emilsoftware-utilities 2.0.0-dev.4 → 2.0.0-dev.41

package/dist/accessi-module/database-updates/optionalColumns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"optionalColumns.js","sourceRoot":"","sources":["../../../src/accessi-module/database-updates/optionalColumns.ts"],"names":[],"mappings":";;;;;;;;;;;AAoBA,wDAEC;AAGD,0CAqBC;AAGD,wCAEC;AAlDD,mCAAgC;AAIhC;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,KAAM,CAAC;AACnC,MAAM,wBAAwB,GAAG,GAAG,CAAC;AACrC,MAAM,WAAW,GAAG,IAAI,GAAG,EAA4B,CAAC;AAExD,SAAS,QAAQ,CAAC,OAAuB,EAAE,KAAa;;IACtD,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC;IACnC,OAAO,CAAC,MAAA,EAAE,CAAC,IAAI,mCAAI,EAAE,EAAE,MAAA,EAAE,CAAC,IAAI,mCAAI,EAAE,EAAE,MAAA,EAAE,CAAC,QAAQ,mCAAI,EAAE,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,yEAAyE;AACzE,SAAgB,sBAAsB;IACpC,WAAW,CAAC,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,uGAAuG;AACvG,SAAsB,eAAe,CAAC,OAAuB,EAAE,KAAa;;QAC1E,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,IAAI,MAAM,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;YACrC,OAAO,MAAM,CAAC,OAAO,CAAC;QACxB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,EAClD,iGAAiG,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC,CAAC;QACrH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAA4B,EAAE,EAAE,WAAC,OAAA,MAAM,CAAC,MAAA,GAAG,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA,EAAA,CAAC,CAAC,CAAC;QAE1G,IAAI,WAAW,CAAC,IAAI,IAAI,wBAAwB,EAAE,CAAC;YACjD,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAClD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC5B,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;QACD,WAAW,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,GAAG,mBAAmB,EAAE,CAAC,CAAC;QAExE,OAAO,OAAO,CAAC;IACjB,CAAC;CAAA;AAED,4FAA4F;AAC5F,SAAgB,cAAc,CAAC,OAAoB,EAAE,IAAY,EAAE,UAAkB,EAAE,WAAmB,EAAE,OAAO,GAAG,IAAI;IACxH,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,UAAU,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,gBAAgB,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,GAAG,OAAO,WAAW,EAAE,CAAC;AACtI,CAAC","sourcesContent":["import type { AccessiOptions } from '../AccessiModule';\nimport { Orm } from '../../Orm';\n\ntype ColumnCacheEntry = { columns: Set<string>; expiresAt: number };\n\n/**\n * I metadati delle colonne sono letti di rado ma usati a ogni operazione. Una cache a breve TTL\n * evita una query di introspezione per richiesta; il TTL limita la finestra di staleness se lo\n * schema viene esteso a runtime (le migrazioni girano comunque al bootstrap).\n */\nconst COLUMN_CACHE_TTL_MS = 60_000;\nconst COLUMN_CACHE_MAX_ENTRIES = 100;\nconst columnCache = new Map<string, ColumnCacheEntry>();\n\nfunction cacheKey(options: AccessiOptions, table: string): string {\n  const db = options.databaseOptions;\n  return [db.host ?? '', db.port ?? '', db.database ?? '', table.toUpperCase()].join('|');\n}\n\n/** Invalida la cache dei metadati (usata dopo migrazioni o nei test). */\nexport function clearTableColumnsCache(): void {\n  columnCache.clear();\n}\n\n/** Metadata is read per operation so host-owned extensions can change without a stale global cache. */\nexport async function getTableColumns(options: AccessiOptions, table: string): Promise<Set<string>> {\n  const key = cacheKey(options, table);\n  const now = Date.now();\n  const cached = columnCache.get(key);\n  if (cached && cached.expiresAt > now) {\n    return cached.columns;\n  }\n\n  const rows = await Orm.query(options.databaseOptions,\n    'SELECT TRIM(RDB$FIELD_NAME) AS COLUMN_NAME FROM RDB$RELATION_FIELDS WHERE RDB$RELATION_NAME = ?', [table], false);\n  const columns = new Set(rows.map((row: Record<string, unknown>) => String(row.COLUMN_NAME ?? '').trim()));\n\n  if (columnCache.size >= COLUMN_CACHE_MAX_ENTRIES) {\n    const oldestKey = columnCache.keys().next().value;\n    if (oldestKey !== undefined) {\n      columnCache.delete(oldestKey);\n    }\n  }\n  columnCache.set(key, { columns, expiresAt: now + COLUMN_CACHE_TTL_MS });\n\n  return columns;\n}\n\n/** Arguments come exclusively from the library's fixed field mappings, never HTTP input. */\nexport function optionalColumn(columns: Set<string>, name: string, tableAlias: string, outputAlias: string, numeric = true): string {\n  return `${columns.has(name) ? `${tableAlias}.${name}` : `CAST(NULL AS ${numeric ? 'INTEGER' : 'VARCHAR(255)'})`} AS ${outputAlias}`;\n}\n"]}

package/dist/accessi-module/database-updates/runAccessiCatalogMigrations.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/accessi-module/database-updates/runAccessiCatalogMigrations.js

@@ -0,0 +1,69 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+const AccessiDatabaseUpdater_1 = require("./AccessiDatabaseUpdater");
+const AccessiCatalogMigrator_1 = require("./AccessiCatalogMigrator");
+const accessiOptionsFromEnv_1 = require("./accessiOptionsFromEnv");
+const Orm_1 = require("../../Orm");
+function main() {
+    return __awaiter(this, void 0, void 0, function* () {
+        var _a;
+        const options = (0, accessiOptionsFromEnv_1.createAccessiOptionsFromEnv)();
+        if (!((_a = options.catalogScripts) === null || _a === void 0 ? void 0 : _a.folder)) {
+            throw new Error("Variabile ambiente mancante: ACCESSI_CATALOG_FOLDER (cartella delle catalog migrations).");
+        }
+        const checkOnly = process.argv.includes('--check');
+        console.log(`[Accessi Catalog] Target: ${options.databaseOptions.host}:${options.databaseOptions.port} -> ${options.databaseOptions.database}`);
+        console.log(`[Accessi Catalog] Cartella: ${options.catalogScripts.folder}`);
+        // Prima lo schema si adegua, poi si eseguono gli script di catalogo.
+        if (!checkOnly) {
+            console.log('[Accessi Catalog] Riconciliazione schema...');
+            yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.run(options);
+        }
+        if (checkOnly) {
+            const pending = yield (0, AccessiCatalogMigrator_1.listPendingCatalogScripts)(options);
+            console.log(`[Accessi Catalog] Gia applicati: ${pending.applied.length}`);
+            console.log(`[Accessi Catalog] Da applicare: ${pending.pending.length}${pending.pending.length ? ` -> ${pending.pending.join(', ')}` : ''}`);
+            console.log(`[Accessi Catalog] Modificati (checksum diverso): ${pending.changed.length}${pending.changed.length ? ` -> ${pending.changed.join(', ')}` : ''}`);
+            console.log(`[Accessi Catalog] Non conformi (solo DML): ${pending.invalid.length}`);
+            for (const entry of pending.invalid) {
+                for (const violation of entry.violations)
+                    console.error(`[Accessi Catalog] Non conforme: ${entry.script} -> ${violation}`);
+            }
+            if (pending.invalid.length)
+                process.exitCode = 1;
+            return;
+        }
+        const report = yield (0, AccessiCatalogMigrator_1.applyCatalogScripts)(options);
+        console.log(`[Accessi Catalog] Scoperti: ${report.discovered} | Applicati: ${report.applied.length} | Saltati: ${report.skipped.length} | Non conformi: ${report.invalid.length} | Falliti: ${report.failed.length}`);
+        if (report.applied.length)
+            console.log(`[Accessi Catalog] Applicati: ${report.applied.join(', ')}`);
+        for (const entry of report.invalid) {
+            for (const violation of entry.violations)
+                console.error(`[Accessi Catalog] Non conforme: ${entry.script} -> ${violation}`);
+        }
+        if (report.failed.length) {
+            for (const failure of report.failed)
+                console.error(`[Accessi Catalog] Fallito: ${failure.script} -> ${failure.error}`);
+        }
+        if (report.failed.length || report.invalid.length)
+            process.exitCode = 1;
+    });
+}
+main()
+    .then(() => Orm_1.Orm.closePools())
+    .then(() => { var _a; return process.exit((_a = process.exitCode) !== null && _a !== void 0 ? _a : 0); })
+    .catch((error) => __awaiter(void 0, void 0, void 0, function* () {
+    console.error("[Accessi Catalog] Errore durante l'esecuzione:", error);
+    yield Orm_1.Orm.closePools().catch(() => undefined);
+    process.exit(1);
+}));
+//# sourceMappingURL=runAccessiCatalogMigrations.js.map

package/dist/accessi-module/database-updates/runAccessiCatalogMigrations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"runAccessiCatalogMigrations.js","sourceRoot":"","sources":["../../../src/accessi-module/database-updates/runAccessiCatalogMigrations.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,qEAAkE;AAClE,qEAA0F;AAC1F,mEAAsE;AACtE,mCAAgC;AAEhC,SAAe,IAAI;;;QACjB,MAAM,OAAO,GAAG,IAAA,mDAA2B,GAAE,CAAC;QAC9C,IAAI,CAAC,CAAA,MAAA,OAAO,CAAC,cAAc,0CAAE,MAAM,CAAA,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,0FAA0F,CAAC,CAAC;QAC9G,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,6BAA6B,OAAO,CAAC,eAAe,CAAC,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,CAAC,CAAC;QAChJ,OAAO,CAAC,GAAG,CAAC,+BAA+B,OAAO,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC;QAE5E,qEAAqE;QACrE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,6CAA6C,CAAC,CAAC;YAC3D,MAAM,+CAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,MAAM,IAAA,kDAAyB,EAAC,OAAO,CAAC,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,oCAAoC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1E,OAAO,CAAC,GAAG,CAAC,mCAAmC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC7I,OAAO,CAAC,GAAG,CAAC,oDAAoD,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9J,OAAO,CAAC,GAAG,CAAC,8CAA8C,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACpF,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;gBACpC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU;oBAAE,OAAO,CAAC,KAAK,CAAC,mCAAmC,KAAK,CAAC,MAAM,OAAO,SAAS,EAAE,CAAC,CAAC;YAC7H,CAAC;YACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YACjD,OAAO;QACT,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAA,4CAAmB,EAAC,OAAO,CAAC,CAAC;QAClD,OAAO,CAAC,GAAG,CAAC,+BAA+B,MAAM,CAAC,UAAU,iBAAiB,MAAM,CAAC,OAAO,CAAC,MAAM,eAAe,MAAM,CAAC,OAAO,CAAC,MAAM,oBAAoB,MAAM,CAAC,OAAO,CAAC,MAAM,eAAe,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACtN,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,GAAG,CAAC,gCAAgC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACpG,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnC,KAAK,MAAM,SAAS,IAAI,KAAK,CAAC,UAAU;gBAAE,OAAO,CAAC,KAAK,CAAC,mCAAmC,KAAK,CAAC,MAAM,OAAO,SAAS,EAAE,CAAC,CAAC;QAC7H,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACzB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM;gBAAE,OAAO,CAAC,KAAK,CAAC,8BAA8B,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC;QACzH,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAC1E,CAAC;CAAA;AAED,IAAI,EAAE;KACH,IAAI,CAAC,GAAG,EAAE,CAAC,SAAG,CAAC,UAAU,EAAE,CAAC;KAC5B,IAAI,CAAC,GAAG,EAAE,WAAC,OAAA,OAAO,CAAC,IAAI,CAAC,MAAA,OAAO,CAAC,QAAQ,mCAAI,CAAC,CAAC,CAAA,EAAA,CAAC;KAC/C,KAAK,CAAC,CAAO,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,gDAAgD,EAAE,KAAK,CAAC,CAAC;IACvE,MAAM,SAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAA,CAAC,CAAC","sourcesContent":["import { AccessiDatabaseUpdater } from \"./AccessiDatabaseUpdater\";\nimport { applyCatalogScripts, listPendingCatalogScripts } from \"./AccessiCatalogMigrator\";\nimport { createAccessiOptionsFromEnv } from \"./accessiOptionsFromEnv\";\nimport { Orm } from \"../../Orm\";\n\nasync function main(): Promise<void> {\n  const options = createAccessiOptionsFromEnv();\n  if (!options.catalogScripts?.folder) {\n    throw new Error(\"Variabile ambiente mancante: ACCESSI_CATALOG_FOLDER (cartella delle catalog migrations).\");\n  }\n\n  const checkOnly = process.argv.includes('--check');\n  console.log(`[Accessi Catalog] Target: ${options.databaseOptions.host}:${options.databaseOptions.port} -> ${options.databaseOptions.database}`);\n  console.log(`[Accessi Catalog] Cartella: ${options.catalogScripts.folder}`);\n\n  // Prima lo schema si adegua, poi si eseguono gli script di catalogo.\n  if (!checkOnly) {\n    console.log('[Accessi Catalog] Riconciliazione schema...');\n    await AccessiDatabaseUpdater.run(options);\n  }\n\n  if (checkOnly) {\n    const pending = await listPendingCatalogScripts(options);\n    console.log(`[Accessi Catalog] Gia applicati: ${pending.applied.length}`);\n    console.log(`[Accessi Catalog] Da applicare: ${pending.pending.length}${pending.pending.length ? ` -> ${pending.pending.join(', ')}` : ''}`);\n    console.log(`[Accessi Catalog] Modificati (checksum diverso): ${pending.changed.length}${pending.changed.length ? ` -> ${pending.changed.join(', ')}` : ''}`);\n    console.log(`[Accessi Catalog] Non conformi (solo DML): ${pending.invalid.length}`);\n    for (const entry of pending.invalid) {\n      for (const violation of entry.violations) console.error(`[Accessi Catalog] Non conforme: ${entry.script} -> ${violation}`);\n    }\n    if (pending.invalid.length) process.exitCode = 1;\n    return;\n  }\n\n  const report = await applyCatalogScripts(options);\n  console.log(`[Accessi Catalog] Scoperti: ${report.discovered} | Applicati: ${report.applied.length} | Saltati: ${report.skipped.length} | Non conformi: ${report.invalid.length} | Falliti: ${report.failed.length}`);\n  if (report.applied.length) console.log(`[Accessi Catalog] Applicati: ${report.applied.join(', ')}`);\n  for (const entry of report.invalid) {\n    for (const violation of entry.violations) console.error(`[Accessi Catalog] Non conforme: ${entry.script} -> ${violation}`);\n  }\n  if (report.failed.length) {\n    for (const failure of report.failed) console.error(`[Accessi Catalog] Fallito: ${failure.script} -> ${failure.error}`);\n  }\n  if (report.failed.length || report.invalid.length) process.exitCode = 1;\n}\n\nmain()\n  .then(() => Orm.closePools())\n  .then(() => process.exit(process.exitCode ?? 0))\n  .catch(async (error) => {\n    console.error(\"[Accessi Catalog] Errore durante l'esecuzione:\", error);\n    await Orm.closePools().catch(() => undefined);\n    process.exit(1);\n  });\n"]}

package/dist/accessi-module/database-updates/runAccessiDbUpdate.js

@@ -10,66 +10,28 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 const AccessiDatabaseUpdater_1 = require("./AccessiDatabaseUpdater");
-const Utilities_1 = require("../../Utilities");
-function getEnv(name, fallback) {
-    var _a;
-    const value = (_a = process.env[name]) !== null && _a !== void 0 ? _a : fallback;
-    if (!value) {
-        throw new Error(`Variabile ambiente mancante: ${name}`);
-    }
-    return value;
-}
-function getOptionalBoolean(name, fallback) {
-    const value = process.env[name];
-    if (value === undefined) {
-        return fallback;
-    }
-    return value.toLowerCase() === "true";
-}
-function createAccessiOptionsFromEnv() {
-    return {
-        databaseOptions: Utilities_1.DatabaseUtilities.createOption(getEnv("ACCESSI_DB_HOST"), Number(getEnv("ACCESSI_DB_PORT", "3050")), getEnv("ACCESSI_DB_DATABASE"), getEnv("ACCESSI_DB_USER", "SYSDBA"), getEnv("ACCESSI_DB_PASSWORD", "masterkey")),
-        confirmationEmailUrl: getEnv("ACCESSI_CONFIRMATION_EMAIL_URL", "http://localhost"),
-        confirmationEmailReturnUrl: getEnv("ACCESSI_CONFIRMATION_RETURN_EMAIL_URL", "http://localhost"),
-        confirmationEmailPrefix: process.env.ACCESSI_CONFIRMATION_EMAIL_PREFIX,
-        customResetPage: process.env.ACCESSI_CUSTOM_RESET_PAGE,
-        encryptionKey: getEnv("ACCESSI_ENCRYPTION_KEY", "1234567890ABCDEF"),
-        mockDemoUser: getOptionalBoolean("ACCESSI_MOCK_DEMO_USER", false),
-        passwordExpiration: getOptionalBoolean("ACCESSI_PASSWORD_EXPIRATION", false),
-        autoUpdateDatabase: true,
-        jwtOptions: {
-            secret: getEnv("ACCESSI_JWT_SECRET", "local-accessi-update"),
-            expiresIn: getEnv("ACCESSI_JWT_EXPIRES", "24h"),
-        },
-        emailOptions: {
-            host: getEnv("ACCESSI_EMAIL_HOST", "localhost"),
-            port: Number(getEnv("ACCESSI_EMAIL_PORT", "25")),
-            secure: getOptionalBoolean("ACCESSI_EMAIL_SECURE", false),
-            requireTLS: getOptionalBoolean("ACCESSI_EMAIL_REQUIRE_TLS", false),
-            tls: {
-                rejectUnauthorized: getOptionalBoolean("ACCESSI_EMAIL_TLS_REJECT_UNAUTHORIZED", false),
-            },
-            from: getEnv("ACCESSI_EMAIL_FROM", "noreply@example.local"),
-            auth: {
-                user: getEnv("ACCESSI_EMAIL_USER", "local-user"),
-                pass: getEnv("ACCESSI_EMAIL_PASSWORD", "local-password"),
-            },
-        },
-        extensionFieldsOptions: [],
-    };
-}
+const accessiOptionsFromEnv_1 = require("./accessiOptionsFromEnv");
+const Orm_1 = require("../../Orm");
 function main() {
     return __awaiter(this, void 0, void 0, function* () {
-        const options = createAccessiOptionsFromEnv();
-        console.log("[Accessi DB Update] Avvio aggiornamento database...");
+        const options = (0, accessiOptionsFromEnv_1.createAccessiOptionsFromEnv)();
+        const checkOnly = process.argv.includes('--check');
+        console.log(checkOnly ? '[Accessi DB Update] Verifica schema in sola lettura...' : '[Accessi DB Update] Avvio aggiornamento database...');
         console.log(`[Accessi DB Update] Target: ${options.databaseOptions.host}:${options.databaseOptions.port} -> ${options.databaseOptions.database}`);
-        yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.run(options);
+        if (checkOnly)
+            yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.assertCompatible(options);
+        else
+            yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.run(options);
         const currentVersion = yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.getCurrentVersion(options);
         console.log(`[Accessi DB Update] Completato. Versione corrente: ${currentVersion !== null && currentVersion !== void 0 ? currentVersion : "N/D"} | Ultima disponibile: ${AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.getLatestVersion()}`);
     });
 }
-main().catch((error) => {
+main()
+    .then(() => Orm_1.Orm.closePools())
+    .then(() => process.exit(0))
+    .catch((error) => __awaiter(void 0, void 0, void 0, function* () {
     console.error("[Accessi DB Update] Errore durante l'aggiornamento:", error);
+    yield Orm_1.Orm.closePools().catch(() => undefined);
     process.exit(1);
-});
+}));
 //# sourceMappingURL=runAccessiDbUpdate.js.map

package/dist/accessi-module/database-updates/runAccessiDbUpdate.js.map

@@ -1 +1 @@
-{"version":3,"file":"runAccessiDbUpdate.js","sourceRoot":"","sources":["../../../src/accessi-module/database-updates/runAccessiDbUpdate.ts"],"names":[],"mappings":";;;;;;;;;;;AACA,qEAAkE;AAClE,+CAAoD;AAEpD,SAAS,MAAM,CAAC,IAAY,EAAE,QAAiB;;IAC7C,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,mCAAI,QAAQ,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,QAAiB;IACzD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC;AACxC,CAAC;AAED,SAAS,2BAA2B;IAClC,OAAO;QACL,eAAe,EAAE,6BAAiB,CAAC,YAAY,CAC7C,MAAM,CAAC,iBAAiB,CAAC,EACzB,MAAM,CAAC,MAAM,CAAC,iBAAiB,EAAE,MAAM,CAAC,CAAC,EACzC,MAAM,CAAC,qBAAqB,CAAC,EAC7B,MAAM,CAAC,iBAAiB,EAAE,QAAQ,CAAC,EACnC,MAAM,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAC3C;QACD,oBAAoB,EAAE,MAAM,CAAC,gCAAgC,EAAE,kBAAkB,CAAC;QAClF,0BAA0B,EAAE,MAAM,CAAC,uCAAuC,EAAE,kBAAkB,CAAC;QAC/F,uBAAuB,EAAE,OAAO,CAAC,GAAG,CAAC,iCAAiC;QACtE,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,yBAAyB;QACtD,aAAa,EAAE,MAAM,CAAC,wBAAwB,EAAE,kBAAkB,CAAC;QACnE,YAAY,EAAE,kBAAkB,CAAC,wBAAwB,EAAE,KAAK,CAAC;QACjE,kBAAkB,EAAE,kBAAkB,CAAC,6BAA6B,EAAE,KAAK,CAAC;QAC5E,kBAAkB,EAAE,IAAI;QACxB,UAAU,EAAE;YACV,MAAM,EAAE,MAAM,CAAC,oBAAoB,EAAE,sBAAsB,CAAC;YAC5D,SAAS,EAAE,MAAM,CAAC,qBAAqB,EAAE,KAAK,CAAC;SAChD;QACD,YAAY,EAAE;YACZ,IAAI,EAAE,MAAM,CAAC,oBAAoB,EAAE,WAAW,CAAC;YAC/C,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,oBAAoB,EAAE,IAAI,CAAC,CAAC;YAChD,MAAM,EAAE,kBAAkB,CAAC,sBAAsB,EAAE,KAAK,CAAC;YACzD,UAAU,EAAE,kBAAkB,CAAC,2BAA2B,EAAE,KAAK,CAAC;YAClE,GAAG,EAAE;gBACH,kBAAkB,EAAE,kBAAkB,CAAC,uCAAuC,EAAE,KAAK,CAAC;aACvF;YACD,IAAI,EAAE,MAAM,CAAC,oBAAoB,EAAE,uBAAuB,CAAC;YAC3D,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM,CAAC,oBAAoB,EAAE,YAAY,CAAC;gBAChD,IAAI,EAAE,MAAM,CAAC,wBAAwB,EAAE,gBAAgB,CAAC;aACzD;SACF;QACD,sBAAsB,EAAE,EAAE;KAC3B,CAAC;AACJ,CAAC;AAED,SAAe,IAAI;;QACjB,MAAM,OAAO,GAAG,2BAA2B,EAAE,CAAC;QAE9C,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CACT,+BAA+B,OAAO,CAAC,eAAe,CAAC,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,CACrI,CAAC;QAEF,MAAM,+CAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,cAAc,GAAG,MAAM,+CAAsB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CACT,sDAAsD,cAAc,aAAd,cAAc,cAAd,cAAc,GAAI,KAAK,0BAA0B,+CAAsB,CAAC,gBAAgB,EAAE,EAAE,CACnJ,CAAC;IACJ,CAAC;CAAA;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;IAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC","sourcesContent":["import { AccessiOptions } from \"../AccessiModule\";\r\nimport { AccessiDatabaseUpdater } from \"./AccessiDatabaseUpdater\";\r\nimport { DatabaseUtilities } from \"../../Utilities\";\r\n\r\nfunction getEnv(name: string, fallback?: string): string {\r\n  const value = process.env[name] ?? fallback;\r\n  if (!value) {\r\n    throw new Error(`Variabile ambiente mancante: ${name}`);\r\n  }\r\n  return value;\r\n}\r\n\r\nfunction getOptionalBoolean(name: string, fallback: boolean): boolean {\r\n  const value = process.env[name];\r\n  if (value === undefined) {\r\n    return fallback;\r\n  }\r\n\r\n  return value.toLowerCase() === \"true\";\r\n}\r\n\r\nfunction createAccessiOptionsFromEnv(): AccessiOptions {\r\n  return {\r\n    databaseOptions: DatabaseUtilities.createOption(\r\n      getEnv(\"ACCESSI_DB_HOST\"),\r\n      Number(getEnv(\"ACCESSI_DB_PORT\", \"3050\")),\r\n      getEnv(\"ACCESSI_DB_DATABASE\"),\r\n      getEnv(\"ACCESSI_DB_USER\", \"SYSDBA\"),\r\n      getEnv(\"ACCESSI_DB_PASSWORD\", \"masterkey\")\r\n    ),\r\n    confirmationEmailUrl: getEnv(\"ACCESSI_CONFIRMATION_EMAIL_URL\", \"http://localhost\"),\r\n    confirmationEmailReturnUrl: getEnv(\"ACCESSI_CONFIRMATION_RETURN_EMAIL_URL\", \"http://localhost\"),\r\n    confirmationEmailPrefix: process.env.ACCESSI_CONFIRMATION_EMAIL_PREFIX,\r\n    customResetPage: process.env.ACCESSI_CUSTOM_RESET_PAGE,\r\n    encryptionKey: getEnv(\"ACCESSI_ENCRYPTION_KEY\", \"1234567890ABCDEF\"),\r\n    mockDemoUser: getOptionalBoolean(\"ACCESSI_MOCK_DEMO_USER\", false),\r\n    passwordExpiration: getOptionalBoolean(\"ACCESSI_PASSWORD_EXPIRATION\", false),\r\n    autoUpdateDatabase: true,\r\n    jwtOptions: {\r\n      secret: getEnv(\"ACCESSI_JWT_SECRET\", \"local-accessi-update\"),\r\n      expiresIn: getEnv(\"ACCESSI_JWT_EXPIRES\", \"24h\"),\r\n    },\r\n    emailOptions: {\r\n      host: getEnv(\"ACCESSI_EMAIL_HOST\", \"localhost\"),\r\n      port: Number(getEnv(\"ACCESSI_EMAIL_PORT\", \"25\")),\r\n      secure: getOptionalBoolean(\"ACCESSI_EMAIL_SECURE\", false),\r\n      requireTLS: getOptionalBoolean(\"ACCESSI_EMAIL_REQUIRE_TLS\", false),\r\n      tls: {\r\n        rejectUnauthorized: getOptionalBoolean(\"ACCESSI_EMAIL_TLS_REJECT_UNAUTHORIZED\", false),\r\n      },\r\n      from: getEnv(\"ACCESSI_EMAIL_FROM\", \"noreply@example.local\"),\r\n      auth: {\r\n        user: getEnv(\"ACCESSI_EMAIL_USER\", \"local-user\"),\r\n        pass: getEnv(\"ACCESSI_EMAIL_PASSWORD\", \"local-password\"),\r\n      },\r\n    },\r\n    extensionFieldsOptions: [],\r\n  };\r\n}\r\n\r\nasync function main(): Promise<void> {\r\n  const options = createAccessiOptionsFromEnv();\r\n\r\n  console.log(\"[Accessi DB Update] Avvio aggiornamento database...\");\r\n  console.log(\r\n    `[Accessi DB Update] Target: ${options.databaseOptions.host}:${options.databaseOptions.port} -> ${options.databaseOptions.database}`\r\n  );\r\n\r\n  await AccessiDatabaseUpdater.run(options);\r\n\r\n  const currentVersion = await AccessiDatabaseUpdater.getCurrentVersion(options);\r\n  console.log(\r\n    `[Accessi DB Update] Completato. Versione corrente: ${currentVersion ?? \"N/D\"} | Ultima disponibile: ${AccessiDatabaseUpdater.getLatestVersion()}`\r\n  );\r\n}\r\n\r\nmain().catch((error) => {\r\n  console.error(\"[Accessi DB Update] Errore durante l'aggiornamento:\", error);\r\n  process.exit(1);\r\n});\r\n"]}
+{"version":3,"file":"runAccessiDbUpdate.js","sourceRoot":"","sources":["../../../src/accessi-module/database-updates/runAccessiDbUpdate.ts"],"names":[],"mappings":";;;;;;;;;;;AAAA,qEAAkE;AAClE,mEAAsE;AACtE,mCAAgC;AAEhC,SAAe,IAAI;;QACjB,MAAM,OAAO,GAAG,IAAA,mDAA2B,GAAE,CAAC;QAE9C,MAAM,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,wDAAwD,CAAC,CAAC,CAAC,qDAAqD,CAAC,CAAC;QAC1I,OAAO,CAAC,GAAG,CACT,+BAA+B,OAAO,CAAC,eAAe,CAAC,IAAI,IAAI,OAAO,CAAC,eAAe,CAAC,IAAI,OAAO,OAAO,CAAC,eAAe,CAAC,QAAQ,EAAE,CACrI,CAAC;QAEF,IAAI,SAAS;YAAE,MAAM,+CAAsB,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC;;YACjE,MAAM,+CAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAE/C,MAAM,cAAc,GAAG,MAAM,+CAAsB,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC;QAC/E,OAAO,CAAC,GAAG,CACT,sDAAsD,cAAc,aAAd,cAAc,cAAd,cAAc,GAAI,KAAK,0BAA0B,+CAAsB,CAAC,gBAAgB,EAAE,EAAE,CACnJ,CAAC;IACJ,CAAC;CAAA;AAED,IAAI,EAAE;KACH,IAAI,CAAC,GAAG,EAAE,CAAC,SAAG,CAAC,UAAU,EAAE,CAAC;KAC5B,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;KAC3B,KAAK,CAAC,CAAO,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,qDAAqD,EAAE,KAAK,CAAC,CAAC;IAC5E,MAAM,SAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAA,CAAC,CAAC","sourcesContent":["import { AccessiDatabaseUpdater } from \"./AccessiDatabaseUpdater\";\nimport { createAccessiOptionsFromEnv } from \"./accessiOptionsFromEnv\";\nimport { Orm } from \"../../Orm\";\n\nasync function main(): Promise<void> {\n  const options = createAccessiOptionsFromEnv();\n\n  const checkOnly = process.argv.includes('--check');\n  console.log(checkOnly ? '[Accessi DB Update] Verifica schema in sola lettura...' : '[Accessi DB Update] Avvio aggiornamento database...');\n  console.log(\n    `[Accessi DB Update] Target: ${options.databaseOptions.host}:${options.databaseOptions.port} -> ${options.databaseOptions.database}`\n  );\n\n  if (checkOnly) await AccessiDatabaseUpdater.assertCompatible(options);\n  else await AccessiDatabaseUpdater.run(options);\n\n  const currentVersion = await AccessiDatabaseUpdater.getCurrentVersion(options);\n  console.log(\n    `[Accessi DB Update] Completato. Versione corrente: ${currentVersion ?? \"N/D\"} | Ultima disponibile: ${AccessiDatabaseUpdater.getLatestVersion()}`\n  );\n}\n\nmain()\n  .then(() => Orm.closePools())\n  .then(() => process.exit(0))\n  .catch(async (error) => {\n    console.error(\"[Accessi DB Update] Errore durante l'aggiornamento:\", error);\n    await Orm.closePools().catch(() => undefined);\n    process.exit(1);\n  });\n"]}

package/dist/accessi-module/federated-auth/FederatedAuthController.d.ts

@@ -0,0 +1,24 @@
+import { Request, Response } from 'express';
+import { CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, SetPasswordLoginPolicyRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest } from '../Dtos/FederatedIdentityDtos';
+import { FederatedAuthService } from './FederatedAuthService';
+/**
+ * Master-only administration API. Authentication itself is intentionally not
+ * exposed over HTTP: the hosting backend validates its SSO and calls
+ * FederatedAuthService.authenticate({ provider, subject }) directly.
+ */
+export declare class FederatedAuthController {
+    private readonly federatedAuthService;
+    constructor(federatedAuthService: FederatedAuthService);
+    getProviders(request: Request, res: Response): Promise<Response<any, Record<string, any>>>;
+    createProvider(request: Request, body: CreateFederatedProviderRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    updateProvider(request: Request, provider: string, body: UpdateFederatedProviderRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    deleteProvider(request: Request, provider: string, res: Response): Promise<Response<any, Record<string, any>>>;
+    getIdentities(request: Request, codiceUtente: number, res: Response): Promise<Response<any, Record<string, any>>>;
+    linkIdentity(request: Request, codiceUtente: number, body: CreateFederatedIdentityRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    createUser(request: Request, body: CreateFederatedUserRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    setPasswordPolicy(request: Request, codiceUtente: number, body: SetPasswordLoginPolicyRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    disableIdentity(request: Request, identityKey: string, res: Response): Promise<Response<any, Record<string, any>>>;
+    deleteIdentity(request: Request, codiceUtente: number, identityKey: string, res: Response): Promise<Response<any, Record<string, any>>>;
+    updateIdentity(request: Request, identityKey: string, body: UpdateFederatedIdentityRequest, res: Response): Promise<Response<any, Record<string, any>>>;
+    private sendError;
+}

package/dist/accessi-module/federated-auth/FederatedAuthController.js

@@ -0,0 +1,333 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var FederatedAuthController_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FederatedAuthController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const Utilities_1 = require("../../Utilities");
+const BaseResponse_1 = require("../Dtos/BaseResponse");
+const FederatedIdentityDtos_1 = require("../Dtos/FederatedIdentityDtos");
+const jwt_strategy_1 = require("../jwt/jwt.strategy");
+const accessControl_1 = require("../security/accessControl");
+const FederatedAuthService_1 = require("./FederatedAuthService");
+/**
+ * Master-only administration API. Authentication itself is intentionally not
+ * exposed over HTTP: the hosting backend validates its SSO and calls
+ * FederatedAuthService.authenticate({ provider, subject }) directly.
+ */
+let FederatedAuthController = FederatedAuthController_1 = class FederatedAuthController {
+    constructor(federatedAuthService) {
+        this.federatedAuthService = federatedAuthService;
+    }
+    getProviders(request, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.getProviders());
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    createProvider(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.createProvider(body), common_1.HttpStatus.CREATED);
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    updateProvider(request, provider, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.updateProvider(provider, body));
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    deleteProvider(request, provider, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                yield this.federatedAuthService.deleteProvider(provider);
+                return Utilities_1.RestUtilities.sendOKMessage(res, `Provider SSO ${provider} eliminato.`);
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    getIdentities(request, codiceUtente, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                return Utilities_1.RestUtilities.sendBaseResponse(res, yield this.federatedAuthService.getUserIdentities(codiceUtente));
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    linkIdentity(request, codiceUtente, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                const identity = yield this.federatedAuthService.linkIdentity(codiceUtente, body, body.note);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, identity, common_1.HttpStatus.CREATED);
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    createUser(request, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                const identity = yield this.federatedAuthService.createManagedFederatedUser(body.user, body, body.passwordLoginEnabled === true, body.note);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, identity, common_1.HttpStatus.CREATED);
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    setPasswordPolicy(request, codiceUtente, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                yield this.federatedAuthService.setPasswordLoginEnabled(codiceUtente, body.passwordLoginEnabled);
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Policy di autenticazione aggiornata.');
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    disableIdentity(request, identityKey, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                yield this.federatedAuthService.disableIdentity(identityKey);
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Identita SSO disabilitata.');
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    deleteIdentity(request, codiceUtente, identityKey, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                yield this.federatedAuthService.deleteIdentity(codiceUtente, identityKey);
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Collegamento SSO eliminato definitivamente.');
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    updateIdentity(request, identityKey, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                (0, accessControl_1.ensureAdmin)((0, accessControl_1.getAuthenticatedAccessiUser)(request));
+                yield this.federatedAuthService.updateIdentity(identityKey, body);
+                return Utilities_1.RestUtilities.sendOKMessage(res, 'Collegamento SSO aggiornato.');
+            }
+            catch (error) {
+                return this.sendError(res, error);
+            }
+        });
+    }
+    sendError(res, error) {
+        const status = error instanceof common_1.HttpException ? error.getStatus() : common_1.HttpStatus.INTERNAL_SERVER_ERROR;
+        return Utilities_1.RestUtilities.sendErrorMessage(res, error, FederatedAuthController_1.name, status);
+    }
+};
+exports.FederatedAuthController = FederatedAuthController;
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Elenca i provider SSO censiti', operationId: 'getFederatedProviders', description: 'Riservato a superutente. Restituisce solo catalogo e stato Accessi; issuer, secret e configurazioni SSO restano nel backend.' }),
+    (0, swagger_1.ApiOkResponse)({ type: FederatedIdentityDtos_1.FederatedProviderListResponse }),
+    (0, common_1.Get)('providers'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "getProviders", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Censisce un provider SSO', operationId: 'createFederatedProvider', description: 'Riservato a superutente. La chiave provider deve corrispondere alla configurazione stabile del backend; non salvare segreti, issuer o token.' }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.CreateFederatedProviderRequest }),
+    (0, swagger_1.ApiCreatedResponse)({ type: FederatedIdentityDtos_1.FederatedProviderResponse }),
+    (0, common_1.Post)('providers'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, FederatedIdentityDtos_1.CreateFederatedProviderRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "createProvider", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider è immutabile: disabilitarla blocca nuovi login SSO ma conserva i collegamenti storici.' }),
+    (0, swagger_1.ApiParam)({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.UpdateFederatedProviderRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: FederatedIdentityDtos_1.FederatedProviderResponse }),
+    (0, common_1.Patch)('providers/:provider'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('provider')),
+    __param(2, (0, common_1.Body)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, FederatedIdentityDtos_1.UpdateFederatedProviderRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "updateProvider", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Elimina un provider SSO', operationId: 'deleteFederatedProvider', description: 'Riservato a superutente. Consentito solo se nessuna identita e collegata al provider; in alternativa disabilitalo.' }),
+    (0, swagger_1.ApiParam)({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' }),
+    (0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 404, type: BaseResponse_1.ErrorResponse, description: 'Provider non registrato.' }),
+    (0, swagger_1.ApiResponse)({ status: 409, type: BaseResponse_1.ErrorResponse, description: 'Provider ancora utilizzato da identita collegate.' }),
+    (0, common_1.Delete)('providers/:provider'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('provider')),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "deleteProvider", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Elenca le identita SSO di un utente', operationId: 'getFederatedIdentities', description: 'Riservato a superutente. Non restituisce token esterni o claim del provider.' }),
+    (0, swagger_1.ApiParam)({ name: 'codiceUtente', example: 123 }),
+    (0, swagger_1.ApiOkResponse)({ type: FederatedIdentityDtos_1.FederatedIdentityListResponse }),
+    (0, swagger_1.ApiResponse)({ status: 403, type: BaseResponse_1.ErrorResponse }),
+    (0, common_1.Get)('users/:codiceUtente/identities'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('codiceUtente', common_1.ParseIntPipe)),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Number, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "getIdentities", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Associa un SSO gia verificato a un utente esistente', operationId: 'linkFederatedIdentity', description: 'Il master deve fornire un provider e subject ottenuti da una verifica SSO lato backend; questo endpoint non verifica token esterni.' }),
+    (0, swagger_1.ApiParam)({ name: 'codiceUtente', example: 123 }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.CreateFederatedIdentityRequest }),
+    (0, swagger_1.ApiCreatedResponse)({ type: FederatedIdentityDtos_1.FederatedIdentityResponse }),
+    (0, common_1.Post)('users/:codiceUtente/identities'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('codiceUtente', common_1.ParseIntPipe)),
+    __param(2, (0, common_1.Body)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Number, FederatedIdentityDtos_1.CreateFederatedIdentityRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "linkIdentity", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Crea un utente gestito e SSO-only', operationId: 'createFederatedUser', description: 'Riservato a superutente. L utente nasce confermato, con identita collegata e senza password salvo opt-in esplicito.' }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.CreateFederatedUserRequest }),
+    (0, swagger_1.ApiCreatedResponse)({ type: FederatedIdentityDtos_1.FederatedIdentityResponse }),
+    (0, swagger_1.ApiResponse)({ status: 400, type: BaseResponse_1.ErrorResponse, description: 'Provider o subject non validi.' }),
+    (0, swagger_1.ApiResponse)({ status: 404, type: BaseResponse_1.ErrorResponse, description: 'Provider SSO non censito.' }),
+    (0, swagger_1.ApiResponse)({ status: 409, type: BaseResponse_1.ErrorResponse, description: 'Email o identità SSO già associate a un utente.' }),
+    (0, swagger_1.ApiResponse)({ status: 503, type: BaseResponse_1.ErrorResponse, description: 'Schema Accessi non aggiornato.' }),
+    (0, swagger_1.ApiResponse)({ status: 500, type: BaseResponse_1.ErrorResponse, description: 'Errore inatteso durante il provisioning; la risposta contiene FEDERATED_USER_PROVISIONING_FAILED.' }),
+    (0, common_1.Post)('users'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Body)()),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, FederatedIdentityDtos_1.CreateFederatedUserRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "createUser", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Abilita o disabilita il login con password', operationId: 'setPasswordLoginPolicy', description: 'Con false il login locale restituisce PASSWORD_LOGIN_DISABLED; le identita SSO attive restano utilizzabili.' }),
+    (0, swagger_1.ApiParam)({ name: 'codiceUtente', example: 123 }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.SetPasswordLoginPolicyRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
+    (0, common_1.Patch)('users/:codiceUtente/password-login'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('codiceUtente', common_1.ParseIntPipe)),
+    __param(2, (0, common_1.Body)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Number, FederatedIdentityDtos_1.SetPasswordLoginPolicyRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "setPasswordPolicy", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Disabilita un identita SSO', operationId: 'disableFederatedIdentity', description: 'Soft delete: l associazione resta tracciata ma non puo piu autenticare.' }),
+    (0, swagger_1.ApiParam)({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' }),
+    (0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
+    (0, common_1.Delete)('identities/:identityKey'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('identityKey')),
+    __param(2, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "disableIdentity", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall’utente, senza eliminare l’utente Accessi.' }),
+    (0, swagger_1.ApiParam)({ name: 'codiceUtente', example: 123 }),
+    (0, swagger_1.ApiParam)({ name: 'identityKey', description: 'SHA-256 del collegamento da eliminare.' }),
+    (0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
+    (0, swagger_1.ApiResponse)({ status: 404, type: BaseResponse_1.ErrorResponse, description: 'Collegamento assente o non appartenente all’utente.' }),
+    (0, common_1.Delete)('users/:codiceUtente/identities/:identityKey'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('codiceUtente', common_1.ParseIntPipe)),
+    __param(2, (0, common_1.Param)('identityKey')),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Number, String, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "deleteIdentity", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({ summary: 'Aggiorna un collegamento SSO', operationId: 'updateFederatedIdentity', description: 'Consente di modificare nota e stato attivo del collegamento. identityKey e una chiave tecnica, non un token SSO.' }),
+    (0, swagger_1.ApiParam)({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' }),
+    (0, swagger_1.ApiBody)({ type: FederatedIdentityDtos_1.UpdateFederatedIdentityRequest }),
+    (0, swagger_1.ApiOkResponse)({ type: BaseResponse_1.ActionResponse }),
+    (0, common_1.Patch)('identities/:identityKey'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('identityKey')),
+    __param(2, (0, common_1.Body)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, String, FederatedIdentityDtos_1.UpdateFederatedIdentityRequest, Object]),
+    __metadata("design:returntype", Promise)
+], FederatedAuthController.prototype, "updateIdentity", null);
+exports.FederatedAuthController = FederatedAuthController = FederatedAuthController_1 = __decorate([
+    (0, swagger_1.ApiTags)('Federated authentication'),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard),
+    (0, common_1.Controller)('accessi/federated-auth'),
+    __metadata("design:paramtypes", [FederatedAuthService_1.FederatedAuthService])
+], FederatedAuthController);
+//# sourceMappingURL=FederatedAuthController.js.map

package/dist/accessi-module/federated-auth/FederatedAuthController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedAuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAiJ;AACjJ,6CAA0I;AAE1I,+CAAgD;AAChD,uDAAqE;AACrE,yEAA8V;AAC9V,sDAAqD;AACrD,6DAAqF;AACrF,iEAA8D;AAE9D;;;;GAIG;AAKI,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,YAA6B,oBAA0C;QAA1C,yBAAoB,GAApB,oBAAoB,CAAsB;IAAG,CAAC;IAKrE,YAAY,CAAQ,OAAgB,EAAS,GAAa;;YAC9D,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,cAAc,CAAQ,OAAgB,EAAU,IAAoC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YACvH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAU,IAAoC,EAAS,GAAa;;YACnJ,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACzD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,QAAQ,aAAa,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,aAAa,CAAQ,OAAgB,EAAuC,YAAoB,EAAS,GAAa;;YAC1H,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,YAAY,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAoC,EAAS,GAAa;;YACvK,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAWK,UAAU,CAAQ,OAAgB,EAAU,IAAgC,EAAS,GAAa;;YACtG,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,iBAAiB,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAmC,EAAS,GAAa;;YAC3K,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACjG,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,eAAe,CAAQ,OAAgB,EAAwB,WAAmB,EAAS,GAAa;;YAC5G,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC7D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAuC,YAAoB,EAAwB,WAAmB,EAAS,GAAa;;YACtK,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAC1E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAwB,WAAmB,EAAU,IAAoC,EAAS,GAAa;;YACzJ,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAEO,SAAS,CAAC,GAAa,EAAE,KAAc;QAC7C,MAAM,MAAM,GAAG,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACrG,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;CACF,CAAA;AA1KY,0DAAuB;AAM5B;IAHL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,8HAA8H,EAAE,CAAC;IAC7O,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,YAAG,EAAC,WAAW,CAAC;IACG,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAOjD;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,8IAA8I,EAAE,CAAC;IAC1P,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,WAAW,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAtC,sDAA8B;;6DAOzF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;IAC9P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IAClD,IAAA,cAAK,EAAC,qBAAqB,CAAC;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAO9H;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC/N,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC1F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;IACnH,IAAA,eAAM,EAAC,qBAAqB,CAAC;IACR,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQxF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;IACpM,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACjD,IAAA,YAAG,EAAC,gCAAgC,CAAC;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4DAO7G;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;IAC1Q,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,gCAAgC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;2DAQlJ;AAWK;IATL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,qHAAqH,EAAE,CAAC;IACtO,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kDAA0B,EAAE,CAAC;IAC7C,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;IACnH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mGAAmG,EAAE,CAAC;IACnK,IAAA,aAAI,EAAC,OAAO,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAlC,kDAA0B;;yDAQjF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,6GAA6G,EAAE,CAAC;IAC1O,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,oCAAoC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAuC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAArC,qDAA6B;;gEAQtJ;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,0BAA0B,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IACxL,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,eAAM,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAQ/F;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,oCAAoC,EAAE,WAAW,EAAE,wHAAwH,EAAE,CAAC;IAClQ,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACxF,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,uDAAuD,EAAE,CAAC;IACvH,IAAA,eAAM,EAAC,6CAA6C,CAAC;IAChC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQzJ;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,kHAAkH,EAAE,CAAC;IAClO,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAQpI;kCApKU,uBAAuB;IAJnC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAEgB,2CAAoB;GAD5D,uBAAuB,CA0KnC","sourcesContent":["import { Body, Controller, Delete, Get, HttpException, HttpStatus, Param, ParseIntPipe, Patch, Post, Req, Res, UseGuards } from '@nestjs/common';\nimport { ApiBearerAuth, ApiBody, ApiCreatedResponse, ApiOkResponse, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, FederatedIdentityListResponse, FederatedIdentityResponse, FederatedProviderListResponse, FederatedProviderResponse, SetPasswordLoginPolicyRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest } from '../Dtos/FederatedIdentityDtos';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureAdmin, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport { FederatedAuthService } from './FederatedAuthService';\n\n/**\n * Master-only administration API. Authentication itself is intentionally not\n * exposed over HTTP: the hosting backend validates its SSO and calls\n * FederatedAuthService.authenticate({ provider, subject }) directly.\n */\n@ApiTags('Federated authentication')\n@ApiBearerAuth()\n@UseGuards(JwtSimpleGuard)\n@Controller('accessi/federated-auth')\nexport class FederatedAuthController {\n  constructor(private readonly federatedAuthService: FederatedAuthService) {}\n\n  @ApiOperation({ summary: 'Elenca i provider SSO censiti', operationId: 'getFederatedProviders', description: 'Riservato a superutente. Restituisce solo catalogo e stato Accessi; issuer, secret e configurazioni SSO restano nel backend.' })\n  @ApiOkResponse({ type: FederatedProviderListResponse })\n  @Get('providers')\n  async getProviders(@Req() request: Request, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getProviders());\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Censisce un provider SSO', operationId: 'createFederatedProvider', description: 'Riservato a superutente. La chiave provider deve corrispondere alla configurazione stabile del backend; non salvare segreti, issuer o token.' })\n  @ApiBody({ type: CreateFederatedProviderRequest })\n  @ApiCreatedResponse({ type: FederatedProviderResponse })\n  @Post('providers')\n  async createProvider(@Req() request: Request, @Body() body: CreateFederatedProviderRequest, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.createProvider(body), HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider è immutabile: disabilitarla blocca nuovi login SSO ma conserva i collegamenti storici.' })\n  @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n  @ApiBody({ type: UpdateFederatedProviderRequest })\n  @ApiOkResponse({ type: FederatedProviderResponse })\n  @Patch('providers/:provider')\n  async updateProvider(@Req() request: Request, @Param('provider') provider: string, @Body() body: UpdateFederatedProviderRequest, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.updateProvider(provider, body));\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Elimina un provider SSO', operationId: 'deleteFederatedProvider', description: 'Riservato a superutente. Consentito solo se nessuna identita e collegata al provider; in alternativa disabilitalo.' })\n  @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n  @ApiOkResponse({ type: ActionResponse })\n  @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider non registrato.' })\n  @ApiResponse({ status: 409, type: ErrorResponse, description: 'Provider ancora utilizzato da identita collegate.' })\n  @Delete('providers/:provider')\n  async deleteProvider(@Req() request: Request, @Param('provider') provider: string, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      await this.federatedAuthService.deleteProvider(provider);\n      return RestUtilities.sendOKMessage(res, `Provider SSO ${provider} eliminato.`);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Elenca le identita SSO di un utente', operationId: 'getFederatedIdentities', description: 'Riservato a superutente. Non restituisce token esterni o claim del provider.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiOkResponse({ type: FederatedIdentityListResponse })\n  @ApiResponse({ status: 403, type: ErrorResponse })\n  @Get('users/:codiceUtente/identities')\n  async getIdentities(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getUserIdentities(codiceUtente));\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Associa un SSO gia verificato a un utente esistente', operationId: 'linkFederatedIdentity', description: 'Il master deve fornire un provider e subject ottenuti da una verifica SSO lato backend; questo endpoint non verifica token esterni.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiBody({ type: CreateFederatedIdentityRequest })\n  @ApiCreatedResponse({ type: FederatedIdentityResponse })\n  @Post('users/:codiceUtente/identities')\n  async linkIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: CreateFederatedIdentityRequest, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      const identity = await this.federatedAuthService.linkIdentity(codiceUtente, body, body.note);\n      return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Crea un utente gestito e SSO-only', operationId: 'createFederatedUser', description: 'Riservato a superutente. L utente nasce confermato, con identita collegata e senza password salvo opt-in esplicito.' })\n  @ApiBody({ type: CreateFederatedUserRequest })\n  @ApiCreatedResponse({ type: FederatedIdentityResponse })\n  @ApiResponse({ status: 400, type: ErrorResponse, description: 'Provider o subject non validi.' })\n  @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider SSO non censito.' })\n  @ApiResponse({ status: 409, type: ErrorResponse, description: 'Email o identità SSO già associate a un utente.' })\n  @ApiResponse({ status: 503, type: ErrorResponse, description: 'Schema Accessi non aggiornato.' })\n  @ApiResponse({ status: 500, type: ErrorResponse, description: 'Errore inatteso durante il provisioning; la risposta contiene FEDERATED_USER_PROVISIONING_FAILED.' })\n  @Post('users')\n  async createUser(@Req() request: Request, @Body() body: CreateFederatedUserRequest, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      const identity = await this.federatedAuthService.createManagedFederatedUser(body.user, body, body.passwordLoginEnabled === true, body.note);\n      return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Abilita o disabilita il login con password', operationId: 'setPasswordLoginPolicy', description: 'Con false il login locale restituisce PASSWORD_LOGIN_DISABLED; le identita SSO attive restano utilizzabili.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiBody({ type: SetPasswordLoginPolicyRequest })\n  @ApiOkResponse({ type: ActionResponse })\n  @Patch('users/:codiceUtente/password-login')\n  async setPasswordPolicy(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: SetPasswordLoginPolicyRequest, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      await this.federatedAuthService.setPasswordLoginEnabled(codiceUtente, body.passwordLoginEnabled);\n      return RestUtilities.sendOKMessage(res, 'Policy di autenticazione aggiornata.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Disabilita un identita SSO', operationId: 'disableFederatedIdentity', description: 'Soft delete: l associazione resta tracciata ma non puo piu autenticare.' })\n  @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n  @ApiOkResponse({ type: ActionResponse })\n  @Delete('identities/:identityKey')\n  async disableIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      await this.federatedAuthService.disableIdentity(identityKey);\n      return RestUtilities.sendOKMessage(res, 'Identita SSO disabilitata.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall’utente, senza eliminare l’utente Accessi.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiParam({ name: 'identityKey', description: 'SHA-256 del collegamento da eliminare.' })\n  @ApiOkResponse({ type: ActionResponse })\n  @ApiResponse({ status: 404, type: ErrorResponse, description: 'Collegamento assente o non appartenente all’utente.' })\n  @Delete('users/:codiceUtente/identities/:identityKey')\n  async deleteIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Param('identityKey') identityKey: string, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      await this.federatedAuthService.deleteIdentity(codiceUtente, identityKey);\n      return RestUtilities.sendOKMessage(res, 'Collegamento SSO eliminato definitivamente.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Aggiorna un collegamento SSO', operationId: 'updateFederatedIdentity', description: 'Consente di modificare nota e stato attivo del collegamento. identityKey e una chiave tecnica, non un token SSO.' })\n  @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n  @ApiBody({ type: UpdateFederatedIdentityRequest })\n  @ApiOkResponse({ type: ActionResponse })\n  @Patch('identities/:identityKey')\n  async updateIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Body() body: UpdateFederatedIdentityRequest, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      await this.federatedAuthService.updateIdentity(identityKey, body);\n      return RestUtilities.sendOKMessage(res, 'Collegamento SSO aggiornato.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  private sendError(res: Response, error: unknown) {\n    const status = error instanceof HttpException ? error.getStatus() : HttpStatus.INTERNAL_SERVER_ERROR;\n    return RestUtilities.sendErrorMessage(res, error, FederatedAuthController.name, status);\n  }\n}\n"]}