emilsoftware-utilities 2.0.0-dev.4 → 2.0.0-dev.40

package/dist/accessi-module/security/accessiValidation.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAccessiValidationPipe = createAccessiValidationPipe;
+const common_1 = require("@nestjs/common");
+const Utilities_1 = require("../../Utilities");
+/**
+ * Creates the validation pipe used by every Accessi bootstrap path.
+ *
+ * It deliberately returns one stable, documented error contract instead of
+ * Nest's default array. Consumers can branch on `code`; `details` is safe to
+ * display or log because it contains only DTO field names and validation text.
+ */
+function createAccessiValidationPipe() {
+    return new common_1.ValidationPipe({
+        whitelist: true,
+        forbidNonWhitelisted: true,
+        transform: true,
+        transformOptions: {
+            enableImplicitConversion: true,
+        },
+        exceptionFactory: (errors) => new common_1.BadRequestException({
+            severity: 'error',
+            status: 400,
+            statusCode: Utilities_1.StatusCode.Error,
+            code: 'ACCESSI_VALIDATION_ERROR',
+            error: 'ACCESSI_VALIDATION_ERROR',
+            message: 'La richiesta contiene dati non validi.',
+            details: flattenValidationErrors(errors),
+        }),
+    });
+}
+/** Converts nested class-validator failures into deterministic client details. */
+function flattenValidationErrors(errors, parentPath = '') {
+    return errors.flatMap((error) => {
+        var _a, _b;
+        const path = parentPath ? `${parentPath}.${error.property}` : error.property;
+        const ownMessages = Object.values((_a = error.constraints) !== null && _a !== void 0 ? _a : {}).map((message) => `${path}: ${message}`);
+        return [...ownMessages, ...flattenValidationErrors((_b = error.children) !== null && _b !== void 0 ? _b : [], path)];
+    });
+}
+//# sourceMappingURL=accessiValidation.js.map

package/dist/accessi-module/security/accessiValidation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"accessiValidation.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessiValidation.ts"],"names":[],"mappings":";;AAUA,kEAmBC;AA7BD,2CAAsF;AACtF,+CAA6C;AAE7C;;;;;;GAMG;AACH,SAAgB,2BAA2B;IACzC,OAAO,IAAI,uBAAc,CAAC;QACxB,SAAS,EAAE,IAAI;QACf,oBAAoB,EAAE,IAAI;QAC1B,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE;YAChB,wBAAwB,EAAE,IAAI;SAC/B;QACD,gBAAgB,EAAE,CAAC,MAAyB,EAAE,EAAE,CAC9C,IAAI,4BAAmB,CAAC;YACtB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG;YACX,UAAU,EAAE,sBAAU,CAAC,KAAK;YAC5B,IAAI,EAAE,0BAA0B;YAChC,KAAK,EAAE,0BAA0B;YACjC,OAAO,EAAE,wCAAwC;YACjD,OAAO,EAAE,uBAAuB,CAAC,MAAM,CAAC;SACzC,CAAC;KACL,CAAC,CAAC;AACL,CAAC;AAED,kFAAkF;AAClF,SAAS,uBAAuB,CAAC,MAAyB,EAAE,UAAU,GAAG,EAAE;IACzE,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE;;QAC9B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC7E,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,MAAA,KAAK,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,GAAG,IAAI,KAAK,OAAO,EAAE,CAAC,CAAC;QACnG,OAAO,CAAC,GAAG,WAAW,EAAE,GAAG,uBAAuB,CAAC,MAAA,KAAK,CAAC,QAAQ,mCAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC;IAClF,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import { BadRequestException, ValidationError, ValidationPipe } from '@nestjs/common';\nimport { StatusCode } from '../../Utilities';\n\n/**\n * Creates the validation pipe used by every Accessi bootstrap path.\n *\n * It deliberately returns one stable, documented error contract instead of\n * Nest's default array. Consumers can branch on `code`; `details` is safe to\n * display or log because it contains only DTO field names and validation text.\n */\nexport function createAccessiValidationPipe(): ValidationPipe {\n  return new ValidationPipe({\n    whitelist: true,\n    forbidNonWhitelisted: true,\n    transform: true,\n    transformOptions: {\n      enableImplicitConversion: true,\n    },\n    exceptionFactory: (errors: ValidationError[]) =>\n      new BadRequestException({\n        severity: 'error',\n        status: 400,\n        statusCode: StatusCode.Error,\n        code: 'ACCESSI_VALIDATION_ERROR',\n        error: 'ACCESSI_VALIDATION_ERROR',\n        message: 'La richiesta contiene dati non validi.',\n        details: flattenValidationErrors(errors),\n      }),\n  });\n}\n\n/** Converts nested class-validator failures into deterministic client details. */\nfunction flattenValidationErrors(errors: ValidationError[], parentPath = ''): string[] {\n  return errors.flatMap((error) => {\n    const path = parentPath ? `${parentPath}.${error.property}` : error.property;\n    const ownMessages = Object.values(error.constraints ?? {}).map((message) => `${path}: ${message}`);\n    return [...ownMessages, ...flattenValidationErrors(error.children ?? [], path)];\n  });\n}\n"]}

package/dist/accessi-module/security/adminBootstrap.d.ts

@@ -0,0 +1,8 @@
+/** Genera (una sola volta per processo) il token di bootstrap admin. */
+export declare function getOrCreateAdminBootstrapToken(): string;
+/** Token corrente, oppure null se non ancora generato. */
+export declare function getAdminBootstrapToken(): string | null;
+/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */
+export declare function clearAdminBootstrapToken(): void;
+/** Confronto a tempo costante del token candidato con quello generato. */
+export declare function isValidAdminBootstrapToken(candidate: unknown): boolean;

package/dist/accessi-module/security/adminBootstrap.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getOrCreateAdminBootstrapToken = getOrCreateAdminBootstrapToken;
+exports.getAdminBootstrapToken = getAdminBootstrapToken;
+exports.clearAdminBootstrapToken = clearAdminBootstrapToken;
+exports.isValidAdminBootstrapToken = isValidAdminBootstrapToken;
+const crypto_1 = require("crypto");
+/**
+ * Token di bootstrap admin, valido per il singolo processo Accessi.
+ * Viene generato al primo accesso (avvio del modulo) e rigenerato a ogni riavvio: non e mai
+ * persistito ne restituito via API, e viene stampato solo nel log del backend.
+ */
+let processToken = null;
+/** Genera (una sola volta per processo) il token di bootstrap admin. */
+function getOrCreateAdminBootstrapToken() {
+    if (!processToken) {
+        processToken = (0, crypto_1.randomBytes)(32).toString('hex');
+    }
+    return processToken;
+}
+/** Token corrente, oppure null se non ancora generato. */
+function getAdminBootstrapToken() {
+    return processToken;
+}
+/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */
+function clearAdminBootstrapToken() {
+    processToken = null;
+}
+/** Confronto a tempo costante del token candidato con quello generato. */
+function isValidAdminBootstrapToken(candidate) {
+    if (!processToken || typeof candidate !== 'string' || candidate.length === 0) {
+        return false;
+    }
+    const expected = Buffer.from(processToken, 'utf8');
+    const provided = Buffer.from(candidate, 'utf8');
+    if (expected.length !== provided.length) {
+        return false;
+    }
+    return (0, crypto_1.timingSafeEqual)(expected, provided);
+}
+//# sourceMappingURL=adminBootstrap.js.map

package/dist/accessi-module/security/adminBootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adminBootstrap.js","sourceRoot":"","sources":["../../../src/accessi-module/security/adminBootstrap.ts"],"names":[],"mappings":";;AAUA,wEAKC;AAGD,wDAEC;AAGD,4DAEC;AAGD,gEAYC;AAxCD,mCAAsD;AAEtD;;;;GAIG;AACH,IAAI,YAAY,GAAkB,IAAI,CAAC;AAEvC,wEAAwE;AACxE,SAAgB,8BAA8B;IAC5C,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACjD,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,0DAA0D;AAC1D,SAAgB,sBAAsB;IACpC,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,iFAAiF;AACjF,SAAgB,wBAAwB;IACtC,YAAY,GAAG,IAAI,CAAC;AACtB,CAAC;AAED,0EAA0E;AAC1E,SAAgB,0BAA0B,CAAC,SAAkB;IAC3D,IAAI,CAAC,YAAY,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,EAAE,CAAC;QACxC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,IAAA,wBAAe,EAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AAC7C,CAAC","sourcesContent":["import { randomBytes, timingSafeEqual } from 'crypto';\n\n/**\n * Token di bootstrap admin, valido per il singolo processo Accessi.\n * Viene generato al primo accesso (avvio del modulo) e rigenerato a ogni riavvio: non e mai\n * persistito ne restituito via API, e viene stampato solo nel log del backend.\n */\nlet processToken: string | null = null;\n\n/** Genera (una sola volta per processo) il token di bootstrap admin. */\nexport function getOrCreateAdminBootstrapToken(): string {\n  if (!processToken) {\n    processToken = randomBytes(32).toString('hex');\n  }\n  return processToken;\n}\n\n/** Token corrente, oppure null se non ancora generato. */\nexport function getAdminBootstrapToken(): string | null {\n  return processToken;\n}\n\n/** Invalida il token (usato dopo un bootstrap riuscito per renderlo monouso). */\nexport function clearAdminBootstrapToken(): void {\n  processToken = null;\n}\n\n/** Confronto a tempo costante del token candidato con quello generato. */\nexport function isValidAdminBootstrapToken(candidate: unknown): boolean {\n  if (!processToken || typeof candidate !== 'string' || candidate.length === 0) {\n    return false;\n  }\n\n  const expected = Buffer.from(processToken, 'utf8');\n  const provided = Buffer.from(candidate, 'utf8');\n  if (expected.length !== provided.length) {\n    return false;\n  }\n\n  return timingSafeEqual(expected, provided);\n}\n"]}

package/dist/accessi-module/security/authenticatedToken.d.ts

@@ -1,11 +1,25 @@
 import { StatoRegistrazione } from '../Dtos/StatoRegistrazione';
+/** Stato autorevole minimo riletto dal database per ogni verifica JWT. */
 export interface AccessiAuthenticatedUserSnapshot {
     codiceUtente: number;
     email?: string;
     statoRegistrazione: StatoRegistrazione;
     flagSuper: boolean;
-    flagAdminConfigurator: boolean;
+    flagAdmin: boolean;
+    flagDueFattori?: boolean;
+    passwordlessLoginEnabled?: boolean;
+    passwordLoginEnabled?: boolean;
 }
+/** Shared, strict Bearer parsing for the Nest guard and Express middleware. */
+export declare function extractAccessiBearerToken(header: unknown): string | undefined;
+/** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */
 export declare function resolveCodiceUtenteFromTokenPayload(decoded: unknown): number | undefined;
+/**
+ * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.
+ * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.
+ */
 export declare function buildAuthenticatedTokenPayload(decoded: unknown, utente: AccessiAuthenticatedUserSnapshot): Record<string, unknown>;
-export declare function isAuthenticatedUserEnabledForJwt(utente: AccessiAuthenticatedUserSnapshot | null | undefined): boolean;
+/** Enabling 2FA invalidates sessions which have not completed the required verification. */
+export declare function isAccessiTokenAllowedForUser(decoded: unknown, user: AccessiAuthenticatedUserSnapshot): boolean;
+/** Un JWT puo essere usato soltanto da utenti nello stato confermato, indipendentemente dalla sua scadenza. */
+export declare function isAuthenticatedUserEnabledForJwt(utente: AccessiAuthenticatedUserSnapshot | null | undefined): utente is AccessiAuthenticatedUserSnapshot;

package/dist/accessi-module/security/authenticatedToken.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractAccessiBearerToken = extractAccessiBearerToken;
 exports.resolveCodiceUtenteFromTokenPayload = resolveCodiceUtenteFromTokenPayload;
 exports.buildAuthenticatedTokenPayload = buildAuthenticatedTokenPayload;
+exports.isAccessiTokenAllowedForUser = isAccessiTokenAllowedForUser;
 exports.isAuthenticatedUserEnabledForJwt = isAuthenticatedUserEnabledForJwt;
 const StatoRegistrazione_1 = require("../Dtos/StatoRegistrazione");
 function normalizeBooleanFlag(value) {
@@ -10,9 +12,18 @@ function normalizeBooleanFlag(value) {
 function isRecord(value) {
     return typeof value === 'object' && value !== null;
 }
+/** Shared, strict Bearer parsing for the Nest guard and Express middleware. */
+function extractAccessiBearerToken(header) {
+    var _a;
+    if (typeof header !== 'string')
+        return undefined;
+    return (_a = /^Bearer[ \t]+([^\s]+)$/i.exec(header.trim())) === null || _a === void 0 ? void 0 : _a[1];
+}
+/** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */
 function resolveCodiceUtenteFromTokenPayload(decoded) {
     var _a;
-    if (!isRecord(decoded)) {
+    // `typ` obbligatorio: un token senza tipo non e un access token Accessi.
+    if (!isRecord(decoded) || decoded.typ !== 'access') {
         return undefined;
     }
     const userData = isRecord(decoded.userData) ? decoded.userData : undefined;
@@ -22,17 +33,33 @@ function resolveCodiceUtenteFromTokenPayload(decoded) {
             ? userData.utente
             : undefined;
     const codiceUtente = Number((_a = utente === null || utente === void 0 ? void 0 : utente.codiceUtente) !== null && _a !== void 0 ? _a : decoded.codiceUtente);
-    if (!Number.isFinite(codiceUtente) || codiceUtente <= 0) {
+    if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {
         return undefined;
     }
     return codiceUtente;
 }
+/**
+ * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.
+ * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.
+ */
 function buildAuthenticatedTokenPayload(decoded, utente) {
     const basePayload = isRecord(decoded) ? Object.assign({}, decoded) : {};
     const userData = isRecord(basePayload.userData) ? Object.assign({}, basePayload.userData) : {};
-    const normalizedUser = Object.assign(Object.assign({}, utente), { flagSuper: normalizeBooleanFlag(utente.flagSuper), flagAdminConfigurator: normalizeBooleanFlag(utente.flagAdminConfigurator) });
-    return Object.assign(Object.assign({}, basePayload), { utente: normalizedUser, userData: Object.assign(Object.assign({}, userData), { utente: normalizedUser }), tokenPayload: decoded });
+    const normalizedUser = Object.assign(Object.assign({}, utente), { flagSuper: normalizeBooleanFlag(utente.flagSuper), flagAdmin: normalizeBooleanFlag(utente.flagAdmin), flagDueFattori: normalizeBooleanFlag(utente.flagDueFattori), passwordlessLoginEnabled: normalizeBooleanFlag(utente.passwordlessLoginEnabled) });
+    return Object.assign(Object.assign({}, basePayload), { codiceUtente: normalizedUser.codiceUtente, email: normalizedUser.email, statoRegistrazione: normalizedUser.statoRegistrazione, flagSuper: normalizedUser.flagSuper, flagAdmin: normalizedUser.flagAdmin, flagDueFattori: normalizedUser.flagDueFattori, passwordlessLoginEnabled: normalizedUser.passwordlessLoginEnabled, passwordLoginEnabled: normalizedUser.passwordLoginEnabled, utente: normalizedUser, userData: Object.assign(Object.assign({}, userData), { utente: normalizedUser }), tokenPayload: decoded });
+}
+/** Enabling 2FA invalidates sessions which have not completed the required verification. */
+function isAccessiTokenAllowedForUser(decoded, user) {
+    if (!isRecord(decoded))
+        return false;
+    const methods = Array.isArray(decoded.amr) ? decoded.amr : [];
+    if (user.flagDueFattori && !methods.includes('otp'))
+        return false;
+    if (methods.includes('passwordless') && (!user.flagDueFattori || !user.passwordlessLoginEnabled))
+        return false;
+    return true;
 }
+/** Un JWT puo essere usato soltanto da utenti nello stato confermato, indipendentemente dalla sua scadenza. */
 function isAuthenticatedUserEnabledForJwt(utente) {
     return (utente === null || utente === void 0 ? void 0 : utente.statoRegistrazione) === StatoRegistrazione_1.StatoRegistrazione.CONF;
 }

package/dist/accessi-module/security/authenticatedToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticatedToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/authenticatedToken.ts"],"names":[],"mappings":";;AAkBA,kFAkBC;AAED,wEAsBC;AAED,4EAIC;AAlED,mEAAgE;AAUhE,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,SAAgB,mCAAmC,CAAC,OAAgB;;IAClE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACvB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,QAAQ,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,mCAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,SAAgB,8BAA8B,CAC5C,OAAgB,EAChB,MAAwC;IAExC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAM,OAAO,EAAG,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAM,WAAW,CAAC,QAAQ,EAAG,CAAC,CAAC,EAAE,CAAC;IAEnF,MAAM,cAAc,mCACf,MAAM,KACT,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,EACjD,qBAAqB,EAAE,oBAAoB,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAC1E,CAAC;IAEF,uCACK,WAAW,KACd,MAAM,EAAE,cAAc,EACtB,QAAQ,kCACH,QAAQ,KACX,MAAM,EAAE,cAAc,KAExB,YAAY,EAAE,OAAO,IACrB;AACJ,CAAC;AAED,SAAgB,gCAAgC,CAC9C,MAA2D;IAE3D,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,kBAAkB,MAAK,uCAAkB,CAAC,IAAI,CAAC;AAChE,CAAC","sourcesContent":["import { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\r\n\r\nexport interface AccessiAuthenticatedUserSnapshot {\r\n  codiceUtente: number;\r\n  email?: string;\r\n  statoRegistrazione: StatoRegistrazione;\r\n  flagSuper: boolean;\r\n  flagAdminConfigurator: boolean;\r\n}\r\n\r\nfunction normalizeBooleanFlag(value: unknown): boolean {\r\n  return value === true || value === 1 || value === '1';\r\n}\r\n\r\nfunction isRecord(value: unknown): value is Record<string, unknown> {\r\n  return typeof value === 'object' && value !== null;\r\n}\r\n\r\nexport function resolveCodiceUtenteFromTokenPayload(decoded: unknown): number | undefined {\r\n  if (!isRecord(decoded)) {\r\n    return undefined;\r\n  }\r\n\r\n  const userData = isRecord(decoded.userData) ? decoded.userData : undefined;\r\n  const utente = isRecord(decoded.utente)\r\n    ? decoded.utente\r\n    : isRecord(userData?.utente)\r\n      ? userData.utente\r\n      : undefined;\r\n\r\n  const codiceUtente = Number(utente?.codiceUtente ?? decoded.codiceUtente);\r\n  if (!Number.isFinite(codiceUtente) || codiceUtente <= 0) {\r\n    return undefined;\r\n  }\r\n\r\n  return codiceUtente;\r\n}\r\n\r\nexport function buildAuthenticatedTokenPayload(\r\n  decoded: unknown,\r\n  utente: AccessiAuthenticatedUserSnapshot,\r\n): Record<string, unknown> {\r\n  const basePayload = isRecord(decoded) ? { ...decoded } : {};\r\n  const userData = isRecord(basePayload.userData) ? { ...basePayload.userData } : {};\r\n\r\n  const normalizedUser = {\r\n    ...utente,\r\n    flagSuper: normalizeBooleanFlag(utente.flagSuper),\r\n    flagAdminConfigurator: normalizeBooleanFlag(utente.flagAdminConfigurator),\r\n  };\r\n\r\n  return {\r\n    ...basePayload,\r\n    utente: normalizedUser,\r\n    userData: {\r\n      ...userData,\r\n      utente: normalizedUser,\r\n    },\r\n    tokenPayload: decoded,\r\n  };\r\n}\r\n\r\nexport function isAuthenticatedUserEnabledForJwt(\r\n  utente: AccessiAuthenticatedUserSnapshot | null | undefined,\r\n): boolean {\r\n  return utente?.statoRegistrazione === StatoRegistrazione.CONF;\r\n}\r\n"]}
+{"version":3,"file":"authenticatedToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/authenticatedToken.ts"],"names":[],"mappings":";;AAuBA,8DAGC;AAGD,kFAmBC;AAMD,wEAgCC;AAGD,oEAMC;AAGD,4EAIC;AAtGD,mEAAgE;AAchE,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED,+EAA+E;AAC/E,SAAgB,yBAAyB,CAAC,MAAe;;IACvD,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IACjD,OAAO,MAAA,yBAAyB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,0CAAG,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED,8FAA8F;AAC9F,SAAgB,mCAAmC,CAAC,OAAgB;;IAClE,yEAAyE;IACzE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC;QACrC,CAAC,CAAC,OAAO,CAAC,MAAM;QAChB,CAAC,CAAC,QAAQ,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,CAAC;YAC1B,CAAC,CAAC,QAAQ,CAAC,MAAM;YACjB,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,mCAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;GAGG;AACH,SAAgB,8BAA8B,CAC5C,OAAgB,EAChB,MAAwC;IAExC,MAAM,WAAW,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,mBAAM,OAAO,EAAG,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAM,WAAW,CAAC,QAAQ,EAAG,CAAC,CAAC,EAAE,CAAC;IAEnF,MAAM,cAAc,mCACf,MAAM,KACT,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,EACjD,SAAS,EAAE,oBAAoB,CAAC,MAAM,CAAC,SAAS,CAAC,EACjD,cAAc,EAAE,oBAAoB,CAAC,MAAM,CAAC,cAAc,CAAC,EAC3D,wBAAwB,EAAE,oBAAoB,CAAC,MAAM,CAAC,wBAAwB,CAAC,GAChF,CAAC;IAEF,uCACK,WAAW,KACd,YAAY,EAAE,cAAc,CAAC,YAAY,EACzC,KAAK,EAAE,cAAc,CAAC,KAAK,EAC3B,kBAAkB,EAAE,cAAc,CAAC,kBAAkB,EACrD,SAAS,EAAE,cAAc,CAAC,SAAS,EACnC,SAAS,EAAE,cAAc,CAAC,SAAS,EACnC,cAAc,EAAE,cAAc,CAAC,cAAc,EAC7C,wBAAwB,EAAE,cAAc,CAAC,wBAAwB,EACjE,oBAAoB,EAAE,cAAc,CAAC,oBAAoB,EACzD,MAAM,EAAE,cAAc,EACtB,QAAQ,kCACH,QAAQ,KACX,MAAM,EAAE,cAAc,KAExB,YAAY,EAAE,OAAO,IACrB;AACJ,CAAC;AAED,4FAA4F;AAC5F,SAAgB,4BAA4B,CAAC,OAAgB,EAAE,IAAsC;IACnG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/G,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+GAA+G;AAC/G,SAAgB,gCAAgC,CAC9C,MAA2D;IAE3D,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,kBAAkB,MAAK,uCAAkB,CAAC,IAAI,CAAC;AAChE,CAAC","sourcesContent":["import { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\n\n/** Stato autorevole minimo riletto dal database per ogni verifica JWT. */\nexport interface AccessiAuthenticatedUserSnapshot {\n  codiceUtente: number;\n  email?: string;\n  statoRegistrazione: StatoRegistrazione;\n  flagSuper: boolean;\n  flagAdmin: boolean;\n  flagDueFattori?: boolean;\n  passwordlessLoginEnabled?: boolean;\n  passwordLoginEnabled?: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return typeof value === 'object' && value !== null;\n}\n\n/** Shared, strict Bearer parsing for the Nest guard and Express middleware. */\nexport function extractAccessiBearerToken(header: unknown): string | undefined {\n  if (typeof header !== 'string') return undefined;\n  return /^Bearer[ \\t]+([^\\s]+)$/i.exec(header.trim())?.[1];\n}\n\n/** Estrae il codice utente sia dai JWT Accessi moderni sia dai payload legacy compatibili. */\nexport function resolveCodiceUtenteFromTokenPayload(decoded: unknown): number | undefined {\n  // `typ` obbligatorio: un token senza tipo non e un access token Accessi.\n  if (!isRecord(decoded) || decoded.typ !== 'access') {\n    return undefined;\n  }\n\n  const userData = isRecord(decoded.userData) ? decoded.userData : undefined;\n  const utente = isRecord(decoded.utente)\n    ? decoded.utente\n    : isRecord(userData?.utente)\n      ? userData.utente\n      : undefined;\n\n  const codiceUtente = Number(utente?.codiceUtente ?? decoded.codiceUtente);\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n    return undefined;\n  }\n\n  return codiceUtente;\n}\n\n/**\n * Mantiene le claim estranee al modulo ma sovrascrive il profilo con valori correnti e autorevoli dal database.\n * `tokenPayload` conserva il payload verificato originale per audit o integrazioni che ne abbiano necessita.\n */\nexport function buildAuthenticatedTokenPayload(\n  decoded: unknown,\n  utente: AccessiAuthenticatedUserSnapshot,\n): Record<string, unknown> {\n  const basePayload = isRecord(decoded) ? { ...decoded } : {};\n  const userData = isRecord(basePayload.userData) ? { ...basePayload.userData } : {};\n\n  const normalizedUser = {\n    ...utente,\n    flagSuper: normalizeBooleanFlag(utente.flagSuper),\n    flagAdmin: normalizeBooleanFlag(utente.flagAdmin),\n    flagDueFattori: normalizeBooleanFlag(utente.flagDueFattori),\n    passwordlessLoginEnabled: normalizeBooleanFlag(utente.passwordlessLoginEnabled),\n  };\n\n  return {\n    ...basePayload,\n    codiceUtente: normalizedUser.codiceUtente,\n    email: normalizedUser.email,\n    statoRegistrazione: normalizedUser.statoRegistrazione,\n    flagSuper: normalizedUser.flagSuper,\n    flagAdmin: normalizedUser.flagAdmin,\n    flagDueFattori: normalizedUser.flagDueFattori,\n    passwordlessLoginEnabled: normalizedUser.passwordlessLoginEnabled,\n    passwordLoginEnabled: normalizedUser.passwordLoginEnabled,\n    utente: normalizedUser,\n    userData: {\n      ...userData,\n      utente: normalizedUser,\n    },\n    tokenPayload: decoded,\n  };\n}\n\n/** Enabling 2FA invalidates sessions which have not completed the required verification. */\nexport function isAccessiTokenAllowedForUser(decoded: unknown, user: AccessiAuthenticatedUserSnapshot): boolean {\n  if (!isRecord(decoded)) return false;\n  const methods = Array.isArray(decoded.amr) ? decoded.amr : [];\n  if (user.flagDueFattori && !methods.includes('otp')) return false;\n  if (methods.includes('passwordless') && (!user.flagDueFattori || !user.passwordlessLoginEnabled)) return false;\n  return true;\n}\n\n/** Un JWT puo essere usato soltanto da utenti nello stato confermato, indipendentemente dalla sua scadenza. */\nexport function isAuthenticatedUserEnabledForJwt(\n  utente: AccessiAuthenticatedUserSnapshot | null | undefined,\n): utente is AccessiAuthenticatedUserSnapshot {\n  return utente?.statoRegistrazione === StatoRegistrazione.CONF;\n}\n"]}

package/dist/accessi-module/security/emailConfiguration.d.ts

@@ -0,0 +1,20 @@
+import { BadRequestException } from '@nestjs/common';
+import type { AccessiOptions } from '../AccessiModule';
+/** Codice stabile usato nel contratto errore quando manca la configurazione email. */
+export declare const ACCESSI_EMAIL_NOT_CONFIGURED = "ACCESSI_EMAIL_NOT_CONFIGURED";
+/**
+ * Errore sollevato quando un'operazione richiede l'invio di email (reset password, 2FA,
+ * creazione utente) ma `AccessiOptions.emailOptions` non e configurato. E' una BadRequestException
+ * con un `code` stabile, cosi il contratto HTTP risponde 400 con ACCESSI_EMAIL_NOT_CONFIGURED.
+ */
+export declare class AccessiEmailNotConfiguredError extends BadRequestException {
+    get code(): string;
+    constructor(message?: string);
+}
+/**
+ * True se `emailOptions` contiene i campi minimi per inviare posta (host SMTP e mittente).
+ * Non verifica la raggiungibilita del server: quella si scopre all'invio.
+ */
+export declare function isEmailConfigured(options: AccessiOptions): boolean;
+/** Fail-fast utilizzato dal bootstrap e dalle operazioni che dipendono dalla posta. */
+export declare function assertEmailConfigured(options: AccessiOptions): void;

package/dist/accessi-module/security/emailConfiguration.js

@@ -0,0 +1,41 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AccessiEmailNotConfiguredError = exports.ACCESSI_EMAIL_NOT_CONFIGURED = void 0;
+exports.isEmailConfigured = isEmailConfigured;
+exports.assertEmailConfigured = assertEmailConfigured;
+const common_1 = require("@nestjs/common");
+/** Codice stabile usato nel contratto errore quando manca la configurazione email. */
+exports.ACCESSI_EMAIL_NOT_CONFIGURED = 'ACCESSI_EMAIL_NOT_CONFIGURED';
+/**
+ * Errore sollevato quando un'operazione richiede l'invio di email (reset password, 2FA,
+ * creazione utente) ma `AccessiOptions.emailOptions` non e configurato. E' una BadRequestException
+ * con un `code` stabile, cosi il contratto HTTP risponde 400 con ACCESSI_EMAIL_NOT_CONFIGURED.
+ */
+class AccessiEmailNotConfiguredError extends common_1.BadRequestException {
+    get code() {
+        return exports.ACCESSI_EMAIL_NOT_CONFIGURED;
+    }
+    constructor(message = 'Nessun servizio email configurato (AccessiOptions.emailOptions): impossibile inviare email di reset password o 2FA.') {
+        super({ code: exports.ACCESSI_EMAIL_NOT_CONFIGURED, message });
+        this.name = 'AccessiEmailNotConfiguredError';
+    }
+}
+exports.AccessiEmailNotConfiguredError = AccessiEmailNotConfiguredError;
+/**
+ * True se `emailOptions` contiene i campi minimi per inviare posta (host SMTP e mittente).
+ * Non verifica la raggiungibilita del server: quella si scopre all'invio.
+ */
+function isEmailConfigured(options) {
+    const email = options === null || options === void 0 ? void 0 : options.emailOptions;
+    if (!email)
+        return false;
+    return typeof email.host === 'string' && email.host.trim() !== ''
+        && typeof email.from === 'string' && email.from.trim() !== '';
+}
+/** Fail-fast utilizzato dal bootstrap e dalle operazioni che dipendono dalla posta. */
+function assertEmailConfigured(options) {
+    if (!isEmailConfigured(options)) {
+        throw new AccessiEmailNotConfiguredError();
+    }
+}
+//# sourceMappingURL=emailConfiguration.js.map

package/dist/accessi-module/security/emailConfiguration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emailConfiguration.js","sourceRoot":"","sources":["../../../src/accessi-module/security/emailConfiguration.ts"],"names":[],"mappings":";;;AA0BA,8CAKC;AAGD,sDAIC;AAtCD,2CAAqD;AAGrD,sFAAsF;AACzE,QAAA,4BAA4B,GAAG,8BAA8B,CAAC;AAE3E;;;;GAIG;AACH,MAAa,8BAA+B,SAAQ,4BAAmB;IACrE,IAAW,IAAI;QACb,OAAO,oCAA4B,CAAC;IACtC,CAAC;IAED,YAAY,OAAO,GAAG,qHAAqH;QACzI,KAAK,CAAC,EAAE,IAAI,EAAE,oCAA4B,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC/C,CAAC;CACF;AATD,wEASC;AAED;;;GAGG;AACH,SAAgB,iBAAiB,CAAC,OAAuB;IACvD,MAAM,KAAK,GAAG,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,YAA8D,CAAC;IACtF,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,OAAO,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE;WAC5D,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;AAClE,CAAC;AAED,uFAAuF;AACvF,SAAgB,qBAAqB,CAAC,OAAuB;IAC3D,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,8BAA8B,EAAE,CAAC;IAC7C,CAAC;AACH,CAAC","sourcesContent":["import { BadRequestException } from '@nestjs/common';\nimport type { AccessiOptions } from '../AccessiModule';\n\n/** Codice stabile usato nel contratto errore quando manca la configurazione email. */\nexport const ACCESSI_EMAIL_NOT_CONFIGURED = 'ACCESSI_EMAIL_NOT_CONFIGURED';\n\n/**\n * Errore sollevato quando un'operazione richiede l'invio di email (reset password, 2FA,\n * creazione utente) ma `AccessiOptions.emailOptions` non e configurato. E' una BadRequestException\n * con un `code` stabile, cosi il contratto HTTP risponde 400 con ACCESSI_EMAIL_NOT_CONFIGURED.\n */\nexport class AccessiEmailNotConfiguredError extends BadRequestException {\n  public get code(): string {\n    return ACCESSI_EMAIL_NOT_CONFIGURED;\n  }\n\n  constructor(message = 'Nessun servizio email configurato (AccessiOptions.emailOptions): impossibile inviare email di reset password o 2FA.') {\n    super({ code: ACCESSI_EMAIL_NOT_CONFIGURED, message });\n    this.name = 'AccessiEmailNotConfiguredError';\n  }\n}\n\n/**\n * True se `emailOptions` contiene i campi minimi per inviare posta (host SMTP e mittente).\n * Non verifica la raggiungibilita del server: quella si scopre all'invio.\n */\nexport function isEmailConfigured(options: AccessiOptions): boolean {\n  const email = options?.emailOptions as { host?: unknown; from?: unknown } | undefined;\n  if (!email) return false;\n  return typeof email.host === 'string' && email.host.trim() !== ''\n    && typeof email.from === 'string' && email.from.trim() !== '';\n}\n\n/** Fail-fast utilizzato dal bootstrap e dalle operazioni che dipendono dalla posta. */\nexport function assertEmailConfigured(options: AccessiOptions): void {\n  if (!isEmailConfigured(options)) {\n    throw new AccessiEmailNotConfiguredError();\n  }\n}\n"]}

package/dist/accessi-module/security/passwordResetToken.d.ts

@@ -1,7 +1,17 @@
-import { AccessiOptions } from '../AccessiModule';
+import * as jwt from 'jsonwebtoken';
+import type { AccessiOptions } from '../AccessiModule';
+/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */
 export declare const DEFAULT_PASSWORD_RESET_EXPIRES_IN = "1h";
-export declare function getAccessiJwtSecret(options: AccessiOptions): string;
-export declare function createPasswordResetToken(codiceUtente: number, nonce: string, secret: string, expiresIn?: string): string;
+/** Scopo della chiave derivata: separa le chiavi di access token, reset password e 2FA. */
+export type AccessiJwtPurpose = 'access' | 'reset' | '2fa';
+/**
+ * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).
+ * Un leak della chiave di reset non compromette gli access token e viceversa.
+ */
+export declare function getAccessiJwtSecret(options: AccessiOptions, purpose?: AccessiJwtPurpose): string;
+/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */
+export declare function createPasswordResetToken(codiceUtente: number, nonce: string, secret: string, expiresIn?: jwt.SignOptions['expiresIn']): string;
+/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */
 export declare function verifyPasswordResetToken(token: string, secret: string): {
     codiceUtente: number;
     nonce: string;

package/dist/accessi-module/security/passwordResetToken.js

@@ -38,15 +38,22 @@ exports.getAccessiJwtSecret = getAccessiJwtSecret;
 exports.createPasswordResetToken = createPasswordResetToken;
 exports.verifyPasswordResetToken = verifyPasswordResetToken;
 const jwt = __importStar(require("jsonwebtoken"));
+const crypto_1 = require("crypto");
+/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */
 exports.DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';
-function getAccessiJwtSecret(options) {
+/**
+ * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).
+ * Un leak della chiave di reset non compromette gli access token e viceversa.
+ */
+function getAccessiJwtSecret(options, purpose = 'access') {
     var _a;
     const secret = ((_a = options === null || options === void 0 ? void 0 : options.jwtOptions) === null || _a === void 0 ? void 0 : _a.secret) || process.env.ACC_JWT_SECRET;
     if (!secret) {
         throw new Error('JWT secret non configurato.');
     }
-    return secret;
+    return (0, crypto_1.createHmac)('sha256', secret).update(`accessi:jwt:${purpose}:v1`).digest('hex');
 }
+/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */
 function createPasswordResetToken(codiceUtente, nonce, secret, expiresIn = exports.DEFAULT_PASSWORD_RESET_EXPIRES_IN) {
     if (!codiceUtente || !nonce) {
         throw new Error('Dati insufficienti per generare il reset token.');
@@ -56,13 +63,14 @@ function createPasswordResetToken(codiceUtente, nonce, secret, expiresIn = expor
         typ: 'password-reset',
     }, secret, {
         subject: `${codiceUtente}`,
-        expiresIn: expiresIn,
+        expiresIn,
     });
 }
+/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */
 function verifyPasswordResetToken(token, secret) {
-    const decoded = jwt.verify(token, secret);
+    const decoded = jwt.verify(token, secret, { algorithms: ['HS256'] });
     const codiceUtente = Number(decoded === null || decoded === void 0 ? void 0 : decoded.sub);
-    if ((decoded === null || decoded === void 0 ? void 0 : decoded.typ) !== 'password-reset' || !codiceUtente || typeof (decoded === null || decoded === void 0 ? void 0 : decoded.nonce) !== 'string') {
+    if ((decoded === null || decoded === void 0 ? void 0 : decoded.typ) !== 'password-reset' || !Number.isSafeInteger(codiceUtente) || codiceUtente <= 0 || typeof (decoded === null || decoded === void 0 ? void 0 : decoded.nonce) !== 'string' || !decoded.nonce) {
         throw new Error('Token di reset non valido.');
     }
     return {

package/dist/accessi-module/security/passwordResetToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"passwordResetToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,kDAOC;AAED,4DAqBC;AAED,4DAeC;AAzDD,kDAAoC;AAGvB,QAAA,iCAAiC,GAAG,IAAI,CAAC;AAOtD,SAAgB,mBAAmB,CAAC,OAAuB;;IACzD,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,KAAa,EACb,MAAc,EACd,YAAoB,yCAAiC;IAErD,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CACb;QACE,KAAK;QACL,GAAG,EAAE,gBAAgB;KACtB,EACD,MAAM,EACN;QACE,OAAO,EAAE,GAAG,YAAY,EAAE;QAC1B,SAAS,EAAE,SAAgB;KAC5B,CACF,CAAC;AACJ,CAAC;AAED,SAAgB,wBAAwB,CACtC,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAA8B,CAAC;IACvE,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,MAAK,gBAAgB,IAAI,CAAC,YAAY,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,EAAE,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import * as jwt from 'jsonwebtoken';\r\nimport { AccessiOptions } from '../AccessiModule';\r\n\r\nexport const DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';\r\n\r\ninterface PasswordResetTokenPayload extends jwt.JwtPayload {\r\n  nonce: string;\r\n  typ: 'password-reset';\r\n}\r\n\r\nexport function getAccessiJwtSecret(options: AccessiOptions): string {\r\n  const secret = options?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\r\n  if (!secret) {\r\n    throw new Error('JWT secret non configurato.');\r\n  }\r\n\r\n  return secret;\r\n}\r\n\r\nexport function createPasswordResetToken(\r\n  codiceUtente: number,\r\n  nonce: string,\r\n  secret: string,\r\n  expiresIn: string = DEFAULT_PASSWORD_RESET_EXPIRES_IN,\r\n): string {\r\n  if (!codiceUtente || !nonce) {\r\n    throw new Error('Dati insufficienti per generare il reset token.');\r\n  }\r\n\r\n  return jwt.sign(\r\n    {\r\n      nonce,\r\n      typ: 'password-reset',\r\n    },\r\n    secret,\r\n    {\r\n      subject: `${codiceUtente}`,\r\n      expiresIn: expiresIn as any,\r\n    },\r\n  );\r\n}\r\n\r\nexport function verifyPasswordResetToken(\r\n  token: string,\r\n  secret: string,\r\n): { codiceUtente: number; nonce: string } {\r\n  const decoded = jwt.verify(token, secret) as PasswordResetTokenPayload;\r\n  const codiceUtente = Number(decoded?.sub);\r\n\r\n  if (decoded?.typ !== 'password-reset' || !codiceUtente || typeof decoded?.nonce !== 'string') {\r\n    throw new Error('Token di reset non valido.');\r\n  }\r\n\r\n  return {\r\n    codiceUtente,\r\n    nonce: decoded.nonce,\r\n  };\r\n}\r\n"]}
+{"version":3,"file":"passwordResetToken.js","sourceRoot":"","sources":["../../../src/accessi-module/security/passwordResetToken.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,kDAOC;AAGD,4DAqBC;AAGD,4DAeC;AApED,kDAAoC;AACpC,mCAAoC;AAGpC,mHAAmH;AACtG,QAAA,iCAAiC,GAAG,IAAI,CAAC;AAUtD;;;GAGG;AACH,SAAgB,mBAAmB,CAAC,OAAuB,EAAE,UAA6B,QAAQ;;IAChG,MAAM,MAAM,GAAG,CAAA,MAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IACzE,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,eAAe,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxF,CAAC;AAED,oHAAoH;AACpH,SAAgB,wBAAwB,CACtC,YAAoB,EACpB,KAAa,EACb,MAAc,EACd,YAA0C,yCAAiC;IAE3E,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,GAAG,CAAC,IAAI,CACb;QACE,KAAK;QACL,GAAG,EAAE,gBAAgB;KACtB,EACD,MAAM,EACN;QACE,OAAO,EAAE,GAAG,YAAY,EAAE;QAC1B,SAAS;KACV,CACF,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAgB,wBAAwB,CACtC,KAAa,EACb,MAAc;IAEd,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAA8B,CAAC;IAClG,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,CAAC,CAAC;IAE1C,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,GAAG,MAAK,gBAAgB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,IAAI,OAAO,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,KAAK,CAAA,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC1J,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAC,KAAK;KACrB,CAAC;AACJ,CAAC","sourcesContent":["import * as jwt from 'jsonwebtoken';\nimport { createHmac } from 'crypto';\nimport type { AccessiOptions } from '../AccessiModule';\n\n/** Durata predefinita del token di reset. La monouso e garantita anche dal nonce persistito in `UTENTI.KEYREG`. */\nexport const DEFAULT_PASSWORD_RESET_EXPIRES_IN = '1h';\n\ninterface PasswordResetTokenPayload extends jwt.JwtPayload {\n  nonce: string;\n  typ: 'password-reset';\n}\n\n/** Scopo della chiave derivata: separa le chiavi di access token, reset password e 2FA. */\nexport type AccessiJwtPurpose = 'access' | 'reset' | '2fa';\n\n/**\n * Deriva una chiave JWT per scopo dal segreto configurato (key separation senza nuova configurazione).\n * Un leak della chiave di reset non compromette gli access token e viceversa.\n */\nexport function getAccessiJwtSecret(options: AccessiOptions, purpose: AccessiJwtPurpose = 'access'): string {\n  const secret = options?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\n  if (!secret) {\n    throw new Error('JWT secret non configurato.');\n  }\n\n  return createHmac('sha256', secret).update(`accessi:jwt:${purpose}:v1`).digest('hex');\n}\n\n/** Crea un token firmato contenente solo codice utente e nonce; non inserire email o dati personali nelle claim. */\nexport function createPasswordResetToken(\n  codiceUtente: number,\n  nonce: string,\n  secret: string,\n  expiresIn: jwt.SignOptions['expiresIn'] = DEFAULT_PASSWORD_RESET_EXPIRES_IN,\n): string {\n  if (!codiceUtente || !nonce) {\n    throw new Error('Dati insufficienti per generare il reset token.');\n  }\n\n  return jwt.sign(\n    {\n      nonce,\n      typ: 'password-reset',\n    },\n    secret,\n    {\n      subject: `${codiceUtente}`,\n      expiresIn,\n    },\n  );\n}\n\n/** Verifica firma e scadenza, quindi restituisce i dati minimi necessari al reset. */\nexport function verifyPasswordResetToken(\n  token: string,\n  secret: string,\n): { codiceUtente: number; nonce: string } {\n  const decoded = jwt.verify(token, secret, { algorithms: ['HS256'] }) as PasswordResetTokenPayload;\n  const codiceUtente = Number(decoded?.sub);\n\n  if (decoded?.typ !== 'password-reset' || !Number.isSafeInteger(codiceUtente) || codiceUtente <= 0 || typeof decoded?.nonce !== 'string' || !decoded.nonce) {\n    throw new Error('Token di reset non valido.');\n  }\n\n  return {\n    codiceUtente,\n    nonce: decoded.nonce,\n  };\n}\n"]}

package/dist/accessi-module/security/publicAuthRateLimit.d.ts

@@ -1,9 +1,9 @@
 import { Request, Response } from 'express';
-import { AccessiOptions } from '../AccessiModule';
-export type PublicAuthRateLimitScope = 'login' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken';
+import type { AccessiOptions } from '../AccessiModule';
+export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken' | 'adminBootstrap';
 type RateLimitDecision = {
     allowed: boolean;
-    retryAfterSeconds?: number;
+    retryAfterSeconds: number;
 };
 export declare function checkPublicAuthRateLimit(options: AccessiOptions, scope: PublicAuthRateLimitScope, req: Request, identifiers?: string[]): RateLimitDecision;
 export declare function sendPublicAuthRateLimitExceeded(res: Response, retryAfterSeconds: number): Response;

package/dist/accessi-module/security/publicAuthRateLimit.js

@@ -6,10 +6,13 @@ const common_1 = require("@nestjs/common");
 const Utilities_1 = require("../../Utilities");
 const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
+    twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },
+    twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },
     register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },
     passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
     getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
+    adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
 };
 const RATE_LIMIT_BUCKETS = new Map();
 const MAX_TRACKED_BUCKETS = 20000;
@@ -49,9 +52,27 @@ function pruneRateLimitBuckets(now) {
         }
     }
 }
+/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */
+function enforceBucketCap() {
+    while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {
+        let oldestKey;
+        let oldestSeen = Number.POSITIVE_INFINITY;
+        for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {
+            if (bucket.lastSeenAt < oldestSeen) {
+                oldestSeen = bucket.lastSeenAt;
+                oldestKey = key;
+            }
+        }
+        if (oldestKey === undefined) {
+            return;
+        }
+        RATE_LIMIT_BUCKETS.delete(oldestKey);
+    }
+}
 function consumeBucket(bucketKey, rule, now) {
     const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);
     if (!existingBucket || existingBucket.resetAt <= now) {
+        enforceBucketCap();
         RATE_LIMIT_BUCKETS.set(bucketKey, {
             count: 1,
             resetAt: now + rule.windowMs,
@@ -69,23 +90,25 @@ function consumeBucket(bucketKey, rule, now) {
 function checkPublicAuthRateLimit(options, scope, req, identifiers = []) {
     var _a, _b, _c, _d, _e;
     if (((_a = options.publicAuthRateLimit) === null || _a === void 0 ? void 0 : _a.enabled) === false) {
-        return { allowed: true };
+        return { allowed: true, retryAfterSeconds: 0 };
     }
     const rule = getRule(options, scope);
     const now = Date.now();
     pruneRateLimitBuckets(now);
     const ipAddress = (_e = normalizeIdentifier((_d = (_b = req.ip) !== null && _b !== void 0 ? _b : (_c = req.socket) === null || _c === void 0 ? void 0 : _c.remoteAddress) !== null && _d !== void 0 ? _d : 'unknown')) !== null && _e !== void 0 ? _e : 'unknown';
-    const bucketKeys = new Set([`${scope}|ip|${ipAddress}`]);
+    // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,
+    // evitando crescita di memoria con identificatori sempre diversi.
+    const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);
+    if (ipRetryAfterSeconds) {
+        return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };
+    }
+    let retryAfterSeconds = 0;
     for (const identifier of identifiers) {
         const normalizedIdentifier = normalizeIdentifier(identifier);
         if (!normalizedIdentifier) {
             continue;
         }
-        bucketKeys.add(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`);
-    }
-    let retryAfterSeconds = 0;
-    for (const bucketKey of bucketKeys) {
-        const bucketRetryAfterSeconds = consumeBucket(bucketKey, rule, now);
+        const bucketRetryAfterSeconds = consumeBucket(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`, rule, now);
         if (bucketRetryAfterSeconds) {
             retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);
         }
@@ -96,7 +119,7 @@ function checkPublicAuthRateLimit(options, scope, req, identifiers = []) {
             retryAfterSeconds,
         };
     }
-    return { allowed: true };
+    return { allowed: true, retryAfterSeconds: 0 };
 }
 function sendPublicAuthRateLimitExceeded(res, retryAfterSeconds) {
     res.setHeader('Retry-After', String(retryAfterSeconds));

package/dist/accessi-module/security/publicAuthRateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA+GA,4DA2CC;AAED,0EAWC;AAvKD,2CAA4C;AAE5C,+CAAgD;AAqBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC7D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IACrF,MAAM,UAAU,GAAG,IAAI,GAAG,CAAS,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC;IAEjE,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,UAAU,CAAC,GAAG,CAAC,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,CAAC,CAAC;IAC7E,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,uBAAuB,GAAG,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACpE,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\r\nimport { Request, Response } from 'express';\r\nimport { RestUtilities } from '../../Utilities';\r\nimport { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\r\n\r\nexport type PublicAuthRateLimitScope =\r\n  | 'login'\r\n  | 'register'\r\n  | 'passwordResetEmail'\r\n  | 'passwordResetConfirm'\r\n  | 'getUserByToken';\r\n\r\ntype RateLimitBucket = {\r\n  count: number;\r\n  resetAt: number;\r\n  lastSeenAt: number;\r\n};\r\n\r\ntype RateLimitDecision = {\r\n  allowed: boolean;\r\n  retryAfterSeconds?: number;\r\n};\r\n\r\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\r\n  PublicAuthRateLimitScope,\r\n  PublicAuthRateLimitRuleOptions\r\n> = {\r\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\r\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\r\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\r\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\r\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\r\n};\r\n\r\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\r\nconst MAX_TRACKED_BUCKETS = 20000;\r\nconst MAX_WINDOW_MS = Math.max(\r\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\r\n);\r\n\r\nfunction getRule(\r\n  options: AccessiOptions,\r\n  scope: PublicAuthRateLimitScope,\r\n): PublicAuthRateLimitRuleOptions {\r\n  const configuredRule = options.publicAuthRateLimit?.[scope];\r\n\r\n  if (\r\n    configuredRule &&\r\n    Number.isFinite(configuredRule.windowMs) &&\r\n    configuredRule.windowMs > 0 &&\r\n    Number.isFinite(configuredRule.maxAttempts) &&\r\n    configuredRule.maxAttempts > 0\r\n  ) {\r\n    return {\r\n      windowMs: Math.trunc(configuredRule.windowMs),\r\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\r\n    };\r\n  }\r\n\r\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\r\n}\r\n\r\nfunction normalizeIdentifier(identifier: string): string | null {\r\n  if (typeof identifier !== 'string') {\r\n    return null;\r\n  }\r\n\r\n  const normalized = identifier.trim().toLowerCase();\r\n  return normalized === '' ? null : normalized;\r\n}\r\n\r\nfunction pruneRateLimitBuckets(now: number): void {\r\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\r\n    return;\r\n  }\r\n\r\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\r\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\r\n      RATE_LIMIT_BUCKETS.delete(key);\r\n    }\r\n\r\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\r\n      return;\r\n    }\r\n  }\r\n}\r\n\r\nfunction consumeBucket(\r\n  bucketKey: string,\r\n  rule: PublicAuthRateLimitRuleOptions,\r\n  now: number,\r\n): number | null {\r\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\r\n  if (!existingBucket || existingBucket.resetAt <= now) {\r\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\r\n      count: 1,\r\n      resetAt: now + rule.windowMs,\r\n      lastSeenAt: now,\r\n    });\r\n    return null;\r\n  }\r\n\r\n  existingBucket.lastSeenAt = now;\r\n  if (existingBucket.count >= rule.maxAttempts) {\r\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\r\n  }\r\n\r\n  existingBucket.count += 1;\r\n  return null;\r\n}\r\n\r\nexport function checkPublicAuthRateLimit(\r\n  options: AccessiOptions,\r\n  scope: PublicAuthRateLimitScope,\r\n  req: Request,\r\n  identifiers: string[] = [],\r\n): RateLimitDecision {\r\n  if (options.publicAuthRateLimit?.enabled === false) {\r\n    return { allowed: true };\r\n  }\r\n\r\n  const rule = getRule(options, scope);\r\n  const now = Date.now();\r\n  pruneRateLimitBuckets(now);\r\n\r\n  const ipAddress =\r\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\r\n  const bucketKeys = new Set<string>([`${scope}|ip|${ipAddress}`]);\r\n\r\n  for (const identifier of identifiers) {\r\n    const normalizedIdentifier = normalizeIdentifier(identifier);\r\n    if (!normalizedIdentifier) {\r\n      continue;\r\n    }\r\n\r\n    bucketKeys.add(`${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`);\r\n  }\r\n\r\n  let retryAfterSeconds = 0;\r\n  for (const bucketKey of bucketKeys) {\r\n    const bucketRetryAfterSeconds = consumeBucket(bucketKey, rule, now);\r\n    if (bucketRetryAfterSeconds) {\r\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\r\n    }\r\n  }\r\n\r\n  if (retryAfterSeconds > 0) {\r\n    return {\r\n      allowed: false,\r\n      retryAfterSeconds,\r\n    };\r\n  }\r\n\r\n  return { allowed: true };\r\n}\r\n\r\nexport function sendPublicAuthRateLimitExceeded(\r\n  res: Response,\r\n  retryAfterSeconds: number,\r\n): Response {\r\n  res.setHeader('Retry-After', String(retryAfterSeconds));\r\n  return RestUtilities.sendErrorMessage(\r\n    res,\r\n    'Troppi tentativi. Riprova piu tardi.',\r\n    'PublicAuthRateLimit',\r\n    HttpStatus.TOO_MANY_REQUESTS,\r\n  );\r\n}\r\n"]}
+{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA2IA,4DAiDC;AAED,0EAWC;AAzMD,2CAA4C;AAE5C,+CAAgD;AAwBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC9D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IAErF,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,aAAa,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,uBAAuB,GAAG,aAAa,CAC3C,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,EACJ,GAAG,CACJ,CAAC;QACF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\n\nexport type PublicAuthRateLimitScope =\n  | 'login'\n  | 'twoFactorVerify'\n  | 'twoFactorResend'\n  | 'register'\n  | 'passwordResetEmail'\n  | 'passwordResetConfirm'\n  | 'getUserByToken'\n  | 'adminBootstrap';\n\ntype RateLimitBucket = {\n  count: number;\n  resetAt: number;\n  lastSeenAt: number;\n};\n\ntype RateLimitDecision = {\n  allowed: boolean;\n  retryAfterSeconds: number;\n};\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n  PublicAuthRateLimitScope,\n  PublicAuthRateLimitRuleOptions\n> = {\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n  twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n  adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n};\n\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\nconst MAX_TRACKED_BUCKETS = 20000;\nconst MAX_WINDOW_MS = Math.max(\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\n);\n\nfunction getRule(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n  const configuredRule = options.publicAuthRateLimit?.[scope];\n\n  if (\n    configuredRule &&\n    Number.isFinite(configuredRule.windowMs) &&\n    configuredRule.windowMs > 0 &&\n    Number.isFinite(configuredRule.maxAttempts) &&\n    configuredRule.maxAttempts > 0\n  ) {\n    return {\n      windowMs: Math.trunc(configuredRule.windowMs),\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\n    };\n  }\n\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nfunction normalizeIdentifier(identifier: string): string | null {\n  if (typeof identifier !== 'string') {\n    return null;\n  }\n\n  const normalized = identifier.trim().toLowerCase();\n  return normalized === '' ? null : normalized;\n}\n\nfunction pruneRateLimitBuckets(now: number): void {\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n    return;\n  }\n\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\n      RATE_LIMIT_BUCKETS.delete(key);\n    }\n\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n      return;\n    }\n  }\n}\n\n/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */\nfunction enforceBucketCap(): void {\n  while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {\n    let oldestKey: string | undefined;\n    let oldestSeen = Number.POSITIVE_INFINITY;\n\n    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n      if (bucket.lastSeenAt < oldestSeen) {\n        oldestSeen = bucket.lastSeenAt;\n        oldestKey = key;\n      }\n    }\n\n    if (oldestKey === undefined) {\n      return;\n    }\n\n    RATE_LIMIT_BUCKETS.delete(oldestKey);\n  }\n}\n\nfunction consumeBucket(\n  bucketKey: string,\n  rule: PublicAuthRateLimitRuleOptions,\n  now: number,\n): number | null {\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\n  if (!existingBucket || existingBucket.resetAt <= now) {\n    enforceBucketCap();\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\n      count: 1,\n      resetAt: now + rule.windowMs,\n      lastSeenAt: now,\n    });\n    return null;\n  }\n\n  existingBucket.lastSeenAt = now;\n  if (existingBucket.count >= rule.maxAttempts) {\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\n  }\n\n  existingBucket.count += 1;\n  return null;\n}\n\nexport function checkPublicAuthRateLimit(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n  req: Request,\n  identifiers: string[] = [],\n): RateLimitDecision {\n  if (options.publicAuthRateLimit?.enabled === false) {\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  const rule = getRule(options, scope);\n  const now = Date.now();\n  pruneRateLimitBuckets(now);\n\n  const ipAddress =\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n  // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n  // evitando crescita di memoria con identificatori sempre diversi.\n  const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);\n  if (ipRetryAfterSeconds) {\n    return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };\n  }\n\n  let retryAfterSeconds = 0;\n  for (const identifier of identifiers) {\n    const normalizedIdentifier = normalizeIdentifier(identifier);\n    if (!normalizedIdentifier) {\n      continue;\n    }\n\n    const bucketRetryAfterSeconds = consumeBucket(\n      `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`,\n      rule,\n      now,\n    );\n    if (bucketRetryAfterSeconds) {\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\n    }\n  }\n\n  if (retryAfterSeconds > 0) {\n    return {\n      allowed: false,\n      retryAfterSeconds,\n    };\n  }\n\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n  res: Response,\n  retryAfterSeconds: number,\n): Response {\n  res.setHeader('Retry-After', String(retryAfterSeconds));\n  return RestUtilities.sendErrorMessage(\n    res,\n    'Troppi tentativi. Riprova piu tardi.',\n    'PublicAuthRateLimit',\n    HttpStatus.TOO_MANY_REQUESTS,\n  );\n}\n"]}

package/dist/accessi-module/security/serviceTokenGuard.d.ts

@@ -0,0 +1,25 @@
+import { CanActivate, ExecutionContext } from '@nestjs/common';
+import { Reflector } from '@nestjs/core';
+import type { Request } from 'express';
+import { ServiceTokenService, VerifiedServiceToken } from '../Services/ServiceTokenService/ServiceTokenService';
+/** Chiave dei metadata usata da `@RequireServiceTokenScopes`. */
+export declare const SERVICE_TOKEN_SCOPES_METADATA = "accessi:service-token-scopes";
+/** Richiede che il token di servizio presenti tutti gli scope indicati. */
+export declare const RequireServiceTokenScopes: (...scopes: string[]) => import("@nestjs/common").CustomDecorator<string>;
+export type AccessiServiceTokenRequest = Request & {
+    accessiServiceToken?: VerifiedServiceToken;
+};
+/** Restituisce il token di servizio verificato da `ServiceTokenGuard`; lancia 401 se assente. */
+export declare function getAccessiServiceToken(req: Request): VerifiedServiceToken;
+/**
+ * Autentica le chiamate tecniche macchina-a-macchina tramite `Authorization: Bearer <token>`.
+ *
+ * Il token e per installazione/servizio, non legato a un utente. Gli scope richiesti si dichiarano
+ * con `@RequireServiceTokenScopes('ia')`.
+ */
+export declare class ServiceTokenGuard implements CanActivate {
+    private readonly serviceTokenService;
+    private readonly reflector;
+    constructor(serviceTokenService: ServiceTokenService, reflector: Reflector);
+    canActivate(context: ExecutionContext): Promise<boolean>;
+}