emilsoftware-utilities 2.0.0-dev.40 → 2.0.0-dev.42

package/dist/accessi-module/Controllers/UserController.js.map

@@ -1 +1 @@
-{"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAmBwB;AAExB,6CASyB;AACzB,+BAA4B;AAC5B,yCAAsC;AACtC,+CAAgD;AAEhD,uDAAqE;AACrE,+DAA4D;AAC5D,yEAAsE;AACtE,+DAA4D;AAC5D,6DAA0D;AAC1D,yEAAyE;AACzE,6CAA0C;AAC1C,wEAAqE;AACrE,qEAAkE;AAClE,sDAAqD;AACrD,yEAGyC;AACzC,6DAKmC;AAQ5B,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YAC6B,cAA+C,EACzD,WAAwB,EACxB,YAA0B;QAFC,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAL5B,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAMvD,CAAC;IAEI,mBAAmB,CAAC,GAAa,EAAE,KAAc;QACvD,gFAAgF;QAChF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAYK,sBAAsB,CAAQ,GAAa,EAAkB,MAAc;;YAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAqDK,QAAQ,CACL,OAAgB,EAChB,GAAa,EACJ,KAAc,EAC+B,YAAqB,EAElF,sBAAgC,EAEhC,aAAuB,EAC+B,KAAc,EACb,MAAe;;YAEtE,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,wDAAwD,CACzD,CAAC;gBAEF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG;oBACd,sBAAsB,EAAE,sBAAsB,aAAtB,sBAAsB,cAAtB,sBAAsB,GAAI,IAAI;oBACtD,aAAa,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,IAAI;iBACrC,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAuBK,UAAU,CACP,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,mDAAmD,CACpD,CAAC;gBAEF,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAcK,kBAAkB,CACf,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,qCAAqC,YAAY,GAAG,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAYK,wBAAwB,CAAQ,OAAgB,EAAS,GAAa;;YAC1E,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oCAAoC,EAAE,CAAC;gBAC3E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,IAAI,8BAA8B,CAAC,CAAC;YAC1G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAyBK,qBAAqB,CAClB,OAAgB,EACf,IAA8B,EAC/B,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,uEAAuE,CACxE,CAAC;gBAEF,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;gBAClD,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;gBACvF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,wBAAwB,YAAY,0BAA0B,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,QAAQ,CACL,OAAgB,EACf,gBAAuC,EACxC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,kBAAkB,0CAAE,OAAO,MAAK,IAAI,EAAE,CAAC;oBAC7D,MAAM,IAAI,sBAAa,CACrB,mFAAmF,EACnF,mBAAU,CAAC,SAAS,CACrB,CAAC;gBACJ,CAAC;gBAED,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,cAAc,EACnB,UAAU,EACV,OAAO,EACP,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,KAAK,CAAC,CAC1B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,KAAK;iBAC7B,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACvE,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GACV,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAAC;gBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;IAQK,iBAAiB,CAAQ,OAAgB,EAAU,gBAAiC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,EAAE,gDAAgD,CAAC,CAAC;gBAC7G,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxG,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAClG,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,YAAY,CACT,OAAgB,EACc,YAAoB,EACjD,IAAa,EACd,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,kBAAkB,GAAG,IAAA,wCAAwB,EAAC,IAAI,CAAC,CAAC;gBAE1D,IAAI,kBAAkB,EAAE,CAAC;oBACvB,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,iFAAiF,CAClF,CAAC;gBACJ,CAAC;qBAAM,CAAC;oBACN,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,sCAAsC,CACvC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBAC1E,MAAM,IAAI,4BAAmB,CAAC,6DAA6D,CAAC,CAAC;gBAC/F,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE;oBACpD,sBAAsB,EAAE,iBAAiB,CAAC,SAAS,IAAI,iBAAiB,CAAC,SAAS;iBACnF,CAAC,CAAC;gBAEH,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,YAAY,YAAY,oCAAoC,CAC7D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAsBK,OAAO,CACJ,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAA,qCAAqB,EACnB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,YAAY,EACZ,6CAA6C,CAC9C,CAAC;gBAEF,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,YAAY,wBAAwB,CAAC,CAAC;YAC5F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAnbY,wCAAc;AAwBnB;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,4BAA4B;KAC1C,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,YAAG,EAAC,uBAAuB,CAAC;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;4DAEjE;AAqDK;IAnDL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8BAA8B;QAC3C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+DAA+D;QAC5E,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4CAA4C;QACzD,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,WAAW,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3D,WAAA,IAAA,cAAK,EAAC,wBAAwB,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEtE,WAAA,IAAA,cAAK,EAAC,eAAe,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE7D,WAAA,IAAA,cAAK,EAAC,OAAO,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;;;;8CAsBvD;AAuBK;IArBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,qEAAqE;KACnF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,2BAA2B,CAAC;IAEjC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gDAaP;AAcK;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,yHAAyH;KACvI,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,oCAAoC,CAAC;IAExC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAYP;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kEAAkE;QAC3E,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,+JAA+J;KAC7K,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,6BAA6B,CAAC;IACJ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAW7D;AAyBK;IAvBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EAAE,uBAAuB;KACrC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,gDAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,WAAW,CAAC;IAEf,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,gDAAwB;;2DAuBvC;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,8IAA8I;QAC3J,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,6CAAqB;QAC3B,WAAW,EAAE,iDAAiD;KAC/D,CAAC;IACD,IAAA,4BAAkB,EAAC;QAClB,WAAW,EACT,kGAAkG;QACpG,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,WAAW;QAC9B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,qBAAqB;QACxC,WAAW,EAAE,sEAAsE;QACnF,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,UAAU,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADoB,6CAAqB;;8CAgChD;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;IAC5N,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAAe,EAAE,CAAC;IAClC,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,mCAAgB,EAAE,CAAC;IAC9C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,qBAAqB,CAAC;IACH,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAqC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAvB,iCAAe;;uDASzF;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,cAAc;KAC5B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,iBAAO;QACb,WAAW,EAAE,6BAA6B;KAC3C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,EAAE;QACrB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAE9B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,iBAAO;;kDAmCtB;AAsBK;IApBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,SAAS;KACvB,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,cAAK,EAAC,wBAAwB,CAAC;IAE7B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6CAcP;yBAlbU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAKE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACV,2BAAY;GANlC,cAAc,CAmb1B","sourcesContent":["import {\n  BadRequestException,\n  Body,\n  Controller,\n  Delete,\n  Get,\n  HttpException,\n  HttpStatus,\n  Param,\n  ParseBoolPipe,\n  ParseIntPipe,\n  Patch,\n  Post,\n  Put,\n  Query,\n  Inject,\n  Req,\n  Res,\n  UseGuards,\n} from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiCreatedResponse,\n  ApiOperation,\n  ApiParam,\n  ApiQuery,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { join } from 'path';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { GetUsersResponse } from '../Dtos/GetUsersResponse';\nimport { PublicRegisterRequest } from '../Dtos/PublicRegisterRequest';\nimport { RegisterResponse } from '../Dtos/RegisterResponse';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { SetStatoRegistrazioneDto } from '../Dtos/SetStatoRegistrazione';\nimport { UserDto } from '../Dtos/UserDto';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\nimport {\n  ensureSelfOrSuperUser,\n  ensureUserManagement,\n  getAuthenticatedAccessiUser,\n  hasPrivilegedUserChanges,\n} from '../security/accessControl';\n\n@ApiTags('User')\n@Controller('accessi/user')\n/**\n * Gestione utenti: la registrazione pubblica e opt-in, mentre creazione, stato e profili privilegiati\n * richiedono un superutente Accessi. Le API restituiscono sempre il wrapper `BaseResponse` storico.\n */\nexport class UserController {\n  private readonly logger = new Logger(UserController.name);\n\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly userService: UserService,\n    private readonly emailService: EmailService,\n  ) {}\n\n  private sendControllerError(res: Response, error: unknown) {\n    // Lo status viene derivato centralmente da RestUtilities (HttpException o 500).\n    return RestUtilities.sendErrorMessage(res, error, UserController.name);\n  }\n\n  @ApiOperation({\n    summary: 'Serve la pagina di reset password',\n    operationId: 'serveResetPasswordPageUser',\n  })\n  @ApiParam({\n    name: 'token',\n    description: 'Token per il reset della password',\n    required: true,\n  })\n  @Get('reset-password/:token')\n  async serveResetPasswordPage(@Res() res: Response, @Param('token') _token: string) {\n    return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n  }\n\n  @ApiOperation({\n    summary: 'Recupera la lista degli utenti',\n    operationId: 'getUsers',\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Lista utenti recuperata con successo',\n    type: GetUsersResponse,\n  })\n  @ApiResponse({ status: 401, description: 'Credenziali non valide', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiQuery({\n    name: 'email',\n    required: false,\n    description: \"Email dell'utente da cercare\",\n    type: String,\n  })\n  @ApiQuery({\n    name: 'codiceUtente',\n    required: false,\n    description: \"Codice dell'utente da cercare\",\n    type: Number,\n  })\n  @ApiQuery({\n    name: 'includeExtensionFields',\n    required: false,\n    description: 'Includi extension fields',\n    type: Boolean,\n  })\n  @ApiQuery({\n    name: 'includeGrants',\n    required: false,\n    description: 'Includi permessi',\n    type: Boolean,\n  })\n  @ApiQuery({\n    name: 'limit',\n    required: false,\n    description: 'Numero massimo di utenti restituiti (1-1000). Omesso = tutti.',\n    type: Number,\n  })\n  @ApiQuery({\n    name: 'offset',\n    required: false,\n    description: 'Numero di utenti da saltare (paginazione).',\n    type: Number,\n  })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Get('get-users')\n  async getUsers(\n    @Req() request: Request,\n    @Res() res: Response,\n    @Query('email') email?: string,\n    @Query('codiceUtente', new ParseIntPipe({ optional: true })) codiceUtente?: number,\n    @Query('includeExtensionFields', new ParseBoolPipe({ optional: true }))\n    includeExtensionFields?: boolean,\n    @Query('includeGrants', new ParseBoolPipe({ optional: true }))\n    includeGrants?: boolean,\n    @Query('limit', new ParseIntPipe({ optional: true })) limit?: number,\n    @Query('offset', new ParseIntPipe({ optional: true })) offset?: number,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono consultare gli utenti.',\n      );\n\n      const filters = { email, codiceUtente, limit, offset };\n      const options = {\n        includeExtensionFields: includeExtensionFields ?? true,\n        includeGrants: includeGrants ?? true,\n      };\n\n      const users = await this.userService.getUsers(filters, options);\n      const total = await this.userService.countUsers({ email, codiceUtente });\n      res.setHeader('X-Total-Count', String(total));\n      return RestUtilities.sendBaseResponse(res, users);\n    } catch (error) {\n      this.logger.error('Errore durante il recupero degli utenti: ', error);\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Elimina un utente',\n    operationId: 'deleteUser',\n    description: 'Imposta lo stato di un utente a eliminato senza rimuovere i record.',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da eliminare\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({ status: 200, description: 'Utente eliminato con successo', type: ActionResponse })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nei parametri della richiesta',\n    type: ErrorResponse,\n  })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Delete('delete-user/:codiceUtente')\n  async deleteUser(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono eliminare utenti.',\n      );\n\n      await this.userService.deleteUser(codiceUtente);\n      return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato con successo.\");\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Forza l invio dell email di reset password a un utente',\n    operationId: 'forcePasswordReset',\n    description: 'Riservato al superutente. Richiede un servizio email configurato; altrimenti risponde con ACCESSI_EMAIL_NOT_CONFIGURED.',\n  })\n  @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n  @ApiResponse({ status: 200, description: 'Email di reset inviata', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n  @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('force-password-reset/:codiceUtente')\n  async forcePasswordReset(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono forzare il reset password.',\n      );\n      await this.userService.forcePasswordReset(codiceUtente);\n      return RestUtilities.sendOKMessage(res, `Email di reset inviata all utente ${codiceUtente}.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Forza il reset password per tutti gli utenti con password legacy',\n    operationId: 'forcePasswordResetLegacy',\n    description: 'Riservato al superutente. Invia l email di reset a tutti gli utenti la cui password non e ancora nel formato moderno. Richiede un servizio email configurato.',\n  })\n  @ApiResponse({ status: 200, description: 'Email di reset inviate', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('force-password-reset-legacy')\n  async forcePasswordResetLegacy(@Req() request: Request, @Res() res: Response) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono forzare il reset password.',\n      );\n      const sent = await this.userService.forcePasswordResetForLegacyPasswords();\n      return RestUtilities.sendOKMessage(res, `Email di reset inviata a ${sent} utenti con password legacy.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta lo stato di registrazione di un utente',\n    operationId: 'setStatoRegistrazione',\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Stato registrazione aggiornato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nei parametri della richiesta',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: 500,\n    description: 'Errore interno del server',\n    type: ErrorResponse,\n  })\n  @ApiBody({ type: SetStatoRegistrazioneDto })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('set-stato')\n  async setStatoRegistrazione(\n    @Req() request: Request,\n    @Body() body: SetStatoRegistrazioneDto,\n    @Res() res: Response,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono modificare lo stato di registrazione.',\n      );\n\n      const { codiceUtente, statoRegistrazione } = body;\n      if (!codiceUtente) throw new BadRequestException('Il codice utente e\\' obbligatorio.');\n      if (statoRegistrazione === undefined) {\n        throw new BadRequestException('Lo stato registrazione e\\' obbligatorio.');\n      }\n\n      await this.userService.setStato(codiceUtente, statoRegistrazione);\n      return RestUtilities.sendOKMessage(\n        res,\n        `Lo stato dell'utente ${codiceUtente} e' stato aggiornato a ${statoRegistrazione}.`,\n      );\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Registra un nuovo utente',\n    description: 'Disponibile soltanto quando publicRegistration.enabled e true. Per utenti SSO usare il provisioning master nel tag Federated authentication.',\n    operationId: 'register',\n  })\n  @ApiBody({\n    type: PublicRegisterRequest,\n    description: \"Dati necessari per la registrazione dell'utente\",\n  })\n  @ApiCreatedResponse({\n    description:\n      'Utente registrato con successo. Restituisce il codice utente e invia una mail di reset password.',\n    type: RegisterResponse,\n  })\n  @ApiResponse({\n    status: HttpStatus.BAD_REQUEST,\n    description: 'Errore nella registrazione.',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: HttpStatus.INTERNAL_SERVER_ERROR,\n    description: 'Errore interno del server durante la registrazione o l\\'invio email.',\n    type: ErrorResponse,\n  })\n  @Post('register')\n  async register(\n    @Req() request: Request,\n    @Body() registrationData: PublicRegisterRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      if (this.accessiOptions.publicRegistration?.enabled !== true) {\n        throw new HttpException(\n          'La registrazione pubblica e disabilitata. Un amministratore deve creare l utente.',\n          HttpStatus.FORBIDDEN,\n        );\n      }\n\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.accessiOptions,\n        'register',\n        request,\n        [registrationData?.email],\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      const codiceUtente = await this.userService.register(registrationData, {\n        allowPrivilegedFields: false,\n      });\n\n      await this.emailService.sendPasswordResetEmail(registrationData.email);\n      return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n    } catch (error) {\n      const status =\n        error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST;\n      return RestUtilities.sendErrorMessage(res, error, UserController.name, status);\n    }\n  }\n\n  @ApiOperation({ summary: 'Crea un utente locale da amministrazione', operationId: 'createManagedUser', description: 'Riservato a superutente. Crea un utente in attesa di impostazione password e invia la mail di reset.' })\n  @ApiBody({ type: RegisterRequest })\n  @ApiCreatedResponse({ type: RegisterResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('create-managed-user')\n  async createManagedUser(@Req() request: Request, @Body() registrationData: RegisterRequest, @Res() res: Response) {\n    try {\n      ensureUserManagement(getAuthenticatedAccessiUser(request), 'Solo gli amministratori possono creare utenti.');\n      const codiceUtente = await this.userService.register(registrationData, { allowPrivilegedFields: true });\n      await this.emailService.sendPasswordResetEmail(registrationData.email, registrationData.htmlMail);\n      return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Aggiorna un utente esistente',\n    operationId: 'updateUtente',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da aggiornare\",\n    required: true,\n    example: 123,\n  })\n  @ApiBody({\n    type: UserDto,\n    description: \"Dati aggiornati dell'utente\",\n  })\n  @ApiResponse({\n    status: HttpStatus.OK,\n    description: 'Utente aggiornato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({ status: 400, description: \"Errore nell'aggiornamento\", type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Put('update-user/:codiceUtente')\n  async updateUtente(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Body() user: UserDto,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      const isPrivilegedUpdate = hasPrivilegedUserChanges(user);\n\n      if (isPrivilegedUpdate) {\n        ensureUserManagement(\n          authenticatedUser,\n          'Solo gli amministratori possono modificare ruoli, permessi o flag privilegiati.',\n        );\n      } else {\n        ensureSelfOrSuperUser(\n          authenticatedUser,\n          codiceUtente,\n          'Puoi modificare solo il tuo profilo.',\n        );\n      }\n\n      if (user.codiceUtente !== undefined && user.codiceUtente !== codiceUtente) {\n        throw new BadRequestException('Il codice utente nel body non coincide con quello del path.');\n      }\n\n      await this.userService.updateUser(codiceUtente, user, {\n        allowPrivilegedChanges: authenticatedUser.flagSuper || authenticatedUser.flagAdmin,\n      });\n\n      return RestUtilities.sendOKMessage(\n        res,\n        `L'utente ${codiceUtente} e' stato aggiornato con successo.`,\n      );\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta il consenso GDPR per un utente',\n    operationId: 'setGdpr',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente che accetta il GDPR\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Consenso GDPR impostato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({ status: 400, description: 'Errore nella richiesta', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Patch('set-gdpr/:codiceUtente')\n  async setGdpr(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      ensureSelfOrSuperUser(\n        getAuthenticatedAccessiUser(request),\n        codiceUtente,\n        'Puoi impostare il GDPR solo sul tuo utente.',\n      );\n\n      await this.userService.setGdpr(codiceUtente);\n      return RestUtilities.sendOKMessage(res, `L'utente ${codiceUtente} ha accettato il GDPR.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n}\n"]}
+{"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAoBwB;AAExB,6CASyB;AACzB,+BAA4B;AAC5B,yCAAsC;AACtC,+CAAgD;AAEhD,uDAAqE;AACrE,+DAA4D;AAC5D,yEAAsE;AACtE,+DAA4D;AAC5D,6DAA0D;AAC1D,yEAAyE;AACzE,2EAAwE;AACxE,6CAA0C;AAC1C,qEAAkE;AAClE,wEAAqE;AACrE,qEAAkE;AAClE,sDAAqD;AACrD,yEAGyC;AACzC,6DAOmC;AAQ5B,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YAC6B,cAA+C,EACzD,WAAwB,EACxB,YAA0B,EAC1B,WAAwB;QAHG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAa;QAN1B,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAOvD,CAAC;IAEI,mBAAmB,CAAC,GAAa,EAAE,KAAc;QACvD,gFAAgF;QAChF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAYK,sBAAsB,CAAQ,GAAa,EAAkB,MAAc;;YAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAqDK,QAAQ,CACL,OAAgB,EAChB,GAAa,EACJ,KAAc,EAC+B,YAAqB,EAElF,sBAAgC,EAEhC,aAAuB,EAC+B,KAAc,EACb,MAAe;;YAEtE,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,wDAAwD,CACzD,CAAC;gBAEF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG;oBACd,sBAAsB,EAAE,sBAAsB,aAAtB,sBAAsB,cAAtB,sBAAsB,GAAI,IAAI;oBACtD,aAAa,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,IAAI;iBACrC,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAuBK,UAAU,CACP,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,mDAAmD,CACpD,CAAC;gBAEF,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAqBK,qBAAqB,CAClB,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,2BAAW,EACT,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;gBAEF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,4BAAmB,CAAC,0DAA0D,CAAC,CAAC;gBAC5F,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAcK,kBAAkB,CACf,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,qCAAqC,YAAY,GAAG,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAYK,wBAAwB,CAAQ,OAAgB,EAAS,GAAa;;YAC1E,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oCAAoC,EAAE,CAAC;gBAC3E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,IAAI,8BAA8B,CAAC,CAAC;YAC1G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAeK,eAAe,CACZ,OAAgB,EACc,YAAoB,EACjD,IAA4B,EAC7B,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,qEAAqE,CACtE,CAAC;gBAEF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAC9C,EAAE,YAAY,EAAE,EAChB,EAAE,sBAAsB,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,CACxD,CAAC;gBACF,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBAC1B,MAAM,IAAI,0BAAiB,CAAC,4BAA4B,YAAY,GAAG,CAAC,CAAC;gBAC3E,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACnE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,wBAAwB,YAAY,cAAc,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAyBK,qBAAqB,CAClB,OAAgB,EACf,IAA8B,EAC/B,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,uEAAuE,CACxE,CAAC;gBAEF,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;gBAClD,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;gBACvF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,wBAAwB,YAAY,0BAA0B,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,QAAQ,CACL,OAAgB,EACf,gBAAuC,EACxC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,kBAAkB,0CAAE,OAAO,MAAK,IAAI,EAAE,CAAC;oBAC7D,MAAM,IAAI,sBAAa,CACrB,mFAAmF,EACnF,mBAAU,CAAC,SAAS,CACrB,CAAC;gBACJ,CAAC;gBAED,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,cAAc,EACnB,UAAU,EACV,OAAO,EACP,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,KAAK,CAAC,CAC1B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,KAAK;iBAC7B,CAAC,CAAC;gBAEH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACvE,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GACV,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAAC;gBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;IAQK,iBAAiB,CAAQ,OAAgB,EAAU,gBAAiC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;gBAC1F,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;gBAChE,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxG,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBAClG,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,YAAY,CACT,OAAgB,EACc,YAAoB,EACjD,IAAa,EACd,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,kBAAkB,GAAG,IAAA,wCAAwB,EAAC,IAAI,CAAC,CAAC;gBAE1D,IAAI,kBAAkB,EAAE,CAAC;oBACvB,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,iFAAiF,CAClF,CAAC;oBACF,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;gBACtD,CAAC;qBAAM,CAAC;oBACN,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,sCAAsC,CACvC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBAC1E,MAAM,IAAI,4BAAmB,CAAC,6DAA6D,CAAC,CAAC;gBAC/F,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE;oBACpD,sBAAsB,EAAE,iBAAiB,CAAC,SAAS,IAAI,iBAAiB,CAAC,SAAS;iBACnF,CAAC,CAAC;gBAEH,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,YAAY,YAAY,oCAAoC,CAC7D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAsBK,OAAO,CACJ,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,IAAA,qCAAqB,EACnB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,YAAY,EACZ,6CAA6C,CAC9C,CAAC;gBAEF,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,YAAY,wBAAwB,CAAC,CAAC;YAC5F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAzgBY,wCAAc;AAyBnB;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,4BAA4B;KAC1C,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,YAAG,EAAC,uBAAuB,CAAC;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;4DAEjE;AAqDK;IAnDL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8BAA8B;QAC3C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+DAA+D;QAC5E,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4CAA4C;QACzD,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,WAAW,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3D,WAAA,IAAA,cAAK,EAAC,wBAAwB,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEtE,WAAA,IAAA,cAAK,EAAC,eAAe,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE7D,WAAA,IAAA,cAAK,EAAC,OAAO,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;;;;8CAsBvD;AAuBK;IArBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,qEAAqE;KACnF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,2BAA2B,CAAC;IAEjC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gDAaP;AAqBK;IAnBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,2FAA2F;KACzG,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gEAAgE;QAC7E,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,qCAAqC,CAAC;IAE3C,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAkBP;AAcK;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,yHAAyH;KACvI,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,oCAAoC,CAAC;IAExC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAYP;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kEAAkE;QAC3E,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,+JAA+J;KAC7K,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,6BAA6B,CAAC;IACJ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAW7D;AAeK;IAbL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,6GAA6G;KAC3H,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,+CAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACtF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACrF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAEhC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,+CAAsB;;qDAsBrC;AAyBK;IAvBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EAAE,uBAAuB;KACrC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,gDAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,WAAW,CAAC;IAEf,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,gDAAwB;;2DAuBvC;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,8IAA8I;QAC3J,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,6CAAqB;QAC3B,WAAW,EAAE,iDAAiD;KAC/D,CAAC;IACD,IAAA,4BAAkB,EAAC;QAClB,WAAW,EACT,kGAAkG;QACpG,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,WAAW;QAC9B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,qBAAqB;QACxC,WAAW,EAAE,sEAAsE;QACnF,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,UAAU,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADoB,6CAAqB;;8CAgChD;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;IAC5N,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAAe,EAAE,CAAC;IAClC,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,mCAAgB,EAAE,CAAC;IAC9C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,qBAAqB,CAAC;IACH,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAqC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAvB,iCAAe;;uDAWzF;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,cAAc;KAC5B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,iBAAO;QACb,WAAW,EAAE,6BAA6B;KAC3C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,EAAE;QACrB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAE9B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,iBAAO;;kDAoCtB;AAsBK;IApBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,SAAS;KACvB,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,cAAK,EAAC,wBAAwB,CAAC;IAE7B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6CAcP;yBAxgBU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAKE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACV,2BAAY;QACb,yBAAW;GAPhC,cAAc,CAygB1B","sourcesContent":["import {\n  BadRequestException,\n  Body,\n  Controller,\n  Delete,\n  Get,\n  HttpException,\n  HttpStatus,\n  NotFoundException,\n  Param,\n  ParseBoolPipe,\n  ParseIntPipe,\n  Patch,\n  Post,\n  Put,\n  Query,\n  Inject,\n  Req,\n  Res,\n  UseGuards,\n} from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport {\n  ApiBearerAuth,\n  ApiBody,\n  ApiCreatedResponse,\n  ApiOperation,\n  ApiParam,\n  ApiQuery,\n  ApiResponse,\n  ApiTags,\n} from '@nestjs/swagger';\nimport { join } from 'path';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { GetUsersResponse } from '../Dtos/GetUsersResponse';\nimport { PublicRegisterRequest } from '../Dtos/PublicRegisterRequest';\nimport { RegisterResponse } from '../Dtos/RegisterResponse';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { SetStatoRegistrazioneDto } from '../Dtos/SetStatoRegistrazione';\nimport { SetUserPasswordRequest } from '../Dtos/SetUserPasswordRequest';\nimport { UserDto } from '../Dtos/UserDto';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport {\n  checkPublicAuthRateLimit,\n  sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\nimport {\n  ensureAdmin,\n  ensurePrivilegeFlagChanges,\n  ensureSelfOrSuperUser,\n  ensureUserManagement,\n  getAuthenticatedAccessiUser,\n  hasPrivilegedUserChanges,\n} from '../security/accessControl';\n\n@ApiTags('User')\n@Controller('accessi/user')\n/**\n * Gestione utenti: la registrazione pubblica e opt-in, mentre creazione, stato e profili privilegiati\n * richiedono un superutente Accessi. Le API restituiscono sempre il wrapper `BaseResponse` storico.\n */\nexport class UserController {\n  private readonly logger = new Logger(UserController.name);\n\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly userService: UserService,\n    private readonly emailService: EmailService,\n    private readonly authService: AuthService,\n  ) {}\n\n  private sendControllerError(res: Response, error: unknown) {\n    // Lo status viene derivato centralmente da RestUtilities (HttpException o 500).\n    return RestUtilities.sendErrorMessage(res, error, UserController.name);\n  }\n\n  @ApiOperation({\n    summary: 'Serve la pagina di reset password',\n    operationId: 'serveResetPasswordPageUser',\n  })\n  @ApiParam({\n    name: 'token',\n    description: 'Token per il reset della password',\n    required: true,\n  })\n  @Get('reset-password/:token')\n  async serveResetPasswordPage(@Res() res: Response, @Param('token') _token: string) {\n    return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n  }\n\n  @ApiOperation({\n    summary: 'Recupera la lista degli utenti',\n    operationId: 'getUsers',\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Lista utenti recuperata con successo',\n    type: GetUsersResponse,\n  })\n  @ApiResponse({ status: 401, description: 'Credenziali non valide', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiQuery({\n    name: 'email',\n    required: false,\n    description: \"Email dell'utente da cercare\",\n    type: String,\n  })\n  @ApiQuery({\n    name: 'codiceUtente',\n    required: false,\n    description: \"Codice dell'utente da cercare\",\n    type: Number,\n  })\n  @ApiQuery({\n    name: 'includeExtensionFields',\n    required: false,\n    description: 'Includi extension fields',\n    type: Boolean,\n  })\n  @ApiQuery({\n    name: 'includeGrants',\n    required: false,\n    description: 'Includi permessi',\n    type: Boolean,\n  })\n  @ApiQuery({\n    name: 'limit',\n    required: false,\n    description: 'Numero massimo di utenti restituiti (1-1000). Omesso = tutti.',\n    type: Number,\n  })\n  @ApiQuery({\n    name: 'offset',\n    required: false,\n    description: 'Numero di utenti da saltare (paginazione).',\n    type: Number,\n  })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Get('get-users')\n  async getUsers(\n    @Req() request: Request,\n    @Res() res: Response,\n    @Query('email') email?: string,\n    @Query('codiceUtente', new ParseIntPipe({ optional: true })) codiceUtente?: number,\n    @Query('includeExtensionFields', new ParseBoolPipe({ optional: true }))\n    includeExtensionFields?: boolean,\n    @Query('includeGrants', new ParseBoolPipe({ optional: true }))\n    includeGrants?: boolean,\n    @Query('limit', new ParseIntPipe({ optional: true })) limit?: number,\n    @Query('offset', new ParseIntPipe({ optional: true })) offset?: number,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono consultare gli utenti.',\n      );\n\n      const filters = { email, codiceUtente, limit, offset };\n      const options = {\n        includeExtensionFields: includeExtensionFields ?? true,\n        includeGrants: includeGrants ?? true,\n      };\n\n      const users = await this.userService.getUsers(filters, options);\n      const total = await this.userService.countUsers({ email, codiceUtente });\n      res.setHeader('X-Total-Count', String(total));\n      return RestUtilities.sendBaseResponse(res, users);\n    } catch (error) {\n      this.logger.error('Errore durante il recupero degli utenti: ', error);\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Elimina un utente',\n    operationId: 'deleteUser',\n    description: 'Imposta lo stato di un utente a eliminato senza rimuovere i record.',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da eliminare\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({ status: 200, description: 'Utente eliminato con successo', type: ActionResponse })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nei parametri della richiesta',\n    type: ErrorResponse,\n  })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Delete('delete-user/:codiceUtente')\n  async deleteUser(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono eliminare utenti.',\n      );\n\n      await this.userService.deleteUser(codiceUtente);\n      return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato con successo.\");\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Elimina definitivamente un utente',\n    operationId: 'deleteUserPermanently',\n    description: 'Rimuove l utente e tutti i record collegati. Operazione distruttiva riservata agli admin.',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da eliminare definitivamente\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({ status: 200, description: 'Utente eliminato definitivamente', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Errore nei parametri della richiesta', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Delete('delete-user-permanent/:codiceUtente')\n  async deleteUserPermanently(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureAdmin(\n        authenticatedUser,\n        'Solo gli admin possono eliminare definitivamente un utente.',\n      );\n\n      if (authenticatedUser.codiceUtente === codiceUtente) {\n        throw new BadRequestException('Non puoi eliminare definitivamente il tuo stesso utente.');\n      }\n\n      await this.userService.deleteUserPermanently(codiceUtente);\n      return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato definitivamente.\");\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Forza l invio dell email di reset password a un utente',\n    operationId: 'forcePasswordReset',\n    description: 'Riservato al superutente. Richiede un servizio email configurato; altrimenti risponde con ACCESSI_EMAIL_NOT_CONFIGURED.',\n  })\n  @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n  @ApiResponse({ status: 200, description: 'Email di reset inviata', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n  @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('force-password-reset/:codiceUtente')\n  async forcePasswordReset(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono forzare il reset password.',\n      );\n      await this.userService.forcePasswordReset(codiceUtente);\n      return RestUtilities.sendOKMessage(res, `Email di reset inviata all utente ${codiceUtente}.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Forza il reset password per tutti gli utenti con password legacy',\n    operationId: 'forcePasswordResetLegacy',\n    description: 'Riservato al superutente. Invia l email di reset a tutti gli utenti la cui password non e ancora nel formato moderno. Richiede un servizio email configurato.',\n  })\n  @ApiResponse({ status: 200, description: 'Email di reset inviate', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('force-password-reset-legacy')\n  async forcePasswordResetLegacy(@Req() request: Request, @Res() res: Response) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono forzare il reset password.',\n      );\n      const sent = await this.userService.forcePasswordResetForLegacyPasswords();\n      return RestUtilities.sendOKMessage(res, `Email di reset inviata a ${sent} utenti con password legacy.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta direttamente la password di un utente',\n    operationId: 'setUserPassword',\n    description: 'Riservato agli amministratori. Hasha la password, aggiorna la scadenza secondo la policy e non invia email.',\n  })\n  @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n  @ApiBody({ type: SetUserPasswordRequest })\n  @ApiResponse({ status: 200, description: 'Password aggiornata', type: ActionResponse })\n  @ApiResponse({ status: 400, description: 'Password non valida', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('set-password/:codiceUtente')\n  async setUserPassword(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Body() body: SetUserPasswordRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono impostare la password di un utente.',\n      );\n\n      const existing = await this.userService.getUsers(\n        { codiceUtente },\n        { includeExtensionFields: false, includeGrants: false },\n      );\n      if (existing.length === 0) {\n        throw new NotFoundException(`Nessun utente con codice ${codiceUtente}.`);\n      }\n\n      await this.authService.setPassword(codiceUtente, body.newPassword);\n      return RestUtilities.sendOKMessage(res, `Password dell utente ${codiceUtente} aggiornata.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta lo stato di registrazione di un utente',\n    operationId: 'setStatoRegistrazione',\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Stato registrazione aggiornato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({\n    status: 400,\n    description: 'Errore nei parametri della richiesta',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: 500,\n    description: 'Errore interno del server',\n    type: ErrorResponse,\n  })\n  @ApiBody({ type: SetStatoRegistrazioneDto })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('set-stato')\n  async setStatoRegistrazione(\n    @Req() request: Request,\n    @Body() body: SetStatoRegistrazioneDto,\n    @Res() res: Response,\n  ) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono modificare lo stato di registrazione.',\n      );\n\n      const { codiceUtente, statoRegistrazione } = body;\n      if (!codiceUtente) throw new BadRequestException('Il codice utente e\\' obbligatorio.');\n      if (statoRegistrazione === undefined) {\n        throw new BadRequestException('Lo stato registrazione e\\' obbligatorio.');\n      }\n\n      await this.userService.setStato(codiceUtente, statoRegistrazione);\n      return RestUtilities.sendOKMessage(\n        res,\n        `Lo stato dell'utente ${codiceUtente} e' stato aggiornato a ${statoRegistrazione}.`,\n      );\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Registra un nuovo utente',\n    description: 'Disponibile soltanto quando publicRegistration.enabled e true. Per utenti SSO usare il provisioning master nel tag Federated authentication.',\n    operationId: 'register',\n  })\n  @ApiBody({\n    type: PublicRegisterRequest,\n    description: \"Dati necessari per la registrazione dell'utente\",\n  })\n  @ApiCreatedResponse({\n    description:\n      'Utente registrato con successo. Restituisce il codice utente e invia una mail di reset password.',\n    type: RegisterResponse,\n  })\n  @ApiResponse({\n    status: HttpStatus.BAD_REQUEST,\n    description: 'Errore nella registrazione.',\n    type: ErrorResponse,\n  })\n  @ApiResponse({\n    status: HttpStatus.INTERNAL_SERVER_ERROR,\n    description: 'Errore interno del server durante la registrazione o l\\'invio email.',\n    type: ErrorResponse,\n  })\n  @Post('register')\n  async register(\n    @Req() request: Request,\n    @Body() registrationData: PublicRegisterRequest,\n    @Res() res: Response,\n  ) {\n    try {\n      if (this.accessiOptions.publicRegistration?.enabled !== true) {\n        throw new HttpException(\n          'La registrazione pubblica e disabilitata. Un amministratore deve creare l utente.',\n          HttpStatus.FORBIDDEN,\n        );\n      }\n\n      const rateLimitDecision = checkPublicAuthRateLimit(\n        this.accessiOptions,\n        'register',\n        request,\n        [registrationData?.email],\n      );\n      if (!rateLimitDecision.allowed) {\n        return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n      }\n\n      const codiceUtente = await this.userService.register(registrationData, {\n        allowPrivilegedFields: false,\n      });\n\n      await this.emailService.sendPasswordResetEmail(registrationData.email);\n      return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n    } catch (error) {\n      const status =\n        error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST;\n      return RestUtilities.sendErrorMessage(res, error, UserController.name, status);\n    }\n  }\n\n  @ApiOperation({ summary: 'Crea un utente locale da amministrazione', operationId: 'createManagedUser', description: 'Riservato a superutente. Crea un utente in attesa di impostazione password e invia la mail di reset.' })\n  @ApiBody({ type: RegisterRequest })\n  @ApiCreatedResponse({ type: RegisterResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Post('create-managed-user')\n  async createManagedUser(@Req() request: Request, @Body() registrationData: RegisterRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono creare utenti.');\n      ensurePrivilegeFlagChanges(authenticatedUser, registrationData);\n      const codiceUtente = await this.userService.register(registrationData, { allowPrivilegedFields: true });\n      await this.emailService.sendPasswordResetEmail(registrationData.email, registrationData.htmlMail);\n      return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Aggiorna un utente esistente',\n    operationId: 'updateUtente',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente da aggiornare\",\n    required: true,\n    example: 123,\n  })\n  @ApiBody({\n    type: UserDto,\n    description: \"Dati aggiornati dell'utente\",\n  })\n  @ApiResponse({\n    status: HttpStatus.OK,\n    description: 'Utente aggiornato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({ status: 400, description: \"Errore nell'aggiornamento\", type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Put('update-user/:codiceUtente')\n  async updateUtente(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Body() user: UserDto,\n    @Res() res: Response,\n  ) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      const isPrivilegedUpdate = hasPrivilegedUserChanges(user);\n\n      if (isPrivilegedUpdate) {\n        ensureUserManagement(\n          authenticatedUser,\n          'Solo gli amministratori possono modificare ruoli, permessi o flag privilegiati.',\n        );\n        ensurePrivilegeFlagChanges(authenticatedUser, user);\n      } else {\n        ensureSelfOrSuperUser(\n          authenticatedUser,\n          codiceUtente,\n          'Puoi modificare solo il tuo profilo.',\n        );\n      }\n\n      if (user.codiceUtente !== undefined && user.codiceUtente !== codiceUtente) {\n        throw new BadRequestException('Il codice utente nel body non coincide con quello del path.');\n      }\n\n      await this.userService.updateUser(codiceUtente, user, {\n        allowPrivilegedChanges: authenticatedUser.flagSuper || authenticatedUser.flagAdmin,\n      });\n\n      return RestUtilities.sendOKMessage(\n        res,\n        `L'utente ${codiceUtente} e' stato aggiornato con successo.`,\n      );\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n\n  @ApiOperation({\n    summary: 'Imposta il consenso GDPR per un utente',\n    operationId: 'setGdpr',\n  })\n  @ApiParam({\n    name: 'codiceUtente',\n    description: \"Codice identificativo dell'utente che accetta il GDPR\",\n    required: true,\n    example: 123,\n  })\n  @ApiResponse({\n    status: 200,\n    description: 'Consenso GDPR impostato con successo',\n    type: ActionResponse,\n  })\n  @ApiResponse({ status: 400, description: 'Errore nella richiesta', type: ErrorResponse })\n  @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n  @ApiBearerAuth()\n  @UseGuards(JwtSimpleGuard)\n  @Patch('set-gdpr/:codiceUtente')\n  async setGdpr(\n    @Req() request: Request,\n    @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n    @Res() res: Response,\n  ) {\n    try {\n      ensureSelfOrSuperUser(\n        getAuthenticatedAccessiUser(request),\n        codiceUtente,\n        'Puoi impostare il GDPR solo sul tuo utente.',\n      );\n\n      await this.userService.setGdpr(codiceUtente);\n      return RestUtilities.sendOKMessage(res, `L'utente ${codiceUtente} ha accettato il GDPR.`);\n    } catch (error) {\n      return this.sendControllerError(res, error);\n    }\n  }\n}\n"]}

package/dist/accessi-module/Dtos/ConfirmResetPasswordRequest.js

@@ -17,7 +17,7 @@ class ConfirmResetPasswordRequest {
 exports.ConfirmResetPasswordRequest = ConfirmResetPasswordRequest;
 __decorate([
     (0, swagger_1.ApiProperty)({
-        description: 'Nuova password da impostare.',
+        description: 'Nuova password: almeno 8 caratteri con maiuscola, minuscola, cifra e carattere speciale, senza spazi e non comune. Se non conforme l API risponde 400 con codice ACCESSI_WEAK_PASSWORD.',
         minLength: 8,
         maxLength: 100,
         example: 'PasswordSicura123!',

package/dist/accessi-module/Dtos/ConfirmResetPasswordRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"ConfirmResetPasswordRequest.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/ConfirmResetPasswordRequest.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAAmD;AAEnD,MAAa,2BAA2B;CAYvC;AAZD,kEAYC;AADC;IAVC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,8BAA8B;QAC3C,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,oBAAoB;KAC9B,CAAC;IACD,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;IACnE,IAAA,wBAAM,EAAC,CAAC,EAAE,GAAG,EAAE;QACd,OAAO,EAAE,+DAA+D;KACzE,CAAC;;gEACmB","sourcesContent":["import { ApiProperty } from '@nestjs/swagger';\nimport { IsString, Length } from 'class-validator';\n\nexport class ConfirmResetPasswordRequest {\n  @ApiProperty({\n    description: 'Nuova password da impostare.',\n    minLength: 8,\n    maxLength: 100,\n    example: 'PasswordSicura123!',\n  })\n  @IsString({ message: 'La nuova password deve essere una stringa.' })\n  @Length(8, 100, {\n    message: 'La nuova password deve essere compresa tra 8 e 100 caratteri.',\n  })\n  newPassword!: string;\n}\n"]}
+{"version":3,"file":"ConfirmResetPasswordRequest.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/ConfirmResetPasswordRequest.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAAmD;AAEnD,MAAa,2BAA2B;CAYvC;AAZD,kEAYC;AADC;IAVC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,yLAAyL;QACtM,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,oBAAoB;KAC9B,CAAC;IACD,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;IACnE,IAAA,wBAAM,EAAC,CAAC,EAAE,GAAG,EAAE;QACd,OAAO,EAAE,+DAA+D;KACzE,CAAC;;gEACmB","sourcesContent":["import { ApiProperty } from '@nestjs/swagger';\nimport { IsString, Length } from 'class-validator';\n\nexport class ConfirmResetPasswordRequest {\n  @ApiProperty({\n    description: 'Nuova password: almeno 8 caratteri con maiuscola, minuscola, cifra e carattere speciale, senza spazi e non comune. Se non conforme l API risponde 400 con codice ACCESSI_WEAK_PASSWORD.',\n    minLength: 8,\n    maxLength: 100,\n    example: 'PasswordSicura123!',\n  })\n  @IsString({ message: 'La nuova password deve essere una stringa.' })\n  @Length(8, 100, {\n    message: 'La nuova password deve essere compresa tra 8 e 100 caratteri.',\n  })\n  newPassword!: string;\n}\n"]}

package/dist/accessi-module/Dtos/SetUserPasswordRequest.d.ts

@@ -0,0 +1,4 @@
+/** Impostazione diretta della password di un utente da parte di un admin. */
+export declare class SetUserPasswordRequest {
+    newPassword: string;
+}

package/dist/accessi-module/Dtos/SetUserPasswordRequest.js

@@ -0,0 +1,32 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SetUserPasswordRequest = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+/** Impostazione diretta della password di un utente da parte di un admin. */
+class SetUserPasswordRequest {
+}
+exports.SetUserPasswordRequest = SetUserPasswordRequest;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: "Nuova password in chiaro: almeno 8 caratteri con maiuscola, minuscola, cifra e carattere speciale, senza spazi e non comune. Viene hashata e non restituita; se non conforme l API risponde 400 con codice ACCESSI_WEAK_PASSWORD.",
+        minLength: 8,
+        maxLength: 100,
+        example: 'PasswordSicura123!',
+    }),
+    (0, class_validator_1.IsString)({ message: 'La nuova password deve essere una stringa.' }),
+    (0, class_validator_1.Length)(8, 100, {
+        message: 'La nuova password deve essere compresa tra 8 e 100 caratteri.',
+    }),
+    __metadata("design:type", String)
+], SetUserPasswordRequest.prototype, "newPassword", void 0);
+//# sourceMappingURL=SetUserPasswordRequest.js.map

package/dist/accessi-module/Dtos/SetUserPasswordRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SetUserPasswordRequest.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/SetUserPasswordRequest.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAAmD;AAEnD,6EAA6E;AAC7E,MAAa,sBAAsB;CAYlC;AAZD,wDAYC;AADC;IAVC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,mOAAmO;QAChP,SAAS,EAAE,CAAC;QACZ,SAAS,EAAE,GAAG;QACd,OAAO,EAAE,oBAAoB;KAC9B,CAAC;IACD,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,CAAC;IACnE,IAAA,wBAAM,EAAC,CAAC,EAAE,GAAG,EAAE;QACd,OAAO,EAAE,+DAA+D;KACzE,CAAC;;2DACmB","sourcesContent":["import { ApiProperty } from '@nestjs/swagger';\nimport { IsString, Length } from 'class-validator';\n\n/** Impostazione diretta della password di un utente da parte di un admin. */\nexport class SetUserPasswordRequest {\n  @ApiProperty({\n    description: \"Nuova password in chiaro: almeno 8 caratteri con maiuscola, minuscola, cifra e carattere speciale, senza spazi e non comune. Viene hashata e non restituita; se non conforme l API risponde 400 con codice ACCESSI_WEAK_PASSWORD.\",\n    minLength: 8,\n    maxLength: 100,\n    example: 'PasswordSicura123!',\n  })\n  @IsString({ message: 'La nuova password deve essere una stringa.' })\n  @Length(8, 100, {\n    message: 'La nuova password deve essere compresa tra 8 e 100 caratteri.',\n  })\n  newPassword!: string;\n}\n"]}

package/dist/accessi-module/Services/AuthService/AuthService.d.ts

@@ -38,8 +38,14 @@ export declare class AuthService {
     private validateTwoFactorProof;
     verifyTwoFactor(challengeId: string, code: string): Promise<LoginResult>;
     resendTwoFactor(challengeId: string): Promise<LoginResult>;
-    /** Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email. */
-    setPassword(codiceUtente: number, nuovaPassword: string): Promise<Record<string, unknown>[]>;
+    /**
+     * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.
+     * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di
+     * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.
+     */
+    setPassword(codiceUtente: number, nuovaPassword: string, options?: {
+        enforcePolicy?: boolean;
+    }): Promise<Record<string, unknown>[]>;
     /**
      * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.
      * E idempotente: hash moderni e gia migrati vengono ignorati.

package/dist/accessi-module/Services/AuthService/AuthService.js

@@ -66,6 +66,7 @@ const UserService_1 = require("../UserService/UserService");
 const FiltriService_1 = require("../FiltriService/FiltriService");
 const authenticatedToken_1 = require("../../security/authenticatedToken");
 const passwordResetToken_1 = require("../../security/passwordResetToken");
+const passwordPolicy_1 = require("../../security/passwordPolicy");
 const Logger_1 = require("../../../Logger");
 /** Error code deliberately returned when a user is configured as SSO-only. */
 exports.PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';
@@ -300,9 +301,16 @@ let AuthService = AuthService_1 = class AuthService {
             return { challenge: yield this.twoFactorService.resend(challengeId) };
         });
     }
-    /** Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email. */
-    setPassword(codiceUtente, nuovaPassword) {
+    /**
+     * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.
+     * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di
+     * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.
+     */
+    setPassword(codiceUtente, nuovaPassword, options) {
         return __awaiter(this, void 0, void 0, function* () {
+            if ((options === null || options === void 0 ? void 0 : options.enforcePolicy) !== false) {
+                (0, passwordPolicy_1.assertStrongPassword)(nuovaPassword);
+            }
             try {
                 const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;
                 const hashedPassword = Utilities_1.PasswordUtilities.hashPassword(nuovaPassword);
@@ -364,13 +372,13 @@ let AuthService = AuthService_1 = class AuthService {
             if (Utilities_1.PasswordUtilities.isLegacyPasswordHash(storedPassword)) {
                 const isMigratedLegacyPasswordValid = Utilities_1.PasswordUtilities.verifyLegacyEncryptedPassword(legacyEncryptedPassword, storedPassword);
                 if (isMigratedLegacyPasswordValid) {
-                    yield this.setPassword(codiceUtente, plainPassword);
+                    yield this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });
                 }
                 return isMigratedLegacyPasswordValid;
             }
             const isLegacyPasswordValid = Utilities_1.PasswordUtilities.timingSafeStringEquals(storedPassword, legacyEncryptedPassword);
             if (isLegacyPasswordValid) {
-                yield this.setPassword(codiceUtente, plainPassword);
+                yield this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });
             }
             return isLegacyPasswordValid;
         });
@@ -439,11 +447,7 @@ let AuthService = AuthService_1 = class AuthService {
                 if (typeof token !== "string" || token.trim() === "") {
                     throw new Error("Token non valido.");
                 }
-                if (typeof newPassword !== "string" ||
-                    newPassword.length < 8 ||
-                    newPassword.length > 100) {
-                    throw new Error("La nuova password deve essere compresa tra 8 e 100 caratteri.");
-                }
+                (0, passwordPolicy_1.assertStrongPassword)(newPassword);
                 const secret = (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions, 'reset');
                 const { codiceUtente, nonce } = (0, passwordResetToken_1.verifyPasswordResetToken)(token.trim(), secret);
                 const hashedPassword = Utilities_1.PasswordUtilities.hashPassword(newPassword);

package/dist/accessi-module/Services/AuthService/AuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AuthService/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA2E;AAC3E,2EAAwF;AACxF,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,sEAAmE;AACnE,4DAAyD;AACzD,kEAA+D;AAC/D,0EAK2C;AAC3C,0EAG2C;AAC3C,4CAAyC;AAGzC,8EAA8E;AACjE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAG1D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,aAA4B,EACT,cAA+C,EACzD,gBAAkC;QAH3C,gBAAW,GAAX,WAAW,CAAa;QACxB,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QACzD,qBAAgB,GAAhB,gBAAgB,CAAkB;QANpC,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qFAAqF;QACrF,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,CAAC;IAClC,CAAC;IAED,+EAA+E;IACxE,kBAAkB,CAAC,MAA6B,EAAE,UAAoB,EAAE;QAC7E,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,8BAAqB,CAAC,2CAA2C,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,EAAE;YACxG,SAAS,EAAE,SAAoD;SAChE,CAAC,CAAC;QAEH,wFAAwF;QACxF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAQ,OAA0B,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnG,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,OAAO;YACL,SAAS;YACT,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED,yFAAyF;IAC5E,qBAAqB,CAAC,YAAoB;;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAC3C,EAAE,YAAY,EAAE,EAChB,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CACtD,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAA,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,CAAC,IAAA,qDAAgC,EAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YACzG,MAAM,CAAC,MAAM,mCAAQ,MAAM,CAAC,MAAM,GAAK,OAAO,CAAE,CAAC;YAEjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC;QACJ,CAAC;KAAA;IAED,8EAA8E;IAChE,sBAAsB,CAAC,YAAoB;;;YACvD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE/E,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAmD,CAAC;YACnH,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,GAAG,CAAC;QAC9H,CAAC;KAAA;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAqB;;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,wBAAwB,EAAE,CAAC;gBACxH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YAChK,CAAC;YACD,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAEzD,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,+BAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB;oBAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,CAAC,CAAC,SAAS,CAAC;gBAEd,qGAAqG;gBACrG,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACnJ,CAAC;YAED,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;KAAA;IAED;;;OAGG;IACU,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAElE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1H,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,CAAC;KAAA;IAED,+FAA+F;IAClF,uBAAuB,CAAC,YAAoB,EAAE,WAAmB;;;YAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACvG,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACrI,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAqB;;;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrF,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7I,MAAM,IAAI,8BAAqB,CAAC,8DAA8D,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAAE,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;YAC7I,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;YACzJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,CAAA;oBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;gBAC7F,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAC9D,6KAA6K,EAC7K,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB,EAAE,IAAY;;YAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,qEAAqE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACpJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,kFAAkF,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAClK,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB;;YAC9C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,CAAC;KAAA;IAED,6GAA6G;IAChG,WAAW,CAAC,YAAoB,EAAE,aAAqB;;YAClE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACU,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAED,yGAAyG;IACnG,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEvC,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;gBACtD,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,6BAAiB,CAAC,sBAAsB,CACpE,cAAc,EACd,uBAAuB,CACxB,CAAC;YAEF,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAED,8GAA8G;IACxG,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,2EAA2E;IAC3E,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACU,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IACE,OAAO,WAAW,KAAK,QAAQ;oBAC/B,WAAW,CAAC,MAAM,GAAG,CAAC;oBACtB,WAAW,CAAC,MAAM,GAAG,GAAG,EACxB,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACjE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAEnE,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;;oBACnF,6EAA6E;oBAC7E,+EAA+E;oBAC/E,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,gBAAgB,CACxC,WAAW,EACX,mHAAmH,EACnH,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uCAAkB,CAAC,IAAI,EAAE,uCAAkB,CAAC,KAAK,CAAC,CAClG,CAAC;oBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;oBACnG,IAAI,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBAC3E,CAAC;oBAED,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,gFAAgF,EAChF,CAAC,YAAY,EAAE,cAAc,CAAC,CAC/B,CAAC;oBAEF,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;wBAChE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,yCAAyC,cAAc,6CAA6C,EACpG,CAAC,YAAY,CAAC,CACf,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAA,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAvfY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFL,yBAAW;QACT,6BAAa,UAED,mCAAgB;GAP1C,WAAW,CAufvB","sourcesContent":["import { Inject, Injectable, UnauthorizedException } from \"@nestjs/common\";\nimport { TwoFactorService, TwoFactorProof } from '../TwoFactorService/TwoFactorService';\nimport * as jwt from \"jsonwebtoken\";\nimport { Orm } from \"../../../Orm\";\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\nimport type { AccessiOptions } from \"../../AccessiModule\";\nimport { LoginRequest } from \"../../Dtos/LoginRequest\";\nimport { LoginResult } from \"../../Dtos/LoginResponse\";\nimport { StatoRegistrazione } from \"../../Dtos/StatoRegistrazione\";\nimport { UserService } from \"../UserService/UserService\";\nimport { FiltriService } from \"../FiltriService/FiltriService\";\nimport {\n  buildAuthenticatedTokenPayload,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../../security/authenticatedToken\";\nimport {\n  getAccessiJwtSecret,\n  verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport { Logger } from \"../../../Logger\";\nimport { TokenResult } from '../../Dtos/TokenResult';\n\n/** Error code deliberately returned when a user is configured as SSO-only. */\nexport const PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';\n\n@Injectable()\nexport class AuthService {\n  private readonly logger = new Logger(AuthService.name);\n\n  constructor(\n    private userService: UserService,\n    private filtriService: FiltriService,\n    @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions,\n    private readonly twoFactorService: TwoFactorService,\n  ) {}\n\n  private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\n    if (!this.accessiOptions.passwordExpiration) {\n      return;\n    }\n\n    const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\n    const expirationDays =\n      Number.isFinite(configuredDays) && configuredDays > 0\n        ? Math.trunc(configuredDays)\n        : 90;\n\n    const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\n    await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n  }\n\n  private isMockDemoUserEnabled(): boolean {\n    if (!this.accessiOptions.mockDemoUser) {\n      return false;\n    }\n\n    // La backdoor mock non e mai attiva in produzione, nemmeno con variabili d'ambiente,\n    // perche emette un superutente senza verifica password.\n    const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\n    return nodeEnv !== \"production\";\n  }\n\n  /** Creates the normal internal JWT consumed by all existing Accessi guards. */\n  public createAccessiToken(utente: LoginResult['utente'], methods: string[] = []): TokenResult {\n    if (!utente?.codiceUtente) {\n      throw new Error('Impossibile creare un token senza un utente Accessi valido.');\n    }\n    if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp')) {\n      throw new UnauthorizedException('Verifica del codice di accesso richiesta.');\n    }\n\n    const expiresIn = this.accessiOptions.jwtOptions.expiresIn;\n    if (typeof expiresIn !== 'string' || expiresIn.trim() === '') {\n      throw new Error('jwtOptions.expiresIn non configurato: impossibile emettere token senza scadenza.');\n    }\n\n    const token = jwt.sign({ utente, typ: 'access', amr: methods }, getAccessiJwtSecret(this.accessiOptions), {\n      expiresIn: expiresIn as unknown as jwt.SignOptions['expiresIn'],\n    });\n\n    // Difesa in profondita: un `expiresIn` malformato farebbe emettere un token permanente.\n    const decoded = jwt.decode(token);\n    if (!decoded || typeof decoded !== 'object' || typeof (decoded as jwt.JwtPayload).exp !== 'number') {\n      throw new Error('Token emesso senza scadenza: configurazione JWT non valida.');\n    }\n\n    return {\n      expiresIn,\n      value: token,\n      type: 'Bearer',\n    };\n  }\n\n  /** Builds the standard login response for a user authenticated by a supported method. */\n  public async getLoginResultForUser(codiceUtente: number): Promise<LoginResult> {\n    const users = await this.userService.getUsers(\n      { codiceUtente },\n      { includeExtensionFields: true, includeGrants: true },\n    );\n    const result = users[0];\n    if (!result?.utente) {\n      throw new Error('Utente Accessi non trovato.');\n    }\n    const current = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(current)) throw new UnauthorizedException('Utente non abilitato.');\n    result.utente = { ...result.utente, ...current };\n\n    return {\n      utente: result.utente,\n      filtri: await this.filtriService.getFiltriUser(codiceUtente),\n      userGrants: result.userGrants,\n      extensionFields: result.extensionFields,\n    };\n  }\n\n  /** Users without a row retain the historic password-login enabled default. */\n  private async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n    if (this.accessiOptions.federatedAuthentication?.enabled !== true) return true;\n\n    const rows = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n      [codiceUtente],\n    );\n    const policy = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { passwordLoginEnabled?: unknown } | undefined;\n    return policy?.passwordLoginEnabled !== false && policy?.passwordLoginEnabled !== 0 && policy?.passwordLoginEnabled !== '0';\n  }\n\n  /**\n   * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.\n   * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.\n   * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.\n   */\n  async login(request: LoginRequest): Promise<LoginResult> {\n    const mockDemoUserEnabled = this.isMockDemoUserEnabled();\n\n    if (\n      mockDemoUserEnabled &&\n      request.email.toLowerCase() === \"demo\"\n    ) {\n      return this.getDemoUser();\n    }\n\n    if (\n      mockDemoUserEnabled &&\n      request.email.toLowerCase() === \"admin\"\n    ) {\n      return this.getAdminUser();\n    }\n\n    const utente = await this.userService.getUserByEmail(\n      request.email.trim().toLowerCase()\n    );\n    if (!utente) {\n      if (!request.password) return { passwordRequired: true };\n      throw new Error(\"Nome utente o password errata!\");\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);\n    if (isAuthenticatedUserEnabledForJwt(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {\n      return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: (currentUser.email ?? '').trim(), mode: 'passwordless' }) };\n    }\n    // The email-only step has the same response for unknown and ordinary local accounts.\n    if (!request.password) return { passwordRequired: true };\n\n    switch (utente.statoRegistrazione) {\n      case undefined:\n        throw new Error(\n          \"Struttura dati compromessa: Stato Registrazione inesistente.\"\n        );\n      case StatoRegistrazione.BLOCC:\n      case StatoRegistrazione.DELETE:\n        throw new Error(\"Utente non abilitato\");\n      case StatoRegistrazione.INVIO:\n        throw new Error(\"Rinnovo password necessario.\");\n    }\n\n    if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\n      throw new Error(\n        `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\n      );\n    }\n\n    if (!isAuthenticatedUserEnabledForJwt(currentUser)) throw new Error('Utente non abilitato');\n    if (!(await this.isPasswordLoginEnabled(utente.codiceUtente))) {\n      throw new Error(PASSWORD_LOGIN_DISABLED);\n    }\n\n    if (typeof request.password !== 'string' || request.password.length === 0) {\n      throw new Error('Nome utente o password errata!');\n    }\n\n    const isPasswordValid = await this.verifyPassword(\n      utente.codiceUtente,\n      request.password\n    );\n    if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\n\n    if (\n      this.accessiOptions.passwordExpiration &&\n      this.accessiOptions.passwordExpiration == true\n    ) {\n      const today = new Date();\n      const targetDate = utente.dataScadenzaPassword\n        ? new Date(utente.dataScadenzaPassword)\n        : undefined;\n\n      // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.\n      if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {\n        throw new Error(\"PASSWORD_EXPIRED\");\n      }\n    }\n\n    if (currentUser.flagDueFattori) {\n      return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email ?? '', mode: 'password' }) };\n    }\n\n    const updateLastAccessDateQuery =\n      \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\n    await Orm.query(\n      this.accessiOptions.databaseOptions,\n      updateLastAccessDateQuery,\n      [utente.codiceUtente]\n    );\n\n    return this.getLoginResultForUser(utente.codiceUtente);\n  }\n\n  /**\n   * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.\n   * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.\n   */\n  public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\n    if (typeof token !== \"string\" || token.trim() === \"\") {\n      throw new Error(\"Token non fornito.\");\n    }\n\n    const secret = getAccessiJwtSecret(this.accessiOptions);\n    const decoded = jwt.verify(token.trim(), secret, { algorithms: ['HS256'] });\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n\n    if (!codiceUtente) {\n      throw new Error(\"Token non valido.\");\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!currentUser || !isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw new Error(\"Token non valido o utente non autorizzato.\");\n    }\n\n    return buildAuthenticatedTokenPayload(decoded, currentUser);\n  }\n\n  /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */\n  public async beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori) throw new UnauthorizedException();\n    return { challenge: await this.twoFactorService.issue({ codiceUtente, email: user.email ?? '', mode: 'federated', identityKey }) };\n  }\n\n  private async validateTwoFactorProof(proof: TwoFactorProof): Promise<void> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori || user.email?.trim().toLowerCase() !== proof.email.trim().toLowerCase()) {\n      throw new UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');\n    }\n    if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled) throw new UnauthorizedException('Accesso senza password disabilitato.');\n    if (proof.mode === 'password' && !(await this.isPasswordLoginEnabled(proof.codiceUtente))) throw new UnauthorizedException('Login locale disabilitato.');\n    if (proof.mode === 'federated') {\n      if (!this.accessiOptions.federatedAuthentication?.enabled) throw new UnauthorizedException();\n      const rows = await Orm.query(this.accessiOptions.databaseOptions,\n        'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1',\n        [proof.identityKey, proof.codiceUtente], false);\n      if (!rows.length) throw new UnauthorizedException('Identita SSO non piu abilitata.');\n    }\n  }\n\n  public async verifyTwoFactor(challengeId: string, code: string): Promise<LoginResult> {\n    const proof = await this.twoFactorService.consume(challengeId, code);\n    await this.validateTwoFactorProof(proof);\n    const result = await this.getLoginResultForUser(proof.codiceUtente);\n    result.token = this.createAccessiToken(result.utente, [proof.mode, 'otp']);\n    await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);\n    if (proof.mode === 'federated') {\n      await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);\n    }\n    return result;\n  }\n\n  public async resendTwoFactor(challengeId: string): Promise<LoginResult> {\n    await this.validateTwoFactorProof(await this.twoFactorService.describe(challengeId));\n    return { challenge: await this.twoFactorService.resend(challengeId) };\n  }\n\n  /** Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email. */\n  public async setPassword(codiceUtente: number, nuovaPassword: string) {\n    try {\n      const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\n      const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\n\n      const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\n        codiceUtente,\n        hashedPassword,\n      ]);\n      await this.refreshPasswordExpiration(codiceUtente);\n      return result;\n    } catch (error) {\n      throw error;\n    }\n  }\n\n  /**\n   * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.\n   * E idempotente: hash moderni e gia migrati vengono ignorati.\n   */\n  public async migrateLegacyEncryptedPasswords(): Promise<void> {\n    const startedAt = performance.now();\n    this.logger.info(\"Avvio migrazione password legacy accessi.\");\n    const results = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n      []\n    );\n\n    const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\n      codiceUtente?: number;\n      password?: string;\n    }[];\n    let migratedCount = 0;\n    let skippedCount = 0;\n\n    for (const row of rows) {\n      const codiceUtente = Number(row.codiceUtente);\n      const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\n      if (\n        !codiceUtente ||\n        !storedPassword ||\n        PasswordUtilities.isPasswordHash(storedPassword) ||\n        PasswordUtilities.isLegacyPasswordHash(storedPassword)\n      ) {\n        skippedCount += 1;\n        continue;\n      }\n\n      const protectedLegacyPassword =\n        PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\n\n      await Orm.execute(\n        this.accessiOptions.databaseOptions,\n        \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n        [protectedLegacyPassword, codiceUtente, storedPassword]\n      );\n      migratedCount += 1;\n    }\n\n    this.logger.info(\n      `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n    );\n  }\n\n  /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */\n  async verifyPassword(\n    codiceUtente: number,\n    plainPassword: string\n  ): Promise<boolean> {\n    const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\n    const result = (await Orm.query(\n      this.accessiOptions.databaseOptions,\n      query,\n      [codiceUtente]\n    ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\n      password: string;\n    }[];\n\n    const stored = result[0];\n    if (!stored || typeof stored.password !== \"string\") {\n      return false;\n    }\n\n    const storedPassword = stored.password;\n\n    if (PasswordUtilities.isPasswordHash(storedPassword)) {\n      return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\n    }\n\n    const legacyEncryptedPassword = CryptUtilities.encrypt(\n      plainPassword,\n      this.accessiOptions.encryptionKey\n    );\n\n    if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\n      const isMigratedLegacyPasswordValid =\n        PasswordUtilities.verifyLegacyEncryptedPassword(\n          legacyEncryptedPassword,\n          storedPassword\n        );\n\n      if (isMigratedLegacyPasswordValid) {\n        await this.setPassword(codiceUtente, plainPassword);\n      }\n\n      return isMigratedLegacyPasswordValid;\n    }\n\n    const isLegacyPasswordValid = PasswordUtilities.timingSafeStringEquals(\n      storedPassword,\n      legacyEncryptedPassword,\n    );\n\n    if (isLegacyPasswordValid) {\n      await this.setPassword(codiceUtente, plainPassword);\n    }\n\n    return isLegacyPasswordValid;\n  }\n\n  /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */\n  async getAdminUser(): Promise<LoginResult> {\n    return {\n      utente: {\n        codiceUtente: 6789,\n        email: \"admin\",\n        statoRegistrazione: StatoRegistrazione.CONF,\n        cognome: \"Admin\",\n        nome: \"Admin\",\n        flagGdpr: true,\n        avatar: \"/path/to/avatar.jpg\",\n        flagDueFattori: false,\n        codiceLingua: \"IT\",\n        cellulare: \"+391234567890\",\n        flagSuper: true,\n        roles: [],\n        permissions: [],\n      },\n      filtri: null,\n      userGrants: {\n        abilitazioni: [],\n        grants: [],\n        ruoli: [],\n      },\n    };\n  }\n\n  /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */\n  getDemoUser(): LoginResult {\n    return {\n      utente: {\n        codiceUtente: 12345,\n        email: \"jdoe\",\n        statoRegistrazione: StatoRegistrazione.CONF,\n        cognome: \"Doe\",\n        nome: \"John\",\n        flagGdpr: true,\n        avatar: \"/path/to/avatar.jpg\",\n        flagDueFattori: false,\n        codiceLingua: \"IT\",\n        cellulare: \"+391234567890\",\n        flagSuper: false,\n        roles: [],\n        permissions: [],\n      },\n      filtri: null,\n      userGrants: {\n        abilitazioni: [],\n        grants: [],\n        ruoli: [],\n      },\n    };\n  }\n\n  /**\n   * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.\n   * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.\n   */\n  public async confirmResetPassword(\n    token: string,\n    newPassword: string\n  ): Promise<void> {\n    try {\n      if (typeof token !== \"string\" || token.trim() === \"\") {\n        throw new Error(\"Token non valido.\");\n      }\n\n      if (\n        typeof newPassword !== \"string\" ||\n        newPassword.length < 8 ||\n        newPassword.length > 100\n      ) {\n        throw new Error(\"La nuova password deve essere compresa tra 8 e 100 caratteri.\");\n      }\n\n      const secret = getAccessiJwtSecret(this.accessiOptions, 'reset');\n      const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\n\n      const hashedPassword = PasswordUtilities.hashPassword(newPassword);\n\n      await Orm.withTransaction(this.accessiOptions.databaseOptions, async (transaction) => {\n        // A conditional write claims the nonce under the database row lock. A second\n        // concurrent reset cannot also consume it; failures roll the whole reset back.\n        const claimed = await Orm.transactionQuery<unknown>(\n          transaction,\n          'UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE',\n          [StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione.CONF, StatoRegistrazione.INVIO],\n        );\n        const row = (Array.isArray(claimed) ? claimed[0] : claimed) as Record<string, unknown> | undefined;\n        if (Number(row?.CODUTE ?? row?.codute) !== codiceUtente) {\n          throw new Error('Token non valido, gia usato o utente non autorizzato.');\n        }\n\n        await Orm.transactionQuery(\n          transaction,\n          'UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)',\n          [codiceUtente, hashedPassword],\n        );\n\n        if (this.accessiOptions.passwordExpiration) {\n          const days = Number(this.accessiOptions.passwordExpirationDays);\n          const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;\n          await Orm.transactionQuery(\n            transaction,\n            `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`,\n            [codiceUtente],\n          );\n        }\n      });\n    } catch (error) {\n      throw error;\n    }\n  }\n}\n"]}
+{"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AuthService/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA2E;AAC3E,2EAAwF;AACxF,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,sEAAmE;AACnE,4DAAyD;AACzD,kEAA+D;AAC/D,0EAK2C;AAC3C,0EAG2C;AAC3C,kEAAqE;AACrE,4CAAyC;AAGzC,8EAA8E;AACjE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAG1D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,aAA4B,EACT,cAA+C,EACzD,gBAAkC;QAH3C,gBAAW,GAAX,WAAW,CAAa;QACxB,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QACzD,qBAAgB,GAAhB,gBAAgB,CAAkB;QANpC,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qFAAqF;QACrF,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,CAAC;IAClC,CAAC;IAED,+EAA+E;IACxE,kBAAkB,CAAC,MAA6B,EAAE,UAAoB,EAAE;QAC7E,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;YACxG,MAAM,IAAI,8BAAqB,CAAC,2CAA2C,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QAC3D,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,EAAE;YACxG,SAAS,EAAE,SAAoD;SAChE,CAAC,CAAC;QAEH,wFAAwF;QACxF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAQ,OAA0B,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACnG,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,OAAO;YACL,SAAS;YACT,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED,yFAAyF;IAC5E,qBAAqB,CAAC,YAAoB;;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAC3C,EAAE,YAAY,EAAE,EAChB,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CACtD,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAA,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,CAAC,IAAA,qDAAgC,EAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YACzG,MAAM,CAAC,MAAM,mCAAQ,MAAM,CAAC,MAAM,GAAK,OAAO,CAAE,CAAC;YAEjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC;QACJ,CAAC;KAAA;IAED,8EAA8E;IAChE,sBAAsB,CAAC,YAAoB;;;YACvD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE/E,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAmD,CAAC;YACnH,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,GAAG,CAAC;QAC9H,CAAC;KAAA;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAqB;;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,wBAAwB,EAAE,CAAC;gBACxH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YAChK,CAAC;YACD,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAEzD,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,+BAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB;oBAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,CAAC,CAAC,SAAS,CAAC;gBAEd,qGAAqG;gBACrG,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACnJ,CAAC;YAED,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;KAAA;IAED;;;OAGG;IACU,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAElE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1H,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,CAAC;KAAA;IAED,+FAA+F;IAClF,uBAAuB,CAAC,YAAoB,EAAE,WAAmB;;;YAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACvG,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACrI,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAqB;;;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrF,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7I,MAAM,IAAI,8BAAqB,CAAC,8DAA8D,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAAE,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;YAC7I,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;YACzJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,CAAA;oBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;gBAC7F,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAC9D,6KAA6K,EAC7K,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB,EAAE,IAAY;;YAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,qEAAqE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACpJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,kFAAkF,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAClK,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB;;YAC9C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,CAAC;KAAA;IAED;;;;OAIG;IACU,WAAW,CACtB,YAAoB,EACpB,aAAqB,EACrB,OAAqC;;YAErC,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,MAAK,KAAK,EAAE,CAAC;gBACrC,IAAA,qCAAoB,EAAC,aAAa,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACU,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAED,yGAAyG;IACnG,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEvC,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChF,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,6BAAiB,CAAC,sBAAsB,CACpE,cAAc,EACd,uBAAuB,CACxB,CAAC;YAEF,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAED,8GAA8G;IACxG,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,2EAA2E;IAC3E,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACU,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IAAA,qCAAoB,EAAC,WAAW,CAAC,CAAC;gBAElC,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACjE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAEnE,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;;oBACnF,6EAA6E;oBAC7E,+EAA+E;oBAC/E,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,gBAAgB,CACxC,WAAW,EACX,mHAAmH,EACnH,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uCAAkB,CAAC,IAAI,EAAE,uCAAkB,CAAC,KAAK,CAAC,CAClG,CAAC;oBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;oBACnG,IAAI,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBAC3E,CAAC;oBAED,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,gFAAgF,EAChF,CAAC,YAAY,EAAE,cAAc,CAAC,CAC/B,CAAC;oBAEF,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;wBAChE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,yCAAyC,cAAc,6CAA6C,EACpG,CAAC,YAAY,CAAC,CACf,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAA,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA5fY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFL,yBAAW;QACT,6BAAa,UAED,mCAAgB;GAP1C,WAAW,CA4fvB","sourcesContent":["import { Inject, Injectable, UnauthorizedException } from \"@nestjs/common\";\nimport { TwoFactorService, TwoFactorProof } from '../TwoFactorService/TwoFactorService';\nimport * as jwt from \"jsonwebtoken\";\nimport { Orm } from \"../../../Orm\";\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\nimport type { AccessiOptions } from \"../../AccessiModule\";\nimport { LoginRequest } from \"../../Dtos/LoginRequest\";\nimport { LoginResult } from \"../../Dtos/LoginResponse\";\nimport { StatoRegistrazione } from \"../../Dtos/StatoRegistrazione\";\nimport { UserService } from \"../UserService/UserService\";\nimport { FiltriService } from \"../FiltriService/FiltriService\";\nimport {\n  buildAuthenticatedTokenPayload,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../../security/authenticatedToken\";\nimport {\n  getAccessiJwtSecret,\n  verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport { assertStrongPassword } from '../../security/passwordPolicy';\nimport { Logger } from \"../../../Logger\";\nimport { TokenResult } from '../../Dtos/TokenResult';\n\n/** Error code deliberately returned when a user is configured as SSO-only. */\nexport const PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';\n\n@Injectable()\nexport class AuthService {\n  private readonly logger = new Logger(AuthService.name);\n\n  constructor(\n    private userService: UserService,\n    private filtriService: FiltriService,\n    @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions,\n    private readonly twoFactorService: TwoFactorService,\n  ) {}\n\n  private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\n    if (!this.accessiOptions.passwordExpiration) {\n      return;\n    }\n\n    const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\n    const expirationDays =\n      Number.isFinite(configuredDays) && configuredDays > 0\n        ? Math.trunc(configuredDays)\n        : 90;\n\n    const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\n    await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n  }\n\n  private isMockDemoUserEnabled(): boolean {\n    if (!this.accessiOptions.mockDemoUser) {\n      return false;\n    }\n\n    // La backdoor mock non e mai attiva in produzione, nemmeno con variabili d'ambiente,\n    // perche emette un superutente senza verifica password.\n    const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\n    return nodeEnv !== \"production\";\n  }\n\n  /** Creates the normal internal JWT consumed by all existing Accessi guards. */\n  public createAccessiToken(utente: LoginResult['utente'], methods: string[] = []): TokenResult {\n    if (!utente?.codiceUtente) {\n      throw new Error('Impossibile creare un token senza un utente Accessi valido.');\n    }\n    if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp')) {\n      throw new UnauthorizedException('Verifica del codice di accesso richiesta.');\n    }\n\n    const expiresIn = this.accessiOptions.jwtOptions.expiresIn;\n    if (typeof expiresIn !== 'string' || expiresIn.trim() === '') {\n      throw new Error('jwtOptions.expiresIn non configurato: impossibile emettere token senza scadenza.');\n    }\n\n    const token = jwt.sign({ utente, typ: 'access', amr: methods }, getAccessiJwtSecret(this.accessiOptions), {\n      expiresIn: expiresIn as unknown as jwt.SignOptions['expiresIn'],\n    });\n\n    // Difesa in profondita: un `expiresIn` malformato farebbe emettere un token permanente.\n    const decoded = jwt.decode(token);\n    if (!decoded || typeof decoded !== 'object' || typeof (decoded as jwt.JwtPayload).exp !== 'number') {\n      throw new Error('Token emesso senza scadenza: configurazione JWT non valida.');\n    }\n\n    return {\n      expiresIn,\n      value: token,\n      type: 'Bearer',\n    };\n  }\n\n  /** Builds the standard login response for a user authenticated by a supported method. */\n  public async getLoginResultForUser(codiceUtente: number): Promise<LoginResult> {\n    const users = await this.userService.getUsers(\n      { codiceUtente },\n      { includeExtensionFields: true, includeGrants: true },\n    );\n    const result = users[0];\n    if (!result?.utente) {\n      throw new Error('Utente Accessi non trovato.');\n    }\n    const current = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(current)) throw new UnauthorizedException('Utente non abilitato.');\n    result.utente = { ...result.utente, ...current };\n\n    return {\n      utente: result.utente,\n      filtri: await this.filtriService.getFiltriUser(codiceUtente),\n      userGrants: result.userGrants,\n      extensionFields: result.extensionFields,\n    };\n  }\n\n  /** Users without a row retain the historic password-login enabled default. */\n  private async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n    if (this.accessiOptions.federatedAuthentication?.enabled !== true) return true;\n\n    const rows = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n      [codiceUtente],\n    );\n    const policy = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { passwordLoginEnabled?: unknown } | undefined;\n    return policy?.passwordLoginEnabled !== false && policy?.passwordLoginEnabled !== 0 && policy?.passwordLoginEnabled !== '0';\n  }\n\n  /**\n   * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.\n   * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.\n   * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.\n   */\n  async login(request: LoginRequest): Promise<LoginResult> {\n    const mockDemoUserEnabled = this.isMockDemoUserEnabled();\n\n    if (\n      mockDemoUserEnabled &&\n      request.email.toLowerCase() === \"demo\"\n    ) {\n      return this.getDemoUser();\n    }\n\n    if (\n      mockDemoUserEnabled &&\n      request.email.toLowerCase() === \"admin\"\n    ) {\n      return this.getAdminUser();\n    }\n\n    const utente = await this.userService.getUserByEmail(\n      request.email.trim().toLowerCase()\n    );\n    if (!utente) {\n      if (!request.password) return { passwordRequired: true };\n      throw new Error(\"Nome utente o password errata!\");\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);\n    if (isAuthenticatedUserEnabledForJwt(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {\n      return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: (currentUser.email ?? '').trim(), mode: 'passwordless' }) };\n    }\n    // The email-only step has the same response for unknown and ordinary local accounts.\n    if (!request.password) return { passwordRequired: true };\n\n    switch (utente.statoRegistrazione) {\n      case undefined:\n        throw new Error(\n          \"Struttura dati compromessa: Stato Registrazione inesistente.\"\n        );\n      case StatoRegistrazione.BLOCC:\n      case StatoRegistrazione.DELETE:\n        throw new Error(\"Utente non abilitato\");\n      case StatoRegistrazione.INVIO:\n        throw new Error(\"Rinnovo password necessario.\");\n    }\n\n    if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\n      throw new Error(\n        `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\n      );\n    }\n\n    if (!isAuthenticatedUserEnabledForJwt(currentUser)) throw new Error('Utente non abilitato');\n    if (!(await this.isPasswordLoginEnabled(utente.codiceUtente))) {\n      throw new Error(PASSWORD_LOGIN_DISABLED);\n    }\n\n    if (typeof request.password !== 'string' || request.password.length === 0) {\n      throw new Error('Nome utente o password errata!');\n    }\n\n    const isPasswordValid = await this.verifyPassword(\n      utente.codiceUtente,\n      request.password\n    );\n    if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\n\n    if (\n      this.accessiOptions.passwordExpiration &&\n      this.accessiOptions.passwordExpiration == true\n    ) {\n      const today = new Date();\n      const targetDate = utente.dataScadenzaPassword\n        ? new Date(utente.dataScadenzaPassword)\n        : undefined;\n\n      // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.\n      if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {\n        throw new Error(\"PASSWORD_EXPIRED\");\n      }\n    }\n\n    if (currentUser.flagDueFattori) {\n      return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email ?? '', mode: 'password' }) };\n    }\n\n    const updateLastAccessDateQuery =\n      \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\n    await Orm.query(\n      this.accessiOptions.databaseOptions,\n      updateLastAccessDateQuery,\n      [utente.codiceUtente]\n    );\n\n    return this.getLoginResultForUser(utente.codiceUtente);\n  }\n\n  /**\n   * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.\n   * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.\n   */\n  public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\n    if (typeof token !== \"string\" || token.trim() === \"\") {\n      throw new Error(\"Token non fornito.\");\n    }\n\n    const secret = getAccessiJwtSecret(this.accessiOptions);\n    const decoded = jwt.verify(token.trim(), secret, { algorithms: ['HS256'] });\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n\n    if (!codiceUtente) {\n      throw new Error(\"Token non valido.\");\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!currentUser || !isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw new Error(\"Token non valido o utente non autorizzato.\");\n    }\n\n    return buildAuthenticatedTokenPayload(decoded, currentUser);\n  }\n\n  /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */\n  public async beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori) throw new UnauthorizedException();\n    return { challenge: await this.twoFactorService.issue({ codiceUtente, email: user.email ?? '', mode: 'federated', identityKey }) };\n  }\n\n  private async validateTwoFactorProof(proof: TwoFactorProof): Promise<void> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori || user.email?.trim().toLowerCase() !== proof.email.trim().toLowerCase()) {\n      throw new UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');\n    }\n    if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled) throw new UnauthorizedException('Accesso senza password disabilitato.');\n    if (proof.mode === 'password' && !(await this.isPasswordLoginEnabled(proof.codiceUtente))) throw new UnauthorizedException('Login locale disabilitato.');\n    if (proof.mode === 'federated') {\n      if (!this.accessiOptions.federatedAuthentication?.enabled) throw new UnauthorizedException();\n      const rows = await Orm.query(this.accessiOptions.databaseOptions,\n        'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1',\n        [proof.identityKey, proof.codiceUtente], false);\n      if (!rows.length) throw new UnauthorizedException('Identita SSO non piu abilitata.');\n    }\n  }\n\n  public async verifyTwoFactor(challengeId: string, code: string): Promise<LoginResult> {\n    const proof = await this.twoFactorService.consume(challengeId, code);\n    await this.validateTwoFactorProof(proof);\n    const result = await this.getLoginResultForUser(proof.codiceUtente);\n    result.token = this.createAccessiToken(result.utente, [proof.mode, 'otp']);\n    await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);\n    if (proof.mode === 'federated') {\n      await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);\n    }\n    return result;\n  }\n\n  public async resendTwoFactor(challengeId: string): Promise<LoginResult> {\n    await this.validateTwoFactorProof(await this.twoFactorService.describe(challengeId));\n    return { challenge: await this.twoFactorService.resend(challengeId) };\n  }\n\n  /**\n   * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.\n   * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di\n   * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.\n   */\n  public async setPassword(\n    codiceUtente: number,\n    nuovaPassword: string,\n    options?: { enforcePolicy?: boolean },\n  ) {\n    if (options?.enforcePolicy !== false) {\n      assertStrongPassword(nuovaPassword);\n    }\n    try {\n      const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\n      const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\n\n      const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\n        codiceUtente,\n        hashedPassword,\n      ]);\n      await this.refreshPasswordExpiration(codiceUtente);\n      return result;\n    } catch (error) {\n      throw error;\n    }\n  }\n\n  /**\n   * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.\n   * E idempotente: hash moderni e gia migrati vengono ignorati.\n   */\n  public async migrateLegacyEncryptedPasswords(): Promise<void> {\n    const startedAt = performance.now();\n    this.logger.info(\"Avvio migrazione password legacy accessi.\");\n    const results = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n      []\n    );\n\n    const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\n      codiceUtente?: number;\n      password?: string;\n    }[];\n    let migratedCount = 0;\n    let skippedCount = 0;\n\n    for (const row of rows) {\n      const codiceUtente = Number(row.codiceUtente);\n      const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\n      if (\n        !codiceUtente ||\n        !storedPassword ||\n        PasswordUtilities.isPasswordHash(storedPassword) ||\n        PasswordUtilities.isLegacyPasswordHash(storedPassword)\n      ) {\n        skippedCount += 1;\n        continue;\n      }\n\n      const protectedLegacyPassword =\n        PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\n\n      await Orm.execute(\n        this.accessiOptions.databaseOptions,\n        \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n        [protectedLegacyPassword, codiceUtente, storedPassword]\n      );\n      migratedCount += 1;\n    }\n\n    this.logger.info(\n      `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n    );\n  }\n\n  /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */\n  async verifyPassword(\n    codiceUtente: number,\n    plainPassword: string\n  ): Promise<boolean> {\n    const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\n    const result = (await Orm.query(\n      this.accessiOptions.databaseOptions,\n      query,\n      [codiceUtente]\n    ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\n      password: string;\n    }[];\n\n    const stored = result[0];\n    if (!stored || typeof stored.password !== \"string\") {\n      return false;\n    }\n\n    const storedPassword = stored.password;\n\n    if (PasswordUtilities.isPasswordHash(storedPassword)) {\n      return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\n    }\n\n    const legacyEncryptedPassword = CryptUtilities.encrypt(\n      plainPassword,\n      this.accessiOptions.encryptionKey\n    );\n\n    if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\n      const isMigratedLegacyPasswordValid =\n        PasswordUtilities.verifyLegacyEncryptedPassword(\n          legacyEncryptedPassword,\n          storedPassword\n        );\n\n      if (isMigratedLegacyPasswordValid) {\n        await this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });\n      }\n\n      return isMigratedLegacyPasswordValid;\n    }\n\n    const isLegacyPasswordValid = PasswordUtilities.timingSafeStringEquals(\n      storedPassword,\n      legacyEncryptedPassword,\n    );\n\n    if (isLegacyPasswordValid) {\n      await this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });\n    }\n\n    return isLegacyPasswordValid;\n  }\n\n  /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */\n  async getAdminUser(): Promise<LoginResult> {\n    return {\n      utente: {\n        codiceUtente: 6789,\n        email: \"admin\",\n        statoRegistrazione: StatoRegistrazione.CONF,\n        cognome: \"Admin\",\n        nome: \"Admin\",\n        flagGdpr: true,\n        avatar: \"/path/to/avatar.jpg\",\n        flagDueFattori: false,\n        codiceLingua: \"IT\",\n        cellulare: \"+391234567890\",\n        flagSuper: true,\n        roles: [],\n        permissions: [],\n      },\n      filtri: null,\n      userGrants: {\n        abilitazioni: [],\n        grants: [],\n        ruoli: [],\n      },\n    };\n  }\n\n  /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */\n  getDemoUser(): LoginResult {\n    return {\n      utente: {\n        codiceUtente: 12345,\n        email: \"jdoe\",\n        statoRegistrazione: StatoRegistrazione.CONF,\n        cognome: \"Doe\",\n        nome: \"John\",\n        flagGdpr: true,\n        avatar: \"/path/to/avatar.jpg\",\n        flagDueFattori: false,\n        codiceLingua: \"IT\",\n        cellulare: \"+391234567890\",\n        flagSuper: false,\n        roles: [],\n        permissions: [],\n      },\n      filtri: null,\n      userGrants: {\n        abilitazioni: [],\n        grants: [],\n        ruoli: [],\n      },\n    };\n  }\n\n  /**\n   * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.\n   * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.\n   */\n  public async confirmResetPassword(\n    token: string,\n    newPassword: string\n  ): Promise<void> {\n    try {\n      if (typeof token !== \"string\" || token.trim() === \"\") {\n        throw new Error(\"Token non valido.\");\n      }\n\n      assertStrongPassword(newPassword);\n\n      const secret = getAccessiJwtSecret(this.accessiOptions, 'reset');\n      const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\n\n      const hashedPassword = PasswordUtilities.hashPassword(newPassword);\n\n      await Orm.withTransaction(this.accessiOptions.databaseOptions, async (transaction) => {\n        // A conditional write claims the nonce under the database row lock. A second\n        // concurrent reset cannot also consume it; failures roll the whole reset back.\n        const claimed = await Orm.transactionQuery<unknown>(\n          transaction,\n          'UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE',\n          [StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione.CONF, StatoRegistrazione.INVIO],\n        );\n        const row = (Array.isArray(claimed) ? claimed[0] : claimed) as Record<string, unknown> | undefined;\n        if (Number(row?.CODUTE ?? row?.codute) !== codiceUtente) {\n          throw new Error('Token non valido, gia usato o utente non autorizzato.');\n        }\n\n        await Orm.transactionQuery(\n          transaction,\n          'UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)',\n          [codiceUtente, hashedPassword],\n        );\n\n        if (this.accessiOptions.passwordExpiration) {\n          const days = Number(this.accessiOptions.passwordExpirationDays);\n          const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;\n          await Orm.transactionQuery(\n            transaction,\n            `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`,\n            [codiceUtente],\n          );\n        }\n      });\n    } catch (error) {\n      throw error;\n    }\n  }\n}\n"]}

package/dist/accessi-module/Services/UserService/UserService.d.ts

@@ -72,6 +72,11 @@ export declare class UserService {
     updateUserFilters(codiceUtente: number, user: UserDto): Promise<void>;
     /** Eliminazione logica: imposta lo stato `DELETE` senza cancellare lo storico o i collegamenti SSO. */
     deleteUser(codiceCliente: number): Promise<void>;
+    /**
+     * Eliminazione definitiva: rimuove l'utente e tutti i record collegati in un'unica
+     * transazione. Operazione distruttiva riservata agli admin (il superutente usa il soft delete).
+     */
+    deleteUserPermanently(codiceUtente: number): Promise<void>;
     /** Cambia esplicitamente lo stato di registrazione; usare questa API per blocco, conferma o eliminazione logica. */
     setStato(codiceCliente: number, statoRegistrazione: StatoRegistrazione): Promise<void>;
     setGdpr(codiceUtente: number): Promise<string>;