emilsoftware-utilities 2.0.0-dev.4 → 2.0.0-dev.40

package/dist/accessi-module/database-updates/AccessiDatabaseUpdater.js

@@ -27,227 +27,523 @@ const common_1 = require("@nestjs/common");
 const DatabaseUpdater_1 = require("../../DatabaseUpdater");
 const Orm_1 = require("../../Orm");
 const Logger_1 = require("../../Logger");
+const accessiSchema_1 = require("./accessiSchema");
+const AccessiCatalogMigrator_1 = require("./AccessiCatalogMigrator");
+/** Reconciles the actual schema; version labels never bypass verification. */
 let AccessiDatabaseUpdater = AccessiDatabaseUpdater_1 = class AccessiDatabaseUpdater extends DatabaseUpdater_1.DatabaseUpdater {
     constructor(accessiOptions) {
         super();
         this.accessiOptions = accessiOptions;
     }
     onModuleInit() {
+        return __awaiter(this, void 0, void 0, function* () { yield AccessiDatabaseUpdater_1.initialize(this.accessiOptions); });
+    }
+    /** Shared bootstrap barrier for services in the same Nest module. Failed attempts may be retried. */
+    static initialize(options) {
+        let pending = this.initialization.get(options);
+        if (!pending) {
+            pending = this.bootstrap(options);
+            this.initialization.set(options, pending);
+            const cleanup = () => this.initialization.delete(options);
+            pending.then(cleanup, cleanup);
+        }
+        return pending;
+    }
+    /**
+     * Prima riconcilia lo schema, poi applica le catalog migrations applicative (menu, ruoli, ...).
+     * Con `autoUpdateDatabase: false` la verifica resta in sola lettura e le catalog migrations
+     * non vengono eseguite automaticamente.
+     */
+    static bootstrap(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            if (this.accessiOptions.autoUpdateDatabase === false) {
-                AccessiDatabaseUpdater_1.logger.info("Aggiornamento automatico database accessi disabilitato da configurazione.");
+            var _a;
+            if (options.autoUpdateDatabase === false) {
+                yield this.assertCompatible(options);
                 return;
             }
-            AccessiDatabaseUpdater_1.logger.info("Avvio updater database accessi.");
-            yield AccessiDatabaseUpdater_1.run(this.accessiOptions);
-            AccessiDatabaseUpdater_1.logger.info("Updater database accessi completato.");
+            yield this.run(options);
+            if ((_a = options.catalogScripts) === null || _a === void 0 ? void 0 : _a.enabled) {
+                yield (0, AccessiCatalogMigrator_1.applyCatalogScripts)(options);
+            }
         });
     }
+    static getLatestVersion() { return accessiSchema_1.ACCESSI_SCHEMA_VERSION; }
+    static getCurrentVersion(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (!(yield this.tableExists(options.databaseOptions, 'PARAMETRI')))
+                return null;
+            const rows = yield Orm_1.Orm.query(options.databaseOptions, 'SELECT DESPAR FROM PARAMETRI WHERE CODPAR = ?', [accessiSchema_1.ACCESSI_VERSION_KEY], false);
+            const version = (_a = rows[0]) === null || _a === void 0 ? void 0 : _a.DESPAR;
+            return typeof version === 'string' ? version.trim() : version == null ? null : String(version).trim();
+        });
+    }
+    /** Serialize callers targeting the same database in this process. Cross-process DDL is a deployment concern. */
     static run(options) {
+        var _a, _b, _c;
+        const db = options.databaseOptions;
+        const key = JSON.stringify([(_a = db.host) !== null && _a !== void 0 ? _a : 'localhost', (_b = db.port) !== null && _b !== void 0 ? _b : 3050, db.database]);
+        const previous = (_c = this.running.get(key)) !== null && _c !== void 0 ? _c : Promise.resolve();
+        const pending = previous.catch(() => { }).then(() => this.reconcile(options));
+        this.running.set(key, pending);
+        const cleanup = () => { if (this.running.get(key) === pending)
+            this.running.delete(key); };
+        pending.then(cleanup, cleanup);
+        return pending;
+    }
+    static query(options_1, sql_1) {
+        return __awaiter(this, arguments, void 0, function* (options, sql, params = []) {
+            return Orm_1.Orm.query(options.databaseOptions, sql, params, false);
+        });
+    }
+    static execute(options_1, sql_1) {
+        return __awaiter(this, arguments, void 0, function* (options, sql, params = []) {
+            try {
+                yield Orm_1.Orm.execute(options.databaseOptions, sql, params, false);
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                throw new Error(`Migrazione Accessi interrotta: ${sql}. ${message}. Correggere lo schema/dati indicati e rilanciare; la versione non e stata avanzata.`);
+            }
+        });
+    }
+    static sequenceExists(options, name) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const rows = yield this.query(options, 'SELECT 1 FROM RDB$GENERATORS WHERE RDB$GENERATOR_NAME = ?', [name.toUpperCase()]);
+            return rows.length > 0;
+        });
+    }
+    /** Nome deterministico del CHECK che replica NOT NULL su Firebird 2.5 (limite identificatore: 31 caratteri). */
+    static notNullConstraint(table, column) {
+        return `CK_NN_${table}_${column}`.toUpperCase().slice(0, 31);
+    }
+    /** Su Firebird 2.5 NOT NULL sulle colonne esistenti e' replicato da un CHECK: la verifica lo accetta. */
+    static notNullEnforcedByCheck(checks, engineMajor, table, column) {
+        if (engineMajor >= 3)
+            return false;
+        const name = this.notNullConstraint(table, column);
+        return checks.some(row => row.NAME === name && this.sameCheck(String(row.CHECK_SOURCE), `${column} IS NOT NULL`));
+    }
+    static relationIssues(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c;
-            const startedAt = performance.now();
-            this.logger.info(`Verifica schema accessi su ${(_a = options.databaseOptions.host) !== null && _a !== void 0 ? _a : "?"}:${(_b = options.databaseOptions.port) !== null && _b !== void 0 ? _b : "?"} -> ${(_c = options.databaseOptions.database) !== null && _c !== void 0 ? _c : "?"}`);
-            yield this.createParametersTable(options.databaseOptions);
-            this.logger.info("Tabella PARAMETRI verificata.");
-            const currentVersion = yield this.getDatabaseVersion(options.databaseOptions);
-            const currentIndex = this.updates.findIndex((update) => update.toVersion === currentVersion);
-            const startIndex = currentIndex >= 0 ? currentIndex + 1 : 0;
-            if (currentVersion && currentIndex === this.updates.length - 1) {
-                this.logger.info(`Database accessi gia' all'ultima versione disponibile (${currentVersion}).`);
-            }
-            else if (currentVersion && currentIndex >= 0) {
-                this.logger.info(`Database accessi rilevato alla versione ${currentVersion}.`);
-            }
-            else if (currentVersion) {
-                this.logger.warning(`Versione database accessi non riconosciuta (${currentVersion}). Verifico tutti gli update idempotenti.`);
+            // RDB$VIEW_BLR esiste in tutte le versioni; RDB$RELATION_TYPE solo da Firebird 3.0.
+            // Una vista ha RDB$VIEW_BLR non nullo: se una tabella Accessi esiste come vista, va segnalato.
+            const rows = yield this.query(options, `SELECT TRIM(RDB$RELATION_NAME) AS NAME
+      FROM RDB$RELATIONS WHERE COALESCE(RDB$SYSTEM_FLAG, 0) = 0 AND RDB$VIEW_BLR IS NOT NULL`);
+            return rows.filter(row => accessiSchema_1.accessiTables[String(row.NAME)]).map(row => `${row.NAME}: richiesta tabella persistente, trovata vista`);
+        });
+    }
+    static engineInfo(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const rows = yield this.query(options, "SELECT RDB$GET_CONTEXT('SYSTEM', 'ENGINE_VERSION') AS ENGINE_VERSION FROM RDB$DATABASE");
+            const version = String((_b = (_a = rows[0]) === null || _a === void 0 ? void 0 : _a.ENGINE_VERSION) !== null && _b !== void 0 ? _b : 'sconosciuta');
+            const match = /^(\d+)(?:\.(\d+))?/.exec(version);
+            return { version, major: match ? Number(match[1]) : Number.NaN, minor: (match === null || match === void 0 ? void 0 : match[2]) ? Number(match[2]) : 0 };
+        });
+    }
+    static engineIssue(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const { version, major, minor } = yield this.engineInfo(options);
+            // Firebird 2.5 e successivi: la 2.5 usa CREATE GENERATOR, dalla 3.0 lo schema usa CREATE SEQUENCE.
+            const supported = major > 2 || (major === 2 && minor >= 5);
+            if (!supported)
+                return `Firebird ${version}: lo schema Accessi richiede Firebird 2.5 o successivo`;
+        });
+    }
+    static columns(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.query(options, `SELECT TRIM(RF.RDB$RELATION_NAME) AS TABLE_NAME, TRIM(RF.RDB$FIELD_NAME) AS COLUMN_NAME,
+      F.RDB$FIELD_TYPE AS FIELD_TYPE, F.RDB$FIELD_SUB_TYPE AS SUB_TYPE, F.RDB$FIELD_SCALE AS FIELD_SCALE,
+      F.RDB$CHARACTER_LENGTH AS TEXT_LENGTH, TRIM(CS.RDB$CHARACTER_SET_NAME) AS CHARSET_NAME,
+      COALESCE(RF.RDB$NULL_FLAG, F.RDB$NULL_FLAG, 0) AS NOT_NULL,
+      CAST(COALESCE(RF.RDB$DEFAULT_SOURCE, F.RDB$DEFAULT_SOURCE) AS VARCHAR(1024)) AS DEFAULT_SOURCE,
+      CASE WHEN F.RDB$COMPUTED_BLR IS NULL THEN 0 ELSE 1 END AS IS_COMPUTED
+      FROM RDB$RELATION_FIELDS RF JOIN RDB$FIELDS F ON F.RDB$FIELD_NAME = RF.RDB$FIELD_SOURCE
+      LEFT JOIN RDB$CHARACTER_SETS CS ON CS.RDB$CHARACTER_SET_ID = F.RDB$CHARACTER_SET_ID
+      WHERE RF.RDB$RELATION_NAME IN (${Object.keys(accessiSchema_1.accessiTables).map(name => `'${name}'`).join(', ')})`);
+        });
+    }
+    static defaultValue(definition) {
+        var _a;
+        return (_a = /\bDEFAULT\s+('[^']*'|\S+)/i.exec(definition)) === null || _a === void 0 ? void 0 : _a[1];
+    }
+    static typeIssue(row, definition) {
+        var _a;
+        if (Number(row.IS_COMPUTED))
+            return 'colonna calcolata invece di scrivibile';
+        const stringLength = /^(?:VAR)?CHAR\((\d+)\)/.exec(definition);
+        if (stringLength) {
+            if (![14, 37].includes(Number(row.FIELD_TYPE)))
+                return `richiesto testo (${definition})`;
+            if (Number(row.TEXT_LENGTH) < Number(stringLength[1]))
+                return `lunghezza ${row.TEXT_LENGTH}, richiesta almeno ${stringLength[1]}`;
+            const charset = (_a = /CHARACTER SET (\w+)/.exec(definition)) === null || _a === void 0 ? void 0 : _a[1];
+            if (charset && typeof row.CHARSET_NAME === 'string' && row.CHARSET_NAME.trim() !== charset)
+                return `character set ${row.CHARSET_NAME}, richiesto ${charset}`;
+        }
+        else if (/^(SMALLINT|INTEGER)/.test(definition)) {
+            const acceptable = definition.startsWith('SMALLINT') ? [7, 8, 16] : [8, 16];
+            if (!acceptable.includes(Number(row.FIELD_TYPE)) || Number(row.FIELD_SCALE) !== 0)
+                return `richiesto intero (${definition})`;
+        }
+        else if (definition.startsWith('DATE')) {
+            if (![12, 35].includes(Number(row.FIELD_TYPE)))
+                return 'richiesto DATE o TIMESTAMP';
+        }
+        else if (definition.startsWith('TIMESTAMP')) {
+            if (Number(row.FIELD_TYPE) !== 35)
+                return 'richiesto TIMESTAMP';
+        }
+        else if (definition.startsWith('BLOB')) {
+            if (Number(row.FIELD_TYPE) !== 261 || Number(row.SUB_TYPE) !== 1)
+                return 'richiesto BLOB testuale';
+        }
+        return undefined;
+    }
+    static constraints(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.query(options, `SELECT TRIM(C.RDB$CONSTRAINT_NAME) AS NAME, TRIM(C.RDB$RELATION_NAME) AS TABLE_NAME,
+      TRIM(C.RDB$CONSTRAINT_TYPE) AS KIND, TRIM(S.RDB$FIELD_NAME) AS COLUMN_NAME, S.RDB$FIELD_POSITION AS POS,
+      TRIM(T.RDB$RELATION_NAME) AS TARGET_TABLE, TRIM(TS.RDB$FIELD_NAME) AS TARGET_COLUMN,
+      TRIM(R.RDB$DELETE_RULE) AS DELETE_RULE
+      FROM RDB$RELATION_CONSTRAINTS C
+      LEFT JOIN RDB$INDEX_SEGMENTS S ON S.RDB$INDEX_NAME = C.RDB$INDEX_NAME
+      LEFT JOIN RDB$REF_CONSTRAINTS R ON R.RDB$CONSTRAINT_NAME = C.RDB$CONSTRAINT_NAME
+      LEFT JOIN RDB$RELATION_CONSTRAINTS T ON T.RDB$CONSTRAINT_NAME = R.RDB$CONST_NAME_UQ
+      LEFT JOIN RDB$INDEX_SEGMENTS TS ON TS.RDB$INDEX_NAME = T.RDB$INDEX_NAME AND TS.RDB$FIELD_POSITION = S.RDB$FIELD_POSITION
+      ORDER BY C.RDB$CONSTRAINT_NAME, S.RDB$FIELD_POSITION`);
+        });
+    }
+    /** Raggruppa per nome; ogni gruppo e non vuoto per costruzione (tupla non vuota). */
+    static groups(rows) {
+        const groups = new Map();
+        for (const row of rows) {
+            const key = String(row.NAME);
+            const existing = groups.get(key);
+            if (existing) {
+                existing.push(row);
             }
             else {
-                this.logger.warning("Versione database accessi assente. Verifico tutti gli update idempotenti.");
-            }
-            for (let index = startIndex; index < this.updates.length; index++) {
-                const update = this.updates[index];
-                const stepStartedAt = performance.now();
-                this.logger.info(`Applico aggiornamento accessi ${update.fromVersion} -> ${update.toVersion}: ${update.description}`);
-                yield update.apply(options);
-                yield this.setDatabaseVersion(options.databaseOptions, update.toVersion);
-                this.logger.info(`Aggiornamento accessi ${update.toVersion} completato in ${(performance.now() - stepStartedAt).toFixed(2)} ms`);
+                groups.set(key, [row]);
             }
-            this.logger.info(`Verifica/aggiornamento database accessi completato in ${(performance.now() - startedAt).toFixed(2)} ms`);
+        }
+        return Array.from(groups.values());
+    }
+    static checks(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.query(options, `SELECT DISTINCT TRIM(C.RDB$CONSTRAINT_NAME) AS NAME,
+      TRIM(C.RDB$RELATION_NAME) AS TABLE_NAME, CAST(T.RDB$TRIGGER_SOURCE AS VARCHAR(2048)) AS CHECK_SOURCE
+      FROM RDB$RELATION_CONSTRAINTS C JOIN RDB$CHECK_CONSTRAINTS K ON K.RDB$CONSTRAINT_NAME = C.RDB$CONSTRAINT_NAME
+      JOIN RDB$TRIGGERS T ON T.RDB$TRIGGER_NAME = K.RDB$TRIGGER_NAME
+      WHERE C.RDB$CONSTRAINT_TYPE = 'CHECK'`);
         });
     }
-    static getCurrentVersion(options) {
+    static sameCheck(source, expression) {
+        const normalize = (s) => s.replace(/^\s*CHECK\s*/i, '').replace(/[\s()]/g, '').toUpperCase();
+        return normalize(source !== null && source !== void 0 ? source : '') === normalize(expression);
+    }
+    static indexes(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            return this.groups(yield this.query(options, `SELECT TRIM(I.RDB$INDEX_NAME) AS NAME, TRIM(I.RDB$RELATION_NAME) AS TABLE_NAME,
+      COALESCE(I.RDB$INDEX_INACTIVE, 0) AS INACTIVE, TRIM(S.RDB$FIELD_NAME) AS COLUMN_NAME
+      FROM RDB$INDICES I LEFT JOIN RDB$INDEX_SEGMENTS S ON S.RDB$INDEX_NAME = I.RDB$INDEX_NAME
+      ORDER BY I.RDB$INDEX_NAME, S.RDB$FIELD_POSITION`));
+        });
+    }
+    static sameColumns(rows, columns) {
+        return rows.map(row => row.COLUMN_NAME).join(',') === columns.join(',');
+    }
+    static triggers(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            return yield this.getDatabaseVersion(options.databaseOptions);
+            return this.query(options, `SELECT TRIM(RDB$TRIGGER_NAME) AS NAME, TRIM(RDB$RELATION_NAME) AS TABLE_NAME,
+      RDB$TRIGGER_INACTIVE AS INACTIVE, RDB$TRIGGER_TYPE AS TRIGGER_TYPE,
+      CAST(RDB$TRIGGER_SOURCE AS VARCHAR(8191)) AS SOURCE
+      FROM RDB$TRIGGERS WHERE COALESCE(RDB$SYSTEM_FLAG, 0) = 0
+      AND RDB$RELATION_NAME IN (${Object.keys(accessiSchema_1.accessiTables).map(name => `'${name}'`).join(', ')})`);
         });
     }
-    static getLatestVersion() {
+    /** Accept historical formatting and renamed triggers, but require the operations used by Accessi. */
+    static compatibleTrigger(row, trigger) {
         var _a, _b;
-        return (_b = (_a = this.updates[this.updates.length - 1]) === null || _a === void 0 ? void 0 : _a.toVersion) !== null && _b !== void 0 ? _b : "0.0.0";
+        if (row.TABLE_NAME !== trigger.table || Number(row.INACTIVE) || Number(row.TRIGGER_TYPE) !== trigger.type)
+            return false;
+        const source = String((_a = row.SOURCE) !== null && _a !== void 0 ? _a : '').replace(/\/\*[\s\S]*?\*\//g, '').replace(/--[^\r\n]*/g, '').replace(/[\s()]/g, '').toUpperCase();
+        const required = {
+            UTENTI_BI: ['IFNEW.CODUTEISNULL', 'NEW.CODUTE=GEN_IDGEN_UTENTI_ID,1', 'NEW.DATINS=CURRENT_TIMESTAMP'],
+            RUOLI_BI: ['IFNEW.CODRUOISNULL', 'NEW.CODRUO=GEN_IDGEN_RUOLI_ID,1'],
+            FILTRI_BI0: ['IFNEW.PROGISNULL', 'MAXPROG', 'FROMFILTRIWHERECODUTE=NEW.CODUTE', 'NEW.PROG=TOT+1'],
+            UTENTI_GDPR_BI0: ['NEW.DATACC=CURRENT_TIMESTAMP', 'UPDATEUTENTISETFLGGDPR=1', 'DATGDPR=CURRENT_TIMESTAMP', 'WHERECODUTE=NEW.CODUTE'],
+        };
+        return ((_b = required[trigger.name]) !== null && _b !== void 0 ? _b : []).every(fragment => source.includes(fragment));
     }
-    static ensureColumn(options, tableName, columnDefinition, columnName, comment) {
+    static futureVersionIssue(options, columns) {
         return __awaiter(this, void 0, void 0, function* () {
-            const exists = yield this.columnExists(options.databaseOptions, tableName, columnName);
-            if (!exists) {
-                yield Orm_1.Orm.execute(options.databaseOptions, `ALTER TABLE ${tableName} ADD ${columnDefinition}`);
-            }
-            if (comment) {
-                yield Orm_1.Orm.execute(options.databaseOptions, `COMMENT ON COLUMN ${tableName}.${columnName} IS '${comment.replace(/'/g, "''")}'`);
+            var _a, _b, _c, _d;
+            if (!['CODPAR', 'DESPAR'].every(name => columns.some(row => row.TABLE_NAME === 'PARAMETRI' && row.COLUMN_NAME === name)))
+                return;
+            const version = yield this.getCurrentVersion(options);
+            if (!version)
+                return;
+            if (!/^\d+\.\d+\.\d+$/.test(version))
+                return `Versione Accessi non riconosciuta: ${version}`;
+            const actual = version.split('.').map(Number), latest = accessiSchema_1.ACCESSI_SCHEMA_VERSION.split('.').map(Number);
+            for (let i = 0; i < 3; i++) {
+                if (((_a = actual[i]) !== null && _a !== void 0 ? _a : 0) > ((_b = latest[i]) !== null && _b !== void 0 ? _b : 0))
+                    return `Schema Accessi ${version} piu recente della libreria (${accessiSchema_1.ACCESSI_SCHEMA_VERSION}); downgrade automatico non consentito`;
+                if (((_c = actual[i]) !== null && _c !== void 0 ? _c : 0) < ((_d = latest[i]) !== null && _d !== void 0 ? _d : 0))
+                    return;
             }
-            return !exists;
         });
     }
-    static upsertFiltroTipo(options, tipfil, desfil, fldfil, flgEnabled) {
+    /** Read-only diagnostics, including when automatic updates are disabled. */
+    static inspectSchema(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const hasEnabledColumn = yield this.columnExists(options.databaseOptions, "FILTRI_TIPO", "FLGENABLED");
-            const existing = yield Orm_1.Orm.query(options.databaseOptions, "SELECT TIPFIL FROM FILTRI_TIPO WHERE TIPFIL = ?", [tipfil]);
-            if (existing.length === 0) {
-                if (hasEnabledColumn && flgEnabled !== undefined) {
-                    yield Orm_1.Orm.execute(options.databaseOptions, "INSERT INTO FILTRI_TIPO (TIPFIL, DESFIL, FLDFIL, FLGENABLED) VALUES (?, ?, ?, ?)", [tipfil, desfil, fldfil, flgEnabled]);
-                    return;
+            var _a, _b;
+            const engine = yield this.engineIssue(options);
+            if (engine)
+                return { compatible: false, issues: [engine] };
+            const { major: engineMajor } = yield this.engineInfo(options);
+            const issues = yield this.relationIssues(options);
+            const columns = yield this.columns(options);
+            const checks = yield this.checks(options);
+            const future = yield this.futureVersionIssue(options, columns);
+            if (future)
+                issues.push(future);
+            for (const [table, schema] of Object.entries(accessiSchema_1.accessiTables)) {
+                const present = columns.filter(row => row.TABLE_NAME === table);
+                if (!present.length) {
+                    issues.push(`Tabella mancante: ${table}`);
+                    continue;
+                }
+                for (const [name, definition] of Object.entries(schema.columns)) {
+                    const row = present.find(row => row.COLUMN_NAME === name);
+                    if (!row) {
+                        issues.push(`Colonna mancante: ${table}.${name}`);
+                        continue;
+                    }
+                    const problem = this.typeIssue(row, definition);
+                    if (problem)
+                        issues.push(`${table}.${name}: ${problem}`);
+                    if (definition.includes('NOT NULL') && !Number(row.NOT_NULL) && !this.notNullEnforcedByCheck(checks, engineMajor, table, name)) {
+                        issues.push(`${table}.${name}: manca NOT NULL`);
+                    }
+                    const expected = this.defaultValue(definition);
+                    if (expected && this.normalizeDefault(row.DEFAULT_SOURCE) !== this.normalizeDefault(expected))
+                        issues.push(`${table}.${name}: richiesto DEFAULT ${expected}`);
                 }
-                yield Orm_1.Orm.execute(options.databaseOptions, "INSERT INTO FILTRI_TIPO (TIPFIL, DESFIL, FLDFIL) VALUES (?, ?, ?)", [tipfil, desfil, fldfil]);
-                return;
             }
-            if (hasEnabledColumn && flgEnabled !== undefined) {
-                yield Orm_1.Orm.execute(options.databaseOptions, "UPDATE FILTRI_TIPO SET DESFIL = ?, FLDFIL = ?, FLGENABLED = COALESCE(FLGENABLED, ?) WHERE TIPFIL = ?", [desfil, fldfil, flgEnabled, tipfil]);
-                return;
+            for (const check of accessiSchema_1.accessiChecks) {
+                if (!checks.some(row => row.TABLE_NAME === check.table && this.sameCheck(String(row.CHECK_SOURCE), check.expression)))
+                    issues.push(`${check.table}: manca CHECK (${check.expression})`);
             }
-            yield Orm_1.Orm.execute(options.databaseOptions, "UPDATE FILTRI_TIPO SET DESFIL = ?, FLDFIL = ? WHERE TIPFIL = ?", [desfil, fldfil, tipfil]);
+            const constraints = this.groups(yield this.constraints(options));
+            for (const [table, schema] of Object.entries(accessiSchema_1.accessiTables)) {
+                if (!constraints.some(rows => rows[0].TABLE_NAME === table && rows[0].KIND === 'PRIMARY KEY' && this.sameColumns(rows, schema.primaryKey)))
+                    issues.push(`${table}: chiave primaria richiesta (${schema.primaryKey.join(', ')})`);
+            }
+            for (const fk of accessiSchema_1.accessiForeignKeys) {
+                if (!constraints.some(rows => rows.length === 1 && rows[0].KIND === 'FOREIGN KEY' && rows[0].TABLE_NAME === fk.table && rows[0].COLUMN_NAME === fk.column && rows[0].TARGET_TABLE === fk.target && rows[0].TARGET_COLUMN === fk.targetColumn && (fk.cascade ? rows[0].DELETE_RULE === 'CASCADE' : ['NO ACTION', 'RESTRICT'].includes(String(rows[0].DELETE_RULE)))))
+                    issues.push(`${fk.name}: manca FK compatibile ${fk.table}.${fk.column} -> ${fk.target}.${fk.targetColumn}`);
+            }
+            const indexes = yield this.indexes(options);
+            for (const index of accessiSchema_1.accessiIndexes) {
+                if (!indexes.some(rows => rows[0].TABLE_NAME === index.table && !Number(rows[0].INACTIVE) && this.sameColumns(rows, index.columns)))
+                    issues.push(`${index.name}: indice mancante o inattivo`);
+            }
+            const triggers = yield this.triggers(options);
+            for (const trigger of accessiSchema_1.accessiTriggers) {
+                if (!triggers.some(row => this.compatibleTrigger(row, trigger)))
+                    issues.push(`${trigger.name}: trigger richiesto attivo ${trigger.event} su ${trigger.table}, con le operazioni Accessi previste`);
+            }
+            for (const generator of accessiSchema_1.accessiGenerators) {
+                if (!(yield this.sequenceExists(options, generator.name)))
+                    issues.push(`${generator.name}: sequence/generatore mancante`);
+                else if (columns.some(row => row.TABLE_NAME === generator.table && row.COLUMN_NAME === generator.column)) {
+                    const rows = yield this.query(options, `SELECT GEN_ID(${generator.name}, 0) AS CURRENT_VALUE, (SELECT COALESCE(MAX(${generator.column}), 0) FROM ${generator.table}) AS MAX_VALUE FROM RDB$DATABASE`);
+                    if (Number((_a = rows[0]) === null || _a === void 0 ? void 0 : _a.CURRENT_VALUE) < Number((_b = rows[0]) === null || _b === void 0 ? void 0 : _b.MAX_VALUE))
+                        issues.push(`${generator.name}: sequence inferiore agli identificativi esistenti`);
+                }
+            }
+            return { compatible: issues.length === 0, issues };
         });
     }
-    static upsertMenu(options, menu) {
+    static assertCompatible(options) {
         return __awaiter(this, void 0, void 0, function* () {
-            const existing = yield Orm_1.Orm.query(options.databaseOptions, "SELECT CODMNU FROM MENU WHERE CODMNU = ?", [menu.CODMNU]);
-            if (existing.length === 0) {
-                yield Orm_1.Orm.execute(options.databaseOptions, `INSERT INTO MENU (CODMNU, DESMNU, CODGRP, FLGENABLED, ICON, ORDINE, CODTIP, PAGINA, RIFMENU)
-         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`, [
-                    menu.CODMNU,
-                    menu.DESMNU,
-                    menu.CODGRP,
-                    menu.FLGENABLED,
-                    menu.ICON,
-                    menu.ORDINE,
-                    menu.CODTIP,
-                    menu.PAGINA,
-                    menu.RIFMENU,
-                ]);
-                return;
+            const report = yield this.inspectSchema(options);
+            if (!report.compatible)
+                throw new Error(`Schema database Accessi incompatibile:\n- ${report.issues.join('\n- ')}\nEseguire AccessiDatabaseUpdater.run con un utente autorizzato o correggere lo schema prima dell'avvio.`);
+        });
+    }
+    static normalizeDefault(value) {
+        return String(value !== null && value !== void 0 ? value : '').replace(/^\s*DEFAULT\s+/i, '').replace(/[()\s]/g, '').toUpperCase();
+    }
+    /**
+     * Riconciliazione idempotente e ripartibile. Firebird non rende utilizzabili gli oggetti
+     * creati nella stessa transazione (metadata cache), quindi il DDL resta auto-commit per
+     * statement: eventuali errori a meta vengono recuperati rieseguendo la migrazione e la
+     * versione viene avanzata solo dopo la verifica finale `assertCompatible`.
+     */
+    static reconcile(options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.logger.info('Verifica dello schema effettivo Accessi.');
+            const engine = yield this.engineIssue(options);
+            if (engine)
+                throw new Error(engine);
+            const { major: engineMajor } = yield this.engineInfo(options);
+            const columns = yield this.columns(options);
+            const checks = yield this.checks(options);
+            const future = yield this.futureVersionIssue(options, columns);
+            if (future)
+                throw new Error(future);
+            // Detect incompatible existing definitions before making any changes. Never guess at data conversion.
+            const problems = yield this.relationIssues(options);
+            for (const [table, schema] of Object.entries(accessiSchema_1.accessiTables)) {
+                for (const [name, definition] of Object.entries(schema.columns)) {
+                    const row = columns.find(row => row.TABLE_NAME === table && row.COLUMN_NAME === name);
+                    if (row) {
+                        const problem = this.typeIssue(row, definition);
+                        if (problem)
+                            problems.push(`${table}.${name}: ${problem}`);
+                    }
+                }
+            }
+            if (problems.length)
+                throw new Error(`Schema Accessi richiede intervento sui tipi:\n- ${problems.join('\n- ')}`);
+            for (const [table, schema] of Object.entries(accessiSchema_1.accessiTables)) {
+                const present = columns.filter(row => row.TABLE_NAME === table);
+                if (!present.length) {
+                    yield this.execute(options, `CREATE TABLE ${table} (${Object.entries(schema.columns).map(([name, definition]) => `${name} ${definition}`).join(', ')})`);
+                    continue;
+                }
+                for (const [name, definition] of Object.entries(schema.columns)) {
+                    const row = present.find(row => row.COLUMN_NAME === name);
+                    if (!row) {
+                        if (definition.includes('NOT NULL') && !this.defaultValue(definition)) {
+                            const data = yield this.query(options, `SELECT FIRST 1 1 AS HAS_DATA FROM ${table}`);
+                            if (data.length)
+                                throw new Error(`Impossibile aggiungere ${table}.${name} obbligatoria: tabella popolata, serve un backfill esplicito. Nessun valore identificativo viene inventato.`);
+                        }
+                        yield this.execute(options, `ALTER TABLE ${table} ADD ${name} ${definition}`);
+                    }
+                    else {
+                        const expected = this.defaultValue(definition);
+                        if (expected && this.normalizeDefault(row.DEFAULT_SOURCE) !== this.normalizeDefault(expected))
+                            yield this.execute(options, `ALTER TABLE ${table} ALTER ${name} SET DEFAULT ${expected}`);
+                        if (definition.includes('NOT NULL') && !Number(row.NOT_NULL)) {
+                            if (expected)
+                                yield this.execute(options, `UPDATE ${table} SET ${name} = ${expected} WHERE ${name} IS NULL`);
+                            if (engineMajor >= 3) {
+                                yield this.execute(options, `ALTER TABLE ${table} ALTER ${name} SET NOT NULL`);
+                            }
+                            else {
+                                // Firebird 2.5 non supporta ALTER ... SET NOT NULL: replica la regola con un CHECK equivalente.
+                                const nnName = this.notNullConstraint(table, name);
+                                if (!checks.some(entry => entry.NAME === nnName)) {
+                                    yield this.execute(options, `ALTER TABLE ${table} ADD CONSTRAINT ${nnName} CHECK (${name} IS NOT NULL)`);
+                                }
+                            }
+                        }
+                    }
+                }
+            }
+            // Pulizia delle colonne ibride: rinomina con copia dati e rimozione dei campi applicativi.
+            // Gira dopo l'aggiunta delle colonne canoniche, cosi il target del rename esiste sempre.
+            for (const rename of accessiSchema_1.accessiRenamedColumns) {
+                const hasLegacy = columns.some(row => row.TABLE_NAME === rename.table && row.COLUMN_NAME === rename.from);
+                if (!hasLegacy)
+                    continue;
+                yield this.execute(options, `UPDATE ${rename.table} SET ${rename.to} = ${rename.from} WHERE ${rename.to} IS NULL AND ${rename.from} IS NOT NULL`);
+                yield this.execute(options, `ALTER TABLE ${rename.table} DROP ${rename.from}`);
+            }
+            // Copie tra tabelle diverse (es. telefono legacy UTENTI.CELLUTE -> UTENTI_CONFIG.CELLULARE).
+            for (const copy of accessiSchema_1.accessiColumnCopies) {
+                const hasSource = columns.some(row => row.TABLE_NAME === copy.sourceTable && row.COLUMN_NAME === copy.sourceColumn);
+                if (!hasSource)
+                    continue;
+                yield this.execute(options, `UPDATE ${copy.targetTable} SET ${copy.targetColumn} = (SELECT S.${copy.sourceColumn} FROM ${copy.sourceTable} S WHERE S.${copy.joinColumn} = ${copy.targetTable}.${copy.joinColumn}) WHERE ${copy.targetColumn} IS NULL AND EXISTS (SELECT 1 FROM ${copy.sourceTable} S WHERE S.${copy.joinColumn} = ${copy.targetTable}.${copy.joinColumn} AND S.${copy.sourceColumn} IS NOT NULL)`);
+            }
+            for (const [table, obsoleteColumns] of Object.entries(accessiSchema_1.accessiObsoleteColumns)) {
+                for (const column of obsoleteColumns) {
+                    if (columns.some(row => row.TABLE_NAME === table && row.COLUMN_NAME === column)) {
+                        yield this.execute(options, `ALTER TABLE ${table} DROP ${column}`);
+                    }
+                }
+            }
+            const constraints = this.groups(yield this.constraints(options));
+            for (const [table, schema] of Object.entries(accessiSchema_1.accessiTables)) {
+                const primary = constraints.find(rows => rows[0].TABLE_NAME === table && rows[0].KIND === 'PRIMARY KEY');
+                if (primary && !this.sameColumns(primary, schema.primaryKey))
+                    throw new Error(`${table}: chiave primaria esistente incompatibile; nessun vincolo viene eliminato automaticamente.`);
+                if (!primary)
+                    yield this.execute(options, `ALTER TABLE ${table} ADD CONSTRAINT PK_${table} PRIMARY KEY (${schema.primaryKey.join(', ')})`);
+            }
+            // Only preserve provider namespaces already referenced by historical SSO identities.
+            yield this.execute(options, `INSERT INTO SSO_PROVIDER (PROVIDER, DESCRIZIONE, FLGATTIVO)
+      SELECT DISTINCT I.PROVIDER, I.PROVIDER, 1 FROM UTENTI_IDENTITA_EXT I
+      WHERE NOT EXISTS (SELECT 1 FROM SSO_PROVIDER P WHERE P.PROVIDER = I.PROVIDER)`);
+            for (const fk of accessiSchema_1.accessiForeignKeys) {
+                const existing = constraints.find(rows => rows[0].KIND === 'FOREIGN KEY' && rows[0].TABLE_NAME === fk.table && this.sameColumns(rows, [fk.column]));
+                if (existing) {
+                    // Una FK sulla stessa colonna ma verso un target/regola diverso non e compatibile:
+                    // correggere il target cambiando semantica e va segnalato, non ignorato.
+                    const deleteRuleOk = fk.cascade
+                        ? existing[0].DELETE_RULE === 'CASCADE'
+                        : ['NO ACTION', 'RESTRICT'].includes(String(existing[0].DELETE_RULE));
+                    if (existing[0].TARGET_TABLE !== fk.target || existing[0].TARGET_COLUMN !== fk.targetColumn || !deleteRuleOk) {
+                        throw new Error(`${fk.name}: FK esistente su ${fk.table}.${fk.column} incompatibile (target ${existing[0].TARGET_TABLE}.${existing[0].TARGET_COLUMN}, delete rule ${existing[0].DELETE_RULE}); correggerla esplicitamente.`);
+                    }
+                    continue;
+                }
+                yield this.execute(options, `ALTER TABLE ${fk.table} ADD CONSTRAINT ${fk.name} FOREIGN KEY (${fk.column}) REFERENCES ${fk.target} (${fk.targetColumn})${fk.cascade ? ' ON DELETE CASCADE' : ''}`);
+            }
+            for (const check of accessiSchema_1.accessiChecks) {
+                if (!checks.some(row => row.TABLE_NAME === check.table && this.sameCheck(String(row.CHECK_SOURCE), check.expression))) {
+                    yield this.execute(options, `ALTER TABLE ${check.table} ADD CONSTRAINT ${check.name} CHECK (${check.expression})`);
+                }
+            }
+            const indexes = yield this.indexes(options);
+            for (const index of accessiSchema_1.accessiIndexes) {
+                if (!indexes.some(rows => rows[0].TABLE_NAME === index.table && !Number(rows[0].INACTIVE) && this.sameColumns(rows, index.columns))) {
+                    if (indexes.some(rows => rows[0].NAME === index.name))
+                        throw new Error(`${index.name}: indice esistente incompatibile o inattivo; correggerlo esplicitamente.`);
+                    yield this.execute(options, `CREATE INDEX ${index.name} ON ${index.table} (${index.columns.join(', ')})`);
+                }
+            }
+            for (const generator of accessiSchema_1.accessiGenerators) {
+                if (!(yield this.sequenceExists(options, generator.name))) {
+                    // Firebird 2.5 non conosce CREATE SEQUENCE: usa CREATE GENERATOR. Da 3.0 si usa la sintassi standard.
+                    yield this.execute(options, engineMajor >= 3 ? `CREATE SEQUENCE ${generator.name}` : `CREATE GENERATOR ${generator.name}`);
+                }
+                // Advance by a positive delta only: do not reset an existing sequence or reuse an allocated value.
+                yield this.execute(options, `EXECUTE BLOCK AS DECLARE VARIABLE MAX_ID BIGINT; DECLARE VARIABLE CURRENT_ID BIGINT; DECLARE VARIABLE NEXT_ID BIGINT;
+        BEGIN SELECT COALESCE(MAX(${generator.column}), 0) FROM ${generator.table} INTO :MAX_ID;
+        CURRENT_ID = GEN_ID(${generator.name}, 0);
+        IF (MAX_ID > CURRENT_ID) THEN NEXT_ID = GEN_ID(${generator.name}, MAX_ID - CURRENT_ID); END`);
+            }
+            const triggers = yield this.triggers(options);
+            for (const trigger of accessiSchema_1.accessiTriggers) {
+                if (!triggers.some(row => this.compatibleTrigger(row, trigger)) && !triggers.some(row => row.NAME === trigger.name)) {
+                    if (triggers.some(row => row.TABLE_NAME === trigger.table && Number(row.TRIGGER_TYPE) === trigger.type)) {
+                        throw new Error(`${trigger.table}: trigger ${trigger.event} personalizzato non riconosciuto; verificare le operazioni di ${trigger.name} prima di aggiungere trigger concorrenti.`);
+                    }
+                    yield this.execute(options, `CREATE TRIGGER ${trigger.name} FOR ${trigger.table} ACTIVE ${trigger.event} POSITION 0 ${trigger.body}`);
+                }
             }
-            yield Orm_1.Orm.execute(options.databaseOptions, `UPDATE MENU
-       SET DESMNU = ?,
-           CODGRP = ?,
-           FLGENABLED = COALESCE(FLGENABLED, ?),
-           ICON = ?,
-           ORDINE = ?,
-           CODTIP = ?,
-           PAGINA = ?,
-           RIFMENU = ?
-       WHERE CODMNU = ?`, [
-                menu.DESMNU,
-                menu.CODGRP,
-                menu.FLGENABLED,
-                menu.ICON,
-                menu.ORDINE,
-                menu.CODTIP,
-                menu.PAGINA,
-                menu.RIFMENU,
-                menu.CODMNU,
-            ]);
+            yield this.assertCompatible(options);
+            // The host's VersioneDB/DBVERSION values belong to the host and are never overwritten.
+            yield this.execute(options, 'UPDATE OR INSERT INTO PARAMETRI (CODPAR, DESPAR) VALUES (?, ?) MATCHING (CODPAR)', [accessiSchema_1.ACCESSI_VERSION_KEY, accessiSchema_1.ACCESSI_SCHEMA_VERSION]);
+            this.logger.info(`Schema Accessi verificato: ${accessiSchema_1.ACCESSI_SCHEMA_VERSION}.`);
         });
     }
 };
 exports.AccessiDatabaseUpdater = AccessiDatabaseUpdater;
 AccessiDatabaseUpdater.logger = new Logger_1.Logger(AccessiDatabaseUpdater_1.name);
-AccessiDatabaseUpdater.updates = [
-    {
-        fromVersion: "1.0.0",
-        toVersion: "1.1.0",
-        description: "Aggiunge filtro postazione, colonna IDXPOS e menu verifica RFID",
-        apply: (options) => __awaiter(void 0, void 0, void 0, function* () {
-            yield AccessiDatabaseUpdater_1.upsertFiltroTipo(options, 20, "POSTAZIONE", "IDXPOS", undefined);
-            yield AccessiDatabaseUpdater_1.ensureColumn(options, "FILTRI", "IDXPOS SMALLINT", "IDXPOS", "idx della postazione nella tabella ANTENNE_POS di PROLAV");
-            yield AccessiDatabaseUpdater_1.upsertMenu(options, {
-                CODMNU: "MNUVERRFID",
-                DESMNU: "Verifica RFID",
-                CODGRP: "F",
-                FLGENABLED: 1,
-                ICON: "hardware-chip-outline",
-                ORDINE: 10,
-                CODTIP: "M",
-                PAGINA: "/verifica-rfid",
-                RIFMENU: null,
-            });
-        }),
-    },
-    {
-        fromVersion: "1.1.0",
-        toVersion: "1.1.1",
-        description: "Aggiunge FLGENABLED su FILTRI_TIPO",
-        apply: (options) => __awaiter(void 0, void 0, void 0, function* () {
-            const columnCreated = yield AccessiDatabaseUpdater_1.ensureColumn(options, "FILTRI_TIPO", "FLGENABLED SMALLINT DEFAULT 1 NOT NULL", "FLGENABLED");
-            if (!columnCreated) {
-                yield Orm_1.Orm.execute(options.databaseOptions, "UPDATE FILTRI_TIPO SET FLGENABLED = 1 WHERE FLGENABLED IS NULL");
-            }
-        }),
-    },
-    {
-        fromVersion: "1.1.1",
-        toVersion: "1.1.2",
-        description: "Aggiunge filtro vettore e colonna CODVET",
-        apply: (options) => __awaiter(void 0, void 0, void 0, function* () {
-            yield AccessiDatabaseUpdater_1.upsertFiltroTipo(options, 30, "VETTORE", "CODVET", 1);
-            yield AccessiDatabaseUpdater_1.ensureColumn(options, "FILTRI", "CODVET INTEGER", "CODVET", "CODICE DEL VETTORE DA INSERIRE SE COME FILTRO HA 30");
-        }),
-    },
-    {
-        fromVersion: "1.1.2",
-        toVersion: "1.1.3",
-        description: "Aggiunge FLGADMINCONFIG e inizializza PARAMETRI",
-        apply: (options) => __awaiter(void 0, void 0, void 0, function* () {
-            yield AccessiDatabaseUpdater_1.ensureColumn(options, "UTENTI_CONFIG", "FLGADMINCONFIG SMALLINT DEFAULT 0", "FLGADMINCONFIG", "flag utente configuratore dei menu amministratore");
-            yield AccessiDatabaseUpdater_1.createParametersTable(options.databaseOptions);
-        }),
-    },
-    {
-        fromVersion: "1.1.3",
-        toVersion: "1.1.4",
-        description: "Aggiunge sequence e trigger per RUOLI",
-        apply: (options) => __awaiter(void 0, void 0, void 0, function* () {
-            if (!(yield AccessiDatabaseUpdater_1.generatorExists(options.databaseOptions, "GEN_RUOLI_ID"))) {
-                yield Orm_1.Orm.execute(options.databaseOptions, "CREATE SEQUENCE GEN_RUOLI_ID");
-            }
-            if (!(yield AccessiDatabaseUpdater_1.triggerExists(options.databaseOptions, "RUOLI_BI"))) {
-                yield Orm_1.Orm.execute(options.databaseOptions, `CREATE TRIGGER RUOLI_BI FOR RUOLI
-ACTIVE BEFORE INSERT POSITION 0
-AS
-BEGIN
-  IF (NEW.CODRUO IS NULL) THEN
-    NEW.CODRUO = GEN_ID(GEN_RUOLI_ID,1);
-END`);
-            }
-        }),
-    },
-    {
-        fromVersion: "1.1.4",
-        toVersion: "1.1.5",
-        description: "Aggiunge NOTE su MENU",
-        apply: (options) => __awaiter(void 0, void 0, void 0, function* () {
-            yield AccessiDatabaseUpdater_1.ensureColumn(options, "MENU", "NOTE VARCHAR(1000)", "NOTE");
-        }),
-    },
-    {
-        fromVersion: "1.1.5",
-        toVersion: "1.1.6",
-        description: "Aggiunge NUMMAC su UTENTI_CONFIG",
-        apply: (options) => __awaiter(void 0, void 0, void 0, function* () {
-            yield AccessiDatabaseUpdater_1.ensureColumn(options, "UTENTI_CONFIG", "NUMMAC INTEGER", "NUMMAC", 'Numero macchina DESPOST PROLAV');
-        }),
-    },
-];
+AccessiDatabaseUpdater.initialization = new WeakMap();
+AccessiDatabaseUpdater.running = new Map();
 exports.AccessiDatabaseUpdater = AccessiDatabaseUpdater = AccessiDatabaseUpdater_1 = __decorate([
     (0, common_1.Injectable)(),
-    __param(0, (0, common_1.Inject)("ACCESSI_OPTIONS")),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
     __metadata("design:paramtypes", [Object])
 ], AccessiDatabaseUpdater);
 //# sourceMappingURL=AccessiDatabaseUpdater.js.map