emilsoftware-utilities 2.0.0-dev.4 → 2.0.0-dev.40

package/dist/accessi-module/Services/ServiceTokenService/ServiceTokenService.js

@@ -0,0 +1,265 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ServiceTokenService = exports.SERVICE_TOKEN_PREFIX = void 0;
+exports.generateServiceToken = generateServiceToken;
+exports.parseServiceToken = parseServiceToken;
+exports.hashServiceTokenSecret = hashServiceTokenSecret;
+exports.normalizeServiceTokenScopes = normalizeServiceTokenScopes;
+exports.serviceTokenHasScope = serviceTokenHasScope;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const autobind_1 = require("../../../autobind");
+const Orm_1 = require("../../../Orm");
+const Utilities_1 = require("../../../Utilities");
+/** Prefisso riconoscibile dei token di servizio; il formato completo e `st_<id>.<segreto>`. */
+exports.SERVICE_TOKEN_PREFIX = 'st_';
+const TOKEN_ID_PATTERN = /^st_[a-f0-9]{32}$/;
+const SCOPE_PATTERN = /^[a-z0-9:_-]{1,40}$/i;
+const LAST_USED_REFRESH_MS = 60000;
+/** Genera un nuovo token di servizio: identificativo pubblico + segreto ad alta entropia. */
+function generateServiceToken() {
+    const tokenId = `${exports.SERVICE_TOKEN_PREFIX}${(0, crypto_1.randomBytes)(16).toString('hex')}`;
+    const secret = (0, crypto_1.randomBytes)(32).toString('base64url');
+    return { token: `${tokenId}.${secret}`, tokenId, secret };
+}
+/** Estrae identificativo e segreto; restituisce `null` se il formato non e valido. */
+function parseServiceToken(token) {
+    if (typeof token !== 'string') {
+        return null;
+    }
+    const separator = token.indexOf('.');
+    if (separator <= 0) {
+        return null;
+    }
+    const tokenId = token.slice(0, separator);
+    const secret = token.slice(separator + 1);
+    if (!TOKEN_ID_PATTERN.test(tokenId) || secret.length < 16) {
+        return null;
+    }
+    return { tokenId, secret };
+}
+/** Hash del segreto per lo storage at-rest. Il segreto e ad alta entropia (256 bit), non una password. */
+function hashServiceTokenSecret(secret) {
+    return (0, crypto_1.createHash)('sha256').update(secret, 'utf8').digest('hex');
+}
+/** Normalizza e valida gli scope: trim, dedup e controllo del formato. */
+function normalizeServiceTokenScopes(scopes) {
+    if (scopes === undefined) {
+        return [];
+    }
+    if (!Array.isArray(scopes)) {
+        throw new common_1.BadRequestException('Gli scope devono essere un array di stringhe.');
+    }
+    const normalized = [];
+    for (const rawScope of scopes) {
+        if (typeof rawScope !== 'string' || !SCOPE_PATTERN.test(rawScope.trim())) {
+            throw new common_1.BadRequestException(`Scope non valido: ${String(rawScope)}. Usare lettere, numeri, ':', '_' o '-'.`);
+        }
+        const scope = rawScope.trim().toLowerCase();
+        if (!normalized.includes(scope)) {
+            normalized.push(scope);
+        }
+    }
+    return normalized;
+}
+/** True se l'insieme di scope soddisfa quello richiesto (uno scope vuoto non richiede nulla). */
+function serviceTokenHasScope(scopes, required) {
+    if (!required) {
+        return true;
+    }
+    return scopes.includes(required.toLowerCase());
+}
+function toIso(value) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    const date = value instanceof Date ? value : new Date(String(value));
+    return Number.isNaN(date.getTime()) ? undefined : date.toISOString();
+}
+function resolveExpiration(input, defaultTtlDays) {
+    var _a;
+    if (input.expiresAt !== undefined && input.expiresAt !== null && input.expiresAt !== '') {
+        const expiresAt = input.expiresAt instanceof Date ? input.expiresAt : new Date(String(input.expiresAt));
+        if (Number.isNaN(expiresAt.getTime())) {
+            throw new common_1.BadRequestException('Data di scadenza non valida.');
+        }
+        if (expiresAt.getTime() <= Date.now()) {
+            throw new common_1.BadRequestException('La data di scadenza deve essere nel futuro.');
+        }
+        return expiresAt;
+    }
+    const ttlDays = (_a = input.ttlDays) !== null && _a !== void 0 ? _a : defaultTtlDays;
+    if (typeof ttlDays === 'number' && Number.isFinite(ttlDays) && ttlDays > 0) {
+        return new Date(Date.now() + ttlDays * 24 * 60 * 60 * 1000);
+    }
+    return null;
+}
+/** Gestisce il ciclo di vita dei token di servizio (emissione, elenco, revoca, rotazione, verifica). */
+let ServiceTokenService = class ServiceTokenService {
+    constructor(accessiOptions) {
+        this.accessiOptions = accessiOptions;
+    }
+    get databaseOptions() {
+        return this.accessiOptions.databaseOptions;
+    }
+    toMetadata(row) {
+        var _a;
+        const scopesRaw = typeof row.scopes === 'string' ? row.scopes.trim() : '';
+        return {
+            tokenId: String((_a = row.tokenId) !== null && _a !== void 0 ? _a : ''),
+            label: typeof row.label === 'string' ? row.label : '',
+            scopes: scopesRaw === '' ? [] : scopesRaw.split(/\s+/),
+            createdAt: toIso(row.createdAt),
+            expiresAt: toIso(row.expiresAt),
+            lastUsedAt: toIso(row.lastUsedAt),
+            lastUsedIp: typeof row.lastUsedIp === 'string' && row.lastUsedIp !== '' ? row.lastUsedIp : undefined,
+            revoked: row.revokedAt !== undefined && row.revokedAt !== null,
+            revokedAt: toIso(row.revokedAt),
+            revokedBy: row.revokedBy == null ? undefined : Number(row.revokedBy),
+        };
+    }
+    readRow(tokenId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const rows = yield Orm_1.Orm.query(this.databaseOptions, `SELECT TOKEN_ID, TOKEN_HASH, LABEL, SCOPES, CREATED_BY, CREATED_AT, EXPIRES_AT, LAST_USED_AT, LAST_USED_IP, REVOKED_AT, REVOKED_BY
+       FROM ACCESSI_SERVICE_TOKEN WHERE TOKEN_ID = ?`, [tokenId], false);
+            return rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
+        });
+    }
+    /** Crea un nuovo token. Il segreto in chiaro e restituito una sola volta e non e recuperabile. */
+    issue(input, createdBy) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const label = typeof (input === null || input === void 0 ? void 0 : input.label) === 'string' ? input.label.trim() : '';
+            if (label.length < 1 || label.length > 100) {
+                throw new common_1.BadRequestException('La descrizione del token deve essere compresa tra 1 e 100 caratteri.');
+            }
+            const scopes = normalizeServiceTokenScopes(input.scopes);
+            const expiresAt = resolveExpiration(input, (_a = this.accessiOptions.serviceTokens) === null || _a === void 0 ? void 0 : _a.defaultTtlDays);
+            const { token, tokenId, secret } = generateServiceToken();
+            yield Orm_1.Orm.execute(this.databaseOptions, `INSERT INTO ACCESSI_SERVICE_TOKEN (TOKEN_ID, TOKEN_HASH, LABEL, SCOPES, CREATED_BY, EXPIRES_AT)
+       VALUES (?, ?, ?, ?, ?, ?)`, [tokenId, hashServiceTokenSecret(secret), label, scopes.join(' '), createdBy !== null && createdBy !== void 0 ? createdBy : null, expiresAt]);
+            const row = yield this.readRow(tokenId);
+            return Object.assign(Object.assign({}, this.toMetadata(row !== null && row !== void 0 ? row : { tokenId, label, scopes: scopes.join(' ') })), { token });
+        });
+    }
+    /** Elenca i token (metadati soltanto, mai il segreto). */
+    list() {
+        return __awaiter(this, arguments, void 0, function* (includeRevoked = false) {
+            const rows = yield Orm_1.Orm.query(this.databaseOptions, `SELECT TOKEN_ID, LABEL, SCOPES, CREATED_BY, CREATED_AT, EXPIRES_AT, LAST_USED_AT, LAST_USED_IP, REVOKED_AT, REVOKED_BY
+       FROM ACCESSI_SERVICE_TOKEN ${includeRevoked ? '' : 'WHERE REVOKED_AT IS NULL'}
+       ORDER BY CREATED_AT DESC, TOKEN_ID DESC`, [], false);
+            return rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase).map((row) => this.toMetadata(row));
+        });
+    }
+    /** Revoca un token rendendolo immediatamente inutilizzabile. Idempotente su token gia revocati. */
+    revoke(tokenId, revokedBy) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const parsed = parseServiceToken(tokenId);
+            const normalizedId = (_a = parsed === null || parsed === void 0 ? void 0 : parsed.tokenId) !== null && _a !== void 0 ? _a : tokenId;
+            const row = yield this.readRow(normalizedId);
+            if (!row) {
+                throw new common_1.NotFoundException(`Token di servizio ${normalizedId} non trovato.`);
+            }
+            if (row.revokedAt !== undefined && row.revokedAt !== null) {
+                return;
+            }
+            yield Orm_1.Orm.execute(this.databaseOptions, 'UPDATE ACCESSI_SERVICE_TOKEN SET REVOKED_AT = CURRENT_TIMESTAMP, REVOKED_BY = ? WHERE TOKEN_ID = ?', [revokedBy !== null && revokedBy !== void 0 ? revokedBy : null, normalizedId]);
+        });
+    }
+    /** Revoca il token indicato ed emette un sostituto con gli stessi metadati. */
+    rotate(tokenId, createdBy) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const parsed = parseServiceToken(tokenId);
+            const normalizedId = (_a = parsed === null || parsed === void 0 ? void 0 : parsed.tokenId) !== null && _a !== void 0 ? _a : tokenId;
+            const row = yield this.readRow(normalizedId);
+            if (!row) {
+                throw new common_1.NotFoundException(`Token di servizio ${normalizedId} non trovato.`);
+            }
+            const metadata = this.toMetadata(row);
+            yield this.revoke(normalizedId, createdBy);
+            return this.issue({
+                label: metadata.label,
+                scopes: metadata.scopes,
+                expiresAt: (_b = metadata.expiresAt) !== null && _b !== void 0 ? _b : null,
+            }, createdBy);
+        });
+    }
+    /**
+     * Verifica un token presentato: formato, esistenza, revoca, scadenza e hash a tempo costante.
+     * Aggiorna `LAST_USED_AT` (best-effort, al massimo una volta al minuto).
+     */
+    verify(token, context) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const parsed = parseServiceToken(token);
+            if (!parsed) {
+                return undefined;
+            }
+            const row = yield this.readRow(parsed.tokenId);
+            if (!row) {
+                return undefined;
+            }
+            if (row.revokedAt !== undefined && row.revokedAt !== null) {
+                return undefined;
+            }
+            const expiresAt = toIso(row.expiresAt);
+            if (expiresAt && new Date(expiresAt).getTime() <= Date.now()) {
+                return undefined;
+            }
+            const storedHash = typeof row.tokenHash === 'string' ? row.tokenHash : '';
+            if (!storedHash || !this.safeHashEquals(hashServiceTokenSecret(parsed.secret), storedHash)) {
+                return undefined;
+            }
+            const metadata = this.toMetadata(row);
+            yield this.touchLastUsed(parsed.tokenId, row.lastUsedAt, context === null || context === void 0 ? void 0 : context.ip).catch(() => undefined);
+            return { tokenId: metadata.tokenId, label: metadata.label, scopes: metadata.scopes };
+        });
+    }
+    safeHashEquals(candidate, stored) {
+        const candidateBuffer = Buffer.from(candidate, 'hex');
+        const storedBuffer = Buffer.from(stored, 'hex');
+        if (candidateBuffer.length !== storedBuffer.length || candidateBuffer.length === 0) {
+            return false;
+        }
+        return (0, crypto_1.timingSafeEqual)(candidateBuffer, storedBuffer);
+    }
+    touchLastUsed(tokenId, lastUsedAt, ip) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const lastUsed = toIso(lastUsedAt);
+            if (lastUsed && Date.now() - new Date(lastUsed).getTime() < LAST_USED_REFRESH_MS) {
+                return;
+            }
+            yield Orm_1.Orm.execute(this.databaseOptions, 'UPDATE ACCESSI_SERVICE_TOKEN SET LAST_USED_AT = CURRENT_TIMESTAMP, LAST_USED_IP = ? WHERE TOKEN_ID = ?', [ip !== null && ip !== void 0 ? ip : null, tokenId], false);
+        });
+    }
+};
+exports.ServiceTokenService = ServiceTokenService;
+exports.ServiceTokenService = ServiceTokenService = __decorate([
+    autobind_1.autobind,
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object])
+], ServiceTokenService);
+//# sourceMappingURL=ServiceTokenService.js.map

package/dist/accessi-module/Services/ServiceTokenService/ServiceTokenService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ServiceTokenService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/ServiceTokenService/ServiceTokenService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAgDA,oDAIC;AAGD,8CAiBC;AAGD,wDAEC;AAGD,kEAmBC;AAGD,oDAKC;AA3GD,2CAA4F;AAC5F,mCAAkE;AAClE,gDAA6C;AAC7C,sCAAmC;AACnC,kDAAmD;AAGnD,+FAA+F;AAClF,QAAA,oBAAoB,GAAG,KAAK,CAAC;AAC1C,MAAM,gBAAgB,GAAG,mBAAmB,CAAC;AAC7C,MAAM,aAAa,GAAG,sBAAsB,CAAC;AAC7C,MAAM,oBAAoB,GAAG,KAAM,CAAC;AAoCpC,6FAA6F;AAC7F,SAAgB,oBAAoB;IAClC,MAAM,OAAO,GAAG,GAAG,4BAAoB,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5E,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACrD,OAAO,EAAE,KAAK,EAAE,GAAG,OAAO,IAAI,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,sFAAsF;AACtF,SAAgB,iBAAiB,CAAC,KAAc;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,SAAS,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,0GAA0G;AAC1G,SAAgB,sBAAsB,CAAC,MAAc;IACnD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,0EAA0E;AAC1E,SAAgB,2BAA2B,CAAC,MAA4B;IACtE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,4BAAmB,CAAC,+CAA+C,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,KAAK,MAAM,QAAQ,IAAI,MAAM,EAAE,CAAC;QAC9B,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,4BAAmB,CAAC,qBAAqB,MAAM,CAAC,QAAQ,CAAC,0CAA0C,CAAC,CAAC;QACjH,CAAC;QACD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC5C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,iGAAiG;AACjG,SAAgB,oBAAoB,CAAC,MAAgB,EAAE,QAA4B;IACjF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,SAAS,KAAK,CAAC,KAAc;IAC3B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1C,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAA6B,EAAE,cAAuB;;IAC/E,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;QACxF,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;QACxG,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,8BAA8B,CAAC,CAAC;QAChE,CAAC;QACD,IAAI,SAAS,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,4BAAmB,CAAC,6CAA6C,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAAG,MAAA,KAAK,CAAC,OAAO,mCAAI,cAAc,CAAC;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAC3E,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC9D,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wGAAwG;AAGjG,IAAM,mBAAmB,GAAzB,MAAM,mBAAmB;IAC9B,YAAwD,cAA8B;QAA9B,mBAAc,GAAd,cAAc,CAAgB;IAAG,CAAC;IAE1F,IAAY,eAAe;QACzB,OAAO,IAAI,CAAC,cAAc,CAAC,eAAe,CAAC;IAC7C,CAAC;IAEO,UAAU,CAAC,GAA4B;;QAC7C,MAAM,SAAS,GAAG,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,OAAO;YACL,OAAO,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,OAAO,mCAAI,EAAE,CAAC;YAClC,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;YACrD,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;YACtD,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;YACjC,UAAU,EAAE,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;YACpG,OAAO,EAAE,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI;YAC9D,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC;YAC/B,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC;SACrE,CAAC;IACJ,CAAC;IAEa,OAAO,CAAC,OAAe;;YACnC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,eAAe,EACpB;qDAC+C,EAC/C,CAAC,OAAO,CAAC,EACT,KAAK,CACN,CAAC;YACF,OAAQ,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAoC,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;KAAA;IAED,kGAAkG;IAC5F,KAAK,CAAC,KAA6B,EAAE,SAAkB;;;YAC3D,MAAM,KAAK,GAAG,OAAO,CAAA,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC3C,MAAM,IAAI,4BAAmB,CAAC,sEAAsE,CAAC,CAAC;YACxG,CAAC;YAED,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,EAAE,MAAA,IAAI,CAAC,cAAc,CAAC,aAAa,0CAAE,cAAc,CAAC,CAAC;YAC9F,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,oBAAoB,EAAE,CAAC;YAE1D,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB;iCAC2B,EAC3B,CAAC,OAAO,EAAE,sBAAsB,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,IAAI,EAAE,SAAS,CAAC,CACjG,CAAC;YAEF,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACxC,uCAAY,IAAI,CAAC,UAAU,CAAC,GAAG,aAAH,GAAG,cAAH,GAAG,GAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,KAAE,KAAK,IAAG;QAC5F,CAAC;KAAA;IAED,0DAA0D;IACpD,IAAI;6DAAC,cAAc,GAAG,KAAK;YAC/B,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,eAAe,EACpB;oCAC8B,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,0BAA0B;+CACrC,EACzC,EAAE,EACF,KAAK,CACN,CAAC;YACF,OAAQ,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAoC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QAC/H,CAAC;KAAA;IAED,mGAAmG;IAC7F,MAAM,CAAC,OAAe,EAAE,SAAkB;;;YAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,mCAAI,OAAO,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,YAAY,eAAe,CAAC,CAAC;YAChF,CAAC;YACD,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1D,OAAO;YACT,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB,oGAAoG,EACpG,CAAC,SAAS,aAAT,SAAS,cAAT,SAAS,GAAI,IAAI,EAAE,YAAY,CAAC,CAClC,CAAC;QACJ,CAAC;KAAA;IAED,+EAA+E;IACzE,MAAM,CAAC,OAAe,EAAE,SAAkB;;;YAC9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YAC1C,MAAM,YAAY,GAAG,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,OAAO,mCAAI,OAAO,CAAC;YAChD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YAC7C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,0BAAiB,CAAC,qBAAqB,YAAY,eAAe,CAAC,CAAC;YAChF,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;YAE3C,OAAO,IAAI,CAAC,KAAK,CACf;gBACE,KAAK,EAAE,QAAQ,CAAC,KAAK;gBACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,SAAS,EAAE,MAAA,QAAQ,CAAC,SAAS,mCAAI,IAAI;aACtC,EACD,SAAS,CACV,CAAC;QACJ,CAAC;KAAA;IAED;;;OAGG;IACG,MAAM,CAAC,KAAa,EAAE,OAAyB;;YACnD,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,GAAG,CAAC,SAAS,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;gBAC1D,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACvC,IAAI,SAAS,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC7D,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,UAAU,GAAG,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,EAAE,CAAC;gBAC3F,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACtC,MAAM,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAE7F,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC;QACvF,CAAC;KAAA;IAEO,cAAc,CAAC,SAAiB,EAAE,MAAc;QACtD,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACtD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,eAAe,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACnF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAA,wBAAe,EAAC,eAAe,EAAE,YAAY,CAAC,CAAC;IACxD,CAAC;IAEa,aAAa,CAAC,OAAe,EAAE,UAAmB,EAAE,EAAW;;YAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;YACnC,IAAI,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,GAAG,oBAAoB,EAAE,CAAC;gBACjF,OAAO;YACT,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,eAAe,EACpB,wGAAwG,EACxG,CAAC,EAAE,aAAF,EAAE,cAAF,EAAE,GAAI,IAAI,EAAE,OAAO,CAAC,EACrB,KAAK,CACN,CAAC;QACJ,CAAC;KAAA;CACF,CAAA;AArKY,kDAAmB;8BAAnB,mBAAmB;IAF/B,mBAAQ;IACR,IAAA,mBAAU,GAAE;IAEE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;;GAD3B,mBAAmB,CAqK/B","sourcesContent":["import { BadRequestException, Inject, Injectable, NotFoundException } from '@nestjs/common';\nimport { createHash, randomBytes, timingSafeEqual } from 'crypto';\nimport { autobind } from '../../../autobind';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\n\n/** Prefisso riconoscibile dei token di servizio; il formato completo e `st_<id>.<segreto>`. */\nexport const SERVICE_TOKEN_PREFIX = 'st_';\nconst TOKEN_ID_PATTERN = /^st_[a-f0-9]{32}$/;\nconst SCOPE_PATTERN = /^[a-z0-9:_-]{1,40}$/i;\nconst LAST_USED_REFRESH_MS = 60_000;\n\n/** Metadati pubblici di un token (mai il segreto). */\nexport interface ServiceTokenMetadata {\n  tokenId: string;\n  label: string;\n  scopes: string[];\n  createdAt?: string;\n  expiresAt?: string;\n  lastUsedAt?: string;\n  lastUsedIp?: string;\n  revoked: boolean;\n  revokedAt?: string;\n  revokedBy?: number;\n}\n\n/** Risultato dell'emissione: contiene il segreto in chiaro, mostrato una sola volta. */\nexport interface IssuedServiceToken extends ServiceTokenMetadata {\n  token: string;\n}\n\n/** Risultato della verifica di un token presentato. */\nexport interface VerifiedServiceToken {\n  tokenId: string;\n  label: string;\n  scopes: string[];\n}\n\nexport interface IssueServiceTokenInput {\n  label: string;\n  scopes?: string[];\n  expiresAt?: Date | string | null;\n  /** Giorni di validita; ignorato se `expiresAt` e valorizzato. */\n  ttlDays?: number;\n}\n\n/** Genera un nuovo token di servizio: identificativo pubblico + segreto ad alta entropia. */\nexport function generateServiceToken(): { token: string; tokenId: string; secret: string } {\n  const tokenId = `${SERVICE_TOKEN_PREFIX}${randomBytes(16).toString('hex')}`;\n  const secret = randomBytes(32).toString('base64url');\n  return { token: `${tokenId}.${secret}`, tokenId, secret };\n}\n\n/** Estrae identificativo e segreto; restituisce `null` se il formato non e valido. */\nexport function parseServiceToken(token: unknown): { tokenId: string; secret: string } | null {\n  if (typeof token !== 'string') {\n    return null;\n  }\n\n  const separator = token.indexOf('.');\n  if (separator <= 0) {\n    return null;\n  }\n\n  const tokenId = token.slice(0, separator);\n  const secret = token.slice(separator + 1);\n  if (!TOKEN_ID_PATTERN.test(tokenId) || secret.length < 16) {\n    return null;\n  }\n\n  return { tokenId, secret };\n}\n\n/** Hash del segreto per lo storage at-rest. Il segreto e ad alta entropia (256 bit), non una password. */\nexport function hashServiceTokenSecret(secret: string): string {\n  return createHash('sha256').update(secret, 'utf8').digest('hex');\n}\n\n/** Normalizza e valida gli scope: trim, dedup e controllo del formato. */\nexport function normalizeServiceTokenScopes(scopes: string[] | undefined): string[] {\n  if (scopes === undefined) {\n    return [];\n  }\n  if (!Array.isArray(scopes)) {\n    throw new BadRequestException('Gli scope devono essere un array di stringhe.');\n  }\n\n  const normalized: string[] = [];\n  for (const rawScope of scopes) {\n    if (typeof rawScope !== 'string' || !SCOPE_PATTERN.test(rawScope.trim())) {\n      throw new BadRequestException(`Scope non valido: ${String(rawScope)}. Usare lettere, numeri, ':', '_' o '-'.`);\n    }\n    const scope = rawScope.trim().toLowerCase();\n    if (!normalized.includes(scope)) {\n      normalized.push(scope);\n    }\n  }\n  return normalized;\n}\n\n/** True se l'insieme di scope soddisfa quello richiesto (uno scope vuoto non richiede nulla). */\nexport function serviceTokenHasScope(scopes: string[], required: string | undefined): boolean {\n  if (!required) {\n    return true;\n  }\n  return scopes.includes(required.toLowerCase());\n}\n\nfunction toIso(value: unknown): string | undefined {\n  if (value === undefined || value === null) {\n    return undefined;\n  }\n  const date = value instanceof Date ? value : new Date(String(value));\n  return Number.isNaN(date.getTime()) ? undefined : date.toISOString();\n}\n\nfunction resolveExpiration(input: IssueServiceTokenInput, defaultTtlDays?: number): Date | null {\n  if (input.expiresAt !== undefined && input.expiresAt !== null && input.expiresAt !== '') {\n    const expiresAt = input.expiresAt instanceof Date ? input.expiresAt : new Date(String(input.expiresAt));\n    if (Number.isNaN(expiresAt.getTime())) {\n      throw new BadRequestException('Data di scadenza non valida.');\n    }\n    if (expiresAt.getTime() <= Date.now()) {\n      throw new BadRequestException('La data di scadenza deve essere nel futuro.');\n    }\n    return expiresAt;\n  }\n\n  const ttlDays = input.ttlDays ?? defaultTtlDays;\n  if (typeof ttlDays === 'number' && Number.isFinite(ttlDays) && ttlDays > 0) {\n    return new Date(Date.now() + ttlDays * 24 * 60 * 60 * 1000);\n  }\n\n  return null;\n}\n\n/** Gestisce il ciclo di vita dei token di servizio (emissione, elenco, revoca, rotazione, verifica). */\n@autobind\n@Injectable()\nexport class ServiceTokenService {\n  constructor(@Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions) {}\n\n  private get databaseOptions() {\n    return this.accessiOptions.databaseOptions;\n  }\n\n  private toMetadata(row: Record<string, unknown>): ServiceTokenMetadata {\n    const scopesRaw = typeof row.scopes === 'string' ? row.scopes.trim() : '';\n    return {\n      tokenId: String(row.tokenId ?? ''),\n      label: typeof row.label === 'string' ? row.label : '',\n      scopes: scopesRaw === '' ? [] : scopesRaw.split(/\\s+/),\n      createdAt: toIso(row.createdAt),\n      expiresAt: toIso(row.expiresAt),\n      lastUsedAt: toIso(row.lastUsedAt),\n      lastUsedIp: typeof row.lastUsedIp === 'string' && row.lastUsedIp !== '' ? row.lastUsedIp : undefined,\n      revoked: row.revokedAt !== undefined && row.revokedAt !== null,\n      revokedAt: toIso(row.revokedAt),\n      revokedBy: row.revokedBy == null ? undefined : Number(row.revokedBy),\n    };\n  }\n\n  private async readRow(tokenId: string): Promise<Record<string, unknown> | undefined> {\n    const rows = await Orm.query(\n      this.databaseOptions,\n      `SELECT TOKEN_ID, TOKEN_HASH, LABEL, SCOPES, CREATED_BY, CREATED_AT, EXPIRES_AT, LAST_USED_AT, LAST_USED_IP, REVOKED_AT, REVOKED_BY\n       FROM ACCESSI_SERVICE_TOKEN WHERE TOKEN_ID = ?`,\n      [tokenId],\n      false,\n    );\n    return (rows.map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>)[0];\n  }\n\n  /** Crea un nuovo token. Il segreto in chiaro e restituito una sola volta e non e recuperabile. */\n  async issue(input: IssueServiceTokenInput, createdBy?: number): Promise<IssuedServiceToken> {\n    const label = typeof input?.label === 'string' ? input.label.trim() : '';\n    if (label.length < 1 || label.length > 100) {\n      throw new BadRequestException('La descrizione del token deve essere compresa tra 1 e 100 caratteri.');\n    }\n\n    const scopes = normalizeServiceTokenScopes(input.scopes);\n    const expiresAt = resolveExpiration(input, this.accessiOptions.serviceTokens?.defaultTtlDays);\n    const { token, tokenId, secret } = generateServiceToken();\n\n    await Orm.execute(\n      this.databaseOptions,\n      `INSERT INTO ACCESSI_SERVICE_TOKEN (TOKEN_ID, TOKEN_HASH, LABEL, SCOPES, CREATED_BY, EXPIRES_AT)\n       VALUES (?, ?, ?, ?, ?, ?)`,\n      [tokenId, hashServiceTokenSecret(secret), label, scopes.join(' '), createdBy ?? null, expiresAt],\n    );\n\n    const row = await this.readRow(tokenId);\n    return { ...this.toMetadata(row ?? { tokenId, label, scopes: scopes.join(' ') }), token };\n  }\n\n  /** Elenca i token (metadati soltanto, mai il segreto). */\n  async list(includeRevoked = false): Promise<ServiceTokenMetadata[]> {\n    const rows = await Orm.query(\n      this.databaseOptions,\n      `SELECT TOKEN_ID, LABEL, SCOPES, CREATED_BY, CREATED_AT, EXPIRES_AT, LAST_USED_AT, LAST_USED_IP, REVOKED_AT, REVOKED_BY\n       FROM ACCESSI_SERVICE_TOKEN ${includeRevoked ? '' : 'WHERE REVOKED_AT IS NULL'}\n       ORDER BY CREATED_AT DESC, TOKEN_ID DESC`,\n      [],\n      false,\n    );\n    return (rows.map(RestUtilities.convertKeysToCamelCase) as Array<Record<string, unknown>>).map((row) => this.toMetadata(row));\n  }\n\n  /** Revoca un token rendendolo immediatamente inutilizzabile. Idempotente su token gia revocati. */\n  async revoke(tokenId: string, revokedBy?: number): Promise<void> {\n    const parsed = parseServiceToken(tokenId);\n    const normalizedId = parsed?.tokenId ?? tokenId;\n    const row = await this.readRow(normalizedId);\n    if (!row) {\n      throw new NotFoundException(`Token di servizio ${normalizedId} non trovato.`);\n    }\n    if (row.revokedAt !== undefined && row.revokedAt !== null) {\n      return;\n    }\n    await Orm.execute(\n      this.databaseOptions,\n      'UPDATE ACCESSI_SERVICE_TOKEN SET REVOKED_AT = CURRENT_TIMESTAMP, REVOKED_BY = ? WHERE TOKEN_ID = ?',\n      [revokedBy ?? null, normalizedId],\n    );\n  }\n\n  /** Revoca il token indicato ed emette un sostituto con gli stessi metadati. */\n  async rotate(tokenId: string, createdBy?: number): Promise<IssuedServiceToken> {\n    const parsed = parseServiceToken(tokenId);\n    const normalizedId = parsed?.tokenId ?? tokenId;\n    const row = await this.readRow(normalizedId);\n    if (!row) {\n      throw new NotFoundException(`Token di servizio ${normalizedId} non trovato.`);\n    }\n\n    const metadata = this.toMetadata(row);\n    await this.revoke(normalizedId, createdBy);\n\n    return this.issue(\n      {\n        label: metadata.label,\n        scopes: metadata.scopes,\n        expiresAt: metadata.expiresAt ?? null,\n      },\n      createdBy,\n    );\n  }\n\n  /**\n   * Verifica un token presentato: formato, esistenza, revoca, scadenza e hash a tempo costante.\n   * Aggiorna `LAST_USED_AT` (best-effort, al massimo una volta al minuto).\n   */\n  async verify(token: string, context?: { ip?: string }): Promise<VerifiedServiceToken | undefined> {\n    const parsed = parseServiceToken(token);\n    if (!parsed) {\n      return undefined;\n    }\n\n    const row = await this.readRow(parsed.tokenId);\n    if (!row) {\n      return undefined;\n    }\n\n    if (row.revokedAt !== undefined && row.revokedAt !== null) {\n      return undefined;\n    }\n\n    const expiresAt = toIso(row.expiresAt);\n    if (expiresAt && new Date(expiresAt).getTime() <= Date.now()) {\n      return undefined;\n    }\n\n    const storedHash = typeof row.tokenHash === 'string' ? row.tokenHash : '';\n    if (!storedHash || !this.safeHashEquals(hashServiceTokenSecret(parsed.secret), storedHash)) {\n      return undefined;\n    }\n\n    const metadata = this.toMetadata(row);\n    await this.touchLastUsed(parsed.tokenId, row.lastUsedAt, context?.ip).catch(() => undefined);\n\n    return { tokenId: metadata.tokenId, label: metadata.label, scopes: metadata.scopes };\n  }\n\n  private safeHashEquals(candidate: string, stored: string): boolean {\n    const candidateBuffer = Buffer.from(candidate, 'hex');\n    const storedBuffer = Buffer.from(stored, 'hex');\n    if (candidateBuffer.length !== storedBuffer.length || candidateBuffer.length === 0) {\n      return false;\n    }\n    return timingSafeEqual(candidateBuffer, storedBuffer);\n  }\n\n  private async touchLastUsed(tokenId: string, lastUsedAt: unknown, ip?: string): Promise<void> {\n    const lastUsed = toIso(lastUsedAt);\n    if (lastUsed && Date.now() - new Date(lastUsed).getTime() < LAST_USED_REFRESH_MS) {\n      return;\n    }\n    await Orm.execute(\n      this.databaseOptions,\n      'UPDATE ACCESSI_SERVICE_TOKEN SET LAST_USED_AT = CURRENT_TIMESTAMP, LAST_USED_IP = ? WHERE TOKEN_ID = ?',\n      [ip ?? null, tokenId],\n      false,\n    );\n  }\n}\n"]}

package/dist/accessi-module/Services/TwoFactorService/TwoFactorService.d.ts

@@ -0,0 +1,27 @@
+import type { AccessiOptions } from '../../AccessiModule';
+import { TwoFactorChallengeDto } from '../../Dtos/TwoFactorDtos';
+import { EmailService } from '../EmailService/EmailService';
+export type TwoFactorMode = 'password' | 'passwordless' | 'federated';
+export interface TwoFactorProof {
+    codiceUtente: number;
+    email: string;
+    mode: TwoFactorMode;
+    identityKey?: string;
+}
+/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */
+export declare class TwoFactorService {
+    private readonly options;
+    private readonly emailService;
+    constructor(options: AccessiOptions, emailService: EmailService);
+    private invalid;
+    private limited;
+    private hash;
+    private row;
+    private transaction;
+    private response;
+    private deliver;
+    issue(proof: TwoFactorProof): Promise<TwoFactorChallengeDto>;
+    describe(id: string): Promise<TwoFactorProof>;
+    resend(id: string): Promise<TwoFactorChallengeDto>;
+    consume(id: string, code: string): Promise<TwoFactorProof>;
+}

package/dist/accessi-module/Services/TwoFactorService/TwoFactorService.js

@@ -0,0 +1,175 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TwoFactorService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const Orm_1 = require("../../../Orm");
+const Utilities_1 = require("../../../Utilities");
+const passwordResetToken_1 = require("../../security/passwordResetToken");
+const EmailService_1 = require("../EmailService/EmailService");
+const LIFETIME_SECONDS = 600;
+const MAX_ATTEMPTS = 5;
+const RESEND_SECONDS = 60;
+const MAX_SENDS = 3;
+const RETURN_FIELDS = 'CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT, ATTEMPTS, SENDS, SENT_AT';
+/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */
+let TwoFactorService = class TwoFactorService {
+    constructor(options, emailService) {
+        this.options = options;
+        this.emailService = emailService;
+    }
+    invalid() {
+        return new common_1.UnauthorizedException({ code: 'ACCESSI_2FA_INVALID', message: 'Codice non valido o scaduto. Ripeti l accesso se hai esaurito i tentativi.' });
+    }
+    limited() {
+        return new common_1.HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);
+    }
+    hash(id, code) {
+        return (0, crypto_1.createHmac)('sha256', (0, passwordResetToken_1.getAccessiJwtSecret)(this.options, '2fa')).update(`accessi-2fa:${id}:${code}`).digest('hex');
+    }
+    row(result) {
+        var _a, _b, _c, _d, _e, _f;
+        const row = (Array.isArray(result) ? result[0] : result);
+        if (!row)
+            return undefined;
+        const raw = Utilities_1.RestUtilities.convertKeysToCamelCase(row);
+        const asString = (value) => typeof value === 'string' ? value : undefined;
+        const codiceUtente = Number(raw.codute);
+        if (!codiceUtente)
+            return undefined;
+        const converted = {
+            codiceUtente,
+            email: (_b = (_a = asString(raw.email)) === null || _a === void 0 ? void 0 : _a.trim()) !== null && _b !== void 0 ? _b : '',
+            mode: (_d = (_c = asString(raw.authmode)) === null || _c === void 0 ? void 0 : _c.trim()) !== null && _d !== void 0 ? _d : 'password',
+            identityKey: (_e = asString(raw.idnkey)) === null || _e === void 0 ? void 0 : _e.trim(),
+            codeHash: (_f = asString(raw.codehash)) !== null && _f !== void 0 ? _f : '',
+            expiresAt: raw.expiresAt,
+            attempts: Number(raw.attempts),
+            sends: Number(raw.sends),
+            sentAt: raw.sentAt,
+        };
+        return converted;
+    }
+    transaction(operation) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return Orm_1.Orm.withTransaction(this.options.databaseOptions, (transaction) => __awaiter(this, void 0, void 0, function* () {
+                const query = (sql, params = []) => Orm_1.Orm.transactionQuery(transaction, sql, params);
+                return operation(query);
+            }));
+        });
+    }
+    response(id, expiresAt) {
+        return { twoFactorRequired: true, challengeId: id, expiresAt: new Date(expiresAt).toISOString(), resendAfterSeconds: RESEND_SECONDS, method: 'email' };
+    }
+    deliver(id, code, email) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                yield this.emailService.sendTwoFactorCode(email, code, LIFETIME_SECONDS / 60);
+            }
+            catch (_a) {
+                // Invalidate only the code whose delivery failed, preserving a concurrent newer code.
+                yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ? AND CODEHASH = ?', [MAX_ATTEMPTS, id, this.hash(id, code)], false).catch(() => undefined);
+                throw new common_1.ServiceUnavailableException({ code: 'ACCESSI_2FA_DELIVERY_FAILED', message: 'Invio del codice non riuscito. Riprova tra poco.' });
+            }
+        });
+    }
+    issue(proof) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (!/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test((_a = proof.email) !== null && _a !== void 0 ? _a : '')) {
+                throw new common_1.ServiceUnavailableException({ code: 'ACCESSI_2FA_EMAIL_REQUIRED', message: 'Per il codice di accesso serve un indirizzo email valido. Contatta un amministratore.' });
+            }
+            const id = (0, crypto_1.randomBytes)(32).toString('hex');
+            const code = String((0, crypto_1.randomInt)(1000000)).padStart(6, '0');
+            const expiresAt = yield this.transaction((query) => __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c, _d, _e, _f;
+                // Serialize issuance for this account across backend instances.
+                yield query('SELECT CODUTE FROM UTENTI WHERE CODUTE = ? WITH LOCK', [proof.codiceUtente]);
+                const recent = yield query('SELECT COUNT(*) AS TOTAL FROM ACCESSI_2FA WHERE CODUTE = ? AND CREATED_AT > DATEADD(-15 MINUTE TO CURRENT_TIMESTAMP)', [proof.codiceUtente]);
+                if (Number((_d = (_b = (_a = recent === null || recent === void 0 ? void 0 : recent[0]) === null || _a === void 0 ? void 0 : _a.TOTAL) !== null && _b !== void 0 ? _b : (_c = recent === null || recent === void 0 ? void 0 : recent[0]) === null || _c === void 0 ? void 0 : _c.total) !== null && _d !== void 0 ? _d : 0) >= 5)
+                    throw this.limited();
+                yield query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');
+                const created = yield query(`INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`, [id, proof.codiceUtente, proof.email, proof.mode, (_e = proof.identityKey) !== null && _e !== void 0 ? _e : null, this.hash(id, code)]);
+                const row = (Array.isArray(created) ? created[0] : created);
+                return ((_f = row === null || row === void 0 ? void 0 : row.EXPIRES_AT) !== null && _f !== void 0 ? _f : row === null || row === void 0 ? void 0 : row.expires_at);
+            }));
+            yield this.deliver(id, code, proof.email);
+            return this.response(id, expiresAt);
+        });
+    }
+    describe(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[a-f0-9]{64}$/.test(id))
+                throw this.invalid();
+            const row = this.row(yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT ${RETURN_FIELDS} FROM ACCESSI_2FA WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ?`, [id, MAX_ATTEMPTS], false));
+            if (!row)
+                throw this.invalid();
+            return row;
+        });
+    }
+    resend(id) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[a-f0-9]{64}$/.test(id))
+                throw this.invalid();
+            const code = String((0, crypto_1.randomInt)(1000000)).padStart(6, '0');
+            const row = yield this.transaction((query) => __awaiter(this, void 0, void 0, function* () {
+                const result = this.row(yield query(`UPDATE ACCESSI_2FA SET CODEHASH = ?, SENDS = SENDS + 1, SENT_AT = CURRENT_TIMESTAMP WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? AND SENDS < ? AND SENT_AT <= DATEADD(-${RESEND_SECONDS} SECOND TO CURRENT_TIMESTAMP) RETURNING ${RETURN_FIELDS}`, [this.hash(id, code), id, MAX_ATTEMPTS, MAX_SENDS]));
+                if (!result)
+                    throw this.limited();
+                return result;
+            }));
+            yield this.deliver(id, code, row.email);
+            return this.response(id, row.expiresAt);
+        });
+    }
+    consume(id, code) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!/^[a-f0-9]{64}$/.test(id) || !/^\d{6}$/.test(code))
+                throw this.invalid();
+            const proof = yield this.transaction((query) => __awaiter(this, void 0, void 0, function* () {
+                // The conditional write serializes verification and persists failed attempts.
+                const row = this.row(yield query(`UPDATE ACCESSI_2FA SET ATTEMPTS = ATTEMPTS + 1 WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? RETURNING ${RETURN_FIELDS}`, [id, MAX_ATTEMPTS]));
+                if (!row)
+                    return null;
+                const expected = Buffer.from(row.codeHash.trim(), 'hex');
+                const actual = Buffer.from(this.hash(id, code), 'hex');
+                if (expected.length !== actual.length || !(0, crypto_1.timingSafeEqual)(expected, actual))
+                    return null;
+                yield query('UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ?', [MAX_ATTEMPTS, id]);
+                return row;
+            }));
+            // Throw after commit, otherwise a wrong code would roll back the attempt counter.
+            if (!proof)
+                throw this.invalid();
+            return proof;
+        });
+    }
+};
+exports.TwoFactorService = TwoFactorService;
+exports.TwoFactorService = TwoFactorService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object, EmailService_1.EmailService])
+], TwoFactorService);
+//# sourceMappingURL=TwoFactorService.js.map

package/dist/accessi-module/Services/TwoFactorService/TwoFactorService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TwoFactorService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/TwoFactorService/TwoFactorService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAuH;AACvH,mCAA6E;AAC7E,sCAAmC;AACnC,kDAAmD;AAGnD,0EAAwE;AACxE,+DAA4D;AAkB5D,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,MAAM,YAAY,GAAG,CAAC,CAAC;AACvB,MAAM,cAAc,GAAG,EAAE,CAAC;AAC1B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,aAAa,GAAG,iFAAiF,CAAC;AAExG,8GAA8G;AAEvG,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAC3B,YAC8C,OAAuB,EAClD,YAA0B;QADC,YAAO,GAAP,OAAO,CAAgB;QAClD,iBAAY,GAAZ,YAAY,CAAc;IAC1C,CAAC;IAEI,OAAO;QACb,OAAO,IAAI,8BAAqB,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAAC,CAAC;IAC3J,CAAC;IAEO,OAAO;QACb,OAAO,IAAI,sBAAa,CAAC,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,8CAA8C,EAAE,EAAE,GAAG,CAAC,CAAC;IAC/H,CAAC;IAEO,IAAI,CAAC,EAAU,EAAE,IAAY;QACnC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAA,wCAAmB,EAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1H,CAAC;IAEO,GAAG,CAAC,MAAe;;QACzB,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAwC,CAAC;QAChG,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAE3B,MAAM,GAAG,GAAG,yBAAa,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAsB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;QACvG,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,YAAY;YAAE,OAAO,SAAS,CAAC;QAEpC,MAAM,SAAS,GAAiB;YAC9B,YAAY;YACZ,KAAK,EAAE,MAAA,MAAA,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,0CAAE,IAAI,EAAE,mCAAI,EAAE;YACxC,IAAI,EAAE,MAAC,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,0CAAE,IAAI,EAAgC,mCAAI,UAAU;YACjF,WAAW,EAAE,MAAA,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,0CAAE,IAAI,EAAE;YACzC,QAAQ,EAAE,MAAA,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,mCAAI,EAAE;YACtC,SAAS,EAAE,GAAG,CAAC,SAAiB;YAChC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC9B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC;YACxB,MAAM,EAAE,GAAG,CAAC,MAAc;SAC3B,CAAC;QACF,OAAO,SAAS,CAAC;IACnB,CAAC;IAEa,WAAW,CAAI,SAAuC;;YAClE,OAAO,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;gBAC7E,MAAM,KAAK,GAAU,CAAC,GAAG,EAAE,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,SAAG,CAAC,gBAAgB,CAAC,WAAW,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC1F,OAAO,SAAS,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC,CAAA,CAAC,CAAC;QACL,CAAC;KAAA;IAEO,QAAQ,CAAC,EAAU,EAAE,SAAe;QAC1C,OAAO,EAAE,iBAAiB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACzJ,CAAC;IAEa,OAAO,CAAC,EAAU,EAAE,IAAY,EAAE,KAAa;;YAC3D,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,EAAE,IAAI,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;YAChF,CAAC;YAAC,WAAM,CAAC;gBACP,sFAAsF;gBACtF,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5C,6EAA6E,EAC7E,CAAC,YAAY,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACzE,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,kDAAkD,EAAE,CAAC,CAAC;YAC9I,CAAC;QACH,CAAC;KAAA;IAEK,KAAK,CAAC,KAAqB;;;YAC/B,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,MAAA,KAAK,CAAC,KAAK,mCAAI,EAAE,CAAC,EAAE,CAAC;gBAC1D,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,uFAAuF,EAAE,CAAC,CAAC;YAClL,CAAC;YACD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;YAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;;gBACrD,gEAAgE;gBAChE,MAAM,KAAK,CAAC,sDAAsD,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;gBAC1F,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,sHAAsH,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAA+C,CAAC;gBACvN,IAAI,MAAM,CAAC,MAAA,MAAA,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAG,CAAC,CAAC,0CAAE,KAAK,mCAAI,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBACrF,MAAM,KAAK,CAAC,iFAAiF,CAAC,CAAC;gBAC/F,MAAM,OAAO,GAAG,MAAM,KAAK,CACzB,mIAAmI,gBAAgB,qDAAqD,EACxM,CAAC,EAAE,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,MAAA,KAAK,CAAC,WAAW,mCAAI,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC,CAClG,CAAC;gBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;gBACnG,OAAO,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,UAAU,CAAS,CAAC;YACtD,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YAC1C,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;QACtC,CAAC;KAAA;IAEK,QAAQ,CAAC,EAAU;;YACvB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAC/D,UAAU,aAAa,8FAA8F,EAAE,CAAC,EAAE,EAAE,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;YACrJ,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC;QACb,CAAC;KAAA;IAEK,MAAM,CAAC,EAAU;;YACrB,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAA,kBAAS,EAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YACzD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CACjC,wMAAwM,cAAc,2CAA2C,aAAa,EAAE,EAChR,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,EAAE,YAAY,EAAE,SAAS,CAAC,CACnD,CAAC,CAAC;gBACH,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;gBAClC,OAAO,MAAM,CAAC;YAChB,CAAC,CAAA,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACxC,OAAO,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;KAAA;IAEK,OAAO,CAAC,EAAU,EAAE,IAAY;;YACpC,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YAC9E,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAM,KAAK,EAAC,EAAE;gBACjD,8EAA8E;gBAC9E,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,CAC9B,uIAAuI,aAAa,EAAE,EACtJ,CAAC,EAAE,EAAE,YAAY,CAAC,CACnB,CAAC,CAAC;gBACH,IAAI,CAAC,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACtB,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;gBACzD,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;gBACvD,IAAI,QAAQ,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM,IAAI,CAAC,IAAA,wBAAe,EAAC,QAAQ,EAAE,MAAM,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACzF,MAAM,KAAK,CAAC,4DAA4D,EAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC9F,OAAO,GAAG,CAAC;YACb,CAAC,CAAA,CAAC,CAAC;YACH,kFAAkF;YAClF,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,OAAO,KAAK,CAAC;QACf,CAAC;KAAA;CACF,CAAA;AAjIY,4CAAgB;2BAAhB,gBAAgB;IAD5B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACK,2BAAY;GAHlC,gBAAgB,CAiI5B","sourcesContent":["import { HttpException, Inject, Injectable, ServiceUnavailableException, UnauthorizedException } from '@nestjs/common';\nimport { createHmac, randomBytes, randomInt, timingSafeEqual } from 'crypto';\nimport { Orm } from '../../../Orm';\nimport { RestUtilities } from '../../../Utilities';\nimport type { AccessiOptions } from '../../AccessiModule';\nimport { TwoFactorChallengeDto } from '../../Dtos/TwoFactorDtos';\nimport { getAccessiJwtSecret } from '../../security/passwordResetToken';\nimport { EmailService } from '../EmailService/EmailService';\n\nexport type TwoFactorMode = 'password' | 'passwordless' | 'federated';\nexport interface TwoFactorProof {\n  codiceUtente: number;\n  email: string;\n  mode: TwoFactorMode;\n  identityKey?: string;\n}\ntype ChallengeRow = TwoFactorProof & {\n  codeHash: string;\n  expiresAt: Date;\n  attempts: number;\n  sends: number;\n  sentAt: Date;\n};\ntype Query = (sql: string, params?: unknown[]) => Promise<unknown>;\n\nconst LIFETIME_SECONDS = 600;\nconst MAX_ATTEMPTS = 5;\nconst RESEND_SECONDS = 60;\nconst MAX_SENDS = 3;\nconst RETURN_FIELDS = 'CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT, ATTEMPTS, SENDS, SENT_AT';\n\n/** Database-backed challenges: no OTP, password or authentication token is logged or stored in clear text. */\n@Injectable()\nexport class TwoFactorService {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n    private readonly emailService: EmailService,\n  ) {}\n\n  private invalid(): UnauthorizedException {\n    return new UnauthorizedException({ code: 'ACCESSI_2FA_INVALID', message: 'Codice non valido o scaduto. Ripeti l accesso se hai esaurito i tentativi.' });\n  }\n\n  private limited(): HttpException {\n    return new HttpException({ code: 'ACCESSI_2FA_RATE_LIMITED', message: 'Attendi prima di richiedere un altro codice.' }, 429);\n  }\n\n  private hash(id: string, code: string): string {\n    return createHmac('sha256', getAccessiJwtSecret(this.options, '2fa')).update(`accessi-2fa:${id}:${code}`).digest('hex');\n  }\n\n  private row(result: unknown): ChallengeRow | undefined {\n    const row = (Array.isArray(result) ? result[0] : result) as Record<string, unknown> | undefined;\n    if (!row) return undefined;\n\n    const raw = RestUtilities.convertKeysToCamelCase(row);\n    const asString = (value: unknown): string | undefined => typeof value === 'string' ? value : undefined;\n    const codiceUtente = Number(raw.codute);\n    if (!codiceUtente) return undefined;\n\n    const converted: ChallengeRow = {\n      codiceUtente,\n      email: asString(raw.email)?.trim() ?? '',\n      mode: (asString(raw.authmode)?.trim() as TwoFactorMode | undefined) ?? 'password',\n      identityKey: asString(raw.idnkey)?.trim(),\n      codeHash: asString(raw.codehash) ?? '',\n      expiresAt: raw.expiresAt as Date,\n      attempts: Number(raw.attempts),\n      sends: Number(raw.sends),\n      sentAt: raw.sentAt as Date,\n    };\n    return converted;\n  }\n\n  private async transaction<T>(operation: (query: Query) => Promise<T>): Promise<T> {\n    return Orm.withTransaction(this.options.databaseOptions, async (transaction) => {\n      const query: Query = (sql, params = []) => Orm.transactionQuery(transaction, sql, params);\n      return operation(query);\n    });\n  }\n\n  private response(id: string, expiresAt: Date): TwoFactorChallengeDto {\n    return { twoFactorRequired: true, challengeId: id, expiresAt: new Date(expiresAt).toISOString(), resendAfterSeconds: RESEND_SECONDS, method: 'email' };\n  }\n\n  private async deliver(id: string, code: string, email: string): Promise<void> {\n    try {\n      await this.emailService.sendTwoFactorCode(email, code, LIFETIME_SECONDS / 60);\n    } catch {\n      // Invalidate only the code whose delivery failed, preserving a concurrent newer code.\n      await Orm.execute(this.options.databaseOptions,\n        'UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ? AND CODEHASH = ?',\n        [MAX_ATTEMPTS, id, this.hash(id, code)], false).catch(() => undefined);\n      throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_DELIVERY_FAILED', message: 'Invio del codice non riuscito. Riprova tra poco.' });\n    }\n  }\n\n  async issue(proof: TwoFactorProof): Promise<TwoFactorChallengeDto> {\n    if (!/^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/.test(proof.email ?? '')) {\n      throw new ServiceUnavailableException({ code: 'ACCESSI_2FA_EMAIL_REQUIRED', message: 'Per il codice di accesso serve un indirizzo email valido. Contatta un amministratore.' });\n    }\n    const id = randomBytes(32).toString('hex');\n    const code = String(randomInt(1000000)).padStart(6, '0');\n    const expiresAt = await this.transaction(async query => {\n      // Serialize issuance for this account across backend instances.\n      await query('SELECT CODUTE FROM UTENTI WHERE CODUTE = ? WITH LOCK', [proof.codiceUtente]);\n      const recent = await query('SELECT COUNT(*) AS TOTAL FROM ACCESSI_2FA WHERE CODUTE = ? AND CREATED_AT > DATEADD(-15 MINUTE TO CURRENT_TIMESTAMP)', [proof.codiceUtente]) as Array<Record<string, unknown>> | undefined;\n      if (Number(recent?.[0]?.TOTAL ?? recent?.[0]?.total ?? 0) >= 5) throw this.limited();\n      await query('DELETE FROM ACCESSI_2FA WHERE EXPIRES_AT < DATEADD(-1 DAY TO CURRENT_TIMESTAMP)');\n      const created = await query(\n        `INSERT INTO ACCESSI_2FA (CHALLENGE_ID, CODUTE, EMAIL, AUTHMODE, IDNKEY, CODEHASH, EXPIRES_AT) VALUES (?, ?, ?, ?, ?, ?, DATEADD(${LIFETIME_SECONDS} SECOND TO CURRENT_TIMESTAMP)) RETURNING EXPIRES_AT`,\n        [id, proof.codiceUtente, proof.email, proof.mode, proof.identityKey ?? null, this.hash(id, code)],\n      );\n      const row = (Array.isArray(created) ? created[0] : created) as Record<string, unknown> | undefined;\n      return (row?.EXPIRES_AT ?? row?.expires_at) as Date;\n    });\n    await this.deliver(id, code, proof.email);\n    return this.response(id, expiresAt);\n  }\n\n  async describe(id: string): Promise<TwoFactorProof> {\n    if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n    const row = this.row(await Orm.query(this.options.databaseOptions,\n      `SELECT ${RETURN_FIELDS} FROM ACCESSI_2FA WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ?`, [id, MAX_ATTEMPTS], false));\n    if (!row) throw this.invalid();\n    return row;\n  }\n\n  async resend(id: string): Promise<TwoFactorChallengeDto> {\n    if (!/^[a-f0-9]{64}$/.test(id)) throw this.invalid();\n    const code = String(randomInt(1000000)).padStart(6, '0');\n    const row = await this.transaction(async query => {\n      const result = this.row(await query(\n        `UPDATE ACCESSI_2FA SET CODEHASH = ?, SENDS = SENDS + 1, SENT_AT = CURRENT_TIMESTAMP WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? AND SENDS < ? AND SENT_AT <= DATEADD(-${RESEND_SECONDS} SECOND TO CURRENT_TIMESTAMP) RETURNING ${RETURN_FIELDS}`,\n        [this.hash(id, code), id, MAX_ATTEMPTS, MAX_SENDS],\n      ));\n      if (!result) throw this.limited();\n      return result;\n    });\n    await this.deliver(id, code, row.email);\n    return this.response(id, row.expiresAt);\n  }\n\n  async consume(id: string, code: string): Promise<TwoFactorProof> {\n    if (!/^[a-f0-9]{64}$/.test(id) || !/^\\d{6}$/.test(code)) throw this.invalid();\n    const proof = await this.transaction(async query => {\n      // The conditional write serializes verification and persists failed attempts.\n      const row = this.row(await query(\n        `UPDATE ACCESSI_2FA SET ATTEMPTS = ATTEMPTS + 1 WHERE CHALLENGE_ID = ? AND EXPIRES_AT > CURRENT_TIMESTAMP AND ATTEMPTS < ? RETURNING ${RETURN_FIELDS}`,\n        [id, MAX_ATTEMPTS],\n      ));\n      if (!row) return null;\n      const expected = Buffer.from(row.codeHash.trim(), 'hex');\n      const actual = Buffer.from(this.hash(id, code), 'hex');\n      if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) return null;\n      await query('UPDATE ACCESSI_2FA SET ATTEMPTS = ? WHERE CHALLENGE_ID = ?', [MAX_ATTEMPTS, id]);\n      return row;\n    });\n    // Throw after commit, otherwise a wrong code would roll back the attempt counter.\n    if (!proof) throw this.invalid();\n    return proof;\n  }\n}\n"]}

package/dist/accessi-module/Services/UserService/UserService.d.ts

@@ -1,4 +1,4 @@
-import { AccessiOptions } from '../../AccessiModule';
+import type { AccessiOptions } from '../../AccessiModule';
 import { GetUsersResult } from '../../Dtos/GetUsersResponse';
 import { RegisterRequest } from '../../Dtos/RegisterRequest';
 import { StatoRegistrazione } from '../../Dtos/StatoRegistrazione';
@@ -14,31 +14,77 @@ export declare class UserService {
     private readonly filtriService;
     constructor(accessiOptions: AccessiOptions, emailService: EmailService, permissionService: PermissionService, filtriService: FiltriService);
     private normalizeDatabaseBoolean;
+    private normalizeUserFlags;
     private normalizeEmail;
     private ensureEmailIsAvailable;
-    isAdminConfigurator(codiceUtente: number): Promise<boolean>;
+    /**
+     * Legge il minimo profilo autorevole usato da JWT e middleware. Restituisce `null` per utenti inesistenti.
+     * Non usare `UserDto` dal token per decisioni di sicurezza: i flag vengono sempre riletti qui.
+     */
     getAuthenticatedUserSnapshot(codiceUtente: number): Promise<AccessiAuthenticatedUserSnapshot | null>;
+    /**
+     * Elenca gli utenti con filtri opzionali. Grant e campi estesi sono costosi e vengono caricati soltanto
+     * quando richiesti esplicitamente nelle opzioni; usare filtri puntuali nei flussi di autenticazione.
+     */
     getUsers(filters?: {
         email?: string;
-        codiceUtente?: number;
+        codiceUtente?: number | number[];
+        numRep?: number | number[];
+        codDipendente?: number;
+        cellulare?: string;
+        tipFil?: number;
+        flagSuper?: boolean;
+        limit?: number;
+        offset?: number;
     }, options?: {
         includeExtensionFields: boolean;
         includeGrants: boolean;
     }): Promise<GetUsersResult[]>;
+    /** Conteggio utenti con gli stessi filtri di `getUsers`, per la paginazione (header X-Total-Count). */
+    countUsers(filters?: {
+        email?: string;
+        codiceUtente?: number;
+    }): Promise<number>;
+    private loadExtensionFieldsForUsers;
+    private chunkArray;
+    /** Cerca il codice interno per email normalizzata. Il chiamante deve gestire il caso senza righe. */
     getCodiceUtenteByEmail(email: string): Promise<{
         codiceUtente: number;
     }>;
+    /** Recupera il profilo locale usato dal login, compresi filtri Accessi eventualmente presenti. */
     getUserByEmail(email: string): Promise<UserDto | null>;
     insertUserFilters(codiceUtente: number, filterData: RegisterRequest): Promise<void>;
-    private executeInTransaction;
+    /**
+     * Crea utente, configurazione e filtri. La registrazione pubblica resta in stato `INVIO` e non puo
+     * impostare privilegi, ruoli o grant; soltanto flussi backend fidati possono usare `allowPrivilegedFields`.
+     */
     register(registrationData: RegisterRequest, options?: {
         allowPrivilegedFields?: boolean;
+        initialState?: StatoRegistrazione;
     }): Promise<number>;
+    /**
+     * Aggiorna il profilo utente e i filtri. Le modifiche a stato, ruoli, grant e flag amministrativi richiedono
+     * `allowPrivilegedChanges`; gli array ruolo/grant passati in un flusso fidato sostituiscono le assegnazioni.
+     */
     updateUser(codiceUtente: number, user: UserDto, options?: {
         allowPrivilegedChanges?: boolean;
     }): Promise<void>;
     updateUserFilters(codiceUtente: number, user: UserDto): Promise<void>;
+    /** Eliminazione logica: imposta lo stato `DELETE` senza cancellare lo storico o i collegamenti SSO. */
     deleteUser(codiceCliente: number): Promise<void>;
+    /** Cambia esplicitamente lo stato di registrazione; usare questa API per blocco, conferma o eliminazione logica. */
     setStato(codiceCliente: number, statoRegistrazione: StatoRegistrazione): Promise<void>;
-    setGdpr(codiceUtente: number): Promise<any>;
+    setGdpr(codiceUtente: number): Promise<string>;
+    /**
+     * Forza l'invio dell'email di reset password per un utente. Operazione amministrativa.
+     * Richiede un servizio email configurato: altrimenti solleva ACCESSI_EMAIL_NOT_CONFIGURED.
+     */
+    forcePasswordReset(codiceUtente: number): Promise<void>;
+    /**
+     * Forza l'invio dell'email di reset a tutti gli utenti la cui password non e ancora nel formato
+     * moderno (`scrypt$...`), cioe' legacy grezza o `scrypt-legacy` non piu verificabile. Utile quando
+     * la `encryptionKey` storica e perduta. Richiede email configurata. Ritorna quanti utenti hanno
+     * ricevuto l'email.
+     */
+    forcePasswordResetForLegacyPasswords(): Promise<number>;
 }