; } });
+var AdminBootstrapService_1 = require("./Services/AdminBootstrapService/AdminBootstrapService");
+Object.defineProperty(exports, "AdminBootstrapService", { enumerable: true, get: function () { return AdminBootstrapService_1.AdminBootstrapService; } });
+var adminBootstrap_1 = require("./security/adminBootstrap");
+Object.defineProperty(exports, "getOrCreateAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.getOrCreateAdminBootstrapToken; } });
+Object.defineProperty(exports, "getAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.getAdminBootstrapToken; } });
+Object.defineProperty(exports, "clearAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.clearAdminBootstrapToken; } });
+Object.defineProperty(exports, "isValidAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.isValidAdminBootstrapToken; } });
 var serviceTokenGuard_1 = require("./security/serviceTokenGuard");
 Object.defineProperty(exports, "ServiceTokenGuard", { enumerable: true, get: function () { return serviceTokenGuard_1.ServiceTokenGuard; } });
 Object.defineProperty(exports, "RequireServiceTokenScopes", { enumerable: true, get: function () { return serviceTokenGuard_1.RequireServiceTokenScopes; } });

package/dist/accessi-module/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuCA,0DA6EC;AApHD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAAwD;AACxD,kEAIsC;AACtC,qDAAiE;AACjE,oEAA2E;AAC3E,sFAAmF;AACnF,sEAAsE;AAEtE,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,yFAAyF;QACzF,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAI,KAAK,kBAAkB;gBAC3B,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBACpC,IAAI,KAAK,uBAAuB;gBAChC,IAAI,KAAK,uBAAuB,CAAC;YAErC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;aACzC,CAAC,CAAC;YAEH,IAAA,4BAAY,EAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,sBAAsB;gBACvC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,eAAe,GAAG,IAAA,8CAA6B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,eAAe,CAAC,sBAAsB,CAAC;YACvE,IAAA,uCAAqB,EAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;YAC9D,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAI/B,oFASmD;AAR/C,gIAAA,sBAAsB,OAAA;AACtB,6HAAA,mBAAmB,OAAA;AACnB,mIAAA,yBAAyB,OAAA;AACzB,4HAAA,kBAAkB,OAAA;AAClB,8HAAA,oBAAoB,OAAA;AACpB,iIAAA,uBAAuB,OAAA;AACvB,sIAAA,4BAA4B,OAAA;AAC5B,gIAAA,sBAAsB,OAAA;AAG1B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAO5B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAE5B,kEAAoH;AAA3G,sHAAA,iBAAiB,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AAAE,2HAAA,sBAAsB,OAAA;AAC7E,oEAAuJ;AAA9I,2HAAA,qBAAqB,OAAA;AAAE,uHAAA,iBAAiB,OAAA;AAAE,oIAAA,8BAA8B,OAAA;AAAE,kIAAA,4BAA4B,OAAA;AAC/G,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA;AAC3B,mDAI0B;AAHtB,+HAAA,6BAA6B,OAAA;AAC7B,0HAAA,wBAAwB,OAAA;AACxB,oIAAA,kCAAkC,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport { setupSwagger } from \"../swagger/SwaggerConfig\";\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { registerAccessiModuleServices } from \"./accessiRuntime\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\nimport { assertEmailConfigured } from './security/emailConfiguration';\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n    const dbOptions = options.databaseOptions as {\n        host?: string;\n        port?: number;\n        database?: string;\n        user?: string;\n    };\n\n    return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/**\n * Monta il modulo Accessi in un'applicazione Express gia esistente.\n *\n * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,\n * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n *\n * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n */\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<void> {\n    // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.\n    assertEmailConfigured(options);\n    const logger: Logger = new Logger(\"initializeAccessiModule\");\n    beginAccessiAuthInitialization();\n    const startedAt = performance.now();\n\n    try {\n        logger.info(\"Inizializzazione modulo accessi avviata.\");\n        logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n        logger.info(\n            `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n        );\n        const nestHostApp = express();\n        const isNestRoute = (path: string) =>\n            path === \"/api/accessi\" ||\n            path.startsWith(\"/api/accessi/\") ||\n            path === \"/accessi/swagger\" ||\n            path.startsWith(\"/accessi/swagger/\") ||\n            path === \"/accessi/swagger.json\" ||\n            path === \"/accessi/swagger-json\";\n\n        app.use((req: Request, res, next) => {\n            if (!isNestRoute(req.path)) {\n                return next();\n            }\n\n            return nestHostApp(req, res, next);\n        });\n\n        const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n        const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: true\n        });\n        logger.info(\"Applicazione Nest accessi creata.\");\n\n        nestApp.enableCors({ exposedHeaders: ['X-Total-Count'] });\n        nestApp.useGlobalPipes(createAccessiValidationPipe());\n        nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\n        nestApp.setGlobalPrefix('api', {\n            exclude: ['/swagger', '/swagger/(.*)']\n        });\n\n        setupSwagger(nestApp, {\n            swaggerPath: \"accessi/swagger\",\n            swaggerJsonPath: \"accessi/swagger.json\",\n            title: \"Accessi API Documentation\",\n            description: \"API del modulo accessi\",\n        });\n        logger.info(\"Avvio init del modulo accessi.\");\n        await nestApp.init();\n        logger.info(\"Init del modulo accessi completata.\");\n        if (options.legacyPasswordMigrationOnStartup !== false) {\n            logger.info(\"Avvio migrazione password legacy accessi.\");\n            const passwordMigrationService = nestApp.get(AuthService);\n            await passwordMigrationService.migrateLegacyEncryptedPasswords();\n            logger.info(\"Migrazione password legacy accessi completata.\");\n        }\n\n        const accessiServices = registerAccessiModuleServices(app, nestApp);\n        app.locals.accessiAuthService = accessiServices.authenticateGenService;\n        setAccessiAuthService(accessiServices.authenticateGenService);\n        const elapsedMs = performance.now() - startedAt;\n        logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n    } catch (error) {\n        failAccessiAuthInitialization(error);\n        logger.error(\n            \"Errore in initialize AccessiModule:\",\n            error instanceof Error\n                ? { name: error.name, message: error.message, stack: error.stack }\n                : { error: String(error) }\n        );\n        throw error;\n    }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from \"./AccessiModule\";\nexport type { CatalogScriptsOptions, CatalogScriptChecksumPolicy } from \"./AccessiModule\";\nexport {\n    AccessiCatalogMigrator,\n    applyCatalogScripts,\n    listPendingCatalogScripts,\n    splitSqlStatements,\n    analyzeCatalogScript,\n    leadingStatementKeyword,\n    computeCatalogScriptChecksum,\n    discoverCatalogScripts\n} from \"./database-updates/AccessiCatalogMigrator\";\nexport type { CatalogMigrationReport, CatalogScriptMigration } from \"./database-updates/AccessiCatalogMigrator\";\nexport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nexport type {\n    ServiceTokenMetadata,\n    IssuedServiceToken,\n    VerifiedServiceToken,\n    IssueServiceTokenInput\n} from './Services/ServiceTokenService/ServiceTokenService';\nexport { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';\nexport type { SchemaDdlResult, SchemaDdlSection, SchemaEntitiesResult } from './Services/SchemaExportService/SchemaExportService';\nexport { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';\nexport { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\n    authorizeAccessi,\n    authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport {\n    registerAccessiModuleServices,\n    getAccessiModuleServices,\n    ACCESSI_MODULE_SERVICES_LOCALS_KEY\n} from \"./accessiRuntime\";\nexport type { AccessiModuleServices } from \"./accessiRuntime\";\nexport type {\n    AccessiAuthorizationOptions,\n    AccessiRequirementNode,\n    AccessiCustomRequirementContext,\n    AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,0DA8EC;AAtHD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAAwD;AACxD,kEAIsC;AACtC,qDAAiE;AACjE,6CAAiD;AACjD,oEAA2E;AAC3E,sFAAmF;AACnF,sEAAsE;AAEtE,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,yFAAyF;QACzF,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAI,KAAK,kBAAkB;gBAC3B,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBACpC,IAAI,KAAK,uBAAuB;gBAChC,IAAI,KAAK,uBAAuB,CAAC;YAErC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;aACzC,CAAC,CAAC;YAEH,IAAA,4BAAY,EAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,sBAAsB;gBACvC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,eAAe,GAAG,IAAA,8CAA6B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,eAAe,CAAC,sBAAsB,CAAC;YACvE,IAAA,uCAAqB,EAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;YAC9D,IAAA,8BAAiB,EAAC,OAAO,CAAC,CAAC;YAC3B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAI/B,oFASmD;AAR/C,gIAAA,sBAAsB,OAAA;AACtB,6HAAA,mBAAmB,OAAA;AACnB,mIAAA,yBAAyB,OAAA;AACzB,4HAAA,kBAAkB,OAAA;AAClB,8HAAA,oBAAoB,OAAA;AACpB,iIAAA,uBAAuB,OAAA;AACvB,sIAAA,4BAA4B,OAAA;AAC5B,gIAAA,sBAAsB,OAAA;AAG1B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAO5B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAE5B,gGAA+F;AAAtF,8HAAA,qBAAqB,OAAA;AAE9B,4DAKmC;AAJ/B,gIAAA,8BAA8B,OAAA;AAC9B,wHAAA,sBAAsB,OAAA;AACtB,0HAAA,wBAAwB,OAAA;AACxB,4HAAA,0BAA0B,OAAA;AAE9B,kEAAoH;AAA3G,sHAAA,iBAAiB,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AAAE,2HAAA,sBAAsB,OAAA;AAC7E,oEAAuJ;AAA9I,2HAAA,qBAAqB,OAAA;AAAE,uHAAA,iBAAiB,OAAA;AAAE,oIAAA,8BAA8B,OAAA;AAAE,kIAAA,4BAA4B,OAAA;AAC/G,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA;AAC3B,mDAI0B;AAHtB,+HAAA,6BAA6B,OAAA;AAC7B,0HAAA,wBAAwB,OAAA;AACxB,oIAAA,kCAAkC,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport { setupSwagger } from \"../swagger/SwaggerConfig\";\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { registerAccessiModuleServices } from \"./accessiRuntime\";\nimport { logAccessiStartup } from \"./startupLog\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\nimport { assertEmailConfigured } from './security/emailConfiguration';\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n    const dbOptions = options.databaseOptions as {\n        host?: string;\n        port?: number;\n        database?: string;\n        user?: string;\n    };\n\n    return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/**\n * Monta il modulo Accessi in un'applicazione Express gia esistente.\n *\n * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,\n * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n *\n * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n */\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<void> {\n    // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.\n    assertEmailConfigured(options);\n    const logger: Logger = new Logger(\"initializeAccessiModule\");\n    beginAccessiAuthInitialization();\n    const startedAt = performance.now();\n\n    try {\n        logger.info(\"Inizializzazione modulo accessi avviata.\");\n        logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n        logger.info(\n            `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n        );\n        const nestHostApp = express();\n        const isNestRoute = (path: string) =>\n            path === \"/api/accessi\" ||\n            path.startsWith(\"/api/accessi/\") ||\n            path === \"/accessi/swagger\" ||\n            path.startsWith(\"/accessi/swagger/\") ||\n            path === \"/accessi/swagger.json\" ||\n            path === \"/accessi/swagger-json\";\n\n        app.use((req: Request, res, next) => {\n            if (!isNestRoute(req.path)) {\n                return next();\n            }\n\n            return nestHostApp(req, res, next);\n        });\n\n        const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n        const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: true\n        });\n        logger.info(\"Applicazione Nest accessi creata.\");\n\n        nestApp.enableCors({ exposedHeaders: ['X-Total-Count'] });\n        nestApp.useGlobalPipes(createAccessiValidationPipe());\n        nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\n        nestApp.setGlobalPrefix('api', {\n            exclude: ['/swagger', '/swagger/(.*)']\n        });\n\n        setupSwagger(nestApp, {\n            swaggerPath: \"accessi/swagger\",\n            swaggerJsonPath: \"accessi/swagger.json\",\n            title: \"Accessi API Documentation\",\n            description: \"API del modulo accessi\",\n        });\n        logger.info(\"Avvio init del modulo accessi.\");\n        await nestApp.init();\n        logger.info(\"Init del modulo accessi completata.\");\n        if (options.legacyPasswordMigrationOnStartup !== false) {\n            logger.info(\"Avvio migrazione password legacy accessi.\");\n            const passwordMigrationService = nestApp.get(AuthService);\n            await passwordMigrationService.migrateLegacyEncryptedPasswords();\n            logger.info(\"Migrazione password legacy accessi completata.\");\n        }\n\n        const accessiServices = registerAccessiModuleServices(app, nestApp);\n        app.locals.accessiAuthService = accessiServices.authenticateGenService;\n        setAccessiAuthService(accessiServices.authenticateGenService);\n        logAccessiStartup(options);\n        const elapsedMs = performance.now() - startedAt;\n        logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n    } catch (error) {\n        failAccessiAuthInitialization(error);\n        logger.error(\n            \"Errore in initialize AccessiModule:\",\n            error instanceof Error\n                ? { name: error.name, message: error.message, stack: error.stack }\n                : { error: String(error) }\n        );\n        throw error;\n    }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from \"./AccessiModule\";\nexport type { CatalogScriptsOptions, CatalogScriptChecksumPolicy } from \"./AccessiModule\";\nexport {\n    AccessiCatalogMigrator,\n    applyCatalogScripts,\n    listPendingCatalogScripts,\n    splitSqlStatements,\n    analyzeCatalogScript,\n    leadingStatementKeyword,\n    computeCatalogScriptChecksum,\n    discoverCatalogScripts\n} from \"./database-updates/AccessiCatalogMigrator\";\nexport type { CatalogMigrationReport, CatalogScriptMigration } from \"./database-updates/AccessiCatalogMigrator\";\nexport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nexport type {\n    ServiceTokenMetadata,\n    IssuedServiceToken,\n    VerifiedServiceToken,\n    IssueServiceTokenInput\n} from './Services/ServiceTokenService/ServiceTokenService';\nexport { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';\nexport type { SchemaDdlResult, SchemaDdlSection, SchemaEntitiesResult } from './Services/SchemaExportService/SchemaExportService';\nexport { AdminBootstrapService } from './Services/AdminBootstrapService/AdminBootstrapService';\nexport type { BootstrapAdminResult } from './Services/AdminBootstrapService/AdminBootstrapService';\nexport {\n    getOrCreateAdminBootstrapToken,\n    getAdminBootstrapToken,\n    clearAdminBootstrapToken,\n    isValidAdminBootstrapToken\n} from './security/adminBootstrap';\nexport { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';\nexport { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\n    authorizeAccessi,\n    authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport {\n    registerAccessiModuleServices,\n    getAccessiModuleServices,\n    ACCESSI_MODULE_SERVICES_LOCALS_KEY\n} from \"./accessiRuntime\";\nexport type { AccessiModuleServices } from \"./accessiRuntime\";\nexport type {\n    AccessiAuthorizationOptions,\n    AccessiRequirementNode,\n    AccessiCustomRequirementContext,\n    AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n"]}

package/dist/accessi-module/security/adminBootstrap.d.ts

@@ -0,0 +1,8 @@
+/** Genera (una sola volta per processo) il token di bootstrap admin. */
+export declare function getOrCreateAdminBootstrapToken(): string;
+/** Token corrente, oppure null se non ancora generato. */
+export declare function getAdminBootstrapToken(): string | null;
+/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */
+export declare function clearAdminBootstrapToken(): void;
+/** Confronto a tempo costante del token candidato con quello generato. */
+export declare function isValidAdminBootstrapToken(candidate: unknown): boolean;

package/dist/accessi-module/security/adminBootstrap.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOrCreateAdminBootstrapToken = getOrCreateAdminBootstrapToken;
+exports.getAdminBootstrapToken = getAdminBootstrapToken;
+exports.clearAdminBootstrapToken = clearAdminBootstrapToken;
+exports.isValidAdminBootstrapToken = isValidAdminBootstrapToken;
+const crypto_1 = require("crypto");
+/**
+ * Token di bootstrap admin, valido per il singolo processo Accessi.
+ * Viene generato al primo accesso (avvio del modulo) e rigenerato a ogni riavvio: non e mai
+ * persistito ne restituito via API, e viene stampato solo nel log del backend.
+ */
+let processToken = null;
+/** Genera (una sola volta per processo) il token di bootstrap admin. */
+function getOrCreateAdminBootstrapToken() {
+    if (!processToken) {
+        processToken = (0, crypto_1.randomBytes)(32).toString('hex');
+    }
+    return processToken;
+}
+/** Token corrente, oppure null se non ancora generato. */
+function getAdminBootstrapToken() {
+    return processToken;
+}
+/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */
+function clearAdminBootstrapToken() {
+    processToken = null;
+}
+/** Confronto a tempo costante del token candidato con quello generato. */
+function isValidAdminBootstrapToken(candidate) {
+    if (!processToken || typeof candidate !== 'string' || candidate.length === 0) {
+        return false;
+    }
+    const expected = Buffer.from(processToken, 'utf8');
+    const provided = Buffer.from(candidate, 'utf8');
+    if (expected.length !== provided.length) {
+        return false;
+    }
+    return (0, crypto_1.timingSafeEqual)(expected, provided);
+}
+//# sourceMappingURL=adminBootstrap.js.map

package/dist/accessi-module/security/adminBootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminBootstrap.js","sourceRoot":"","sources":["../../../src/accessi-module/security/adminBootstrap.ts"],"names":[],"mappings":";;AAUA,wEAKC;AAGD,wDAEC;AAGD,4DAEC;AAGD,gEAYC;AAxCD,mCAAsD;AAEtD;;;;GAIG;AACH,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC,wEAAwE;AACxE,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,0DAA0D;AAC1D,SAAgB,sBAAsB;IACpC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iFAAiF;AACjF,SAAgB,wBAAwB;IACtC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,0BAA0B,CAAC,SAAkB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAA,wBAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { randomBytes, timingSafeEqual } from 'crypto';\n\n/**\n * Token di bootstrap admin, valido per il singolo processo Accessi.\n * Viene generato al primo accesso (avvio del modulo) e rigenerato a ogni riavvio: non e mai\n * persistito ne restituito via API, e viene stampato solo nel log del backend.\n */\nlet processToken: string | null = null;\n\n/** Genera (una sola volta per processo) il token di bootstrap admin. */\nexport function getOrCreateAdminBootstrapToken(): string {\n  if (!processToken) {\n    processToken = randomBytes(32).toString('hex');\n  }\n  return processToken;\n}\n\n/** Token corrente, oppure null se non ancora generato. */\nexport function getAdminBootstrapToken(): string | null {\n  return processToken;\n}\n\n/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */\nexport function clearAdminBootstrapToken(): void {\n  processToken = null;\n}\n\n/** Confronto a tempo costante del token candidato con quello generato. */\nexport function isValidAdminBootstrapToken(candidate: unknown): boolean {\n  if (!processToken || typeof candidate !== 'string' || candidate.length === 0) {\n    return false;\n  }\n\n  const expected = Buffer.from(processToken, 'utf8');\n  const provided = Buffer.from(candidate, 'utf8');\n  if (expected.length !== provided.length) {\n    return false;\n  }\n\n  return timingSafeEqual(expected, provided);\n}\n"]}

package/dist/accessi-module/security/publicAuthRateLimit.d.ts

@@ -1,6 +1,6 @@
 import { Request, Response } from 'express';
 import type { AccessiOptions } from '../AccessiModule';
-export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken';
+export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken' | 'adminBootstrap';
 type RateLimitDecision = {
     allowed: boolean;
     retryAfterSeconds: number;

package/dist/accessi-module/security/publicAuthRateLimit.js

@@ -12,6 +12,7 @@ const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
     getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
+    adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
 };
 const RATE_LIMIT_BUCKETS = new Map();
 const MAX_TRACKED_BUCKETS = 20000;

package/dist/accessi-module/security/publicAuthRateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AAyIA,4DAiDC;AAED,0EAWC;AAvMD,2CAA4C;AAE5C,+CAAgD;AAuBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC7D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IAErF,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,aAAa,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,uBAAuB,GAAG,aAAa,CAC3C,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,EACJ,GAAG,CACJ,CAAC;QACF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\n\nexport type PublicAuthRateLimitScope =\n  | 'login'\n  | 'twoFactorVerify'\n  | 'twoFactorResend'\n  | 'register'\n  | 'passwordResetEmail'\n  | 'passwordResetConfirm'\n  | 'getUserByToken';\n\ntype RateLimitBucket = {\n  count: number;\n  resetAt: number;\n  lastSeenAt: number;\n};\n\ntype RateLimitDecision = {\n  allowed: boolean;\n  retryAfterSeconds: number;\n};\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n  PublicAuthRateLimitScope,\n  PublicAuthRateLimitRuleOptions\n> = {\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n  twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n};\n\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\nconst MAX_TRACKED_BUCKETS = 20000;\nconst MAX_WINDOW_MS = Math.max(\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\n);\n\nfunction getRule(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n  const configuredRule = options.publicAuthRateLimit?.[scope];\n\n  if (\n    configuredRule &&\n    Number.isFinite(configuredRule.windowMs) &&\n    configuredRule.windowMs > 0 &&\n    Number.isFinite(configuredRule.maxAttempts) &&\n    configuredRule.maxAttempts > 0\n  ) {\n    return {\n      windowMs: Math.trunc(configuredRule.windowMs),\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\n    };\n  }\n\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nfunction normalizeIdentifier(identifier: string): string | null {\n  if (typeof identifier !== 'string') {\n    return null;\n  }\n\n  const normalized = identifier.trim().toLowerCase();\n  return normalized === '' ? null : normalized;\n}\n\nfunction pruneRateLimitBuckets(now: number): void {\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n    return;\n  }\n\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\n      RATE_LIMIT_BUCKETS.delete(key);\n    }\n\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n      return;\n    }\n  }\n}\n\n/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */\nfunction enforceBucketCap(): void {\n  while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {\n    let oldestKey: string | undefined;\n    let oldestSeen = Number.POSITIVE_INFINITY;\n\n    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n      if (bucket.lastSeenAt < oldestSeen) {\n        oldestSeen = bucket.lastSeenAt;\n        oldestKey = key;\n      }\n    }\n\n    if (oldestKey === undefined) {\n      return;\n    }\n\n    RATE_LIMIT_BUCKETS.delete(oldestKey);\n  }\n}\n\nfunction consumeBucket(\n  bucketKey: string,\n  rule: PublicAuthRateLimitRuleOptions,\n  now: number,\n): number | null {\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\n  if (!existingBucket || existingBucket.resetAt <= now) {\n    enforceBucketCap();\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\n      count: 1,\n      resetAt: now + rule.windowMs,\n      lastSeenAt: now,\n    });\n    return null;\n  }\n\n  existingBucket.lastSeenAt = now;\n  if (existingBucket.count >= rule.maxAttempts) {\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\n  }\n\n  existingBucket.count += 1;\n  return null;\n}\n\nexport function checkPublicAuthRateLimit(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n  req: Request,\n  identifiers: string[] = [],\n): RateLimitDecision {\n  if (options.publicAuthRateLimit?.enabled === false) {\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  const rule = getRule(options, scope);\n  const now = Date.now();\n  pruneRateLimitBuckets(now);\n\n  const ipAddress =\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n  // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n  // evitando crescita di memoria con identificatori sempre diversi.\n  const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);\n  if (ipRetryAfterSeconds) {\n    return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };\n  }\n\n  let retryAfterSeconds = 0;\n  for (const identifier of identifiers) {\n    const normalizedIdentifier = normalizeIdentifier(identifier);\n    if (!normalizedIdentifier) {\n      continue;\n    }\n\n    const bucketRetryAfterSeconds = consumeBucket(\n      `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`,\n      rule,\n      now,\n    );\n    if (bucketRetryAfterSeconds) {\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\n    }\n  }\n\n  if (retryAfterSeconds > 0) {\n    return {\n      allowed: false,\n      retryAfterSeconds,\n    };\n  }\n\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n  res: Response,\n  retryAfterSeconds: number,\n): Response {\n  res.setHeader('Retry-After', String(retryAfterSeconds));\n  return RestUtilities.sendErrorMessage(\n    res,\n    'Troppi tentativi. Riprova piu tardi.',\n    'PublicAuthRateLimit',\n    HttpStatus.TOO_MANY_REQUESTS,\n  );\n}\n"]}
+{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA2IA,4DAiDC;AAED,0EAWC;AAzMD,2CAA4C;AAE5C,+CAAgD;AAwBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC9D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IAErF,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,aAAa,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,uBAAuB,GAAG,aAAa,CAC3C,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,EACJ,GAAG,CACJ,CAAC;QACF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\n\nexport type PublicAuthRateLimitScope =\n  | 'login'\n  | 'twoFactorVerify'\n  | 'twoFactorResend'\n  | 'register'\n  | 'passwordResetEmail'\n  | 'passwordResetConfirm'\n  | 'getUserByToken'\n  | 'adminBootstrap';\n\ntype RateLimitBucket = {\n  count: number;\n  resetAt: number;\n  lastSeenAt: number;\n};\n\ntype RateLimitDecision = {\n  allowed: boolean;\n  retryAfterSeconds: number;\n};\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n  PublicAuthRateLimitScope,\n  PublicAuthRateLimitRuleOptions\n> = {\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n  twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n  adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n};\n\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\nconst MAX_TRACKED_BUCKETS = 20000;\nconst MAX_WINDOW_MS = Math.max(\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\n);\n\nfunction getRule(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n  const configuredRule = options.publicAuthRateLimit?.[scope];\n\n  if (\n    configuredRule &&\n    Number.isFinite(configuredRule.windowMs) &&\n    configuredRule.windowMs > 0 &&\n    Number.isFinite(configuredRule.maxAttempts) &&\n    configuredRule.maxAttempts > 0\n  ) {\n    return {\n      windowMs: Math.trunc(configuredRule.windowMs),\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\n    };\n  }\n\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nfunction normalizeIdentifier(identifier: string): string | null {\n  if (typeof identifier !== 'string') {\n    return null;\n  }\n\n  const normalized = identifier.trim().toLowerCase();\n  return normalized === '' ? null : normalized;\n}\n\nfunction pruneRateLimitBuckets(now: number): void {\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n    return;\n  }\n\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\n      RATE_LIMIT_BUCKETS.delete(key);\n    }\n\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n      return;\n    }\n  }\n}\n\n/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */\nfunction enforceBucketCap(): void {\n  while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {\n    let oldestKey: string | undefined;\n    let oldestSeen = Number.POSITIVE_INFINITY;\n\n    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n      if (bucket.lastSeenAt < oldestSeen) {\n        oldestSeen = bucket.lastSeenAt;\n        oldestKey = key;\n      }\n    }\n\n    if (oldestKey === undefined) {\n      return;\n    }\n\n    RATE_LIMIT_BUCKETS.delete(oldestKey);\n  }\n}\n\nfunction consumeBucket(\n  bucketKey: string,\n  rule: PublicAuthRateLimitRuleOptions,\n  now: number,\n): number | null {\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\n  if (!existingBucket || existingBucket.resetAt <= now) {\n    enforceBucketCap();\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\n      count: 1,\n      resetAt: now + rule.windowMs,\n      lastSeenAt: now,\n    });\n    return null;\n  }\n\n  existingBucket.lastSeenAt = now;\n  if (existingBucket.count >= rule.maxAttempts) {\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\n  }\n\n  existingBucket.count += 1;\n  return null;\n}\n\nexport function checkPublicAuthRateLimit(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n  req: Request,\n  identifiers: string[] = [],\n): RateLimitDecision {\n  if (options.publicAuthRateLimit?.enabled === false) {\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  const rule = getRule(options, scope);\n  const now = Date.now();\n  pruneRateLimitBuckets(now);\n\n  const ipAddress =\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n  // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n  // evitando crescita di memoria con identificatori sempre diversi.\n  const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);\n  if (ipRetryAfterSeconds) {\n    return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };\n  }\n\n  let retryAfterSeconds = 0;\n  for (const identifier of identifiers) {\n    const normalizedIdentifier = normalizeIdentifier(identifier);\n    if (!normalizedIdentifier) {\n      continue;\n    }\n\n    const bucketRetryAfterSeconds = consumeBucket(\n      `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`,\n      rule,\n      now,\n    );\n    if (bucketRetryAfterSeconds) {\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\n    }\n  }\n\n  if (retryAfterSeconds > 0) {\n    return {\n      allowed: false,\n      retryAfterSeconds,\n    };\n  }\n\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n  res: Response,\n  retryAfterSeconds: number,\n): Response {\n  res.setHeader('Retry-After', String(retryAfterSeconds));\n  return RestUtilities.sendErrorMessage(\n    res,\n    'Troppi tentativi. Riprova piu tardi.',\n    'PublicAuthRateLimit',\n    HttpStatus.TOO_MANY_REQUESTS,\n  );\n}\n"]}

package/dist/accessi-module/startupLog.d.ts

@@ -0,0 +1,6 @@
+import type { AccessiOptions } from './AccessiModule';
+/**
+ * Logga gli indirizzi utili del modulo Accessi appena il bootstrap e completato, cosi che
+ * console, swagger e API siano visibili insieme nei log di avvio.
+ */
+export declare function logAccessiStartup(options: AccessiOptions): void;

package/dist/accessi-module/startupLog.js

@@ -0,0 +1,25 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logAccessiStartup = logAccessiStartup;
+const Logger_1 = require("../Logger");
+const adminBootstrap_1 = require("./security/adminBootstrap");
+/**
+ * Logga gli indirizzi utili del modulo Accessi appena il bootstrap e completato, cosi che
+ * console, swagger e API siano visibili insieme nei log di avvio.
+ */
+function logAccessiStartup(options) {
+    var _a, _b;
+    const logger = new Logger_1.Logger('Accessi');
+    const base = ((_a = options.publicBaseUrl) !== null && _a !== void 0 ? _a : '').replace(/\/+$/, '');
+    const url = (path) => `${base}${path}`;
+    logger.info('Accessi pronto. Indirizzi utili:');
+    logger.info(`  Console:      ${url('/api/accessi/console')}`);
+    logger.info(`  Swagger UI:   ${url('/accessi/swagger')}`);
+    logger.info(`  Swagger JSON: ${url('/accessi/swagger.json')}`);
+    logger.info(`  API:          ${url('/api/accessi')}`);
+    if (((_b = options.adminBootstrap) === null || _b === void 0 ? void 0 : _b.enabled) === true) {
+        const token = (0, adminBootstrap_1.getOrCreateAdminBootstrapToken)();
+        logger.warning(`  Bootstrap admin abilitato. Token di avvio (monouso, valido fino al riavvio): ${token}`);
+    }
+}
+//# sourceMappingURL=startupLog.js.map

package/dist/accessi-module/startupLog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"startupLog.js","sourceRoot":"","sources":["../../src/accessi-module/startupLog.ts"],"names":[],"mappings":";;AAQA,8CAeC;AAvBD,sCAAmC;AAEnC,8DAA2E;AAE3E;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,OAAuB;;IACvD,MAAM,MAAM,GAAG,IAAI,eAAM,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,CAAC,MAAA,OAAO,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI,EAAE,CAAC;IAE/C,MAAM,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IAChD,MAAM,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC;IAC9D,MAAM,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC,CAAC;IAC1D,MAAM,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IAC/D,MAAM,CAAC,IAAI,CAAC,mBAAmB,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;IAEtD,IAAI,CAAA,MAAA,OAAO,CAAC,cAAc,0CAAE,OAAO,MAAK,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAA,+CAA8B,GAAE,CAAC;QAC/C,MAAM,CAAC,OAAO,CAAC,kFAAkF,KAAK,EAAE,CAAC,CAAC;IAC5G,CAAC;AACH,CAAC","sourcesContent":["import { Logger } from '../Logger';\nimport type { AccessiOptions } from './AccessiModule';\nimport { getOrCreateAdminBootstrapToken } from './security/adminBootstrap';\n\n/**\n * Logga gli indirizzi utili del modulo Accessi appena il bootstrap e completato, cosi che\n * console, swagger e API siano visibili insieme nei log di avvio.\n */\nexport function logAccessiStartup(options: AccessiOptions): void {\n  const logger = new Logger('Accessi');\n  const base = (options.publicBaseUrl ?? '').replace(/\\/+$/, '');\n  const url = (path: string) => `${base}${path}`;\n\n  logger.info('Accessi pronto. Indirizzi utili:');\n  logger.info(`  Console:      ${url('/api/accessi/console')}`);\n  logger.info(`  Swagger UI:   ${url('/accessi/swagger')}`);\n  logger.info(`  Swagger JSON: ${url('/accessi/swagger.json')}`);\n  logger.info(`  API:          ${url('/api/accessi')}`);\n\n  if (options.adminBootstrap?.enabled === true) {\n    const token = getOrCreateAdminBootstrapToken();\n    logger.warning(`  Bootstrap admin abilitato. Token di avvio (monouso, valido fino al riavvio): ${token}`);\n  }\n}\n"]}

package/dist/initEmilsoftwareModule.js

@@ -21,6 +21,7 @@ const Logger_1 = require("./Logger");
 const EmilsoftwareModule_1 = require("./EmilsoftwareModule");
 const authenticateGen_1 = require("./accessi-module/middleware/authenticateGen");
 const accessiRuntime_1 = require("./accessi-module/accessiRuntime");
+const startupLog_1 = require("./accessi-module/startupLog");
 const accessiValidation_1 = require("./accessi-module/security/accessiValidation");
 const AccessiHttpExceptionFilter_1 = require("./accessi-module/security/AccessiHttpExceptionFilter");
 /**
@@ -69,6 +70,7 @@ function initEmilsoftwareModule(app, options) {
                 const accessiServices = (0, accessiRuntime_1.registerAccessiModuleServices)(app, nestApp);
                 app.locals.accessiAuthService = accessiServices.authenticateGenService;
                 (0, authenticateGen_1.setAccessiAuthService)(accessiServices.authenticateGenService);
+                (0, startupLog_1.logAccessiStartup)(options.accessiOptions);
             }
             logger.info("Emilsoftware module initialized successfully");
         }