emilsoftware-utilities 2.0.0-dev.42 → 2.0.0-dev.44

package/dist/accessi-module/security/accessControl.js.map

@@ -1 +1 @@
-{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,kCAOC;AAMD,oDAOC;AAOD,gEAUC;AAGD,kDAOC;AAGD,sDAUC;AAGD,4DAoBC;AAvID,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,sCAAsC;IAEhD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,WAAW,CACzB,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,IAA8B,EAC9B,OAAqD;IAErD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,2BAAkB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,2BAAkB,CAAC,oEAAoE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,mBAAmB,CACjC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */\nexport interface AuthenticatedAccessiUser {\n  codiceUtente: number;\n  email?: string;\n  flagSuper: boolean;\n  flagAdmin: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\n/**\n * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n */\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n  const payload = (req as Request & { user?: unknown }).user;\n  const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\n  const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\n    ? payloadRecord.userData as Record<string, unknown>\n    : undefined;\n  const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\n  const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\n  const codiceUtente = Number(utente?.codiceUtente);\n\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n    throw new UnauthorizedException('Utente non autenticato.');\n  }\n\n  return {\n    codiceUtente,\n    email: typeof utente?.email === 'string' ? utente.email : undefined,\n    flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n    flagAdmin: normalizeBooleanFlag(utente?.flagAdmin),\n  };\n}\n\n/** Impone il flag superutente: gestione utenti e dei loro grant. */\nexport function ensureSuperUser(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata ai superutenti.',\n): void {\n  if (!user.flagSuper) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */\nexport function ensureAdmin(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori.',\n): void {\n  if (!user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Gestione utenti e assegnazioni: consentita a superutenti e admin.\n * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.\n */\nexport function ensureUserManagement(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori degli utenti.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:\n * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza\n * `flagAdmin` gestisce solo `flagSuper`.\n */\nexport function ensurePrivilegeFlagChanges(\n  user: AuthenticatedAccessiUser,\n  changes: { flagSuper?: unknown; flagAdmin?: unknown },\n): void {\n  if (changes.flagAdmin !== undefined && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un admin puo modificare il flag admin.');\n  }\n  if (changes.flagSuper !== undefined && !user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un superutente o un admin puo modificare il flag superutente.');\n  }\n}\n\n/** Accesso alla console: superutenti e admin. */\nexport function ensureConsoleAccess(\n  user: AuthenticatedAccessiUser,\n  message = 'La console richiede un superutente o un admin Accessi.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */\nexport function ensureSelfOrSuperUser(\n  user: AuthenticatedAccessiUser,\n  targetUserCode: number,\n  message = 'Operazione non autorizzata su questo utente.',\n): void {\n  if (user.flagSuper || user.flagAdmin || user.codiceUtente === targetUserCode) {\n    return;\n  }\n\n  throw new ForbiddenException(message);\n}\n\n/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n  statoRegistrazione?: unknown;\n  flagSuper?: unknown;\n  flagAdmin?: unknown;\n  passwordLoginEnabled?: unknown;\n  passwordlessLoginEnabled?: unknown;\n  flagDueFattori?: unknown;\n  roles?: unknown;\n  permissions?: unknown;\n}): boolean {\n  return (\n    user.statoRegistrazione !== undefined ||\n    user.flagSuper !== undefined ||\n    user.flagAdmin !== undefined ||\n    user.passwordLoginEnabled !== undefined ||\n    user.passwordlessLoginEnabled !== undefined ||\n    user.flagDueFattori !== undefined ||\n    user.roles !== undefined ||\n    user.permissions !== undefined\n  );\n}\n"]}
+{"version":3,"file":"accessControl.js","sourceRoot":"","sources":["../../../src/accessi-module/security/accessControl.ts"],"names":[],"mappings":";;AAmBA,kEAoBC;AAGD,0CAOC;AAGD,kCAOC;AAMD,oDAOC;AAOD,0CAIC;AAMD,8DAQC;AAOD,gEAUC;AAGD,kDAOC;AAGD,sDAUC;AAGD,4DAoBC;AAhKD,2CAA2E;AAW3E,SAAS,oBAAoB,CAAC,KAAc;IAC1C,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,GAAG,CAAC;AACxD,CAAC;AAED;;;GAGG;AACH,SAAgB,2BAA2B,CAAC,GAAY;;IACtD,MAAM,OAAO,GAAI,GAAoC,CAAC,IAAI,CAAC;IAC3D,MAAM,aAAa,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9G,MAAM,QAAQ,GAAG,CAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,QAAQ,KAAI,OAAO,aAAa,CAAC,QAAQ,KAAK,QAAQ;QACpF,CAAC,CAAC,aAAa,CAAC,QAAmC;QACnD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,OAAO,GAAG,MAAA,MAAA,aAAa,aAAb,aAAa,uBAAb,aAAa,CAAE,MAAM,mCAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,MAAM,mCAAI,aAAa,CAAC;IAC3E,MAAM,MAAM,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAkC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvG,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAC,CAAC;IAElD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,8BAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,YAAY;QACZ,KAAK,EAAE,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,KAAK,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACnE,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;QAClD,SAAS,EAAE,oBAAoB,CAAC,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,SAAS,CAAC;KACnD,CAAC;AACJ,CAAC;AAED,oEAAoE;AACpE,SAAgB,eAAe,CAC7B,IAA8B,EAC9B,OAAO,GAAG,sCAAsC;IAEhD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,WAAW,CACzB,IAA8B,EAC9B,OAAO,GAAG,2CAA2C;IAErD,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAgB,oBAAoB,CAClC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,IAAkD;IAChF,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;GAGG;AACH,SAAgB,yBAAyB,CACvC,KAA+B,EAC/B,MAAoD,EACpD,OAAO,GAAG,uDAAuD;IAEjE,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,eAAe,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAgB,0BAA0B,CACxC,IAA8B,EAC9B,OAAqD;IAErD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvD,MAAM,IAAI,2BAAkB,CAAC,6CAA6C,CAAC,CAAC;IAC9E,CAAC;IACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1E,MAAM,IAAI,2BAAkB,CAAC,oEAAoE,CAAC,CAAC;IACrG,CAAC;AACH,CAAC;AAED,iDAAiD;AACjD,SAAgB,mBAAmB,CACjC,IAA8B,EAC9B,OAAO,GAAG,wDAAwD;IAElE,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACvC,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,iFAAiF;AACjF,SAAgB,qBAAqB,CACnC,IAA8B,EAC9B,cAAsB,EACtB,OAAO,GAAG,8CAA8C;IAExD,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,cAAc,EAAE,CAAC;QAC7E,OAAO;IACT,CAAC;IAED,MAAM,IAAI,2BAAkB,CAAC,OAAO,CAAC,CAAC;AACxC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,wBAAwB,CAAC,IASxC;IACC,OAAO,CACL,IAAI,CAAC,kBAAkB,KAAK,SAAS;QACrC,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,SAAS,KAAK,SAAS;QAC5B,IAAI,CAAC,oBAAoB,KAAK,SAAS;QACvC,IAAI,CAAC,wBAAwB,KAAK,SAAS;QAC3C,IAAI,CAAC,cAAc,KAAK,SAAS;QACjC,IAAI,CAAC,KAAK,KAAK,SAAS;QACxB,IAAI,CAAC,WAAW,KAAK,SAAS,CAC/B,CAAC;AACJ,CAAC","sourcesContent":["import { ForbiddenException, UnauthorizedException } from '@nestjs/common';\nimport { Request } from 'express';\n\n/** Profilo autorizzativo normalizzato estratto dal middleware Accessi. */\nexport interface AuthenticatedAccessiUser {\n  codiceUtente: number;\n  email?: string;\n  flagSuper: boolean;\n  flagAdmin: boolean;\n}\n\nfunction normalizeBooleanFlag(value: unknown): boolean {\n  return value === true || value === 1 || value === '1';\n}\n\n/**\n * Estrae l'utente gia verificato da `authorizeAccessi` o `JwtSimpleGuard`.\n * Non usare questa funzione come autenticazione: se il middleware non e stato applicato genera 401.\n */\nexport function getAuthenticatedAccessiUser(req: Request): AuthenticatedAccessiUser {\n  const payload = (req as Request & { user?: unknown }).user;\n  const payloadRecord = payload && typeof payload === 'object' ? payload as Record<string, unknown> : undefined;\n  const userData = payloadRecord?.userData && typeof payloadRecord.userData === 'object'\n    ? payloadRecord.userData as Record<string, unknown>\n    : undefined;\n  const rawUser = payloadRecord?.utente ?? userData?.utente ?? payloadRecord;\n  const utente = rawUser && typeof rawUser === 'object' ? rawUser as Record<string, unknown> : undefined;\n  const codiceUtente = Number(utente?.codiceUtente);\n\n  if (!Number.isSafeInteger(codiceUtente) || codiceUtente <= 0) {\n    throw new UnauthorizedException('Utente non autenticato.');\n  }\n\n  return {\n    codiceUtente,\n    email: typeof utente?.email === 'string' ? utente.email : undefined,\n    flagSuper: normalizeBooleanFlag(utente?.flagSuper),\n    flagAdmin: normalizeBooleanFlag(utente?.flagAdmin),\n  };\n}\n\n/** Impone il flag superutente: gestione utenti e dei loro grant. */\nexport function ensureSuperUser(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata ai superutenti.',\n): void {\n  if (!user.flagSuper) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Impone il flag admin: catalogo (menu, gruppi, tipi), token di servizio e provider SSO. */\nexport function ensureAdmin(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori.',\n): void {\n  if (!user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Gestione utenti e assegnazioni: consentita a superutenti e admin.\n * `flagAdmin` non conferisce abilitazioni, ma abilita la console completa.\n */\nexport function ensureUserManagement(\n  user: AuthenticatedAccessiUser,\n  message = 'Operazione riservata agli amministratori degli utenti.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Rango di un utente Accessi: 0 utente comune, 1 superutente, 2 admin.\n * La gerarchia e' ADMIN > SUPER: un attore puo' gestire solo utenti di rango\n * pari o inferiore, quindi un superutente non puo' toccare un admin.\n */\nexport function accessiUserRank(user: { flagSuper?: boolean; flagAdmin?: boolean }): number {\n  if (user.flagAdmin) return 2;\n  if (user.flagSuper) return 1;\n  return 0;\n}\n\n/**\n * Impone che l'attore possa gestire il target: rango attore >= rango target.\n * Un superutente (1) gestisce utenti comuni e altri superutenti, ma non admin (2).\n */\nexport function ensureCanManageTargetUser(\n  actor: AuthenticatedAccessiUser,\n  target: { flagSuper?: boolean; flagAdmin?: boolean },\n  message = 'Non puoi gestire un utente di rango superiore al tuo.',\n): void {\n  if (accessiUserRank(actor) < accessiUserRank(target)) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/**\n * Limita la modifica dei flag di privilegio in base al ruolo dell'attore:\n * un admin gestisce sia `flagAdmin` sia `flagSuper`; un superutente senza\n * `flagAdmin` gestisce solo `flagSuper`.\n */\nexport function ensurePrivilegeFlagChanges(\n  user: AuthenticatedAccessiUser,\n  changes: { flagSuper?: unknown; flagAdmin?: unknown },\n): void {\n  if (changes.flagAdmin !== undefined && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un admin puo modificare il flag admin.');\n  }\n  if (changes.flagSuper !== undefined && !user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException('Solo un superutente o un admin puo modificare il flag superutente.');\n  }\n}\n\n/** Accesso alla console: superutenti e admin. */\nexport function ensureConsoleAccess(\n  user: AuthenticatedAccessiUser,\n  message = 'La console richiede un superutente o un admin Accessi.',\n): void {\n  if (!user.flagSuper && !user.flagAdmin) {\n    throw new ForbiddenException(message);\n  }\n}\n\n/** Permette l'operazione al proprietario della risorsa o a superutenti/admin. */\nexport function ensureSelfOrSuperUser(\n  user: AuthenticatedAccessiUser,\n  targetUserCode: number,\n  message = 'Operazione non autorizzata su questo utente.',\n): void {\n  if (user.flagSuper || user.flagAdmin || user.codiceUtente === targetUserCode) {\n    return;\n  }\n\n  throw new ForbiddenException(message);\n}\n\n/** Riconosce i campi che non possono essere aggiornati da un utente sul proprio profilo. */\nexport function hasPrivilegedUserChanges(user: {\n  statoRegistrazione?: unknown;\n  flagSuper?: unknown;\n  flagAdmin?: unknown;\n  passwordLoginEnabled?: unknown;\n  passwordlessLoginEnabled?: unknown;\n  flagDueFattori?: unknown;\n  roles?: unknown;\n  permissions?: unknown;\n}): boolean {\n  return (\n    user.statoRegistrazione !== undefined ||\n    user.flagSuper !== undefined ||\n    user.flagAdmin !== undefined ||\n    user.passwordLoginEnabled !== undefined ||\n    user.passwordlessLoginEnabled !== undefined ||\n    user.flagDueFattori !== undefined ||\n    user.roles !== undefined ||\n    user.permissions !== undefined\n  );\n}\n"]}

package/dist/accessi-module/security/consoleEntry.d.ts

@@ -0,0 +1,16 @@
+export interface ConsoleEntryTicket {
+    ticket: string;
+    expiresInSeconds: number;
+}
+/** Emette un ticket monouso per l'utente indicato, conservando il suo JWT per lo scambio. */
+export declare function issueConsoleEntryTicket(record: {
+    token: string;
+    codiceUtente: number;
+}, ttlMs?: number): ConsoleEntryTicket;
+/** Consuma (monouso) un ticket e restituisce il JWT collegato, oppure null se scaduto/assente/invalido. */
+export declare function consumeConsoleEntryTicket(ticket: unknown): {
+    token: string;
+    codiceUtente: number;
+} | null;
+/** Solo per i test: azzera lo store in memoria. */
+export declare function clearConsoleEntryTickets(): void;

package/dist/accessi-module/security/consoleEntry.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.issueConsoleEntryTicket = issueConsoleEntryTicket;
+exports.consumeConsoleEntryTicket = consumeConsoleEntryTicket;
+exports.clearConsoleEntryTickets = clearConsoleEntryTickets;
+const crypto_1 = require("crypto");
+const DEFAULT_TTL_MS = 60000;
+const MAX_ENTRIES = 5000;
+const entries = new Map();
+function sweep(now) {
+    for (const [ticket, record] of entries) {
+        if (record.expiresAt <= now)
+            entries.delete(ticket);
+    }
+}
+/** Emette un ticket monouso per l'utente indicato, conservando il suo JWT per lo scambio. */
+function issueConsoleEntryTicket(record, ttlMs = DEFAULT_TTL_MS) {
+    const now = Date.now();
+    sweep(now);
+    // Limita la memoria anche sotto attacco: rimuove la voce piu vecchia.
+    while (entries.size >= MAX_ENTRIES) {
+        const oldest = entries.keys().next().value;
+        if (oldest === undefined)
+            break;
+        entries.delete(oldest);
+    }
+    const ticket = (0, crypto_1.randomBytes)(32).toString('hex');
+    entries.set(ticket, Object.assign(Object.assign({}, record), { expiresAt: now + ttlMs }));
+    return { ticket, expiresInSeconds: Math.ceil(ttlMs / 1000) };
+}
+/** Consuma (monouso) un ticket e restituisce il JWT collegato, oppure null se scaduto/assente/invalido. */
+function consumeConsoleEntryTicket(ticket) {
+    if (typeof ticket !== 'string' || !/^[a-f0-9]{64}$/i.test(ticket)) {
+        return null;
+    }
+    const record = entries.get(ticket);
+    if (!record) {
+        return null;
+    }
+    entries.delete(ticket);
+    if (record.expiresAt <= Date.now()) {
+        return null;
+    }
+    return { token: record.token, codiceUtente: record.codiceUtente };
+}
+/** Solo per i test: azzera lo store in memoria. */
+function clearConsoleEntryTickets() {
+    entries.clear();
+}
+//# sourceMappingURL=consoleEntry.js.map

package/dist/accessi-module/security/consoleEntry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"consoleEntry.js","sourceRoot":"","sources":["../../../src/accessi-module/security/consoleEntry.ts"],"names":[],"mappings":";;AAqCA,0DAiBC;AAGD,8DAeC;AAGD,4DAEC;AA7ED,mCAAqC;AAqBrC,MAAM,cAAc,GAAG,KAAM,CAAC;AAC9B,MAAM,WAAW,GAAG,IAAI,CAAC;AACzB,MAAM,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAC;AAOtD,SAAS,KAAK,CAAC,GAAW;IACxB,KAAK,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACvC,IAAI,MAAM,CAAC,SAAS,IAAI,GAAG;YAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,SAAgB,uBAAuB,CACrC,MAA+C,EAC/C,QAAgB,cAAc;IAE9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,KAAK,CAAC,GAAG,CAAC,CAAC;IAEX,sEAAsE;IACtE,OAAO,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC;QACnC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QAC3C,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACzB,CAAC;IAED,MAAM,MAAM,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,MAAM,kCAAO,MAAM,KAAE,SAAS,EAAE,GAAG,GAAG,KAAK,IAAG,CAAC;IAC3D,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED,2GAA2G;AAC3G,SAAgB,yBAAyB,CACvC,MAAe;IAEf,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAClE,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvB,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC;AACpE,CAAC;AAED,mDAAmD;AACnD,SAAgB,wBAAwB;IACtC,OAAO,CAAC,KAAK,EAAE,CAAC;AAClB,CAAC","sourcesContent":["import { randomBytes } from 'crypto';\n\n/**\n * Ticket di ingresso alla console, monouso e a breve scadenza.\n *\n * Serve a passare una sessione gia autenticata (frontend che possiede un JWT Accessi)\n * alla console amministrativa senza reinserire le credenziali e senza mettere il JWT\n * nell'URL: il frontend scambia il proprio JWT con un ticket opaco, apre la console\n * con `#entry=<ticket>` e la console lo scambia con il token originale.\n *\n * Il ticket e' valido una sola volta, per pochi secondi, ed e' legato all'utente che\n * lo ha richiesto (che deve avere accesso alla console). Resta in memoria del processo:\n * con piu istanze del backend il ticket va consumato dalla stessa istanza che lo emette.\n */\n\ninterface ConsoleEntryRecord {\n  token: string;\n  codiceUtente: number;\n  expiresAt: number;\n}\n\nconst DEFAULT_TTL_MS = 60_000;\nconst MAX_ENTRIES = 5000;\nconst entries = new Map<string, ConsoleEntryRecord>();\n\nexport interface ConsoleEntryTicket {\n  ticket: string;\n  expiresInSeconds: number;\n}\n\nfunction sweep(now: number): void {\n  for (const [ticket, record] of entries) {\n    if (record.expiresAt <= now) entries.delete(ticket);\n  }\n}\n\n/** Emette un ticket monouso per l'utente indicato, conservando il suo JWT per lo scambio. */\nexport function issueConsoleEntryTicket(\n  record: { token: string; codiceUtente: number },\n  ttlMs: number = DEFAULT_TTL_MS,\n): ConsoleEntryTicket {\n  const now = Date.now();\n  sweep(now);\n\n  // Limita la memoria anche sotto attacco: rimuove la voce piu vecchia.\n  while (entries.size >= MAX_ENTRIES) {\n    const oldest = entries.keys().next().value;\n    if (oldest === undefined) break;\n    entries.delete(oldest);\n  }\n\n  const ticket = randomBytes(32).toString('hex');\n  entries.set(ticket, { ...record, expiresAt: now + ttlMs });\n  return { ticket, expiresInSeconds: Math.ceil(ttlMs / 1000) };\n}\n\n/** Consuma (monouso) un ticket e restituisce il JWT collegato, oppure null se scaduto/assente/invalido. */\nexport function consumeConsoleEntryTicket(\n  ticket: unknown,\n): { token: string; codiceUtente: number } | null {\n  if (typeof ticket !== 'string' || !/^[a-f0-9]{64}$/i.test(ticket)) {\n    return null;\n  }\n  const record = entries.get(ticket);\n  if (!record) {\n    return null;\n  }\n  entries.delete(ticket);\n  if (record.expiresAt <= Date.now()) {\n    return null;\n  }\n  return { token: record.token, codiceUtente: record.codiceUtente };\n}\n\n/** Solo per i test: azzera lo store in memoria. */\nexport function clearConsoleEntryTickets(): void {\n  entries.clear();\n}\n"]}

package/dist/accessi-module/security/publicAuthRateLimit.d.ts

@@ -1,6 +1,6 @@
 import { Request, Response } from 'express';
 import type { AccessiOptions } from '../AccessiModule';
-export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken' | 'adminBootstrap';
+export type PublicAuthRateLimitScope = 'login' | 'twoFactorVerify' | 'twoFactorResend' | 'register' | 'passwordResetEmail' | 'passwordResetConfirm' | 'getUserByToken' | 'adminBootstrap' | 'consoleEntry';
 type RateLimitDecision = {
     allowed: boolean;
     retryAfterSeconds: number;

package/dist/accessi-module/security/publicAuthRateLimit.js

@@ -13,6 +13,7 @@ const DEFAULT_PUBLIC_AUTH_RATE_LIMITS = {
     passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
     getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
     adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },
+    consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },
 };
 const RATE_LIMIT_BUCKETS = new Map();
 const MAX_TRACKED_BUCKETS = 20000;

package/dist/accessi-module/security/publicAuthRateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA2IA,4DAiDC;AAED,0EAWC;AAzMD,2CAA4C;AAE5C,+CAAgD;AAwBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC9D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IAErF,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,aAAa,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,uBAAuB,GAAG,aAAa,CAC3C,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,EACJ,GAAG,CACJ,CAAC;QACF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\n\nexport type PublicAuthRateLimitScope =\n  | 'login'\n  | 'twoFactorVerify'\n  | 'twoFactorResend'\n  | 'register'\n  | 'passwordResetEmail'\n  | 'passwordResetConfirm'\n  | 'getUserByToken'\n  | 'adminBootstrap';\n\ntype RateLimitBucket = {\n  count: number;\n  resetAt: number;\n  lastSeenAt: number;\n};\n\ntype RateLimitDecision = {\n  allowed: boolean;\n  retryAfterSeconds: number;\n};\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n  PublicAuthRateLimitScope,\n  PublicAuthRateLimitRuleOptions\n> = {\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n  twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n  adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n};\n\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\nconst MAX_TRACKED_BUCKETS = 20000;\nconst MAX_WINDOW_MS = Math.max(\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\n);\n\nfunction getRule(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n  const configuredRule = options.publicAuthRateLimit?.[scope];\n\n  if (\n    configuredRule &&\n    Number.isFinite(configuredRule.windowMs) &&\n    configuredRule.windowMs > 0 &&\n    Number.isFinite(configuredRule.maxAttempts) &&\n    configuredRule.maxAttempts > 0\n  ) {\n    return {\n      windowMs: Math.trunc(configuredRule.windowMs),\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\n    };\n  }\n\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nfunction normalizeIdentifier(identifier: string): string | null {\n  if (typeof identifier !== 'string') {\n    return null;\n  }\n\n  const normalized = identifier.trim().toLowerCase();\n  return normalized === '' ? null : normalized;\n}\n\nfunction pruneRateLimitBuckets(now: number): void {\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n    return;\n  }\n\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\n      RATE_LIMIT_BUCKETS.delete(key);\n    }\n\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n      return;\n    }\n  }\n}\n\n/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */\nfunction enforceBucketCap(): void {\n  while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {\n    let oldestKey: string | undefined;\n    let oldestSeen = Number.POSITIVE_INFINITY;\n\n    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n      if (bucket.lastSeenAt < oldestSeen) {\n        oldestSeen = bucket.lastSeenAt;\n        oldestKey = key;\n      }\n    }\n\n    if (oldestKey === undefined) {\n      return;\n    }\n\n    RATE_LIMIT_BUCKETS.delete(oldestKey);\n  }\n}\n\nfunction consumeBucket(\n  bucketKey: string,\n  rule: PublicAuthRateLimitRuleOptions,\n  now: number,\n): number | null {\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\n  if (!existingBucket || existingBucket.resetAt <= now) {\n    enforceBucketCap();\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\n      count: 1,\n      resetAt: now + rule.windowMs,\n      lastSeenAt: now,\n    });\n    return null;\n  }\n\n  existingBucket.lastSeenAt = now;\n  if (existingBucket.count >= rule.maxAttempts) {\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\n  }\n\n  existingBucket.count += 1;\n  return null;\n}\n\nexport function checkPublicAuthRateLimit(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n  req: Request,\n  identifiers: string[] = [],\n): RateLimitDecision {\n  if (options.publicAuthRateLimit?.enabled === false) {\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  const rule = getRule(options, scope);\n  const now = Date.now();\n  pruneRateLimitBuckets(now);\n\n  const ipAddress =\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n  // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n  // evitando crescita di memoria con identificatori sempre diversi.\n  const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);\n  if (ipRetryAfterSeconds) {\n    return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };\n  }\n\n  let retryAfterSeconds = 0;\n  for (const identifier of identifiers) {\n    const normalizedIdentifier = normalizeIdentifier(identifier);\n    if (!normalizedIdentifier) {\n      continue;\n    }\n\n    const bucketRetryAfterSeconds = consumeBucket(\n      `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`,\n      rule,\n      now,\n    );\n    if (bucketRetryAfterSeconds) {\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\n    }\n  }\n\n  if (retryAfterSeconds > 0) {\n    return {\n      allowed: false,\n      retryAfterSeconds,\n    };\n  }\n\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n  res: Response,\n  retryAfterSeconds: number,\n): Response {\n  res.setHeader('Retry-After', String(retryAfterSeconds));\n  return RestUtilities.sendErrorMessage(\n    res,\n    'Troppi tentativi. Riprova piu tardi.',\n    'PublicAuthRateLimit',\n    HttpStatus.TOO_MANY_REQUESTS,\n  );\n}\n"]}
+{"version":3,"file":"publicAuthRateLimit.js","sourceRoot":"","sources":["../../../src/accessi-module/security/publicAuthRateLimit.ts"],"names":[],"mappings":";;AA6IA,4DAiDC;AAED,0EAWC;AA3MD,2CAA4C;AAE5C,+CAAgD;AAyBhD,MAAM,+BAA+B,GAGjC;IACF,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACpD,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC9D,eAAe,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAC7D,QAAQ,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IACtD,kBAAkB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,CAAC,EAAE;IAChE,oBAAoB,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IACnE,cAAc,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC5D,cAAc,EAAE,EAAE,QAAQ,EAAE,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;IAC7D,YAAY,EAAE,EAAE,QAAQ,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE;CAC3D,CAAC;AAEF,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAA2B,CAAC;AAC9D,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAClC,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAC5B,GAAG,MAAM,CAAC,MAAM,CAAC,+BAA+B,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAC/E,CAAC;AAEF,SAAS,OAAO,CACd,OAAuB,EACvB,KAA+B;;IAE/B,MAAM,cAAc,GAAG,MAAA,OAAO,CAAC,mBAAmB,0CAAG,KAAK,CAAC,CAAC;IAE5D,IACE,cAAc;QACd,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC;QACxC,cAAc,CAAC,QAAQ,GAAG,CAAC;QAC3B,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC;QAC3C,cAAc,CAAC,WAAW,GAAG,CAAC,EAC9B,CAAC;QACD,OAAO;YACL,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,QAAQ,CAAC;YAC7C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,WAAW,CAAC;SACpD,CAAC;IACJ,CAAC;IAED,OAAO,+BAA+B,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,UAAkB;IAC7C,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACnD,OAAO,UAAU,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/C,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW;IACxC,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;QAClD,OAAO;IACT,CAAC;IAED,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;QACzD,IAAI,MAAM,CAAC,OAAO,IAAI,GAAG,IAAI,MAAM,CAAC,UAAU,IAAI,GAAG,GAAG,aAAa,GAAG,CAAC,EAAE,CAAC;YAC1E,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjC,CAAC;QAED,IAAI,kBAAkB,CAAC,IAAI,GAAG,mBAAmB,EAAE,CAAC;YAClD,OAAO;QACT,CAAC;IACH,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,SAAS,gBAAgB;IACvB,OAAO,kBAAkB,CAAC,IAAI,IAAI,mBAAmB,EAAE,CAAC;QACtD,IAAI,SAA6B,CAAC;QAClC,IAAI,UAAU,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAE1C,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,kBAAkB,CAAC,OAAO,EAAE,EAAE,CAAC;YACzD,IAAI,MAAM,CAAC,UAAU,GAAG,UAAU,EAAE,CAAC;gBACnC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;gBAC/B,SAAS,GAAG,GAAG,CAAC;YAClB,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;QACT,CAAC;QAED,kBAAkB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACpB,SAAiB,EACjB,IAAoC,EACpC,GAAW;IAEX,MAAM,cAAc,GAAG,kBAAkB,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,CAAC,cAAc,IAAI,cAAc,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;QACrD,gBAAgB,EAAE,CAAC;QACnB,kBAAkB,CAAC,GAAG,CAAC,SAAS,EAAE;YAChC,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ;YAC5B,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IAED,cAAc,CAAC,UAAU,GAAG,GAAG,CAAC;IAChC,IAAI,cAAc,CAAC,KAAK,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,cAAc,CAAC,OAAO,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;IACvE,CAAC;IAED,cAAc,CAAC,KAAK,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,wBAAwB,CACtC,OAAuB,EACvB,KAA+B,EAC/B,GAAY,EACZ,cAAwB,EAAE;;IAE1B,IAAI,CAAA,MAAA,OAAO,CAAC,mBAAmB,0CAAE,OAAO,MAAK,KAAK,EAAE,CAAC;QACnD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAE3B,MAAM,SAAS,GACb,MAAA,mBAAmB,CAAC,MAAA,MAAA,GAAG,CAAC,EAAE,mCAAI,MAAA,GAAG,CAAC,MAAM,0CAAE,aAAa,mCAAI,SAAS,CAAC,mCAAI,SAAS,CAAC;IAErF,gFAAgF;IAChF,kEAAkE;IAClE,MAAM,mBAAmB,GAAG,aAAa,CAAC,GAAG,KAAK,OAAO,SAAS,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACjF,IAAI,mBAAmB,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,CAAC;IACpE,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,oBAAoB,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAC;QAC7D,IAAI,CAAC,oBAAoB,EAAE,CAAC;YAC1B,SAAS;QACX,CAAC;QAED,MAAM,uBAAuB,GAAG,aAAa,CAC3C,GAAG,KAAK,eAAe,SAAS,IAAI,oBAAoB,EAAE,EAC1D,IAAI,EACJ,GAAG,CACJ,CAAC;QACF,IAAI,uBAAuB,EAAE,CAAC;YAC5B,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QAC3E,CAAC;IACH,CAAC;IAED,IAAI,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO;YACL,OAAO,EAAE,KAAK;YACd,iBAAiB;SAClB,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;AACjD,CAAC;AAED,SAAgB,+BAA+B,CAC7C,GAAa,EACb,iBAAyB;IAEzB,GAAG,CAAC,SAAS,CAAC,aAAa,EAAE,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACxD,OAAO,yBAAa,CAAC,gBAAgB,CACnC,GAAG,EACH,sCAAsC,EACtC,qBAAqB,EACrB,mBAAU,CAAC,iBAAiB,CAC7B,CAAC;AACJ,CAAC","sourcesContent":["import { HttpStatus } from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions, PublicAuthRateLimitRuleOptions } from '../AccessiModule';\n\nexport type PublicAuthRateLimitScope =\n  | 'login'\n  | 'twoFactorVerify'\n  | 'twoFactorResend'\n  | 'register'\n  | 'passwordResetEmail'\n  | 'passwordResetConfirm'\n  | 'getUserByToken'\n  | 'adminBootstrap'\n  | 'consoleEntry';\n\ntype RateLimitBucket = {\n  count: number;\n  resetAt: number;\n  lastSeenAt: number;\n};\n\ntype RateLimitDecision = {\n  allowed: boolean;\n  retryAfterSeconds: number;\n};\n\nconst DEFAULT_PUBLIC_AUTH_RATE_LIMITS: Record<\n  PublicAuthRateLimitScope,\n  PublicAuthRateLimitRuleOptions\n> = {\n  login: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  twoFactorVerify: { windowMs: 15 * 60 * 1000, maxAttempts: 20 },\n  twoFactorResend: { windowMs: 15 * 60 * 1000, maxAttempts: 5 },\n  register: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetEmail: { windowMs: 60 * 60 * 1000, maxAttempts: 5 },\n  passwordResetConfirm: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  getUserByToken: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n  adminBootstrap: { windowMs: 15 * 60 * 1000, maxAttempts: 10 },\n  consoleEntry: { windowMs: 5 * 60 * 1000, maxAttempts: 30 },\n};\n\nconst RATE_LIMIT_BUCKETS = new Map<string, RateLimitBucket>();\nconst MAX_TRACKED_BUCKETS = 20000;\nconst MAX_WINDOW_MS = Math.max(\n  ...Object.values(DEFAULT_PUBLIC_AUTH_RATE_LIMITS).map((rule) => rule.windowMs),\n);\n\nfunction getRule(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n): PublicAuthRateLimitRuleOptions {\n  const configuredRule = options.publicAuthRateLimit?.[scope];\n\n  if (\n    configuredRule &&\n    Number.isFinite(configuredRule.windowMs) &&\n    configuredRule.windowMs > 0 &&\n    Number.isFinite(configuredRule.maxAttempts) &&\n    configuredRule.maxAttempts > 0\n  ) {\n    return {\n      windowMs: Math.trunc(configuredRule.windowMs),\n      maxAttempts: Math.trunc(configuredRule.maxAttempts),\n    };\n  }\n\n  return DEFAULT_PUBLIC_AUTH_RATE_LIMITS[scope];\n}\n\nfunction normalizeIdentifier(identifier: string): string | null {\n  if (typeof identifier !== 'string') {\n    return null;\n  }\n\n  const normalized = identifier.trim().toLowerCase();\n  return normalized === '' ? null : normalized;\n}\n\nfunction pruneRateLimitBuckets(now: number): void {\n  if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n    return;\n  }\n\n  for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n    if (bucket.resetAt <= now || bucket.lastSeenAt <= now - MAX_WINDOW_MS * 2) {\n      RATE_LIMIT_BUCKETS.delete(key);\n    }\n\n    if (RATE_LIMIT_BUCKETS.size < MAX_TRACKED_BUCKETS) {\n      return;\n    }\n  }\n}\n\n/** Mantiene il numero di bucket sotto la soglia, scartando i meno recenti. */\nfunction enforceBucketCap(): void {\n  while (RATE_LIMIT_BUCKETS.size >= MAX_TRACKED_BUCKETS) {\n    let oldestKey: string | undefined;\n    let oldestSeen = Number.POSITIVE_INFINITY;\n\n    for (const [key, bucket] of RATE_LIMIT_BUCKETS.entries()) {\n      if (bucket.lastSeenAt < oldestSeen) {\n        oldestSeen = bucket.lastSeenAt;\n        oldestKey = key;\n      }\n    }\n\n    if (oldestKey === undefined) {\n      return;\n    }\n\n    RATE_LIMIT_BUCKETS.delete(oldestKey);\n  }\n}\n\nfunction consumeBucket(\n  bucketKey: string,\n  rule: PublicAuthRateLimitRuleOptions,\n  now: number,\n): number | null {\n  const existingBucket = RATE_LIMIT_BUCKETS.get(bucketKey);\n  if (!existingBucket || existingBucket.resetAt <= now) {\n    enforceBucketCap();\n    RATE_LIMIT_BUCKETS.set(bucketKey, {\n      count: 1,\n      resetAt: now + rule.windowMs,\n      lastSeenAt: now,\n    });\n    return null;\n  }\n\n  existingBucket.lastSeenAt = now;\n  if (existingBucket.count >= rule.maxAttempts) {\n    return Math.max(1, Math.ceil((existingBucket.resetAt - now) / 1000));\n  }\n\n  existingBucket.count += 1;\n  return null;\n}\n\nexport function checkPublicAuthRateLimit(\n  options: AccessiOptions,\n  scope: PublicAuthRateLimitScope,\n  req: Request,\n  identifiers: string[] = [],\n): RateLimitDecision {\n  if (options.publicAuthRateLimit?.enabled === false) {\n    return { allowed: true, retryAfterSeconds: 0 };\n  }\n\n  const rule = getRule(options, scope);\n  const now = Date.now();\n  pruneRateLimitBuckets(now);\n\n  const ipAddress =\n    normalizeIdentifier(req.ip ?? req.socket?.remoteAddress ?? 'unknown') ?? 'unknown';\n\n  // Consuma prima il bucket per IP: se gia bloccato non crea bucket per soggetto,\n  // evitando crescita di memoria con identificatori sempre diversi.\n  const ipRetryAfterSeconds = consumeBucket(`${scope}|ip|${ipAddress}`, rule, now);\n  if (ipRetryAfterSeconds) {\n    return { allowed: false, retryAfterSeconds: ipRetryAfterSeconds };\n  }\n\n  let retryAfterSeconds = 0;\n  for (const identifier of identifiers) {\n    const normalizedIdentifier = normalizeIdentifier(identifier);\n    if (!normalizedIdentifier) {\n      continue;\n    }\n\n    const bucketRetryAfterSeconds = consumeBucket(\n      `${scope}|ip-subject|${ipAddress}|${normalizedIdentifier}`,\n      rule,\n      now,\n    );\n    if (bucketRetryAfterSeconds) {\n      retryAfterSeconds = Math.max(retryAfterSeconds, bucketRetryAfterSeconds);\n    }\n  }\n\n  if (retryAfterSeconds > 0) {\n    return {\n      allowed: false,\n      retryAfterSeconds,\n    };\n  }\n\n  return { allowed: true, retryAfterSeconds: 0 };\n}\n\nexport function sendPublicAuthRateLimitExceeded(\n  res: Response,\n  retryAfterSeconds: number,\n): Response {\n  res.setHeader('Retry-After', String(retryAfterSeconds));\n  return RestUtilities.sendErrorMessage(\n    res,\n    'Troppi tentativi. Riprova piu tardi.',\n    'PublicAuthRateLimit',\n    HttpStatus.TOO_MANY_REQUESTS,\n  );\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "emilsoftware-utilities",
-  "version": "2.0.0-dev.42",
+  "version": "2.0.0-dev.44",
   "description": "Utilities for EmilSoftware",
   "main": "dist/index.js",
   "module": "dist/index.js",