npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.42 → 2.0.0-dev.43 - Mend

emilsoftware-utilities 2.0.0-dev.42 → 2.0.0-dev.43

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (69) hide show

package/dist/accessi-module/federated-auth/FederatedAuthService.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"FederatedAuthService.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4M;AAC5M,mCAAoC;AACpC,uFAAoF;AACpF,mCAAgC;AAChC,+CAAgD;AAGhD,mEAAgE;AAChE,qEAAkE;AAClE,qEAAkE;AAClE,uEAAkF;AAwBlF;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAC8C,OAAuB,EAClD,WAAwB,EACxB,WAAwB;QAFG,YAAO,GAAP,OAAO,CAAgB;QAClD,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,+FAA+F;IACzF,YAAY;;YAChB,MAAM,+CAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;KAAA;IAED,wFAAwF;IACxF,SAAS;;QACP,OAAO,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI,CAAC;IAChE,CAAC;IAED;;;OAGG;IACG,YAAY,CAAC,QAAmC;;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEjE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YACzI,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACrG,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC9G,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,cAAc,CAAC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;gBACtH,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;YAC9D,CAAC;YAED,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,kFAAkF,EAClF,CAAC,cAAc,CAAC,WAAW,CAAC,CAC7B,CAAC;YACF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,qEAAqE,EACrE,CAAC,cAAc,CAAC,YAAY,CAAC,CAC9B,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACxF,OAAO;gBACL,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;aACxE,CAAC;QACJ,CAAC;KAAA;IAED,4GAA4G;IACtG,YAAY,CAAC,YAAoB,EAAE,QAAmC,EAAE,IAAa;;;YACzF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAE5D,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;YAC3I,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,MAAA,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,IAAI,mCAAI,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,CACtD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;mCAC2B,EAC3B,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,IAAI,CAAC,CACvG,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAE,CAAC;QACvD,CAAC;KAAA;IAED,0GAA0G;IACpG,0BAA0B;6DAC9B,gBAAiC,EACjC,QAAmC,EACnC,oBAAoB,GAAG,KAAK,EAC5B,IAAa;YAEb,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YAC7I,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,IAAI;oBAC3B,YAAY,EAAE,uCAAkB,CAAC,IAAI;iBACtC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;gBACvE,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,4BAAmB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,2BAAkB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,oCAA2B,EAAE,CAAC;oBAC5M,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,+FAA+F,EAAE,CAAC,CAAC;gBAChM,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,oIAAoI,EAAE,CAAC,CAAC;YACxO,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,gCAAgC,CACpC,gBAAiC,EACjC,QAAmC;;;YAEnC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,qBAAqB,MAAK,IAAI,EAAE,CAAC;gBACzE,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnI,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;gBACrE,qBAAqB,EAAE,KAAK;gBAC5B,YAAY,EAAE,uCAAkB,CAAC,IAAI;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;KAAA;IAED,0FAA0F;IACpF,iBAAiB,CAAC,YAAoB;;YAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;;8BAOwB,EACxB,CAAC,YAAY,CAAC,CACf,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,yGAAyG;IACnG,YAAY;;YAChB,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;sDAGgD,CACjD,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,wFAAwF;IAClF,cAAc,CAAC,KAA+D;;;YAClF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,uFAAuF,EACvF,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,IAAI,EAAE,KAAI,IAAI,CAAC,CACpD,CAAC;YACF,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED,gGAAgG;IAChG;;;OAGG;IACG,cAAc,CAAC,aAAqB,EAAE,MAAiE;;YAC3G,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC9H,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED;;;;OAIG;IACG,cAAc,CAAC,aAAqB;;;YACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,SAAG,CAAC,KAAK,CAC3B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,sEAAsE,EACtE,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,QAAQ,GAAG,MAAA,MAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAyC,0CAAE,KAAK,mCACtE,MAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAyC,0CAAE,KAAK,CAAC;YAChE,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC;oBAC1B,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,qCAAqC,QAAQ,KAAK,KAAK,wEAAwE;iBACzI,CAAC,CAAC;YACL,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,6CAA6C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7G,CAAC;KAAA;IAED,0EAA0E;IAC1E;;;OAGG;IACG,uBAAuB,CAAC,YAAoB,EAAE,OAAgB;;YAClE,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,2EAA2E;YAC3E,iFAAiF;YACjF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAChC,CAAC;QACJ,CAAC;KAAA;IAED,mHAAmH;IACnH,0GAA0G;IACpG,sBAAsB,CAAC,YAAoB;;YAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,GAAG,CAAC;QACrH,CAAC;KAAA;IAED,4EAA4E;IAC5E,8GAA8G;IACxG,eAAe,CAAC,WAAmB;;YACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,8FAA8F,EAC9F,CAAC,WAAW,CAAC,CACd,CAAC;QACJ,CAAC;KAAA;IAED,oGAAoG;IACpG;;;OAGG;IACG,cAAc,CAAC,YAAoB,EAAE,WAAmB;;YAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;YAC/G,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,iEAAiE,EACjE,CAAC,WAAW,EAAE,YAAY,CAAC,CAC5B,CAAC;QACJ,CAAC;KAAA;IAED,sGAAsG;IACtG,6GAA6G;IACvG,cAAc,CAAC,WAAmB,EAAE,MAA2C;;YACnF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;;oBAC/C,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACjC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACnI,CAAC;KAAA;IAED,uFAAuF;IACjF,YAAY;;YAChB,IAAI,IAAI,CAAC,SAAS,EAAE;gBAAE,MAAM,+CAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;KAAA;IAEa,YAAY,CAAC,QAAmC,EAAE,UAAmB;;YACjF,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;gEAM0D,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,EACpG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEa,gBAAgB,CAAC,YAAoB;;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QACxE,CAAC;KAAA;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;QACzI,CAAC;IACH,CAAC;IAED,uFAAuF;IAC/E,iBAAiB,CAAC,WAAmB;QAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,QAAmC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;QAChK,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAEO,iBAAiB,CAAC,KAAc;QACtC,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC,CAAC;QACnK,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEa,oBAAoB,CAAC,QAAgB;;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KAAA;IAEa,YAAY,CAAC,QAAgB;;YACzC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;0BAGoB,EACpB,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEO,cAAc,CAAC,QAAmC;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAChK,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAEO,UAAU,CAAC,GAAgB;QACjC,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;YACpC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YACtC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,KAAK,KAAK,IAAI,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;YACjI,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAgB;;QACjC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,WAAW,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACjD,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AArcY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACX,yBAAW;GAJhC,oBAAoB,CAqchC","sourcesContent":["import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, InternalServerErrorException, NotFoundException, OnModuleInit, ServiceUnavailableException } from '@nestjs/common';\nimport { createHash } from 'crypto';\nimport { AccessiDatabaseUpdater } from '../database-updates/AccessiDatabaseUpdater';\nimport { Orm } from '../../Orm';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { isAuthenticatedUserEnabledForJwt } from '../security/authenticatedToken';\nimport { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './FederatedAuthTypes';\n\ntype IdentityRow = {\n identityKey?: string;\n codiceUtente?: number;\n provider?: string;\n subject?: string;\n active?: unknown;\n createdAt?: Date \| string;\n lastLoginAt?: Date \| string;\n disabledAt?: Date \| string;\n note?: string;\n passwordLoginEnabled?: unknown;\n};\n\ntype ProviderRow = {\n provider?: string;\n description?: string;\n active?: unknown;\n createdAt?: Date \| string;\n note?: string;\n};\n\n/*\n Maps externally verified identities to Accessi users and issues the usual\n * Accessi JWT. It deliberately has no provider SDK dependency: validating an\n * Azure, Google, Apple, SAML, or custom token is always the hosting backend's job.\n /\n@Injectable()\nexport class FederatedAuthService implements OnModuleInit {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n private readonly userService: UserService,\n private readonly authService: AuthService,\n ) {}\n\n /* Await the same schema barrier as the module updater; never race two DDL implementations. /\n async onModuleInit(): Promise<void> {\n await AccessiDatabaseUpdater.initialize(this.options);\n }\n\n /* Returns true only when the host application opted in to federated authentication. /\n isEnabled(): boolean {\n return this.options.federatedAuthentication?.enabled === true;\n }\n\n /\n Exchanges a backend-verified identity for the same login result and JWT\n * emitted by the local password endpoint. No raw external token is accepted.\n /\n async authenticate(identity: VerifiedFederatedIdentity): Promise<FederatedAuthenticationResult> {\n this.assertEnabled();\n const normalized = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalized.provider);\n const linkedIdentity = await this.findIdentity(normalized, true);\n\n if (!linkedIdentity) {\n throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_LINKED', message: 'Identita esterna non associata a un utente Accessi.' });\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(linkedIdentity.codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\n throw new ForbiddenException({ code: 'FEDERATED_USER_DISABLED', message: 'Utente Accessi non abilitato.' });\n }\n\n if (currentUser.flagDueFattori) {\n const login = await this.authService.beginFederatedTwoFactor(linkedIdentity.codiceUtente, linkedIdentity.identityKey);\n return { codiceUtente: linkedIdentity.codiceUtente, login };\n }\n\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n [linkedIdentity.identityKey],\n );\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?',\n [linkedIdentity.codiceUtente],\n );\n\n const login = await this.authService.getLoginResultForUser(linkedIdentity.codiceUtente);\n return {\n codiceUtente: linkedIdentity.codiceUtente,\n login,\n token: this.authService.createAccessiToken(login.utente, ['federated']),\n };\n }\n\n /* Links an external identity to an existing Accessi user. It never changes that user's password policy. /\n async linkIdentity(codiceUtente: number, identity: VerifiedFederatedIdentity, note?: string): Promise<FederatedIdentity> {\n this.assertEnabled();\n await this.assertUserExists(codiceUtente);\n const normalized = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalized.provider);\n const existing = await this.findIdentity(normalized, false);\n\n if (existing && existing.codiceUtente !== codiceUtente) {\n throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identita esterna gia associata a un altro utente.' });\n }\n\n if (existing) {\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 1, DATDISATT = NULL, NOTA = ? WHERE IDNKEY = ?',\n [note ?? existing.note ?? null, existing.identityKey],\n );\n } else {\n await Orm.execute(\n this.options.databaseOptions,\n `INSERT INTO UTENTI_IDENTITA_EXT (IDNKEY, CODUTE, PROVIDER, SUBJECT, FLGATTIVO, NOTA)\n VALUES (?, ?, ?, ?, 1, ?)`,\n [this.getIdentityKey(normalized), codiceUtente, normalized.provider, normalized.subject, note ?? null],\n );\n }\n\n return (await this.findIdentity(normalized, false))!;\n }\n\n /* Creates a confirmed Accessi user, associates an SSO identity and defaults the new user to SSO-only. /\n async createManagedFederatedUser(\n registrationData: RegisterRequest,\n identity: VerifiedFederatedIdentity,\n passwordLoginEnabled = false,\n note?: string,\n ): Promise<FederatedIdentity> {\n this.assertEnabled();\n const normalizedIdentity = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalizedIdentity.provider);\n if (await this.findIdentity(normalizedIdentity, false)) {\n throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identità esterna già associata a un utente Accessi.' });\n }\n\n try {\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: true,\n initialState: StatoRegistrazione.CONF,\n });\n await this.setPasswordLoginEnabled(codiceUtente, passwordLoginEnabled);\n return await this.linkIdentity(codiceUtente, normalizedIdentity, note);\n } catch (error) {\n if (error instanceof BadRequestException \|\| error instanceof ConflictException \|\| error instanceof ForbiddenException \|\| error instanceof NotFoundException \|\| error instanceof ServiceUnavailableException) {\n throw error;\n }\n if (RestUtilities.isDatabaseSchemaError(error)) {\n throw new ServiceUnavailableException({ code: 'ACCESSI_DATABASE_SCHEMA_OUTDATED', message: 'Lo schema del database Accessi non è aggiornato. Eseguire la migrazione database e riprovare.' });\n }\n throw new InternalServerErrorException({ code: 'FEDERATED_USER_PROVISIONING_FAILED', message: 'La creazione dell’utente SSO non è stata completata. Verificare il log del backend e l’eventuale utente creato senza identità SSO.' });\n }\n }\n\n /\n Allows self-provisioning only when explicitly enabled. The caller must have\n * verified the external identity and decide which profile fields are trusted.\n /\n async registerSelfServiceFederatedUser(\n registrationData: RegisterRequest,\n identity: VerifiedFederatedIdentity,\n ): Promise<FederatedIdentity> {\n this.assertEnabled();\n if (this.options.federatedAuthentication?.allowSelfRegistration !== true) {\n throw new ForbiddenException({ code: 'FEDERATED_SELF_REGISTRATION_DISABLED', message: 'Auto-registrazione SSO non abilitata.' });\n }\n\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: false,\n initialState: StatoRegistrazione.CONF,\n });\n await this.setPasswordLoginEnabled(codiceUtente, false);\n return this.linkIdentity(codiceUtente, identity);\n }\n\n /* Returns all linked identities for administration; disabled identities are included. /\n async getUserIdentities(codiceUtente: number): Promise<FederatedIdentity[]> {\n this.assertEnabled();\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n I.DATDISATT AS disabled_at, I.NOTA,\n COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n FROM UTENTI_IDENTITA_EXT I\n LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n WHERE I.CODUTE = ?\n ORDER BY I.DATINS DESC`,\n [codiceUtente],\n );\n return rows.map(RestUtilities.convertKeysToCamelCase).map((row: IdentityRow) => this.toIdentity(row));\n }\n\n /* Returns the complete provider catalog, including inactive providers, for superuser administration. /\n async getProviders(): Promise<FederatedProvider[]> {\n this.assertEnabled();\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n DATINS AS created_at, NOTA AS note\n FROM SSO_PROVIDER\n ORDER BY FLGATTIVO DESC, DESCRIZIONE, PROVIDER`,\n );\n return rows.map(RestUtilities.convertKeysToCamelCase).map((row: ProviderRow) => this.toProvider(row));\n }\n\n /* Registers a provider key that must match the backend's SSO configuration exactly. /\n async createProvider(input: { provider: string; description: string; note?: string }): Promise<FederatedProvider> {\n this.assertEnabled();\n const provider = this.normalizeProvider(input.provider);\n const description = this.normalizeDescription(input.description);\n const existing = await this.findProvider(provider);\n if (existing) {\n throw new ConflictException({ code: 'FEDERATED_PROVIDER_ALREADY_EXISTS', message: 'Il provider SSO è già registrato.' });\n }\n await Orm.execute(\n this.options.databaseOptions,\n 'INSERT INTO SSO_PROVIDER (PROVIDER, DESCRIZIONE, FLGATTIVO, NOTA) VALUES (?, ?, 1, ?)',\n [provider, description, input.note?.trim() \|\| null],\n );\n return (await this.findProvider(provider))!;\n }\n\n /* Updates provider metadata or disables the provider without removing its identity history. /\n /\n Aggiorna metadati amministrativi del catalogo. La chiave provider e immutabile perche parte dell'identita\n * persistita e deve coincidere esattamente con la configurazione del backend validante.\n /\n async updateProvider(providerValue: string, update: { description?: string; active?: boolean; note?: string }): Promise<FederatedProvider> {\n this.assertEnabled();\n const provider = this.normalizeProvider(providerValue);\n if (!(await this.findProvider(provider))) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n const changes: string[] = [];\n const params: unknown[] = [];\n if (update.description !== undefined) {\n changes.push('DESCRIZIONE = ?');\n params.push(this.normalizeDescription(update.description));\n }\n if (update.active !== undefined) {\n changes.push('FLGATTIVO = ?');\n params.push(update.active ? 1 : 0);\n }\n if (update.note !== undefined) {\n changes.push('NOTA = ?');\n params.push(update.note.trim() \|\| null);\n }\n if (changes.length > 0) {\n params.push(provider);\n await Orm.execute(this.options.databaseOptions, `UPDATE SSO_PROVIDER SET ${changes.join(', ')} WHERE PROVIDER = ?`, params);\n }\n return (await this.findProvider(provider))!;\n }\n\n /\n Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK\n * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un\n * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.\n /\n async deleteProvider(providerValue: string): Promise<void> {\n this.assertEnabled();\n const provider = this.normalizeProvider(providerValue);\n if (!(await this.findProvider(provider))) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n const usage = await Orm.query(\n this.options.databaseOptions,\n 'SELECT COUNT() AS total FROM UTENTI_IDENTITA_EXT WHERE PROVIDER = ?',\n [provider],\n );\n const rawTotal = (usage?.[0] as Record<string, unknown> \| undefined)?.TOTAL\n ?? (usage?.[0] as Record<string, unknown> \| undefined)?.total;\n const total = typeof rawTotal === 'number' ? rawTotal : Number.parseInt(`${rawTotal ?? '0'}`, 10);\n if (total > 0) {\n throw new ConflictException({\n code: 'FEDERATED_PROVIDER_IN_USE',\n message: `Impossibile eliminare il provider ${provider}: ${total} identita collegate. Disabilitalo oppure rimuovi prima i collegamenti.`,\n });\n }\n await Orm.execute(this.options.databaseOptions, 'DELETE FROM SSO_PROVIDER WHERE PROVIDER = ?', [provider]);\n }\n\n /** Enables or disables all local password authentication for one user. /\n /\n Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso\n * email/password, che restituisce `PASSWORD_LOGIN_DISABLED`. L'assenza della riga mantiene il default legacy `true`.\n /\n async setPasswordLoginEnabled(codiceUtente: number, enabled: boolean): Promise<void> {\n this.assertEnabled();\n await this.assertUserExists(codiceUtente);\n // Upsert: per utenti legacy senza riga in UTENTI_CONFIG una UPDATE a vuoto\n // lasciava la policy al default, rendendo la disattivazione un no-op silenzioso.\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE OR INSERT INTO UTENTI_CONFIG (CODUTE, FLGPASSWORD) VALUES (?, ?) MATCHING (CODUTE)',\n [codiceUtente, enabled ? 1 : 0],\n );\n }\n\n /* Returns the effective local password policy. Users without a policy row retain the historic enabled default. /\n /* Restituisce la policy effettiva; utenti precedenti alla migrazione restano abilitati alla password. /\n async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n if (!this.isEnabled()) return true;\n const rows = await Orm.query(\n this.options.databaseOptions,\n 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n [codiceUtente],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow \| undefined;\n return row?.passwordLoginEnabled !== false && row?.passwordLoginEnabled !== 0 && row?.passwordLoginEnabled !== '0';\n }\n\n /* Soft-disables a linked identity without deleting operational history. /\n /* Disabilita logicamente un collegamento SSO conservando audit e possibilita di successiva riattivazione. /\n async disableIdentity(identityKey: string): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 0, DATDISATT = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n [identityKey],\n );\n }\n\n /* Permanently removes one identity link from its owning user after administrative confirmation. /\n /\n Elimina fisicamente un collegamento SSO soltanto dopo aver verificato che appartenga all'utente indicato.\n * Non elimina mai l'utente Accessi, password, ruoli o grant associati.\n /\n async deleteIdentity(codiceUtente: number, identityKey: string): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n const identity = (await this.getUserIdentities(codiceUtente)).find((item) => item.identityKey === identityKey);\n if (!identity) {\n throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_FOUND', message: 'Collegamento SSO non trovato per questo utente.' });\n }\n await Orm.execute(\n this.options.databaseOptions,\n 'DELETE FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ? AND CODUTE = ?',\n [identityKey, codiceUtente],\n );\n }\n\n /* Aggiorna lo stato o la nota di un collegamento SSO usando la sua chiave tecnica amministrativa. /\n /* Aggiorna stato o nota amministrativa senza modificare provider e subject, che identificano la persona. /\n async updateIdentity(identityKey: string, update: { active?: boolean; note?: string }): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n const changes: string[] = [];\n const params: unknown[] = [];\n if (update.active !== undefined) {\n changes.push('FLGATTIVO = ?');\n params.push(update.active ? 1 : 0);\n if (update.active) changes.push('DATDISATT = NULL');\n else changes.push('DATDISATT = CURRENT_TIMESTAMP');\n }\n if (update.note !== undefined) {\n changes.push('NOTA = ?');\n params.push(update.note);\n }\n if (changes.length === 0) return;\n params.push(identityKey);\n await Orm.execute(this.options.databaseOptions, `UPDATE UTENTI_IDENTITA_EXT SET ${changes.join(', ')} WHERE IDNKEY = ?`, params);\n }\n\n /* Explicit administrative schema reconciliation, shared with the standard updater. /\n async ensureSchema(): Promise<void> {\n if (this.isEnabled()) await AccessiDatabaseUpdater.run(this.options);\n }\n\n private async findIdentity(identity: VerifiedFederatedIdentity, onlyActive: boolean): Promise<FederatedIdentity \| null> {\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n I.DATDISATT AS disabled_at, I.NOTA,\n COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n FROM UTENTI_IDENTITA_EXT I\n LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n WHERE I.IDNKEY = ? AND I.PROVIDER = ? AND I.SUBJECT = ?${onlyActive ? ' AND I.FLGATTIVO = 1' : ''}`,\n [this.getIdentityKey(identity), identity.provider, identity.subject],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow \| undefined;\n return row ? this.toIdentity(row) : null;\n }\n\n private async assertUserExists(codiceUtente: number): Promise<void> {\n const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!user) throw new NotFoundException('Utente Accessi non trovato.');\n }\n\n private assertEnabled(): void {\n if (!this.isEnabled()) {\n throw new ForbiddenException({ code: 'FEDERATED_AUTH_DISABLED', message: 'Autenticazione federata non abilitata in AccessiOptions.' });\n }\n }\n\n /* Validates the opaque SHA-256 key used only by administrative identity endpoints. */\n private assertIdentityKey(identityKey: string): void {\n if (!/^[a-f0-9]{64}$/i.test(identityKey)) {\n throw new BadRequestException({ code: 'FEDERATED_IDENTITY_KEY_INVALID', message: 'Chiave del collegamento SSO non valida.' });\n }\n }\n\n private normalizeIdentity(identity: VerifiedFederatedIdentity): VerifiedFederatedIdentity {\n const provider = this.normalizeProvider(identity?.provider);\n const subject = typeof identity?.subject === 'string' ? identity.subject.trim() : '';\n if (!subject \|\| Buffer.byteLength(subject, 'utf8') > 512) {\n throw new BadRequestException({ code: 'FEDERATED_SUBJECT_INVALID', message: 'Subject non valido: è obbligatorio e può occupare al massimo 512 byte UTF-8.' });\n }\n return { provider, subject };\n }\n\n private normalizeProvider(value: unknown): string {\n const provider = typeof value === 'string' ? value.trim().toLowerCase() : '';\n if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(provider)) {\n throw new BadRequestException({ code: 'FEDERATED_PROVIDER_INVALID', message: 'Provider non valido: usare un namespace ASCII stabile di massimo 64 caratteri.' });\n }\n return provider;\n }\n\n private normalizeDescription(value: unknown): string {\n const description = typeof value === 'string' ? value.trim() : '';\n if (!description \|\| description.length > 160) {\n throw new BadRequestException({ code: 'FEDERATED_PROVIDER_DESCRIPTION_INVALID', message: 'La descrizione del provider deve contenere da 1 a 160 caratteri.' });\n }\n return description;\n }\n\n private async assertProviderActive(provider: string): Promise<FederatedProvider> {\n const registered = await this.findProvider(provider);\n if (!registered) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n if (!registered.active) {\n throw new ForbiddenException({ code: 'FEDERATED_PROVIDER_DISABLED', message: 'Provider SSO disabilitato.' });\n }\n return registered;\n }\n\n private async findProvider(provider: string): Promise<FederatedProvider \| null> {\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n DATINS AS created_at, NOTA AS note\n FROM SSO_PROVIDER\n WHERE PROVIDER = ?`,\n [provider],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as ProviderRow \| undefined;\n return row ? this.toProvider(row) : null;\n }\n\n private getIdentityKey(identity: VerifiedFederatedIdentity): string {\n const provider = Buffer.from(identity.provider, 'utf8');\n const subject = Buffer.from(identity.subject, 'utf8');\n const payload = Buffer.concat([Buffer.from('accessi:federated:v1:'), Buffer.from(`${provider.length}:`), provider, Buffer.from(`${subject.length}:`), subject]);\n return createHash('sha256').update(payload).digest('hex');\n }\n\n private toIdentity(row: IdentityRow): FederatedIdentity {\n return {\n identityKey: String(row.identityKey),\n codiceUtente: Number(row.codiceUtente),\n provider: String(row.provider).trim(),\n subject: String(row.subject),\n active: row.active === true \|\| row.active === 1 \|\| row.active === '1',\n passwordLoginEnabled: !(row.passwordLoginEnabled === false \|\| row.passwordLoginEnabled === 0 \|\| row.passwordLoginEnabled === '0'),\n createdAt: row.createdAt,\n lastLoginAt: row.lastLoginAt,\n disabledAt: row.disabledAt,\n note: row.note,\n };\n }\n\n private toProvider(row: ProviderRow): FederatedProvider {\n return {\n provider: String(row.provider).trim(),\n description: String(row.description ?? '').trim(),\n active: row.active === true \|\| row.active === 1 \|\| row.active === '1',\n createdAt: row.createdAt,\n note: row.note,\n };\n }\n}\n"]}
1	+ {"version":3,"file":"FederatedAuthService.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4M;AAC5M,mCAAoC;AACpC,uFAAoF;AACpF,mCAAgC;AAChC,+CAAgD;AAGhD,mEAAgE;AAChE,qEAAkE;AAClE,qEAAkE;AAClE,uEAAkF;AAwBlF;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAC8C,OAAuB,EAClD,WAAwB,EACxB,WAAwB;QAFG,YAAO,GAAP,OAAO,CAAgB;QAClD,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,+FAA+F;IACzF,YAAY;;YAChB,MAAM,+CAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;KAAA;IAED,wFAAwF;IACxF,SAAS;;QACP,OAAO,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI,CAAC;IAChE,CAAC;IAED;;;OAGG;IACG,YAAY,CAAC,QAAmC;;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEjE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YACzI,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACrG,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC9G,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,cAAc,CAAC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;gBACtH,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;YAC9D,CAAC;YAED,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,kFAAkF,EAClF,CAAC,cAAc,CAAC,WAAW,CAAC,CAC7B,CAAC;YACF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,qEAAqE,EACrE,CAAC,cAAc,CAAC,YAAY,CAAC,CAC9B,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACxF,OAAO;gBACL,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;aACxE,CAAC;QACJ,CAAC;KAAA;IAED,4GAA4G;IACtG,YAAY,CAAC,YAAoB,EAAE,QAAmC,EAAE,IAAa;;;YACzF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAE5D,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;YAC3I,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,MAAA,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,IAAI,mCAAI,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,CACtD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;mCAC2B,EAC3B,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,IAAI,CAAC,CACvG,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAE,CAAC;QACvD,CAAC;KAAA;IAED,0GAA0G;IACpG,0BAA0B;6DAC9B,gBAAiC,EACjC,QAAmC,EACnC,oBAAoB,GAAG,KAAK,EAC5B,IAAa;YAEb,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YAC7I,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,IAAI;oBAC3B,YAAY,EAAE,uCAAkB,CAAC,IAAI;iBACtC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;gBACvE,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,4BAAmB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,2BAAkB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,oCAA2B,EAAE,CAAC;oBAC5M,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,+FAA+F,EAAE,CAAC,CAAC;gBAChM,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,oIAAoI,EAAE,CAAC,CAAC;YACxO,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,gCAAgC,CACpC,gBAAiC,EACjC,QAAmC;;;YAEnC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,qBAAqB,MAAK,IAAI,EAAE,CAAC;gBACzE,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnI,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;gBACrE,qBAAqB,EAAE,KAAK;gBAC5B,YAAY,EAAE,uCAAkB,CAAC,IAAI;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;KAAA;IAED,0FAA0F;IACpF,iBAAiB,CAAC,YAAoB;;YAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;;8BAOwB,EACxB,CAAC,YAAY,CAAC,CACf,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,yGAAyG;IACnG,YAAY;;YAChB,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;sDAGgD,CACjD,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,wFAAwF;IAClF,cAAc,CAAC,KAA+D;;;YAClF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,uFAAuF,EACvF,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,IAAI,EAAE,KAAI,IAAI,CAAC,CACpD,CAAC;YACF,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED,gGAAgG;IAChG;;;OAGG;IACG,cAAc,CAAC,aAAqB,EAAE,MAAiE;;YAC3G,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC9H,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED;;;;OAIG;IACG,cAAc,CAAC,aAAqB;;;YACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,SAAG,CAAC,KAAK,CAC3B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,sEAAsE,EACtE,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,QAAQ,GAAG,MAAA,MAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAyC,0CAAE,KAAK,mCACtE,MAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAyC,0CAAE,KAAK,CAAC;YAChE,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC;oBAC1B,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,qCAAqC,QAAQ,KAAK,KAAK,wEAAwE;iBACzI,CAAC,CAAC;YACL,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,6CAA6C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7G,CAAC;KAAA;IAED,0EAA0E;IAC1E;;;OAGG;IACG,uBAAuB,CAAC,YAAoB,EAAE,OAAgB;;YAClE,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,2EAA2E;YAC3E,iFAAiF;YACjF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAChC,CAAC;QACJ,CAAC;KAAA;IAED,mHAAmH;IACnH,0GAA0G;IACpG,sBAAsB,CAAC,YAAoB;;YAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,GAAG,CAAC;QACrH,CAAC;KAAA;IAED,4EAA4E;IAC5E,8GAA8G;IACxG,eAAe,CAAC,WAAmB;;YACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,8FAA8F,EAC9F,CAAC,WAAW,CAAC,CACd,CAAC;QACJ,CAAC;KAAA;IAED,oFAAoF;IAC9E,gBAAgB,CAAC,WAAmB;;YACxC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC3B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,0EAA0E,EAC1E,CAAC,WAAW,CAAC,CACd,CAAmC,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA0C,CAAC;YACvG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,YAAY,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,CAAC;KAAA;IAED,oGAAoG;IACpG;;;OAGG;IACG,cAAc,CAAC,YAAoB,EAAE,WAAmB;;YAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;YAC/G,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,iEAAiE,EACjE,CAAC,WAAW,EAAE,YAAY,CAAC,CAC5B,CAAC;QACJ,CAAC;KAAA;IAED,sGAAsG;IACtG,6GAA6G;IACvG,cAAc,CAAC,WAAmB,EAAE,MAA2C;;YACnF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;;oBAC/C,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACjC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACnI,CAAC;KAAA;IAED,uFAAuF;IACjF,YAAY;;YAChB,IAAI,IAAI,CAAC,SAAS,EAAE;gBAAE,MAAM,+CAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;KAAA;IAEa,YAAY,CAAC,QAAmC,EAAE,UAAmB;;YACjF,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;gEAM0D,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,EACpG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEa,gBAAgB,CAAC,YAAoB;;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QACxE,CAAC;KAAA;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;QACzI,CAAC;IACH,CAAC;IAED,uFAAuF;IAC/E,iBAAiB,CAAC,WAAmB;QAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,QAAmC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;QAChK,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAEO,iBAAiB,CAAC,KAAc;QACtC,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC,CAAC;QACnK,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEa,oBAAoB,CAAC,QAAgB;;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KAAA;IAEa,YAAY,CAAC,QAAgB;;YACzC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;0BAGoB,EACpB,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEO,cAAc,CAAC,QAAmC;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAChK,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAEO,UAAU,CAAC,GAAgB;QACjC,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;YACpC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YACtC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,KAAK,KAAK,IAAI,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;YACjI,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAgB;;QACjC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,WAAW,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACjD,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AAldY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACX,yBAAW;GAJhC,oBAAoB,CAkdhC","sourcesContent":["import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, InternalServerErrorException, NotFoundException, OnModuleInit, ServiceUnavailableException } from '@nestjs/common';\nimport { createHash } from 'crypto';\nimport { AccessiDatabaseUpdater } from '../database-updates/AccessiDatabaseUpdater';\nimport { Orm } from '../../Orm';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { isAuthenticatedUserEnabledForJwt } from '../security/authenticatedToken';\nimport { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './FederatedAuthTypes';\n\ntype IdentityRow = {\n identityKey?: string;\n codiceUtente?: number;\n provider?: string;\n subject?: string;\n active?: unknown;\n createdAt?: Date \| string;\n lastLoginAt?: Date \| string;\n disabledAt?: Date \| string;\n note?: string;\n passwordLoginEnabled?: unknown;\n};\n\ntype ProviderRow = {\n provider?: string;\n description?: string;\n active?: unknown;\n createdAt?: Date \| string;\n note?: string;\n};\n\n/*\n Maps externally verified identities to Accessi users and issues the usual\n * Accessi JWT. It deliberately has no provider SDK dependency: validating an\n * Azure, Google, Apple, SAML, or custom token is always the hosting backend's job.\n /\n@Injectable()\nexport class FederatedAuthService implements OnModuleInit {\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n private readonly userService: UserService,\n private readonly authService: AuthService,\n ) {}\n\n /* Await the same schema barrier as the module updater; never race two DDL implementations. /\n async onModuleInit(): Promise<void> {\n await AccessiDatabaseUpdater.initialize(this.options);\n }\n\n /* Returns true only when the host application opted in to federated authentication. /\n isEnabled(): boolean {\n return this.options.federatedAuthentication?.enabled === true;\n }\n\n /\n Exchanges a backend-verified identity for the same login result and JWT\n * emitted by the local password endpoint. No raw external token is accepted.\n /\n async authenticate(identity: VerifiedFederatedIdentity): Promise<FederatedAuthenticationResult> {\n this.assertEnabled();\n const normalized = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalized.provider);\n const linkedIdentity = await this.findIdentity(normalized, true);\n\n if (!linkedIdentity) {\n throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_LINKED', message: 'Identita esterna non associata a un utente Accessi.' });\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(linkedIdentity.codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\n throw new ForbiddenException({ code: 'FEDERATED_USER_DISABLED', message: 'Utente Accessi non abilitato.' });\n }\n\n if (currentUser.flagDueFattori) {\n const login = await this.authService.beginFederatedTwoFactor(linkedIdentity.codiceUtente, linkedIdentity.identityKey);\n return { codiceUtente: linkedIdentity.codiceUtente, login };\n }\n\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n [linkedIdentity.identityKey],\n );\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?',\n [linkedIdentity.codiceUtente],\n );\n\n const login = await this.authService.getLoginResultForUser(linkedIdentity.codiceUtente);\n return {\n codiceUtente: linkedIdentity.codiceUtente,\n login,\n token: this.authService.createAccessiToken(login.utente, ['federated']),\n };\n }\n\n /* Links an external identity to an existing Accessi user. It never changes that user's password policy. /\n async linkIdentity(codiceUtente: number, identity: VerifiedFederatedIdentity, note?: string): Promise<FederatedIdentity> {\n this.assertEnabled();\n await this.assertUserExists(codiceUtente);\n const normalized = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalized.provider);\n const existing = await this.findIdentity(normalized, false);\n\n if (existing && existing.codiceUtente !== codiceUtente) {\n throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identita esterna gia associata a un altro utente.' });\n }\n\n if (existing) {\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 1, DATDISATT = NULL, NOTA = ? WHERE IDNKEY = ?',\n [note ?? existing.note ?? null, existing.identityKey],\n );\n } else {\n await Orm.execute(\n this.options.databaseOptions,\n `INSERT INTO UTENTI_IDENTITA_EXT (IDNKEY, CODUTE, PROVIDER, SUBJECT, FLGATTIVO, NOTA)\n VALUES (?, ?, ?, ?, 1, ?)`,\n [this.getIdentityKey(normalized), codiceUtente, normalized.provider, normalized.subject, note ?? null],\n );\n }\n\n return (await this.findIdentity(normalized, false))!;\n }\n\n /* Creates a confirmed Accessi user, associates an SSO identity and defaults the new user to SSO-only. /\n async createManagedFederatedUser(\n registrationData: RegisterRequest,\n identity: VerifiedFederatedIdentity,\n passwordLoginEnabled = false,\n note?: string,\n ): Promise<FederatedIdentity> {\n this.assertEnabled();\n const normalizedIdentity = this.normalizeIdentity(identity);\n await this.assertProviderActive(normalizedIdentity.provider);\n if (await this.findIdentity(normalizedIdentity, false)) {\n throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identità esterna già associata a un utente Accessi.' });\n }\n\n try {\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: true,\n initialState: StatoRegistrazione.CONF,\n });\n await this.setPasswordLoginEnabled(codiceUtente, passwordLoginEnabled);\n return await this.linkIdentity(codiceUtente, normalizedIdentity, note);\n } catch (error) {\n if (error instanceof BadRequestException \|\| error instanceof ConflictException \|\| error instanceof ForbiddenException \|\| error instanceof NotFoundException \|\| error instanceof ServiceUnavailableException) {\n throw error;\n }\n if (RestUtilities.isDatabaseSchemaError(error)) {\n throw new ServiceUnavailableException({ code: 'ACCESSI_DATABASE_SCHEMA_OUTDATED', message: 'Lo schema del database Accessi non è aggiornato. Eseguire la migrazione database e riprovare.' });\n }\n throw new InternalServerErrorException({ code: 'FEDERATED_USER_PROVISIONING_FAILED', message: 'La creazione dell’utente SSO non è stata completata. Verificare il log del backend e l’eventuale utente creato senza identità SSO.' });\n }\n }\n\n /\n Allows self-provisioning only when explicitly enabled. The caller must have\n * verified the external identity and decide which profile fields are trusted.\n /\n async registerSelfServiceFederatedUser(\n registrationData: RegisterRequest,\n identity: VerifiedFederatedIdentity,\n ): Promise<FederatedIdentity> {\n this.assertEnabled();\n if (this.options.federatedAuthentication?.allowSelfRegistration !== true) {\n throw new ForbiddenException({ code: 'FEDERATED_SELF_REGISTRATION_DISABLED', message: 'Auto-registrazione SSO non abilitata.' });\n }\n\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: false,\n initialState: StatoRegistrazione.CONF,\n });\n await this.setPasswordLoginEnabled(codiceUtente, false);\n return this.linkIdentity(codiceUtente, identity);\n }\n\n /* Returns all linked identities for administration; disabled identities are included. /\n async getUserIdentities(codiceUtente: number): Promise<FederatedIdentity[]> {\n this.assertEnabled();\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n I.DATDISATT AS disabled_at, I.NOTA,\n COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n FROM UTENTI_IDENTITA_EXT I\n LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n WHERE I.CODUTE = ?\n ORDER BY I.DATINS DESC`,\n [codiceUtente],\n );\n return rows.map(RestUtilities.convertKeysToCamelCase).map((row: IdentityRow) => this.toIdentity(row));\n }\n\n /* Returns the complete provider catalog, including inactive providers, for superuser administration. /\n async getProviders(): Promise<FederatedProvider[]> {\n this.assertEnabled();\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n DATINS AS created_at, NOTA AS note\n FROM SSO_PROVIDER\n ORDER BY FLGATTIVO DESC, DESCRIZIONE, PROVIDER`,\n );\n return rows.map(RestUtilities.convertKeysToCamelCase).map((row: ProviderRow) => this.toProvider(row));\n }\n\n /* Registers a provider key that must match the backend's SSO configuration exactly. /\n async createProvider(input: { provider: string; description: string; note?: string }): Promise<FederatedProvider> {\n this.assertEnabled();\n const provider = this.normalizeProvider(input.provider);\n const description = this.normalizeDescription(input.description);\n const existing = await this.findProvider(provider);\n if (existing) {\n throw new ConflictException({ code: 'FEDERATED_PROVIDER_ALREADY_EXISTS', message: 'Il provider SSO è già registrato.' });\n }\n await Orm.execute(\n this.options.databaseOptions,\n 'INSERT INTO SSO_PROVIDER (PROVIDER, DESCRIZIONE, FLGATTIVO, NOTA) VALUES (?, ?, 1, ?)',\n [provider, description, input.note?.trim() \|\| null],\n );\n return (await this.findProvider(provider))!;\n }\n\n /* Updates provider metadata or disables the provider without removing its identity history. /\n /\n Aggiorna metadati amministrativi del catalogo. La chiave provider e immutabile perche parte dell'identita\n * persistita e deve coincidere esattamente con la configurazione del backend validante.\n /\n async updateProvider(providerValue: string, update: { description?: string; active?: boolean; note?: string }): Promise<FederatedProvider> {\n this.assertEnabled();\n const provider = this.normalizeProvider(providerValue);\n if (!(await this.findProvider(provider))) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n const changes: string[] = [];\n const params: unknown[] = [];\n if (update.description !== undefined) {\n changes.push('DESCRIZIONE = ?');\n params.push(this.normalizeDescription(update.description));\n }\n if (update.active !== undefined) {\n changes.push('FLGATTIVO = ?');\n params.push(update.active ? 1 : 0);\n }\n if (update.note !== undefined) {\n changes.push('NOTA = ?');\n params.push(update.note.trim() \|\| null);\n }\n if (changes.length > 0) {\n params.push(provider);\n await Orm.execute(this.options.databaseOptions, `UPDATE SSO_PROVIDER SET ${changes.join(', ')} WHERE PROVIDER = ?`, params);\n }\n return (await this.findProvider(provider))!;\n }\n\n /\n Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK\n * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un\n * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.\n /\n async deleteProvider(providerValue: string): Promise<void> {\n this.assertEnabled();\n const provider = this.normalizeProvider(providerValue);\n if (!(await this.findProvider(provider))) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n const usage = await Orm.query(\n this.options.databaseOptions,\n 'SELECT COUNT() AS total FROM UTENTI_IDENTITA_EXT WHERE PROVIDER = ?',\n [provider],\n );\n const rawTotal = (usage?.[0] as Record<string, unknown> \| undefined)?.TOTAL\n ?? (usage?.[0] as Record<string, unknown> \| undefined)?.total;\n const total = typeof rawTotal === 'number' ? rawTotal : Number.parseInt(`${rawTotal ?? '0'}`, 10);\n if (total > 0) {\n throw new ConflictException({\n code: 'FEDERATED_PROVIDER_IN_USE',\n message: `Impossibile eliminare il provider ${provider}: ${total} identita collegate. Disabilitalo oppure rimuovi prima i collegamenti.`,\n });\n }\n await Orm.execute(this.options.databaseOptions, 'DELETE FROM SSO_PROVIDER WHERE PROVIDER = ?', [provider]);\n }\n\n /** Enables or disables all local password authentication for one user. /\n /\n Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso\n * email/password, che restituisce `PASSWORD_LOGIN_DISABLED`. L'assenza della riga mantiene il default legacy `true`.\n /\n async setPasswordLoginEnabled(codiceUtente: number, enabled: boolean): Promise<void> {\n this.assertEnabled();\n await this.assertUserExists(codiceUtente);\n // Upsert: per utenti legacy senza riga in UTENTI_CONFIG una UPDATE a vuoto\n // lasciava la policy al default, rendendo la disattivazione un no-op silenzioso.\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE OR INSERT INTO UTENTI_CONFIG (CODUTE, FLGPASSWORD) VALUES (?, ?) MATCHING (CODUTE)',\n [codiceUtente, enabled ? 1 : 0],\n );\n }\n\n /* Returns the effective local password policy. Users without a policy row retain the historic enabled default. /\n /* Restituisce la policy effettiva; utenti precedenti alla migrazione restano abilitati alla password. /\n async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n if (!this.isEnabled()) return true;\n const rows = await Orm.query(\n this.options.databaseOptions,\n 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n [codiceUtente],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow \| undefined;\n return row?.passwordLoginEnabled !== false && row?.passwordLoginEnabled !== 0 && row?.passwordLoginEnabled !== '0';\n }\n\n /* Soft-disables a linked identity without deleting operational history. /\n /* Disabilita logicamente un collegamento SSO conservando audit e possibilita di successiva riattivazione. /\n async disableIdentity(identityKey: string): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n await Orm.execute(\n this.options.databaseOptions,\n 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 0, DATDISATT = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n [identityKey],\n );\n }\n\n /* Restituisce il CODUTE proprietario di un collegamento SSO, o null se assente. /\n async getIdentityOwner(identityKey: string): Promise<number \| null> {\n this.assertIdentityKey(identityKey);\n const rows = (await Orm.query(\n this.options.databaseOptions,\n 'SELECT CODUTE AS codice_utente FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ?',\n [identityKey],\n )) as Array<Record<string, unknown>>;\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { codiceUtente?: number } \| undefined;\n const owner = Number(row?.codiceUtente);\n return Number.isSafeInteger(owner) && owner > 0 ? owner : null;\n }\n\n /* Permanently removes one identity link from its owning user after administrative confirmation. /\n /\n Elimina fisicamente un collegamento SSO soltanto dopo aver verificato che appartenga all'utente indicato.\n * Non elimina mai l'utente Accessi, password, ruoli o grant associati.\n /\n async deleteIdentity(codiceUtente: number, identityKey: string): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n const identity = (await this.getUserIdentities(codiceUtente)).find((item) => item.identityKey === identityKey);\n if (!identity) {\n throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_FOUND', message: 'Collegamento SSO non trovato per questo utente.' });\n }\n await Orm.execute(\n this.options.databaseOptions,\n 'DELETE FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ? AND CODUTE = ?',\n [identityKey, codiceUtente],\n );\n }\n\n /* Aggiorna lo stato o la nota di un collegamento SSO usando la sua chiave tecnica amministrativa. /\n /* Aggiorna stato o nota amministrativa senza modificare provider e subject, che identificano la persona. /\n async updateIdentity(identityKey: string, update: { active?: boolean; note?: string }): Promise<void> {\n this.assertEnabled();\n this.assertIdentityKey(identityKey);\n const changes: string[] = [];\n const params: unknown[] = [];\n if (update.active !== undefined) {\n changes.push('FLGATTIVO = ?');\n params.push(update.active ? 1 : 0);\n if (update.active) changes.push('DATDISATT = NULL');\n else changes.push('DATDISATT = CURRENT_TIMESTAMP');\n }\n if (update.note !== undefined) {\n changes.push('NOTA = ?');\n params.push(update.note);\n }\n if (changes.length === 0) return;\n params.push(identityKey);\n await Orm.execute(this.options.databaseOptions, `UPDATE UTENTI_IDENTITA_EXT SET ${changes.join(', ')} WHERE IDNKEY = ?`, params);\n }\n\n /* Explicit administrative schema reconciliation, shared with the standard updater. /\n async ensureSchema(): Promise<void> {\n if (this.isEnabled()) await AccessiDatabaseUpdater.run(this.options);\n }\n\n private async findIdentity(identity: VerifiedFederatedIdentity, onlyActive: boolean): Promise<FederatedIdentity \| null> {\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n I.DATDISATT AS disabled_at, I.NOTA,\n COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n FROM UTENTI_IDENTITA_EXT I\n LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n WHERE I.IDNKEY = ? AND I.PROVIDER = ? AND I.SUBJECT = ?${onlyActive ? ' AND I.FLGATTIVO = 1' : ''}`,\n [this.getIdentityKey(identity), identity.provider, identity.subject],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow \| undefined;\n return row ? this.toIdentity(row) : null;\n }\n\n private async assertUserExists(codiceUtente: number): Promise<void> {\n const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!user) throw new NotFoundException('Utente Accessi non trovato.');\n }\n\n private assertEnabled(): void {\n if (!this.isEnabled()) {\n throw new ForbiddenException({ code: 'FEDERATED_AUTH_DISABLED', message: 'Autenticazione federata non abilitata in AccessiOptions.' });\n }\n }\n\n /* Validates the opaque SHA-256 key used only by administrative identity endpoints. */\n private assertIdentityKey(identityKey: string): void {\n if (!/^[a-f0-9]{64}$/i.test(identityKey)) {\n throw new BadRequestException({ code: 'FEDERATED_IDENTITY_KEY_INVALID', message: 'Chiave del collegamento SSO non valida.' });\n }\n }\n\n private normalizeIdentity(identity: VerifiedFederatedIdentity): VerifiedFederatedIdentity {\n const provider = this.normalizeProvider(identity?.provider);\n const subject = typeof identity?.subject === 'string' ? identity.subject.trim() : '';\n if (!subject \|\| Buffer.byteLength(subject, 'utf8') > 512) {\n throw new BadRequestException({ code: 'FEDERATED_SUBJECT_INVALID', message: 'Subject non valido: è obbligatorio e può occupare al massimo 512 byte UTF-8.' });\n }\n return { provider, subject };\n }\n\n private normalizeProvider(value: unknown): string {\n const provider = typeof value === 'string' ? value.trim().toLowerCase() : '';\n if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(provider)) {\n throw new BadRequestException({ code: 'FEDERATED_PROVIDER_INVALID', message: 'Provider non valido: usare un namespace ASCII stabile di massimo 64 caratteri.' });\n }\n return provider;\n }\n\n private normalizeDescription(value: unknown): string {\n const description = typeof value === 'string' ? value.trim() : '';\n if (!description \|\| description.length > 160) {\n throw new BadRequestException({ code: 'FEDERATED_PROVIDER_DESCRIPTION_INVALID', message: 'La descrizione del provider deve contenere da 1 a 160 caratteri.' });\n }\n return description;\n }\n\n private async assertProviderActive(provider: string): Promise<FederatedProvider> {\n const registered = await this.findProvider(provider);\n if (!registered) {\n throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n }\n if (!registered.active) {\n throw new ForbiddenException({ code: 'FEDERATED_PROVIDER_DISABLED', message: 'Provider SSO disabilitato.' });\n }\n return registered;\n }\n\n private async findProvider(provider: string): Promise<FederatedProvider \| null> {\n const rows = await Orm.query(\n this.options.databaseOptions,\n `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n DATINS AS created_at, NOTA AS note\n FROM SSO_PROVIDER\n WHERE PROVIDER = ?`,\n [provider],\n );\n const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as ProviderRow \| undefined;\n return row ? this.toProvider(row) : null;\n }\n\n private getIdentityKey(identity: VerifiedFederatedIdentity): string {\n const provider = Buffer.from(identity.provider, 'utf8');\n const subject = Buffer.from(identity.subject, 'utf8');\n const payload = Buffer.concat([Buffer.from('accessi:federated:v1:'), Buffer.from(`${provider.length}:`), provider, Buffer.from(`${subject.length}:`), subject]);\n return createHash('sha256').update(payload).digest('hex');\n }\n\n private toIdentity(row: IdentityRow): FederatedIdentity {\n return {\n identityKey: String(row.identityKey),\n codiceUtente: Number(row.codiceUtente),\n provider: String(row.provider).trim(),\n subject: String(row.subject),\n active: row.active === true \|\| row.active === 1 \|\| row.active === '1',\n passwordLoginEnabled: !(row.passwordLoginEnabled === false \|\| row.passwordLoginEnabled === 0 \|\| row.passwordLoginEnabled === '0'),\n createdAt: row.createdAt,\n lastLoginAt: row.lastLoginAt,\n disabledAt: row.disabledAt,\n note: row.note,\n };\n }\n\n private toProvider(row: ProviderRow): FederatedProvider {\n return {\n provider: String(row.provider).trim(),\n description: String(row.description ?? '').trim(),\n active: row.active === true \|\| row.active === 1 \|\| row.active === '1',\n createdAt: row.createdAt,\n note: row.note,\n };\n }\n}\n"]}

package/dist/accessi-module/security/accessControl.d.ts CHANGED Viewed

@@ -20,6 +20,23 @@ export declare function ensureAdmin(user: AuthenticatedAccessiUser, message?: st
  * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.
  */
 export declare function ensureUserManagement(user: AuthenticatedAccessiUser, message?: string): void;
+/**
+ * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.
+ * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango
+ * pari o inferiore, quindi un superutente non puo' toccare un admin.
+ */
+export declare function accessiUserRank(user: {
+    flagSuper?: boolean;
+    flagAdmin?: boolean;
+}): number;
+/**
+ * Impone che l'attore possa gestire il target: rango attore >= rango target.
+ * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).
+ */
+export declare function ensureCanManageTargetUser(actor: AuthenticatedAccessiUser, target: {
+    flagSuper?: boolean;
+    flagAdmin?: boolean;
+}, message?: string): void;
 /**
  * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:
  * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza

package/dist/accessi-module/security/accessControl.js CHANGED Viewed

@@ -4,6 +4,8 @@ exports.getAuthenticatedAccessiUser = getAuthenticatedAccessiUser;
 exports.ensureSuperUser = ensureSuperUser;
 exports.ensureAdmin = ensureAdmin;
 exports.ensureUserManagement = ensureUserManagement;
+exports.accessiUserRank = accessiUserRank;
+exports.ensureCanManageTargetUser = ensureCanManageTargetUser;
 exports.ensurePrivilegeFlagChanges = ensurePrivilegeFlagChanges;
 exports.ensureConsoleAccess = ensureConsoleAccess;
 exports.ensureSelfOrSuperUser = ensureSelfOrSuperUser;
@@ -57,6 +59,27 @@ function ensureUserManagement(user, message = 'Operazione riservata agli amminis
         throw new common_1.ForbiddenException(message);
     }
 }
+/**
+ * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.
+ * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango
+ * pari o inferiore, quindi un superutente non puo' toccare un admin.
+ */
+function accessiUserRank(user) {
+    if (user.flagAdmin)
+        return 2;
+    if (user.flagSuper)
+        return 1;
+    return 0;
+}
+/**
+ * Impone che l'attore possa gestire il target: rango attore >= rango target.
+ * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).
+ */
+function ensureCanManageTargetUser(actor, target, message = 'Non puoi gestire un utente di rango superiore al tuo.') {
+    if (accessiUserRank(actor) < accessiUserRank(target)) {
+        throw new common_1.ForbiddenException(message);
+    }
+}
 /**
  * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:
  * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza

package/dist/accessi-module/security/accessControl.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,kCAOC;AAMD,oDAOC;AAOD,gEAUC;AAGD,kDAOC;AAGD,sDAUC;AAGD,4DAoBC;~~AAvID~~,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,sCAAsC;IAEhD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,WAAW,CACzB,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,IAA8B,EAC9B,OAAqD;IAErD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,2BAAkB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,2BAAkB,CAAC,oEAAoE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,mBAAmB,CACjC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. /\nexport interface AuthenticatedAccessiUser {\n codiceUtente: number;\n email?: string;\n flagSuper: boolean;\n flagAdmin: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n return value === true \|\| value === 1 \|\| value === '1';\n}\n\n/\n Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n /\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n const payload = (req as Request & { user?: unknown }).user;\n const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\n const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\n ? payloadRecord.userData as Record<string, unknown>\n : undefined;\n const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\n const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\n const codiceUtente = Number(utente?.codiceUtente);\n\n if (!Number.isSafeInteger(codiceUtente) \|\| codiceUtente <= 0) {\n throw new UnauthorizedException('Utente non autenticato.');\n }\n\n return {\n codiceUtente,\n email: typeof utente?.email === 'string' ? utente.email : undefined,\n flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n flagAdmin: normalizeBooleanFlag(utente?.flagAdmin),\n };\n}\n\n/* Impone il flag superutente: gestione utenti e dei loro grant. /\nexport function ensureSuperUser(\n user: AuthenticatedAccessiUser,\n message = 'Operazione riservata ai superutenti.',\n): void {\n if (!user.flagSuper) {\n throw new ForbiddenException(message);\n }\n}\n\n/* Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. /\nexport function ensureAdmin(\n user: AuthenticatedAccessiUser,\n message = 'Operazione riservata agli amministratori.',\n): void {\n if (!user.flagAdmin) {\n throw new ForbiddenException(message);\n }\n}\n\n/\n Gestione utenti e assegnazioni: consentita a superutenti e admin.\n * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.\n /\nexport function ensureUserManagement(\n user: AuthenticatedAccessiUser,\n message = 'Operazione riservata agli amministratori degli utenti.',\n): void {\n if (!user.flagSuper && !user.flagAdmin) {\n throw new ForbiddenException(message);\n }\n}\n\n/\n Limita la modifica dei flag di privilegio in base al ruolo dell'attore:\n * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza\n * `flagAdmin` gestisce solo `flagSuper`.\n /\nexport function ensurePrivilegeFlagChanges(\n user: AuthenticatedAccessiUser,\n changes: { flagSuper?: unknown; flagAdmin?: unknown },\n): void {\n if (changes.flagAdmin !== undefined && !user.flagAdmin) {\n throw new ForbiddenException('Solo un admin puo modificare il flag admin.');\n }\n if (changes.flagSuper !== undefined && !user.flagSuper && !user.flagAdmin) {\n throw new ForbiddenException('Solo un superutente o un admin puo modificare il flag superutente.');\n }\n}\n\n/* Accesso alla console: superutenti e admin. /\nexport function ensureConsoleAccess(\n user: AuthenticatedAccessiUser,\n message = 'La console richiede un superutente o un admin Accessi.',\n): void {\n if (!user.flagSuper && !user.flagAdmin) {\n throw new ForbiddenException(message);\n }\n}\n\n/* Permette l'operazione al proprietario della risorsa o a superutenti/admin. /\nexport function ensureSelfOrSuperUser(\n user: AuthenticatedAccessiUser,\n targetUserCode: number,\n message = 'Operazione non autorizzata su questo utente.',\n): void {\n if (user.flagSuper \|\| user.flagAdmin \|\| user.codiceUtente === targetUserCode) {\n return;\n }\n\n throw new ForbiddenException(message);\n}\n\n/* Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n statoRegistrazione?: unknown;\n flagSuper?: unknown;\n flagAdmin?: unknown;\n passwordLoginEnabled?: unknown;\n passwordlessLoginEnabled?: unknown;\n flagDueFattori?: unknown;\n roles?: unknown;\n permissions?: unknown;\n}): boolean {\n return (\n user.statoRegistrazione !== undefined \|\|\n user.flagSuper !== undefined \|\|\n user.flagAdmin !== undefined \|\|\n user.passwordLoginEnabled !== undefined \|\|\n user.passwordlessLoginEnabled !== undefined \|\|\n user.flagDueFattori !== undefined \|\|\n user.roles !== undefined \|\|\n user.permissions !== undefined\n );\n}\n"]}
1	+ {"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,kCAOC;AAMD,oDAOC;AAOD,0CAIC;AAMD,8DAQC;AAOD,gEAUC;AAGD,kDAOC;AAGD,sDAUC;AAGD,4DAoBC;AAhKD,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,sCAAsC;IAEhD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,WAAW,CACzB,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAkD;IAChF,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,KAA+B,EAC/B,MAAoD,EACpD,OAAO,GAAG,uDAAuD;IAEjE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,IAA8B,EAC9B,OAAqD;IAErD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,2BAAkB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,2BAAkB,CAAC,oEAAoE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,mBAAmB,CACjC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. /\nexport interface AuthenticatedAccessiUser {\n codiceUtente: number;\n email?: string;\n flagSuper: boolean;\n flagAdmin: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n return value === true \|\| value === 1 \|\| value === '1';\n}\n\n/\n Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n /\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n const payload = (req as Request & { user?: unknown }).user;\n const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\n const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\n ? payloadRecord.userData as Record<string, unknown>\n : undefined;\n const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\n const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\n const codiceUtente = Number(utente?.codiceUtente);\n\n if (!Number.isSafeInteger(codiceUtente) \|\| codiceUtente <= 0) {\n throw new UnauthorizedException('Utente non autenticato.');\n }\n\n return {\n codiceUtente,\n email: typeof utente?.email === 'string' ? utente.email : undefined,\n flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n flagAdmin: normalizeBooleanFlag(utente?.flagAdmin),\n };\n}\n\n/* Impone il flag superutente: gestione utenti e dei loro grant. /\nexport function ensureSuperUser(\n user: AuthenticatedAccessiUser,\n message = 'Operazione riservata ai superutenti.',\n): void {\n if (!user.flagSuper) {\n throw new ForbiddenException(message);\n }\n}\n\n/* Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. /\nexport function ensureAdmin(\n user: AuthenticatedAccessiUser,\n message = 'Operazione riservata agli amministratori.',\n): void {\n if (!user.flagAdmin) {\n throw new ForbiddenException(message);\n }\n}\n\n/\n Gestione utenti e assegnazioni: consentita a superutenti e admin.\n * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.\n /\nexport function ensureUserManagement(\n user: AuthenticatedAccessiUser,\n message = 'Operazione riservata agli amministratori degli utenti.',\n): void {\n if (!user.flagSuper && !user.flagAdmin) {\n throw new ForbiddenException(message);\n }\n}\n\n/\n Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.\n * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango\n * pari o inferiore, quindi un superutente non puo' toccare un admin.\n /\nexport function accessiUserRank(user: { flagSuper?: boolean; flagAdmin?: boolean }): number {\n if (user.flagAdmin) return 2;\n if (user.flagSuper) return 1;\n return 0;\n}\n\n/\n Impone che l'attore possa gestire il target: rango attore >= rango target.\n * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).\n /\nexport function ensureCanManageTargetUser(\n actor: AuthenticatedAccessiUser,\n target: { flagSuper?: boolean; flagAdmin?: boolean },\n message = 'Non puoi gestire un utente di rango superiore al tuo.',\n): void {\n if (accessiUserRank(actor) < accessiUserRank(target)) {\n throw new ForbiddenException(message);\n }\n}\n\n/\n Limita la modifica dei flag di privilegio in base al ruolo dell'attore:\n * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza\n * `flagAdmin` gestisce solo `flagSuper`.\n /\nexport function ensurePrivilegeFlagChanges(\n user: AuthenticatedAccessiUser,\n changes: { flagSuper?: unknown; flagAdmin?: unknown },\n): void {\n if (changes.flagAdmin !== undefined && !user.flagAdmin) {\n throw new ForbiddenException('Solo un admin puo modificare il flag admin.');\n }\n if (changes.flagSuper !== undefined && !user.flagSuper && !user.flagAdmin) {\n throw new ForbiddenException('Solo un superutente o un admin puo modificare il flag superutente.');\n }\n}\n\n/* Accesso alla console: superutenti e admin. /\nexport function ensureConsoleAccess(\n user: AuthenticatedAccessiUser,\n message = 'La console richiede un superutente o un admin Accessi.',\n): void {\n if (!user.flagSuper && !user.flagAdmin) {\n throw new ForbiddenException(message);\n }\n}\n\n/* Permette l'operazione al proprietario della risorsa o a superutenti/admin. /\nexport function ensureSelfOrSuperUser(\n user: AuthenticatedAccessiUser,\n targetUserCode: number,\n message = 'Operazione non autorizzata su questo utente.',\n): void {\n if (user.flagSuper \|\| user.flagAdmin \|\| user.codiceUtente === targetUserCode) {\n return;\n }\n\n throw new ForbiddenException(message);\n}\n\n/* Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n statoRegistrazione?: unknown;\n flagSuper?: unknown;\n flagAdmin?: unknown;\n passwordLoginEnabled?: unknown;\n passwordlessLoginEnabled?: unknown;\n flagDueFattori?: unknown;\n roles?: unknown;\n permissions?: unknown;\n}): boolean {\n return (\n user.statoRegistrazione !== undefined \|\|\n user.flagSuper !== undefined \|\|\n user.flagAdmin !== undefined \|\|\n user.passwordLoginEnabled !== undefined \|\|\n user.passwordlessLoginEnabled !== undefined \|\|\n user.flagDueFattori !== undefined \|\|\n user.roles !== undefined \|\|\n user.permissions !== undefined\n );\n}\n"]}

package/dist/accessi-module/security/consoleEntry.d.ts ADDED Viewed

@@ -0,0 +1,16 @@
+export interface ConsoleEntryTicket {
+    ticket: string;
+    expiresInSeconds: number;
+}
+/** Emette un ticket monouso per l'utente indicato, conservando il suo JWT per lo scambio. */
+export declare function issueConsoleEntryTicket(record: {
+    token: string;
+    codiceUtente: number;
+}, ttlMs?: number): ConsoleEntryTicket;
+/** Consuma (monouso) un ticket e restituisce il JWT collegato, oppure null se scaduto/assente/invalido. */
+export declare function consumeConsoleEntryTicket(ticket: unknown): {
+    token: string;
+    codiceUtente: number;
+} | null;
+/** Solo per i test: azzera lo store in memoria. */
+export declare function clearConsoleEntryTickets(): void;

package/dist/accessi-module/security/consoleEntry.js ADDED Viewed

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.issueConsoleEntryTicket = issueConsoleEntryTicket;
+exports.consumeConsoleEntryTicket = consumeConsoleEntryTicket;
+exports.clearConsoleEntryTickets = clearConsoleEntryTickets;
+const crypto_1 = require("crypto");
+const DEFAULT_TTL_MS = 60000;
+const MAX_ENTRIES = 5000;
+const entries = new Map();
+function sweep(now) {
+    for (const [ticket, record] of entries) {
+        if (record.expiresAt <= now)
+            entries.delete(ticket);
+    }
+}
+/** Emette un ticket monouso per l'utente indicato, conservando il suo JWT per lo scambio. */
+function issueConsoleEntryTicket(record, ttlMs = DEFAULT_TTL_MS) {
+    const now = Date.now();
+    sweep(now);
+    // Limita la memoria anche sotto attacco: rimuove la voce piu vecchia.
+    while (entries.size >= MAX_ENTRIES) {
+        const oldest = entries.keys().next().value;
+        if (oldest === undefined)
+            break;
+        entries.delete(oldest);
+    }
+    const ticket = (0, crypto_1.randomBytes)(32).toString('hex');
+    entries.set(ticket, Object.assign(Object.assign({}, record), { expiresAt: now + ttlMs }));
+    return { ticket, expiresInSeconds: Math.ceil(ttlMs / 1000) };
+}
+/** Consuma (monouso) un ticket e restituisce il JWT collegato, oppure null se scaduto/assente/invalido. */
+function consumeConsoleEntryTicket(ticket) {
+    if (typeof ticket !== 'string' || !/^[a-f0-9]{64}$/i.test(ticket)) {
+        return null;
+    }
+    const record = entries.get(ticket);
+    if (!record) {
+        return null;
+    }
+    entries.delete(ticket);
+    if (record.expiresAt <= Date.now()) {
+        return null;
+    }
+    return { token: record.token, codiceUtente: record.codiceUtente };
+}
+/** Solo per i test: azzera lo store in memoria. */
+function clearConsoleEntryTickets() {
+    entries.clear();
+}
+//# sourceMappingURL=consoleEntry.js.map

package/dist/accessi-module/security/consoleEntry.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"consoleEntry.js","sourceRoot":"","sources":["../../../src/accessi-module/security/consoleEntry.ts"],"names":[],"mappings":";;AAqCA,0DAiBC;AAGD,8DAeC;AAGD,4DAEC;AA7ED,mCAAqC;AAqBrC,MAAM,cAAc,GAAG,KAAM,CAAC;AAC9B,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;AAOtD,SAAS,KAAK,CAAC,GAAW;IACxB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,uBAAuB,CACrC,MAA+C,EAC/C,QAAgB,cAAc;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,CAAC,GAAG,CAAC,CAAC;IAEX,sEAAsE;IACtE,OAAO,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC3C,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,kCAAO,MAAM,KAAE,SAAS,EAAE,GAAG,GAAG,KAAK,IAAG,CAAC;IAC3D,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,2GAA2G;AAC3G,SAAgB,yBAAyB,CACvC,MAAe;IAEf,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AACpE,CAAC;AAED,mDAAmD;AACnD,SAAgB,wBAAwB;IACtC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC","sourcesContent":["import { randomBytes } from 'crypto';\n\n/**\n * Ticket di ingresso alla console, monouso e a breve scadenza.\n *\n * Serve a passare una sessione gia autenticata (frontend che possiede un JWT Accessi)\n * alla console amministrativa senza reinserire le credenziali e senza mettere il JWT\n * nell'URL: il frontend scambia il proprio JWT con un ticket opaco, apre la console\n * con `#entry=<ticket>` e la console lo scambia con il token originale.\n *\n * Il ticket e' valido una sola volta, per pochi secondi, ed e' legato all'utente che\n * lo ha richiesto (che deve avere accesso alla console). Resta in memoria del processo:\n * con piu istanze del backend il ticket va consumato dalla stessa istanza che lo emette.\n */\n\ninterface ConsoleEntryRecord {\n token: string;\n codiceUtente: number;\n expiresAt: number;\n}\n\nconst DEFAULT_TTL_MS = 60_000;\nconst MAX_ENTRIES = 5000;\nconst entries = new Map<string, ConsoleEntryRecord>();\n\nexport interface ConsoleEntryTicket {\n ticket: string;\n expiresInSeconds: number;\n}\n\nfunction sweep(now: number): void {\n for (const [ticket, record] of entries) {\n if (record.expiresAt <= now) entries.delete(ticket);\n }\n}\n\n/** Emette un ticket monouso per l'utente indicato, conservando il suo JWT per lo scambio. */\nexport function issueConsoleEntryTicket(\n record: { token: string; codiceUtente: number },\n ttlMs: number = DEFAULT_TTL_MS,\n): ConsoleEntryTicket {\n const now = Date.now();\n sweep(now);\n\n // Limita la memoria anche sotto attacco: rimuove la voce piu vecchia.\n while (entries.size >= MAX_ENTRIES) {\n const oldest = entries.keys().next().value;\n if (oldest === undefined) break;\n entries.delete(oldest);\n }\n\n const ticket = randomBytes(32).toString('hex');\n entries.set(ticket, { ...record, expiresAt: now + ttlMs });\n return { ticket, expiresInSeconds: Math.ceil(ttlMs / 1000) };\n}\n\n/** Consuma (monouso) un ticket e restituisce il JWT collegato, oppure null se scaduto/assente/invalido. */\nexport function consumeConsoleEntryTicket(\n ticket: unknown,\n): { token: string; codiceUtente: number } | null {\n if (typeof ticket !== 'string' || !/^[a-f0-9]{64}$/i.test(ticket)) {\n return null;\n }\n const record = entries.get(ticket);\n if (!record) {\n return null;\n }\n entries.delete(ticket);\n if (record.expiresAt <= Date.now()) {\n return null;\n }\n return { token: record.token, codiceUtente: record.codiceUtente };\n}\n\n/** Solo per i test: azzera lo store in memoria. */\nexport function clearConsoleEntryTickets(): void {\n entries.clear();\n}\n"]}

package/dist/accessi-module/security/publicAuthRateLimit.d.ts CHANGED Viewed

@@ -1,6 +1,6 @@
 import { Request, Response } from 'express';
 import type { AccessiOptions } from '../AccessiModule';
-export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken' | 'adminBootstrap';
+export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken' | 'adminBootstrap' | 'consoleEntry';
 type RateLimitDecision = {
     allowed: boolean;
     retryAfterSeconds: number;

package/dist/accessi-module/security/publicAuthRateLimit.js CHANGED Viewed

@@ -13,6 +13,7 @@ const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
     getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
     adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
+    consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
 };
 const RATE_LIMIT_BUCKETS = new Map();
 const MAX_TRACKED_BUCKETS = 20000;

package/dist/accessi-module/security/publicAuthRateLimit.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA2IA,4DAiDC;AAED,0EAWC;AAzMD,2CAA4C;AAE5C,+CAAgD;AAwBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC9D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IAErF,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,aAAa,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,uBAAuB,GAAG,aAAa,CAC3C,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,EACJ,GAAG,CACJ,CAAC;QACF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\n\nexport type PublicAuthRateLimitScope =\n \| 'login'\n \| 'twoFactorVerify'\n \| 'twoFactorResend'\n \| 'register'\n \| 'passwordResetEmail'\n \| 'passwordResetConfirm'\n \| 'getUserByToken'\n \| 'adminBootstrap';\n\ntype RateLimitBucket = {\n count: number;\n resetAt: number;\n lastSeenAt: number;\n};\n\ntype RateLimitDecision = {\n allowed: boolean;\n retryAfterSeconds: number;\n};\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n PublicAuthRateLimitScope,\n PublicAuthRateLimitRuleOptions\n> = {\n login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n};\n\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\nconst MAX_TRACKED_BUCKETS = 20000;\nconst MAX_WINDOW_MS = Math.max(\n ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\n);\n\nfunction getRule(\n options: AccessiOptions,\n scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n const configuredRule = options.publicAuthRateLimit?.[scope];\n\n if (\n configuredRule &&\n Number.isFinite(configuredRule.windowMs) &&\n configuredRule.windowMs > 0 &&\n Number.isFinite(configuredRule.maxAttempts) &&\n configuredRule.maxAttempts > 0\n ) {\n return {\n windowMs: Math.trunc(configuredRule.windowMs),\n maxAttempts: Math.trunc(configuredRule.maxAttempts),\n };\n }\n\n return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nfunction normalizeIdentifier(identifier: string): string \| null {\n if (typeof identifier !== 'string') {\n return null;\n }\n\n const normalized = identifier.trim().toLowerCase();\n return normalized === '' ? null : normalized;\n}\n\nfunction pruneRateLimitBuckets(now: number): void {\n if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n return;\n }\n\n for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n if (bucket.resetAt <= now \|\| bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\n RATE_LIMIT_BUCKETS.delete(key);\n }\n\n if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n return;\n }\n }\n}\n\n/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */\nfunction enforceBucketCap(): void {\n while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {\n let oldestKey: string \| undefined;\n let oldestSeen = Number.POSITIVE_INFINITY;\n\n for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n if (bucket.lastSeenAt < oldestSeen) {\n oldestSeen = bucket.lastSeenAt;\n oldestKey = key;\n }\n }\n\n if (oldestKey === undefined) {\n return;\n }\n\n RATE_LIMIT_BUCKETS.delete(oldestKey);\n }\n}\n\nfunction consumeBucket(\n bucketKey: string,\n rule: PublicAuthRateLimitRuleOptions,\n now: number,\n): number \| null {\n const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\n if (!existingBucket \|\| existingBucket.resetAt <= now) {\n enforceBucketCap();\n RATE_LIMIT_BUCKETS.set(bucketKey, {\n count: 1,\n resetAt: now + rule.windowMs,\n lastSeenAt: now,\n });\n return null;\n }\n\n existingBucket.lastSeenAt = now;\n if (existingBucket.count >= rule.maxAttempts) {\n return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\n }\n\n existingBucket.count += 1;\n return null;\n}\n\nexport function checkPublicAuthRateLimit(\n options: AccessiOptions,\n scope: PublicAuthRateLimitScope,\n req: Request,\n identifiers: string[] = [],\n): RateLimitDecision {\n if (options.publicAuthRateLimit?.enabled === false) {\n return { allowed: true, retryAfterSeconds: 0 };\n }\n\n const rule = getRule(options, scope);\n const now = Date.now();\n pruneRateLimitBuckets(now);\n\n const ipAddress =\n normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n // evitando crescita di memoria con identificatori sempre diversi.\n const ipRetryAfterSeconds = consumeBucket(`${scope}\|ip\|${ipAddress}`, rule, now);\n if (ipRetryAfterSeconds) {\n return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };\n }\n\n let retryAfterSeconds = 0;\n for (const identifier of identifiers) {\n const normalizedIdentifier = normalizeIdentifier(identifier);\n if (!normalizedIdentifier) {\n continue;\n }\n\n const bucketRetryAfterSeconds = consumeBucket(\n `${scope}\|ip-subject\|${ipAddress}\|${normalizedIdentifier}`,\n rule,\n now,\n );\n if (bucketRetryAfterSeconds) {\n retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\n }\n }\n\n if (retryAfterSeconds > 0) {\n return {\n allowed: false,\n retryAfterSeconds,\n };\n }\n\n return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n res: Response,\n retryAfterSeconds: number,\n): Response {\n res.setHeader('Retry-After', String(retryAfterSeconds));\n return RestUtilities.sendErrorMessage(\n res,\n 'Troppi tentativi. Riprova piu tardi.',\n 'PublicAuthRateLimit',\n HttpStatus.TOO_MANY_REQUESTS,\n );\n}\n"]}
1	+ {"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA6IA,4DAiDC;AAED,0EAWC;AA3MD,2CAA4C;AAE5C,+CAAgD;AAyBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC7D,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC3D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IAErF,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,aAAa,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,uBAAuB,GAAG,aAAa,CAC3C,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,EACJ,GAAG,CACJ,CAAC;QACF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\n\nexport type PublicAuthRateLimitScope =\n \| 'login'\n \| 'twoFactorVerify'\n \| 'twoFactorResend'\n \| 'register'\n \| 'passwordResetEmail'\n \| 'passwordResetConfirm'\n \| 'getUserByToken'\n \| 'adminBootstrap'\n \| 'consoleEntry';\n\ntype RateLimitBucket = {\n count: number;\n resetAt: number;\n lastSeenAt: number;\n};\n\ntype RateLimitDecision = {\n allowed: boolean;\n retryAfterSeconds: number;\n};\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n PublicAuthRateLimitScope,\n PublicAuthRateLimitRuleOptions\n> = {\n login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n};\n\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\nconst MAX_TRACKED_BUCKETS = 20000;\nconst MAX_WINDOW_MS = Math.max(\n ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\n);\n\nfunction getRule(\n options: AccessiOptions,\n scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n const configuredRule = options.publicAuthRateLimit?.[scope];\n\n if (\n configuredRule &&\n Number.isFinite(configuredRule.windowMs) &&\n configuredRule.windowMs > 0 &&\n Number.isFinite(configuredRule.maxAttempts) &&\n configuredRule.maxAttempts > 0\n ) {\n return {\n windowMs: Math.trunc(configuredRule.windowMs),\n maxAttempts: Math.trunc(configuredRule.maxAttempts),\n };\n }\n\n return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nfunction normalizeIdentifier(identifier: string): string \| null {\n if (typeof identifier !== 'string') {\n return null;\n }\n\n const normalized = identifier.trim().toLowerCase();\n return normalized === '' ? null : normalized;\n}\n\nfunction pruneRateLimitBuckets(now: number): void {\n if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n return;\n }\n\n for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n if (bucket.resetAt <= now \|\| bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\n RATE_LIMIT_BUCKETS.delete(key);\n }\n\n if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n return;\n }\n }\n}\n\n/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */\nfunction enforceBucketCap(): void {\n while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {\n let oldestKey: string \| undefined;\n let oldestSeen = Number.POSITIVE_INFINITY;\n\n for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n if (bucket.lastSeenAt < oldestSeen) {\n oldestSeen = bucket.lastSeenAt;\n oldestKey = key;\n }\n }\n\n if (oldestKey === undefined) {\n return;\n }\n\n RATE_LIMIT_BUCKETS.delete(oldestKey);\n }\n}\n\nfunction consumeBucket(\n bucketKey: string,\n rule: PublicAuthRateLimitRuleOptions,\n now: number,\n): number \| null {\n const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\n if (!existingBucket \|\| existingBucket.resetAt <= now) {\n enforceBucketCap();\n RATE_LIMIT_BUCKETS.set(bucketKey, {\n count: 1,\n resetAt: now + rule.windowMs,\n lastSeenAt: now,\n });\n return null;\n }\n\n existingBucket.lastSeenAt = now;\n if (existingBucket.count >= rule.maxAttempts) {\n return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\n }\n\n existingBucket.count += 1;\n return null;\n}\n\nexport function checkPublicAuthRateLimit(\n options: AccessiOptions,\n scope: PublicAuthRateLimitScope,\n req: Request,\n identifiers: string[] = [],\n): RateLimitDecision {\n if (options.publicAuthRateLimit?.enabled === false) {\n return { allowed: true, retryAfterSeconds: 0 };\n }\n\n const rule = getRule(options, scope);\n const now = Date.now();\n pruneRateLimitBuckets(now);\n\n const ipAddress =\n normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n // evitando crescita di memoria con identificatori sempre diversi.\n const ipRetryAfterSeconds = consumeBucket(`${scope}\|ip\|${ipAddress}`, rule, now);\n if (ipRetryAfterSeconds) {\n return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };\n }\n\n let retryAfterSeconds = 0;\n for (const identifier of identifiers) {\n const normalizedIdentifier = normalizeIdentifier(identifier);\n if (!normalizedIdentifier) {\n continue;\n }\n\n const bucketRetryAfterSeconds = consumeBucket(\n `${scope}\|ip-subject\|${ipAddress}\|${normalizedIdentifier}`,\n rule,\n now,\n );\n if (bucketRetryAfterSeconds) {\n retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\n }\n }\n\n if (retryAfterSeconds > 0) {\n return {\n allowed: false,\n retryAfterSeconds,\n };\n }\n\n return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n res: Response,\n retryAfterSeconds: number,\n): Response {\n res.setHeader('Retry-After', String(retryAfterSeconds));\n return RestUtilities.sendErrorMessage(\n res,\n 'Troppi tentativi. Riprova piu tardi.',\n 'PublicAuthRateLimit',\n HttpStatus.TOO_MANY_REQUESTS,\n );\n}\n"]}

package/dist/emilsoftware-utilities-2.0.0-dev.43.tgz ADDED Viewed

Binary file

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "emilsoftware-utilities",
-  "version": "2.0.0-dev.42",
+  "version": "2.0.0-dev.43",
   "description": "Utilities for EmilSoftware",
   "main": "dist/index.js",
   "module": "dist/index.js",

package/dist/emilsoftware-utilities-2.0.0-dev.42.tgz DELETED Viewed

Binary file