emilsoftware-utilities 2.0.0-dev.5 → 2.0.0-dev.50

package/dist/accessi-module/federated-auth/FederatedAuthService.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedAuthService.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA4M;AAC5M,mCAAoC;AACpC,uFAAoF;AACpF,mCAAgC;AAChC,+CAAgD;AAGhD,mEAAgE;AAChE,qEAAkE;AAClE,qEAAkE;AAClE,uEAAkF;AAwBlF;;;;GAIG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAC/B,YAC8C,OAAuB,EAClD,WAAwB,EACxB,WAAwB;QAFG,YAAO,GAAP,OAAO,CAAgB;QAClD,gBAAW,GAAX,WAAW,CAAa;QACxB,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ,+FAA+F;IACzF,YAAY;;YAChB,MAAM,+CAAsB,CAAC,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxD,CAAC;KAAA;IAED,wFAAwF;IACxF,SAAS;;QACP,OAAO,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI,CAAC;IAChE,CAAC;IAED;;;OAGG;IACG,YAAY,CAAC,QAAmC;;YACpD,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;YAEjE,IAAI,CAAC,cAAc,EAAE,CAAC;gBACpB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,+BAA+B,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YACzI,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACrG,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;YAC9G,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,uBAAuB,CAAC,cAAc,CAAC,YAAY,EAAE,cAAc,CAAC,WAAW,CAAC,CAAC;gBACtH,OAAO,EAAE,YAAY,EAAE,cAAc,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC;YAC9D,CAAC;YAED,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,kFAAkF,EAClF,CAAC,cAAc,CAAC,WAAW,CAAC,CAC7B,CAAC;YACF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,qEAAqE,EACrE,CAAC,cAAc,CAAC,YAAY,CAAC,CAC9B,CAAC;YAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,cAAc,CAAC,YAAY,CAAC,CAAC;YACxF,OAAO;gBACL,YAAY,EAAE,cAAc,CAAC,YAAY;gBACzC,KAAK;gBACL,KAAK,EAAE,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,CAAC;aACxE,CAAC;QACJ,CAAC;KAAA;IAED,4GAA4G;IACtG,YAAY,CAAC,YAAoB,EAAE,QAAmC,EAAE,IAAa;;;YACzF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YACpD,MAAM,IAAI,CAAC,oBAAoB,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;YACrD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YAE5D,IAAI,QAAQ,IAAI,QAAQ,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,CAAC;YAC3I,CAAC;YAED,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,MAAA,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,QAAQ,CAAC,IAAI,mCAAI,IAAI,EAAE,QAAQ,CAAC,WAAW,CAAC,CACtD,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;mCAC2B,EAC3B,CAAC,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,EAAE,YAAY,EAAE,UAAU,CAAC,QAAQ,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,aAAJ,IAAI,cAAJ,IAAI,GAAI,IAAI,CAAC,CACvG,CAAC;YACJ,CAAC;YAED,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,KAAK,CAAC,CAAE,CAAC;QACvD,CAAC;KAAA;IAED,0GAA0G;IACpG,0BAA0B;6DAC9B,gBAAiC,EACjC,QAAmC,EACnC,oBAAoB,GAAG,KAAK,EAC5B,IAAa;YAEb,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,kBAAkB,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;YAC5D,MAAM,IAAI,CAAC,oBAAoB,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,MAAM,IAAI,CAAC,YAAY,CAAC,kBAAkB,EAAE,KAAK,CAAC,EAAE,CAAC;gBACvD,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,qDAAqD,EAAE,CAAC,CAAC;YAC7I,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,IAAI;oBAC3B,YAAY,EAAE,uCAAkB,CAAC,IAAI;iBACtC,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAC;gBACvE,OAAO,MAAM,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,kBAAkB,EAAE,IAAI,CAAC,CAAC;YACzE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,4BAAmB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,2BAAkB,IAAI,KAAK,YAAY,0BAAiB,IAAI,KAAK,YAAY,oCAA2B,EAAE,CAAC;oBAC5M,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,IAAI,yBAAa,CAAC,qBAAqB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC/C,MAAM,IAAI,oCAA2B,CAAC,EAAE,IAAI,EAAE,kCAAkC,EAAE,OAAO,EAAE,+FAA+F,EAAE,CAAC,CAAC;gBAChM,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,EAAE,IAAI,EAAE,oCAAoC,EAAE,OAAO,EAAE,oIAAoI,EAAE,CAAC,CAAC;YACxO,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACG,gCAAgC,CACpC,gBAAiC,EACjC,QAAmC;;;YAEnC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAA,MAAA,IAAI,CAAC,OAAO,CAAC,uBAAuB,0CAAE,qBAAqB,MAAK,IAAI,EAAE,CAAC;gBACzE,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,sCAAsC,EAAE,OAAO,EAAE,uCAAuC,EAAE,CAAC,CAAC;YACnI,CAAC;YAED,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;gBACrE,qBAAqB,EAAE,KAAK;gBAC5B,YAAY,EAAE,uCAAkB,CAAC,IAAI;aACtC,CAAC,CAAC;YACH,MAAM,IAAI,CAAC,uBAAuB,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;YACxD,OAAO,IAAI,CAAC,YAAY,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;KAAA;IAED,0FAA0F;IACpF,iBAAiB,CAAC,YAAoB;;YAC1C,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;;8BAOwB,EACxB,CAAC,YAAY,CAAC,CACf,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,yGAAyG;IACnG,YAAY;;YAChB,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;sDAGgD,CACjD,CAAC;YACF,OAAO,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,CAAC,GAAgB,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;QACxG,CAAC;KAAA;IAED,wFAAwF;IAClF,cAAc,CAAC,KAA+D;;;YAClF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACxD,MAAM,WAAW,GAAG,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,mCAAmC,EAAE,OAAO,EAAE,mCAAmC,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,uFAAuF,EACvF,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAA,MAAA,KAAK,CAAC,IAAI,0CAAE,IAAI,EAAE,KAAI,IAAI,CAAC,CACpD,CAAC;YACF,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED,gGAAgG;IAChG;;;OAGG;IACG,cAAc,CAAC,aAAqB,EAAE,MAAiE;;YAC3G,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;gBACrC,OAAO,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;gBAChC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC;YAC7D,CAAC;YACD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACrC,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,CAAC;YAC1C,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,2BAA2B,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;YAC9H,CAAC;YACD,OAAO,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAE,CAAC;QAC9C,CAAC;KAAA;IAED;;;;OAIG;IACG,cAAc,CAAC,aAAqB;;;YACxC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvD,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,SAAG,CAAC,KAAK,CAC3B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,sEAAsE,EACtE,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,QAAQ,GAAG,MAAA,MAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAyC,0CAAE,KAAK,mCACtE,MAAC,KAAK,aAAL,KAAK,uBAAL,KAAK,CAAG,CAAC,CAAyC,0CAAE,KAAK,CAAC;YAChE,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;YAClG,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC;oBAC1B,IAAI,EAAE,2BAA2B;oBACjC,OAAO,EAAE,qCAAqC,QAAQ,KAAK,KAAK,wEAAwE;iBACzI,CAAC,CAAC;YACL,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,6CAA6C,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7G,CAAC;KAAA;IAED,0EAA0E;IAC1E;;;OAGG;IACG,uBAAuB,CAAC,YAAoB,EAAE,OAAgB;;YAClE,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,CAAC;YAC1C,2EAA2E;YAC3E,iFAAiF;YACjF,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,2FAA2F,EAC3F,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAChC,CAAC;QACJ,CAAC;KAAA;IAED,mHAAmH;IACnH,0GAA0G;IACpG,sBAAsB,CAAC,YAAoB;;YAC/C,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE;gBAAE,OAAO,IAAI,CAAC;YACnC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,oBAAoB,MAAK,GAAG,CAAC;QACrH,CAAC;KAAA;IAED,4EAA4E;IAC5E,8GAA8G;IACxG,eAAe,CAAC,WAAmB;;YACvC,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,8FAA8F,EAC9F,CAAC,WAAW,CAAC,CACd,CAAC;QACJ,CAAC;KAAA;IAED,oFAAoF;IAC9E,gBAAgB,CAAC,WAAmB;;YACxC,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,IAAI,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC3B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,0EAA0E,EAC1E,CAAC,WAAW,CAAC,CACd,CAAmC,CAAC;YACrC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA0C,CAAC;YACvG,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,YAAY,CAAC,CAAC;YACxC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACjE,CAAC;KAAA;IAED,oGAAoG;IACpG;;;OAGG;IACG,cAAc,CAAC,YAAoB,EAAE,WAAmB;;YAC5D,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,QAAQ,GAAG,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,KAAK,WAAW,CAAC,CAAC;YAC/G,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,iDAAiD,EAAE,CAAC,CAAC;YACpI,CAAC;YACD,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B,iEAAiE,EACjE,CAAC,WAAW,EAAE,YAAY,CAAC,CAC5B,CAAC;QACJ,CAAC;KAAA;IAED,sGAAsG;IACtG,6GAA6G;IACvG,cAAc,CAAC,WAAmB,EAAE,MAA2C;;YACnF,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,iBAAiB,CAAC,WAAW,CAAC,CAAC;YACpC,MAAM,OAAO,GAAa,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAc,EAAE,CAAC;YAC7B,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnC,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;;oBAC/C,OAAO,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC9B,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBACzB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC3B,CAAC;YACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO;YACjC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;YACzB,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,kCAAkC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC;QACnI,CAAC;KAAA;IAED,uFAAuF;IACjF,YAAY;;YAChB,IAAI,IAAI,CAAC,SAAS,EAAE;gBAAE,MAAM,+CAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;KAAA;IAEa,YAAY,CAAC,QAAmC,EAAE,UAAmB;;YACjF,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;;;;gEAM0D,UAAU,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,EAAE,EACpG,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,OAAO,CAAC,CACrE,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEa,gBAAgB,CAAC,YAAoB;;YACjD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAI;gBAAE,MAAM,IAAI,0BAAiB,CAAC,6BAA6B,CAAC,CAAC;QACxE,CAAC;KAAA;IAEO,aAAa;QACnB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,0DAA0D,EAAE,CAAC,CAAC;QACzI,CAAC;IACH,CAAC;IAED,uFAAuF;IAC/E,iBAAiB,CAAC,WAAmB;QAC3C,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,gCAAgC,EAAE,OAAO,EAAE,yCAAyC,EAAE,CAAC,CAAC;QAChI,CAAC;IACH,CAAC;IAEO,iBAAiB,CAAC,QAAmC;QAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,iBAAiB,CAAC,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,QAAQ,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,OAAO,CAAA,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,OAAO,CAAA,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;YACzD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,2BAA2B,EAAE,OAAO,EAAE,8EAA8E,EAAE,CAAC,CAAC;QAChK,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;IAEO,iBAAiB,CAAC,KAAc;QACtC,MAAM,QAAQ,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,4BAA4B,EAAE,OAAO,EAAE,gFAAgF,EAAE,CAAC,CAAC;QACnK,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAEO,oBAAoB,CAAC,KAAc;QACzC,MAAM,WAAW,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YAC7C,MAAM,IAAI,4BAAmB,CAAC,EAAE,IAAI,EAAE,wCAAwC,EAAE,OAAO,EAAE,kEAAkE,EAAE,CAAC,CAAC;QACjK,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAEa,oBAAoB,CAAC,QAAgB;;YACjD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,0BAAiB,CAAC,EAAE,IAAI,EAAE,8BAA8B,EAAE,OAAO,EAAE,8BAA8B,EAAE,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC;gBACvB,MAAM,IAAI,2BAAkB,CAAC,EAAE,IAAI,EAAE,6BAA6B,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;YAC/G,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;KAAA;IAEa,YAAY,CAAC,QAAgB;;YACzC,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,OAAO,CAAC,eAAe,EAC5B;;;0BAGoB,EACpB,CAAC,QAAQ,CAAC,CACX,CAAC;YACF,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAA4B,CAAC;YACzF,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3C,CAAC;KAAA;IAEO,cAAc,CAAC,QAAmC;QACxD,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAChK,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAEO,UAAU,CAAC,GAAgB;QACjC,OAAO;YACL,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC;YACpC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC;YACtC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,OAAO,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC;YAC5B,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,oBAAoB,EAAE,CAAC,CAAC,GAAG,CAAC,oBAAoB,KAAK,KAAK,IAAI,GAAG,CAAC,oBAAoB,KAAK,CAAC,IAAI,GAAG,CAAC,oBAAoB,KAAK,GAAG,CAAC;YACjI,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,UAAU,EAAE,GAAG,CAAC,UAAU;YAC1B,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;IAEO,UAAU,CAAC,GAAgB;;QACjC,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE;YACrC,WAAW,EAAE,MAAM,CAAC,MAAA,GAAG,CAAC,WAAW,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE;YACjD,MAAM,EAAE,GAAG,CAAC,MAAM,KAAK,IAAI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YACrE,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC;IACJ,CAAC;CACF,CAAA;AAldY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACX,yBAAW;GAJhC,oBAAoB,CAkdhC","sourcesContent":["import { BadRequestException, ConflictException, ForbiddenException, Inject, Injectable, InternalServerErrorException, NotFoundException, OnModuleInit, ServiceUnavailableException } from '@nestjs/common';\nimport { createHash } from 'crypto';\nimport { AccessiDatabaseUpdater } from '../database-updates/AccessiDatabaseUpdater';\nimport { Orm } from '../../Orm';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { isAuthenticatedUserEnabledForJwt } from '../security/authenticatedToken';\nimport { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './FederatedAuthTypes';\n\ntype IdentityRow = {\n  identityKey?: string;\n  codiceUtente?: number;\n  provider?: string;\n  subject?: string;\n  active?: unknown;\n  createdAt?: Date | string;\n  lastLoginAt?: Date | string;\n  disabledAt?: Date | string;\n  note?: string;\n  passwordLoginEnabled?: unknown;\n};\n\ntype ProviderRow = {\n  provider?: string;\n  description?: string;\n  active?: unknown;\n  createdAt?: Date | string;\n  note?: string;\n};\n\n/**\n * Maps externally verified identities to Accessi users and issues the usual\n * Accessi JWT. It deliberately has no provider SDK dependency: validating an\n * Azure, Google, Apple, SAML, or custom token is always the hosting backend's job.\n */\n@Injectable()\nexport class FederatedAuthService implements OnModuleInit {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly options: AccessiOptions,\n    private readonly userService: UserService,\n    private readonly authService: AuthService,\n  ) {}\n\n  /** Await the same schema barrier as the module updater; never race two DDL implementations. */\n  async onModuleInit(): Promise<void> {\n    await AccessiDatabaseUpdater.initialize(this.options);\n  }\n\n  /** Returns true only when the host application opted in to federated authentication. */\n  isEnabled(): boolean {\n    return this.options.federatedAuthentication?.enabled === true;\n  }\n\n  /**\n   * Exchanges a backend-verified identity for the same login result and JWT\n   * emitted by the local password endpoint. No raw external token is accepted.\n   */\n  async authenticate(identity: VerifiedFederatedIdentity): Promise<FederatedAuthenticationResult> {\n    this.assertEnabled();\n    const normalized = this.normalizeIdentity(identity);\n    await this.assertProviderActive(normalized.provider);\n    const linkedIdentity = await this.findIdentity(normalized, true);\n\n    if (!linkedIdentity) {\n      throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_LINKED', message: 'Identita esterna non associata a un utente Accessi.' });\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(linkedIdentity.codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\n      throw new ForbiddenException({ code: 'FEDERATED_USER_DISABLED', message: 'Utente Accessi non abilitato.' });\n    }\n\n    if (currentUser.flagDueFattori) {\n      const login = await this.authService.beginFederatedTwoFactor(linkedIdentity.codiceUtente, linkedIdentity.identityKey);\n      return { codiceUtente: linkedIdentity.codiceUtente, login };\n    }\n\n    await Orm.execute(\n      this.options.databaseOptions,\n      'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n      [linkedIdentity.identityKey],\n    );\n    await Orm.execute(\n      this.options.databaseOptions,\n      'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?',\n      [linkedIdentity.codiceUtente],\n    );\n\n    const login = await this.authService.getLoginResultForUser(linkedIdentity.codiceUtente);\n    return {\n      codiceUtente: linkedIdentity.codiceUtente,\n      login,\n      token: this.authService.createAccessiToken(login.utente, ['federated']),\n    };\n  }\n\n  /** Links an external identity to an existing Accessi user. It never changes that user's password policy. */\n  async linkIdentity(codiceUtente: number, identity: VerifiedFederatedIdentity, note?: string): Promise<FederatedIdentity> {\n    this.assertEnabled();\n    await this.assertUserExists(codiceUtente);\n    const normalized = this.normalizeIdentity(identity);\n    await this.assertProviderActive(normalized.provider);\n    const existing = await this.findIdentity(normalized, false);\n\n    if (existing && existing.codiceUtente !== codiceUtente) {\n      throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identita esterna gia associata a un altro utente.' });\n    }\n\n    if (existing) {\n      await Orm.execute(\n        this.options.databaseOptions,\n        'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 1, DATDISATT = NULL, NOTA = ? WHERE IDNKEY = ?',\n        [note ?? existing.note ?? null, existing.identityKey],\n      );\n    } else {\n      await Orm.execute(\n        this.options.databaseOptions,\n        `INSERT INTO UTENTI_IDENTITA_EXT (IDNKEY, CODUTE, PROVIDER, SUBJECT, FLGATTIVO, NOTA)\n         VALUES (?, ?, ?, ?, 1, ?)`,\n        [this.getIdentityKey(normalized), codiceUtente, normalized.provider, normalized.subject, note ?? null],\n      );\n    }\n\n    return (await this.findIdentity(normalized, false))!;\n  }\n\n  /** Creates a confirmed Accessi user, associates an SSO identity and defaults the new user to SSO-only. */\n  async createManagedFederatedUser(\n    registrationData: RegisterRequest,\n    identity: VerifiedFederatedIdentity,\n    passwordLoginEnabled = false,\n    note?: string,\n  ): Promise<FederatedIdentity> {\n    this.assertEnabled();\n    const normalizedIdentity = this.normalizeIdentity(identity);\n    await this.assertProviderActive(normalizedIdentity.provider);\n    if (await this.findIdentity(normalizedIdentity, false)) {\n      throw new ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identità esterna già associata a un utente Accessi.' });\n    }\n\n    try {\n      const codiceUtente = await this.userService.register(registrationData, {\n        allowPrivilegedFields: true,\n        initialState: StatoRegistrazione.CONF,\n      });\n      await this.setPasswordLoginEnabled(codiceUtente, passwordLoginEnabled);\n      return await this.linkIdentity(codiceUtente, normalizedIdentity, note);\n    } catch (error) {\n      if (error instanceof BadRequestException || error instanceof ConflictException || error instanceof ForbiddenException || error instanceof NotFoundException || error instanceof ServiceUnavailableException) {\n        throw error;\n      }\n      if (RestUtilities.isDatabaseSchemaError(error)) {\n        throw new ServiceUnavailableException({ code: 'ACCESSI_DATABASE_SCHEMA_OUTDATED', message: 'Lo schema del database Accessi non è aggiornato. Eseguire la migrazione database e riprovare.' });\n      }\n      throw new InternalServerErrorException({ code: 'FEDERATED_USER_PROVISIONING_FAILED', message: 'La creazione dell’utente SSO non è stata completata. Verificare il log del backend e l’eventuale utente creato senza identità SSO.' });\n    }\n  }\n\n  /**\n   * Allows self-provisioning only when explicitly enabled. The caller must have\n   * verified the external identity and decide which profile fields are trusted.\n   */\n  async registerSelfServiceFederatedUser(\n    registrationData: RegisterRequest,\n    identity: VerifiedFederatedIdentity,\n  ): Promise<FederatedIdentity> {\n    this.assertEnabled();\n    if (this.options.federatedAuthentication?.allowSelfRegistration !== true) {\n      throw new ForbiddenException({ code: 'FEDERATED_SELF_REGISTRATION_DISABLED', message: 'Auto-registrazione SSO non abilitata.' });\n    }\n\n    const codiceUtente = await this.userService.register(registrationData, {\n      allowPrivilegedFields: false,\n      initialState: StatoRegistrazione.CONF,\n    });\n    await this.setPasswordLoginEnabled(codiceUtente, false);\n    return this.linkIdentity(codiceUtente, identity);\n  }\n\n  /** Returns all linked identities for administration; disabled identities are included. */\n  async getUserIdentities(codiceUtente: number): Promise<FederatedIdentity[]> {\n    this.assertEnabled();\n    const rows = await Orm.query(\n      this.options.databaseOptions,\n      `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n              I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n              I.DATDISATT AS disabled_at, I.NOTA,\n              COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n       FROM UTENTI_IDENTITA_EXT I\n       LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n       WHERE I.CODUTE = ?\n       ORDER BY I.DATINS DESC`,\n      [codiceUtente],\n    );\n    return rows.map(RestUtilities.convertKeysToCamelCase).map((row: IdentityRow) => this.toIdentity(row));\n  }\n\n  /** Returns the complete provider catalog, including inactive providers, for superuser administration. */\n  async getProviders(): Promise<FederatedProvider[]> {\n    this.assertEnabled();\n    const rows = await Orm.query(\n      this.options.databaseOptions,\n      `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n              DATINS AS created_at, NOTA AS note\n       FROM SSO_PROVIDER\n       ORDER BY FLGATTIVO DESC, DESCRIZIONE, PROVIDER`,\n    );\n    return rows.map(RestUtilities.convertKeysToCamelCase).map((row: ProviderRow) => this.toProvider(row));\n  }\n\n  /** Registers a provider key that must match the backend's SSO configuration exactly. */\n  async createProvider(input: { provider: string; description: string; note?: string }): Promise<FederatedProvider> {\n    this.assertEnabled();\n    const provider = this.normalizeProvider(input.provider);\n    const description = this.normalizeDescription(input.description);\n    const existing = await this.findProvider(provider);\n    if (existing) {\n      throw new ConflictException({ code: 'FEDERATED_PROVIDER_ALREADY_EXISTS', message: 'Il provider SSO è già registrato.' });\n    }\n    await Orm.execute(\n      this.options.databaseOptions,\n      'INSERT INTO SSO_PROVIDER (PROVIDER, DESCRIZIONE, FLGATTIVO, NOTA) VALUES (?, ?, 1, ?)',\n      [provider, description, input.note?.trim() || null],\n    );\n    return (await this.findProvider(provider))!;\n  }\n\n  /** Updates provider metadata or disables the provider without removing its identity history. */\n  /**\n   * Aggiorna metadati amministrativi del catalogo. La chiave provider e immutabile perche parte dell'identita\n   * persistita e deve coincidere esattamente con la configurazione del backend validante.\n   */\n  async updateProvider(providerValue: string, update: { description?: string; active?: boolean; note?: string }): Promise<FederatedProvider> {\n    this.assertEnabled();\n    const provider = this.normalizeProvider(providerValue);\n    if (!(await this.findProvider(provider))) {\n      throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n    }\n    const changes: string[] = [];\n    const params: unknown[] = [];\n    if (update.description !== undefined) {\n      changes.push('DESCRIZIONE = ?');\n      params.push(this.normalizeDescription(update.description));\n    }\n    if (update.active !== undefined) {\n      changes.push('FLGATTIVO = ?');\n      params.push(update.active ? 1 : 0);\n    }\n    if (update.note !== undefined) {\n      changes.push('NOTA = ?');\n      params.push(update.note.trim() || null);\n    }\n    if (changes.length > 0) {\n      params.push(provider);\n      await Orm.execute(this.options.databaseOptions, `UPDATE SSO_PROVIDER SET ${changes.join(', ')} WHERE PROVIDER = ?`, params);\n    }\n    return (await this.findProvider(provider))!;\n  }\n\n  /**\n   * Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK\n   * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un\n   * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.\n   */\n  async deleteProvider(providerValue: string): Promise<void> {\n    this.assertEnabled();\n    const provider = this.normalizeProvider(providerValue);\n    if (!(await this.findProvider(provider))) {\n      throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n    }\n    const usage = await Orm.query(\n      this.options.databaseOptions,\n      'SELECT COUNT(*) AS total FROM UTENTI_IDENTITA_EXT WHERE PROVIDER = ?',\n      [provider],\n    );\n    const rawTotal = (usage?.[0] as Record<string, unknown> | undefined)?.TOTAL\n      ?? (usage?.[0] as Record<string, unknown> | undefined)?.total;\n    const total = typeof rawTotal === 'number' ? rawTotal : Number.parseInt(`${rawTotal ?? '0'}`, 10);\n    if (total > 0) {\n      throw new ConflictException({\n        code: 'FEDERATED_PROVIDER_IN_USE',\n        message: `Impossibile eliminare il provider ${provider}: ${total} identita collegate. Disabilitalo oppure rimuovi prima i collegamenti.`,\n      });\n    }\n    await Orm.execute(this.options.databaseOptions, 'DELETE FROM SSO_PROVIDER WHERE PROVIDER = ?', [provider]);\n  }\n\n  /** Enables or disables all local password authentication for one user. */\n  /**\n   * Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso\n   * email/password, che restituisce `PASSWORD_LOGIN_DISABLED`. L'assenza della riga mantiene il default legacy `true`.\n   */\n  async setPasswordLoginEnabled(codiceUtente: number, enabled: boolean): Promise<void> {\n    this.assertEnabled();\n    await this.assertUserExists(codiceUtente);\n    // Upsert: per utenti legacy senza riga in UTENTI_CONFIG una UPDATE a vuoto\n    // lasciava la policy al default, rendendo la disattivazione un no-op silenzioso.\n    await Orm.execute(\n      this.options.databaseOptions,\n      'UPDATE OR INSERT INTO UTENTI_CONFIG (CODUTE, FLGPASSWORD) VALUES (?, ?) MATCHING (CODUTE)',\n      [codiceUtente, enabled ? 1 : 0],\n    );\n  }\n\n  /** Returns the effective local password policy. Users without a policy row retain the historic enabled default. */\n  /** Restituisce la policy effettiva; utenti precedenti alla migrazione restano abilitati alla password. */\n  async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n    if (!this.isEnabled()) return true;\n    const rows = await Orm.query(\n      this.options.databaseOptions,\n      'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n      [codiceUtente],\n    );\n    const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow | undefined;\n    return row?.passwordLoginEnabled !== false && row?.passwordLoginEnabled !== 0 && row?.passwordLoginEnabled !== '0';\n  }\n\n  /** Soft-disables a linked identity without deleting operational history. */\n  /** Disabilita logicamente un collegamento SSO conservando audit e possibilita di successiva riattivazione. */\n  async disableIdentity(identityKey: string): Promise<void> {\n    this.assertEnabled();\n    this.assertIdentityKey(identityKey);\n    await Orm.execute(\n      this.options.databaseOptions,\n      'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 0, DATDISATT = CURRENT_TIMESTAMP WHERE IDNKEY = ?',\n      [identityKey],\n    );\n  }\n\n  /** Restituisce il CODUTE proprietario di un collegamento SSO, o null se assente. */\n  async getIdentityOwner(identityKey: string): Promise<number | null> {\n    this.assertIdentityKey(identityKey);\n    const rows = (await Orm.query(\n      this.options.databaseOptions,\n      'SELECT CODUTE AS codice_utente FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ?',\n      [identityKey],\n    )) as Array<Record<string, unknown>>;\n    const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { codiceUtente?: number } | undefined;\n    const owner = Number(row?.codiceUtente);\n    return Number.isSafeInteger(owner) && owner > 0 ? owner : null;\n  }\n\n  /** Permanently removes one identity link from its owning user after administrative confirmation. */\n  /**\n   * Elimina fisicamente un collegamento SSO soltanto dopo aver verificato che appartenga all'utente indicato.\n   * Non elimina mai l'utente Accessi, password, ruoli o grant associati.\n   */\n  async deleteIdentity(codiceUtente: number, identityKey: string): Promise<void> {\n    this.assertEnabled();\n    this.assertIdentityKey(identityKey);\n    const identity = (await this.getUserIdentities(codiceUtente)).find((item) => item.identityKey === identityKey);\n    if (!identity) {\n      throw new NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_FOUND', message: 'Collegamento SSO non trovato per questo utente.' });\n    }\n    await Orm.execute(\n      this.options.databaseOptions,\n      'DELETE FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ? AND CODUTE = ?',\n      [identityKey, codiceUtente],\n    );\n  }\n\n  /** Aggiorna lo stato o la nota di un collegamento SSO usando la sua chiave tecnica amministrativa. */\n  /** Aggiorna stato o nota amministrativa senza modificare provider e subject, che identificano la persona. */\n  async updateIdentity(identityKey: string, update: { active?: boolean; note?: string }): Promise<void> {\n    this.assertEnabled();\n    this.assertIdentityKey(identityKey);\n    const changes: string[] = [];\n    const params: unknown[] = [];\n    if (update.active !== undefined) {\n      changes.push('FLGATTIVO = ?');\n      params.push(update.active ? 1 : 0);\n      if (update.active) changes.push('DATDISATT = NULL');\n      else changes.push('DATDISATT = CURRENT_TIMESTAMP');\n    }\n    if (update.note !== undefined) {\n      changes.push('NOTA = ?');\n      params.push(update.note);\n    }\n    if (changes.length === 0) return;\n    params.push(identityKey);\n    await Orm.execute(this.options.databaseOptions, `UPDATE UTENTI_IDENTITA_EXT SET ${changes.join(', ')} WHERE IDNKEY = ?`, params);\n  }\n\n  /** Explicit administrative schema reconciliation, shared with the standard updater. */\n  async ensureSchema(): Promise<void> {\n    if (this.isEnabled()) await AccessiDatabaseUpdater.run(this.options);\n  }\n\n  private async findIdentity(identity: VerifiedFederatedIdentity, onlyActive: boolean): Promise<FederatedIdentity | null> {\n    const rows = await Orm.query(\n      this.options.databaseOptions,\n      `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,\n              I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,\n              I.DATDISATT AS disabled_at, I.NOTA,\n              COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled\n       FROM UTENTI_IDENTITA_EXT I\n       LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE\n       WHERE I.IDNKEY = ? AND I.PROVIDER = ? AND I.SUBJECT = ?${onlyActive ? ' AND I.FLGATTIVO = 1' : ''}`,\n      [this.getIdentityKey(identity), identity.provider, identity.subject],\n    );\n    const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as IdentityRow | undefined;\n    return row ? this.toIdentity(row) : null;\n  }\n\n  private async assertUserExists(codiceUtente: number): Promise<void> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!user) throw new NotFoundException('Utente Accessi non trovato.');\n  }\n\n  private assertEnabled(): void {\n    if (!this.isEnabled()) {\n      throw new ForbiddenException({ code: 'FEDERATED_AUTH_DISABLED', message: 'Autenticazione federata non abilitata in AccessiOptions.' });\n    }\n  }\n\n  /** Validates the opaque SHA-256 key used only by administrative identity endpoints. */\n  private assertIdentityKey(identityKey: string): void {\n    if (!/^[a-f0-9]{64}$/i.test(identityKey)) {\n      throw new BadRequestException({ code: 'FEDERATED_IDENTITY_KEY_INVALID', message: 'Chiave del collegamento SSO non valida.' });\n    }\n  }\n\n  private normalizeIdentity(identity: VerifiedFederatedIdentity): VerifiedFederatedIdentity {\n    const provider = this.normalizeProvider(identity?.provider);\n    const subject = typeof identity?.subject === 'string' ? identity.subject.trim() : '';\n    if (!subject || Buffer.byteLength(subject, 'utf8') > 512) {\n      throw new BadRequestException({ code: 'FEDERATED_SUBJECT_INVALID', message: 'Subject non valido: è obbligatorio e può occupare al massimo 512 byte UTF-8.' });\n    }\n    return { provider, subject };\n  }\n\n  private normalizeProvider(value: unknown): string {\n    const provider = typeof value === 'string' ? value.trim().toLowerCase() : '';\n    if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(provider)) {\n      throw new BadRequestException({ code: 'FEDERATED_PROVIDER_INVALID', message: 'Provider non valido: usare un namespace ASCII stabile di massimo 64 caratteri.' });\n    }\n    return provider;\n  }\n\n  private normalizeDescription(value: unknown): string {\n    const description = typeof value === 'string' ? value.trim() : '';\n    if (!description || description.length > 160) {\n      throw new BadRequestException({ code: 'FEDERATED_PROVIDER_DESCRIPTION_INVALID', message: 'La descrizione del provider deve contenere da 1 a 160 caratteri.' });\n    }\n    return description;\n  }\n\n  private async assertProviderActive(provider: string): Promise<FederatedProvider> {\n    const registered = await this.findProvider(provider);\n    if (!registered) {\n      throw new NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });\n    }\n    if (!registered.active) {\n      throw new ForbiddenException({ code: 'FEDERATED_PROVIDER_DISABLED', message: 'Provider SSO disabilitato.' });\n    }\n    return registered;\n  }\n\n  private async findProvider(provider: string): Promise<FederatedProvider | null> {\n    const rows = await Orm.query(\n      this.options.databaseOptions,\n      `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,\n              DATINS AS created_at, NOTA AS note\n       FROM SSO_PROVIDER\n       WHERE PROVIDER = ?`,\n      [provider],\n    );\n    const row = rows.map(RestUtilities.convertKeysToCamelCase)[0] as ProviderRow | undefined;\n    return row ? this.toProvider(row) : null;\n  }\n\n  private getIdentityKey(identity: VerifiedFederatedIdentity): string {\n    const provider = Buffer.from(identity.provider, 'utf8');\n    const subject = Buffer.from(identity.subject, 'utf8');\n    const payload = Buffer.concat([Buffer.from('accessi:federated:v1:'), Buffer.from(`${provider.length}:`), provider, Buffer.from(`${subject.length}:`), subject]);\n    return createHash('sha256').update(payload).digest('hex');\n  }\n\n  private toIdentity(row: IdentityRow): FederatedIdentity {\n    return {\n      identityKey: String(row.identityKey),\n      codiceUtente: Number(row.codiceUtente),\n      provider: String(row.provider).trim(),\n      subject: String(row.subject),\n      active: row.active === true || row.active === 1 || row.active === '1',\n      passwordLoginEnabled: !(row.passwordLoginEnabled === false || row.passwordLoginEnabled === 0 || row.passwordLoginEnabled === '0'),\n      createdAt: row.createdAt,\n      lastLoginAt: row.lastLoginAt,\n      disabledAt: row.disabledAt,\n      note: row.note,\n    };\n  }\n\n  private toProvider(row: ProviderRow): FederatedProvider {\n    return {\n      provider: String(row.provider).trim(),\n      description: String(row.description ?? '').trim(),\n      active: row.active === true || row.active === 1 || row.active === '1',\n      createdAt: row.createdAt,\n      note: row.note,\n    };\n  }\n}\n"]}

package/dist/accessi-module/federated-auth/FederatedAuthTypes.d.ts

@@ -0,0 +1,53 @@
+import { LoginResult } from '../Dtos/LoginResponse';
+import { TokenResult } from '../Dtos/TokenResult';
+/**
+ * Identita esterna gia verificata dal backend ospitante.
+ *
+ * Questa e l unica informazione che il backend passa ad Accessi dopo avere
+ * concluso il proprio flusso SSO. Accessi non riceve e non verifica token del
+ * provider: decide solo quale utente interno corrisponde all identita e quali
+ * grant possiede.
+ */
+export interface VerifiedFederatedIdentity {
+    /** Chiave stabile censita in Accessi e configurata nel backend, ad esempio `azure-ad-acme-produzione`. Non e il nome commerciale del provider. */
+    provider: string;
+    /** ID opaco e stabile dell account presso il provider, ad esempio oid, sub o NameID persistente. Non usare email, nome o username. */
+    subject: string;
+}
+/** Provider SSO censito in Accessi. Le configurazioni e i segreti restano nel backend ospitante. */
+export interface FederatedProvider {
+    /** Chiave stabile usata dal backend nei payload `{ provider, subject }`. */
+    provider: string;
+    /** Nome leggibile mostrato agli amministratori nella console. */
+    description: string;
+    /** Un provider disabilitato non puo autenticare nuove sessioni SSO. */
+    active: boolean;
+    createdAt?: Date | string;
+    note?: string;
+}
+/** Collegamento persistito fra una identita esterna e un utente Accessi. */
+export interface FederatedIdentity {
+    /** Chiave tecnica SHA-256 del collegamento. Serve solo alle CRUD amministrative, mai al login SSO. */
+    identityKey: string;
+    /** Chiave dell utente Accessi che riceve ruoli, grant e sessione interna. */
+    codiceUtente: number;
+    /** Namespace backend salvato al momento del collegamento. */
+    provider: string;
+    /** Identificativo esterno usato insieme a provider per riconoscere la persona. */
+    subject: string;
+    /** Indica se l utente puo usare anche la password locale. */
+    passwordLoginEnabled: boolean;
+    /** Indica se questo singolo collegamento SSO puo ancora autenticare. */
+    active: boolean;
+    createdAt?: Date | string;
+    lastLoginAt?: Date | string;
+    disabledAt?: Date | string;
+    note?: string;
+}
+/** Risultato dello scambio di un identita esterna verificata con una normale sessione Accessi. */
+export interface FederatedAuthenticationResult {
+    codiceUtente: number;
+    login: LoginResult;
+    /** Assente quando login.challenge richiede la verifica email. */
+    token?: TokenResult;
+}

package/dist/accessi-module/federated-auth/FederatedAuthTypes.js

@@ -0,0 +1,3 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=FederatedAuthTypes.js.map

package/dist/accessi-module/federated-auth/FederatedAuthTypes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedAuthTypes.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthTypes.ts"],"names":[],"mappings":"","sourcesContent":["import { LoginResult } from '../Dtos/LoginResponse';\nimport { TokenResult } from '../Dtos/TokenResult';\n\n/**\n * Identita esterna gia verificata dal backend ospitante.\n *\n * Questa e l unica informazione che il backend passa ad Accessi dopo avere\n * concluso il proprio flusso SSO. Accessi non riceve e non verifica token del\n * provider: decide solo quale utente interno corrisponde all identita e quali\n * grant possiede.\n */\nexport interface VerifiedFederatedIdentity {\n  /** Chiave stabile censita in Accessi e configurata nel backend, ad esempio `azure-ad-acme-produzione`. Non e il nome commerciale del provider. */\n  provider: string;\n  /** ID opaco e stabile dell account presso il provider, ad esempio oid, sub o NameID persistente. Non usare email, nome o username. */\n  subject: string;\n}\n\n/** Provider SSO censito in Accessi. Le configurazioni e i segreti restano nel backend ospitante. */\nexport interface FederatedProvider {\n  /** Chiave stabile usata dal backend nei payload `{ provider, subject }`. */\n  provider: string;\n  /** Nome leggibile mostrato agli amministratori nella console. */\n  description: string;\n  /** Un provider disabilitato non puo autenticare nuove sessioni SSO. */\n  active: boolean;\n  createdAt?: Date | string;\n  note?: string;\n}\n\n/** Collegamento persistito fra una identita esterna e un utente Accessi. */\nexport interface FederatedIdentity {\n  /** Chiave tecnica SHA-256 del collegamento. Serve solo alle CRUD amministrative, mai al login SSO. */\n  identityKey: string;\n  /** Chiave dell utente Accessi che riceve ruoli, grant e sessione interna. */\n  codiceUtente: number;\n  /** Namespace backend salvato al momento del collegamento. */\n  provider: string;\n  /** Identificativo esterno usato insieme a provider per riconoscere la persona. */\n  subject: string;\n  /** Indica se l utente puo usare anche la password locale. */\n  passwordLoginEnabled: boolean;\n  /** Indica se questo singolo collegamento SSO puo ancora autenticare. */\n  active: boolean;\n  createdAt?: Date | string;\n  lastLoginAt?: Date | string;\n  disabledAt?: Date | string;\n  note?: string;\n}\n\n/** Risultato dello scambio di un identita esterna verificata con una normale sessione Accessi. */\nexport interface FederatedAuthenticationResult {\n  codiceUtente: number;\n  login: LoginResult;\n  /** Assente quando login.challenge richiede la verifica email. */\n  token?: TokenResult;\n}\n"]}

package/dist/accessi-module/index.d.ts

@@ -1,9 +1,38 @@
 import { Application } from "express";
 import { AccessiOptions } from "./AccessiModule";
+/**
+ * Monta il modulo Accessi in un'applicazione Express gia esistente.
+ *
+ * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,
+ * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.
+ * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware
+ * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.
+ *
+ * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.
+ * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.
+ */
 export declare function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<void>;
 export { AccessiModule } from "./AccessiModule";
 export { AccessiDatabaseUpdater } from "./database-updates/AccessiDatabaseUpdater";
+export type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from "./AccessiModule";
+export type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from "./AccessiModule";
+export type { CatalogScriptsOptions, CatalogScriptChecksumPolicy } from "./AccessiModule";
+export { AccessiCatalogMigrator, applyCatalogScripts, listPendingCatalogScripts, splitSqlStatements, analyzeCatalogScript, leadingStatementKeyword, computeCatalogScriptChecksum, discoverCatalogScripts } from "./database-updates/AccessiCatalogMigrator";
+export type { CatalogMigrationReport, CatalogScriptMigration } from "./database-updates/AccessiCatalogMigrator";
+export { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';
+export type { ServiceTokenMetadata, IssuedServiceToken, VerifiedServiceToken, IssueServiceTokenInput } from './Services/ServiceTokenService/ServiceTokenService';
+export { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';
+export type { SchemaDdlResult, SchemaDdlSection, SchemaEntitiesResult } from './Services/SchemaExportService/SchemaExportService';
+export { AdminBootstrapService } from './Services/AdminBootstrapService/AdminBootstrapService';
+export type { BootstrapAdminResult } from './Services/AdminBootstrapService/AdminBootstrapService';
+export { getOrCreateAdminBootstrapToken, getAdminBootstrapToken, clearAdminBootstrapToken, isValidAdminBootstrapToken } from './security/adminBootstrap';
+export { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';
+export { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';
+export { FederatedAuthService } from './federated-auth/FederatedAuthService';
+export type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';
 export * from "./Dtos";
 export { authorizeAccessi, authenticateGen } from "./middleware/authenticateGen";
 export { accessiRequirement } from "./middleware/accessiRequirements";
+export { registerAccessiModuleServices, getAccessiModuleServices, ACCESSI_MODULE_SERVICES_LOCALS_KEY } from "./accessiRuntime";
+export type { AccessiModuleServices } from "./accessiRuntime";
 export type { AccessiAuthorizationOptions, AccessiRequirementNode, AccessiCustomRequirementContext, AccessiCustomRequirementHandler } from "./middleware/accessiRequirements";

package/dist/accessi-module/index.js

@@ -22,23 +22,45 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
+exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.isValidAdminBootstrapToken = exports.clearAdminBootstrapToken = exports.getAdminBootstrapToken = exports.getOrCreateAdminBootstrapToken = exports.AdminBootstrapService = exports.SchemaExportService = exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.leadingStatementKeyword = exports.analyzeCatalogScript = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
 exports.initializeAccessiModule = initializeAccessiModule;
-const common_1 = require("@nestjs/common");
+const express_1 = __importDefault(require("express"));
 const core_1 = require("@nestjs/core");
 const platform_express_1 = require("@nestjs/platform-express");
 const AccessiModule_1 = require("./AccessiModule");
 const Logger_1 = require("../Logger");
 const AuthService_1 = require("./Services/AuthService/AuthService");
+const SwaggerConfig_1 = require("../swagger/SwaggerConfig");
 const authenticateGen_1 = require("./middleware/authenticateGen");
+const accessiRuntime_1 = require("./accessiRuntime");
+const startupLog_1 = require("./startupLog");
+const accessiValidation_1 = require("./security/accessiValidation");
+const AccessiHttpExceptionFilter_1 = require("./security/AccessiHttpExceptionFilter");
+const emailConfiguration_1 = require("./security/emailConfiguration");
 function describeDatabaseTarget(options) {
     var _a, _b, _c, _d;
     const dbOptions = options.databaseOptions;
     return `${(_a = dbOptions.host) !== null && _a !== void 0 ? _a : "?"}:${(_b = dbOptions.port) !== null && _b !== void 0 ? _b : "?"} -> ${(_c = dbOptions.database) !== null && _c !== void 0 ? _c : "?"} as ${(_d = dbOptions.user) !== null && _d !== void 0 ? _d : "?"}`;
 }
+/**
+ * Monta il modulo Accessi in un'applicazione Express gia esistente.
+ *
+ * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,
+ * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.
+ * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware
+ * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.
+ *
+ * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.
+ * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.
+ */
 function initializeAccessiModule(app, options) {
     return __awaiter(this, void 0, void 0, function* () {
+        // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.
+        (0, emailConfiguration_1.assertEmailConfigured)(options);
         const logger = new Logger_1.Logger("initializeAccessiModule");
         (0, authenticateGen_1.beginAccessiAuthInitialization)();
         const startedAt = performance.now();
@@ -46,26 +68,36 @@ function initializeAccessiModule(app, options) {
             logger.info("Inizializzazione modulo accessi avviata.");
             logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);
             logger.info(`Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`);
-            // Creiamo un'istanza Express separata per NestJS
-            const nestExpressInstance = new platform_express_1.ExpressAdapter(app);
-            // Creiamo l'app NestJS attaccata a Express
+            const nestHostApp = (0, express_1.default)();
+            const isNestRoute = (path) => path === "/api/accessi" ||
+                path.startsWith("/api/accessi/") ||
+                path === "/accessi/openapi" ||
+                path.startsWith("/accessi/openapi/") ||
+                path === "/accessi/openapi.json" ||
+                path === "/accessi/openapi-json";
+            app.use((req, res, next) => {
+                if (!isNestRoute(req.path)) {
+                    return next();
+                }
+                return nestHostApp(req, res, next);
+            });
+            const nestExpressInstance = new platform_express_1.ExpressAdapter(nestHostApp);
             const nestApp = yield core_1.NestFactory.create(AccessiModule_1.AccessiModule.forRoot(options), nestExpressInstance, {
                 bufferLogs: true
             });
             logger.info("Applicazione Nest accessi creata.");
-            nestApp.enableCors();
-            nestApp.useGlobalPipes(new common_1.ValidationPipe({
-                whitelist: true,
-                forbidNonWhitelisted: true,
-                transform: true,
-                transformOptions: {
-                    enableImplicitConversion: true,
-                },
-            }));
+            nestApp.enableCors({ exposedHeaders: ['X-Total-Count'] });
+            nestApp.useGlobalPipes((0, accessiValidation_1.createAccessiValidationPipe)());
+            nestApp.useGlobalFilters(new AccessiHttpExceptionFilter_1.AccessiHttpExceptionFilter());
             nestApp.setGlobalPrefix('api', {
-                exclude: ['/swagger', '/swagger/(.*)']
+                exclude: ['/accessi/openapi', '/accessi/openapi/(.*)']
+            });
+            (0, SwaggerConfig_1.setupSwagger)(nestApp, {
+                swaggerPath: "accessi/openapi",
+                swaggerJsonPath: "accessi/openapi.json",
+                title: "Accessi API Documentation",
+                description: "API del modulo accessi",
             });
-            // Note: Swagger setup is now handled by the unified module
             logger.info("Avvio init del modulo accessi.");
             yield nestApp.init();
             logger.info("Init del modulo accessi completata.");
@@ -75,15 +107,18 @@ function initializeAccessiModule(app, options) {
                 yield passwordMigrationService.migrateLegacyEncryptedPasswords();
                 logger.info("Migrazione password legacy accessi completata.");
             }
-            const accessiAuthService = nestApp.get(authenticateGen_1.AuthenticateGenService);
-            app.locals.accessiAuthService = accessiAuthService;
-            (0, authenticateGen_1.setAccessiAuthService)(accessiAuthService);
+            const accessiServices = (0, accessiRuntime_1.registerAccessiModuleServices)(app, nestApp);
+            app.locals.accessiAuthService = accessiServices.authenticateGenService;
+            (0, authenticateGen_1.setAccessiAuthService)(accessiServices.authenticateGenService);
+            (0, startupLog_1.logAccessiStartup)(options);
             const elapsedMs = performance.now() - startedAt;
             logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);
         }
         catch (error) {
             (0, authenticateGen_1.failAccessiAuthInitialization)(error);
-            logger.error("Errore in initialize AccessiModule:", error);
+            logger.error("Errore in initialize AccessiModule:", error instanceof Error
+                ? { name: error.name, message: error.message, stack: error.stack }
+                : { error: String(error) });
             throw error;
         }
     });
@@ -92,10 +127,45 @@ var AccessiModule_2 = require("./AccessiModule");
 Object.defineProperty(exports, "AccessiModule", { enumerable: true, get: function () { return AccessiModule_2.AccessiModule; } });
 var AccessiDatabaseUpdater_1 = require("./database-updates/AccessiDatabaseUpdater");
 Object.defineProperty(exports, "AccessiDatabaseUpdater", { enumerable: true, get: function () { return AccessiDatabaseUpdater_1.AccessiDatabaseUpdater; } });
+var AccessiCatalogMigrator_1 = require("./database-updates/AccessiCatalogMigrator");
+Object.defineProperty(exports, "AccessiCatalogMigrator", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.AccessiCatalogMigrator; } });
+Object.defineProperty(exports, "applyCatalogScripts", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.applyCatalogScripts; } });
+Object.defineProperty(exports, "listPendingCatalogScripts", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.listPendingCatalogScripts; } });
+Object.defineProperty(exports, "splitSqlStatements", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.splitSqlStatements; } });
+Object.defineProperty(exports, "analyzeCatalogScript", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.analyzeCatalogScript; } });
+Object.defineProperty(exports, "leadingStatementKeyword", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.leadingStatementKeyword; } });
+Object.defineProperty(exports, "computeCatalogScriptChecksum", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.computeCatalogScriptChecksum; } });
+Object.defineProperty(exports, "discoverCatalogScripts", { enumerable: true, get: function () { return AccessiCatalogMigrator_1.discoverCatalogScripts; } });
+var ServiceTokenService_1 = require("./Services/ServiceTokenService/ServiceTokenService");
+Object.defineProperty(exports, "ServiceTokenService", { enumerable: true, get: function () { return ServiceTokenService_1.ServiceTokenService; } });
+var SchemaExportService_1 = require("./Services/SchemaExportService/SchemaExportService");
+Object.defineProperty(exports, "SchemaExportService", { enumerable: true, get: function () { return SchemaExportService_1.SchemaExportService; } });
+var AdminBootstrapService_1 = require("./Services/AdminBootstrapService/AdminBootstrapService");
+Object.defineProperty(exports, "AdminBootstrapService", { enumerable: true, get: function () { return AdminBootstrapService_1.AdminBootstrapService; } });
+var adminBootstrap_1 = require("./security/adminBootstrap");
+Object.defineProperty(exports, "getOrCreateAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.getOrCreateAdminBootstrapToken; } });
+Object.defineProperty(exports, "getAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.getAdminBootstrapToken; } });
+Object.defineProperty(exports, "clearAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.clearAdminBootstrapToken; } });
+Object.defineProperty(exports, "isValidAdminBootstrapToken", { enumerable: true, get: function () { return adminBootstrap_1.isValidAdminBootstrapToken; } });
+var serviceTokenGuard_1 = require("./security/serviceTokenGuard");
+Object.defineProperty(exports, "ServiceTokenGuard", { enumerable: true, get: function () { return serviceTokenGuard_1.ServiceTokenGuard; } });
+Object.defineProperty(exports, "RequireServiceTokenScopes", { enumerable: true, get: function () { return serviceTokenGuard_1.RequireServiceTokenScopes; } });
+Object.defineProperty(exports, "getAccessiServiceToken", { enumerable: true, get: function () { return serviceTokenGuard_1.getAccessiServiceToken; } });
+var emailConfiguration_2 = require("./security/emailConfiguration");
+Object.defineProperty(exports, "assertEmailConfigured", { enumerable: true, get: function () { return emailConfiguration_2.assertEmailConfigured; } });
+Object.defineProperty(exports, "isEmailConfigured", { enumerable: true, get: function () { return emailConfiguration_2.isEmailConfigured; } });
+Object.defineProperty(exports, "AccessiEmailNotConfiguredError", { enumerable: true, get: function () { return emailConfiguration_2.AccessiEmailNotConfiguredError; } });
+Object.defineProperty(exports, "ACCESSI_EMAIL_NOT_CONFIGURED", { enumerable: true, get: function () { return emailConfiguration_2.ACCESSI_EMAIL_NOT_CONFIGURED; } });
+var FederatedAuthService_1 = require("./federated-auth/FederatedAuthService");
+Object.defineProperty(exports, "FederatedAuthService", { enumerable: true, get: function () { return FederatedAuthService_1.FederatedAuthService; } });
 __exportStar(require("./Dtos"), exports);
 var authenticateGen_2 = require("./middleware/authenticateGen");
 Object.defineProperty(exports, "authorizeAccessi", { enumerable: true, get: function () { return authenticateGen_2.authorizeAccessi; } });
 Object.defineProperty(exports, "authenticateGen", { enumerable: true, get: function () { return authenticateGen_2.authenticateGen; } });
 var accessiRequirements_1 = require("./middleware/accessiRequirements");
 Object.defineProperty(exports, "accessiRequirement", { enumerable: true, get: function () { return accessiRequirements_1.accessiRequirement; } });
+var accessiRuntime_2 = require("./accessiRuntime");
+Object.defineProperty(exports, "registerAccessiModuleServices", { enumerable: true, get: function () { return accessiRuntime_2.registerAccessiModuleServices; } });
+Object.defineProperty(exports, "getAccessiModuleServices", { enumerable: true, get: function () { return accessiRuntime_2.getAccessiModuleServices; } });
+Object.defineProperty(exports, "ACCESSI_MODULE_SERVICES_LOCALS_KEY", { enumerable: true, get: function () { return accessiRuntime_2.ACCESSI_MODULE_SERVICES_LOCALS_KEY; } });
 //# sourceMappingURL=index.js.map

package/dist/accessi-module/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;AAyBA,0DA0DC;AAlFD,2CAAgD;AAChD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,kEAKsC;AAEtC,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,iDAAiD;YACjD,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,GAAG,CAAC,CAAC;YAEpD,2CAA2C;YAC3C,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,EAAE,CAAC;YACrB,OAAO,CAAC,cAAc,CAClB,IAAI,uBAAc,CAAC;gBACf,SAAS,EAAE,IAAI;gBACf,oBAAoB,EAAE,IAAI;gBAC1B,SAAS,EAAE,IAAI;gBACf,gBAAgB,EAAE;oBACd,wBAAwB,EAAE,IAAI;iBACjC;aACJ,CAAC,CACL,CAAC;YAEF,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,UAAU,EAAE,eAAe,CAAC;aACzC,CAAC,CAAC;YAEH,2DAA2D;YAC3D,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,kBAAkB,GAAG,OAAO,CAAC,GAAG,CAAC,wCAAsB,CAAC,CAAC;YAC/D,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,kBAAkB,CAAC;YACnD,IAAA,uCAAqB,EAAC,kBAAkB,CAAC,CAAC;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,qCAAqC,EAAE,KAAK,CAAC,CAAC;YAC3D,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAC/B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA","sourcesContent":["import { Application } from \"express\";\r\nimport { ValidationPipe } from \"@nestjs/common\";\r\nimport { NestFactory } from \"@nestjs/core\";\r\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\r\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\r\nimport { Logger } from \"../Logger\";\r\nimport { AuthService } from \"./Services/AuthService/AuthService\";\r\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    AuthenticateGenService,\n    setAccessiAuthService\n} from \"./middleware/authenticateGen\";\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n    const dbOptions = options.databaseOptions as {\n        host?: string;\n        port?: number;\n        database?: string;\n        user?: string;\n    };\n\n    return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions) {\n    const logger: Logger = new Logger(\"initializeAccessiModule\");\n    beginAccessiAuthInitialization();\n    const startedAt = performance.now();\n\n    try {\n        logger.info(\"Inizializzazione modulo accessi avviata.\");\n        logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n        logger.info(\n            `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n        );\n        // Creiamo un'istanza Express separata per NestJS\n        const nestExpressInstance = new ExpressAdapter(app);\n\n        // Creiamo l'app NestJS attaccata a Express\n        const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: true\n        });\n        logger.info(\"Applicazione Nest accessi creata.\");\n\n        nestApp.enableCors();\n        nestApp.useGlobalPipes(\n            new ValidationPipe({\n                whitelist: true,\r\n                forbidNonWhitelisted: true,\r\n                transform: true,\r\n                transformOptions: {\r\n                    enableImplicitConversion: true,\r\n                },\r\n            }),\r\n        );\r\n\r\n        nestApp.setGlobalPrefix('api', {\n            exclude: ['/swagger', '/swagger/(.*)']\n        });\n\n        // Note: Swagger setup is now handled by the unified module\n        logger.info(\"Avvio init del modulo accessi.\");\n        await nestApp.init();\n        logger.info(\"Init del modulo accessi completata.\");\n        if (options.legacyPasswordMigrationOnStartup !== false) {\n            logger.info(\"Avvio migrazione password legacy accessi.\");\n            const passwordMigrationService = nestApp.get(AuthService);\n            await passwordMigrationService.migrateLegacyEncryptedPasswords();\n            logger.info(\"Migrazione password legacy accessi completata.\");\n        }\n\n        const accessiAuthService = nestApp.get(AuthenticateGenService);\n        app.locals.accessiAuthService = accessiAuthService;\n        setAccessiAuthService(accessiAuthService);\n        const elapsedMs = performance.now() - startedAt;\n        logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n    } catch (error) {\n        failAccessiAuthInitialization(error);\n        logger.error(\"Errore in initialize AccessiModule:\", error);\n        throw error;\r\n    }\r\n}\r\n\r\nexport { AccessiModule } from \"./AccessiModule\";\r\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\r\nexport * from \"./Dtos\";\r\nexport {\r\n    authorizeAccessi,\r\n    authenticateGen\r\n} from \"./middleware/authenticateGen\";\r\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\r\nexport type {\r\n    AccessiAuthorizationOptions,\r\n    AccessiRequirementNode,\r\n    AccessiCustomRequirementContext,\r\n    AccessiCustomRequirementHandler\r\n} from \"./middleware/accessiRequirements\";\r\n"]}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/accessi-module/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAwCA,0DA8EC;AAtHD,sDAAwD;AACxD,uCAA2C;AAC3C,+DAA0D;AAC1D,mDAAgE;AAChE,sCAAmC;AACnC,oEAAiE;AACjE,4DAAwD;AACxD,kEAIsC;AACtC,qDAAiE;AACjE,6CAAiD;AACjD,oEAA2E;AAC3E,sFAAmF;AACnF,sEAAsE;AAEtE,SAAS,sBAAsB,CAAC,OAAuB;;IACnD,MAAM,SAAS,GAAG,OAAO,CAAC,eAKzB,CAAC;IAEF,OAAO,GAAG,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,IAAI,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,QAAQ,mCAAI,GAAG,OAAO,MAAA,SAAS,CAAC,IAAI,mCAAI,GAAG,EAAE,CAAC;AAC3H,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAsB,uBAAuB,CAAC,GAAgB,EAAE,OAAuB;;QACnF,yFAAyF;QACzF,IAAA,0CAAqB,EAAC,OAAO,CAAC,CAAC;QAC/B,MAAM,MAAM,GAAW,IAAI,eAAM,CAAC,yBAAyB,CAAC,CAAC;QAC7D,IAAA,gDAA8B,GAAE,CAAC;QACjC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAEpC,IAAI,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;YACxD,MAAM,CAAC,IAAI,CAAC,4BAA4B,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC3E,MAAM,CAAC,IAAI,CACP,8CAA8C,OAAO,CAAC,kBAAkB,KAAK,KAAK,sCAAsC,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAC/K,CAAC;YACF,MAAM,WAAW,GAAG,IAAA,iBAAO,GAAE,CAAC;YAC9B,MAAM,WAAW,GAAG,CAAC,IAAY,EAAE,EAAE,CACjC,IAAI,KAAK,cAAc;gBACvB,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;gBAChC,IAAI,KAAK,kBAAkB;gBAC3B,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC;gBACpC,IAAI,KAAK,uBAAuB;gBAChC,IAAI,KAAK,uBAAuB,CAAC;YAErC,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;gBAChC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAClB,CAAC;gBAED,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;YACvC,CAAC,CAAC,CAAC;YAEH,MAAM,mBAAmB,GAAG,IAAI,iCAAc,CAAC,WAAW,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,6BAAa,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,mBAAmB,EAAE;gBAC1F,UAAU,EAAE,IAAI;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAC;YAEjD,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YAC1D,OAAO,CAAC,cAAc,CAAC,IAAA,+CAA2B,GAAE,CAAC,CAAC;YACtD,OAAO,CAAC,gBAAgB,CAAC,IAAI,uDAA0B,EAAE,CAAC,CAAC;YAE3D,OAAO,CAAC,eAAe,CAAC,KAAK,EAAE;gBAC3B,OAAO,EAAE,CAAC,kBAAkB,EAAE,uBAAuB,CAAC;aACzD,CAAC,CAAC;YAEH,IAAA,4BAAY,EAAC,OAAO,EAAE;gBAClB,WAAW,EAAE,iBAAiB;gBAC9B,eAAe,EAAE,sBAAsB;gBACvC,KAAK,EAAE,2BAA2B;gBAClC,WAAW,EAAE,wBAAwB;aACxC,CAAC,CAAC;YACH,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;YAC9C,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YACrB,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;YACnD,IAAI,OAAO,CAAC,gCAAgC,KAAK,KAAK,EAAE,CAAC;gBACrD,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;gBACzD,MAAM,wBAAwB,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAW,CAAC,CAAC;gBAC1D,MAAM,wBAAwB,CAAC,+BAA+B,EAAE,CAAC;gBACjE,MAAM,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;YAClE,CAAC;YAED,MAAM,eAAe,GAAG,IAAA,8CAA6B,EAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACpE,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,eAAe,CAAC,sBAAsB,CAAC;YACvE,IAAA,uCAAqB,EAAC,eAAe,CAAC,sBAAsB,CAAC,CAAC;YAC9D,IAAA,8BAAiB,EAAC,OAAO,CAAC,CAAC;YAC3B,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;YAChD,MAAM,CAAC,IAAI,CAAC,gDAAgD,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE3F,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,IAAA,+CAA6B,EAAC,KAAK,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CACR,qCAAqC,EACrC,KAAK,YAAY,KAAK;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;gBAClE,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CACjC,CAAC;YACF,MAAM,KAAK,CAAC;QAChB,CAAC;IACL,CAAC;CAAA;AAED,iDAAgD;AAAvC,8GAAA,aAAa,OAAA;AACtB,oFAAmF;AAA1E,gIAAA,sBAAsB,OAAA;AAI/B,oFASmD;AAR/C,gIAAA,sBAAsB,OAAA;AACtB,6HAAA,mBAAmB,OAAA;AACnB,mIAAA,yBAAyB,OAAA;AACzB,4HAAA,kBAAkB,OAAA;AAClB,8HAAA,oBAAoB,OAAA;AACpB,iIAAA,uBAAuB,OAAA;AACvB,sIAAA,4BAA4B,OAAA;AAC5B,gIAAA,sBAAsB,OAAA;AAG1B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAO5B,0FAAyF;AAAhF,0HAAA,mBAAmB,OAAA;AAE5B,gGAA+F;AAAtF,8HAAA,qBAAqB,OAAA;AAE9B,4DAKmC;AAJ/B,gIAAA,8BAA8B,OAAA;AAC9B,wHAAA,sBAAsB,OAAA;AACtB,0HAAA,wBAAwB,OAAA;AACxB,4HAAA,0BAA0B,OAAA;AAE9B,kEAAoH;AAA3G,sHAAA,iBAAiB,OAAA;AAAE,8HAAA,yBAAyB,OAAA;AAAE,2HAAA,sBAAsB,OAAA;AAC7E,oEAAuJ;AAA9I,2HAAA,qBAAqB,OAAA;AAAE,uHAAA,iBAAiB,OAAA;AAAE,oIAAA,8BAA8B,OAAA;AAAE,kIAAA,4BAA4B,OAAA;AAC/G,8EAA6E;AAApE,4HAAA,oBAAoB,OAAA;AAE7B,yCAAuB;AACvB,gEAGsC;AAFlC,mHAAA,gBAAgB,OAAA;AAChB,kHAAA,eAAe,OAAA;AAEnB,wEAAsE;AAA7D,yHAAA,kBAAkB,OAAA;AAC3B,mDAI0B;AAHtB,+HAAA,6BAA6B,OAAA;AAC7B,0HAAA,wBAAwB,OAAA;AACxB,oIAAA,kCAAkC,OAAA","sourcesContent":["import express, { Application, Request } from \"express\";\nimport { NestFactory } from \"@nestjs/core\";\nimport { ExpressAdapter } from \"@nestjs/platform-express\";\nimport { AccessiModule, AccessiOptions } from \"./AccessiModule\";\nimport { Logger } from \"../Logger\";\nimport { AuthService } from \"./Services/AuthService/AuthService\";\nimport { setupSwagger } from \"../swagger/SwaggerConfig\";\nimport {\n    beginAccessiAuthInitialization,\n    failAccessiAuthInitialization,\n    setAccessiAuthService\n} from \"./middleware/authenticateGen\";\nimport { registerAccessiModuleServices } from \"./accessiRuntime\";\nimport { logAccessiStartup } from \"./startupLog\";\nimport { createAccessiValidationPipe } from './security/accessiValidation';\nimport { AccessiHttpExceptionFilter } from './security/AccessiHttpExceptionFilter';\nimport { assertEmailConfigured } from './security/emailConfiguration';\n\nfunction describeDatabaseTarget(options: AccessiOptions): string {\n    const dbOptions = options.databaseOptions as {\n        host?: string;\n        port?: number;\n        database?: string;\n        user?: string;\n    };\n\n    return `${dbOptions.host ?? \"?\"}:${dbOptions.port ?? \"?\"} -> ${dbOptions.database ?? \"?\"} as ${dbOptions.user ?? \"?\"}`;\n}\n\n/**\n * Monta il modulo Accessi in un'applicazione Express gia esistente.\n *\n * Il bootstrap crea un host Nest isolato per le rotte `/api/accessi`, inizializza Swagger,\n * validazione ed error handler, quindi rende disponibile `authorizeAccessi` al resto dell'app.\n * Attendere questa Promise prima di aprire la porta HTTP: durante il bootstrap il middleware\n * restituisce `ACCESSI_AUTH_INITIALIZING` invece di autorizzare richieste parzialmente inizializzate.\n *\n * @param app Applicazione Express ospitante. Non viene sostituita ne vengono intercettate rotte estranee ad Accessi.\n * @param options Configurazione riservata del modulo; proviene normalmente da variabili d'ambiente o secret manager.\n */\nexport async function initializeAccessiModule(app: Application, options: AccessiOptions): Promise<void> {\n    // Il servizio email e obbligatorio: reset password, 2FA e creazione utente ne dipendono.\n    assertEmailConfigured(options);\n    const logger: Logger = new Logger(\"initializeAccessiModule\");\n    beginAccessiAuthInitialization();\n    const startedAt = performance.now();\n\n    try {\n        logger.info(\"Inizializzazione modulo accessi avviata.\");\n        logger.info(`Target database accessi: ${describeDatabaseTarget(options)}`);\n        logger.info(\n            `Configurazione accessi: autoUpdateDatabase=${options.autoUpdateDatabase !== false}, legacyPasswordMigrationOnStartup=${options.legacyPasswordMigrationOnStartup !== false}`\n        );\n        const nestHostApp = express();\n        const isNestRoute = (path: string) =>\n            path === \"/api/accessi\" ||\n            path.startsWith(\"/api/accessi/\") ||\n            path === \"/accessi/openapi\" ||\n            path.startsWith(\"/accessi/openapi/\") ||\n            path === \"/accessi/openapi.json\" ||\n            path === \"/accessi/openapi-json\";\n\n        app.use((req: Request, res, next) => {\n            if (!isNestRoute(req.path)) {\n                return next();\n            }\n\n            return nestHostApp(req, res, next);\n        });\n\n        const nestExpressInstance = new ExpressAdapter(nestHostApp);\n\n        const nestApp = await NestFactory.create(AccessiModule.forRoot(options), nestExpressInstance, {\n            bufferLogs: true\n        });\n        logger.info(\"Applicazione Nest accessi creata.\");\n\n        nestApp.enableCors({ exposedHeaders: ['X-Total-Count'] });\n        nestApp.useGlobalPipes(createAccessiValidationPipe());\n        nestApp.useGlobalFilters(new AccessiHttpExceptionFilter());\n\n        nestApp.setGlobalPrefix('api', {\n            exclude: ['/accessi/openapi', '/accessi/openapi/(.*)']\n        });\n\n        setupSwagger(nestApp, {\n            swaggerPath: \"accessi/openapi\",\n            swaggerJsonPath: \"accessi/openapi.json\",\n            title: \"Accessi API Documentation\",\n            description: \"API del modulo accessi\",\n        });\n        logger.info(\"Avvio init del modulo accessi.\");\n        await nestApp.init();\n        logger.info(\"Init del modulo accessi completata.\");\n        if (options.legacyPasswordMigrationOnStartup !== false) {\n            logger.info(\"Avvio migrazione password legacy accessi.\");\n            const passwordMigrationService = nestApp.get(AuthService);\n            await passwordMigrationService.migrateLegacyEncryptedPasswords();\n            logger.info(\"Migrazione password legacy accessi completata.\");\n        }\n\n        const accessiServices = registerAccessiModuleServices(app, nestApp);\n        app.locals.accessiAuthService = accessiServices.authenticateGenService;\n        setAccessiAuthService(accessiServices.authenticateGenService);\n        logAccessiStartup(options);\n        const elapsedMs = performance.now() - startedAt;\n        logger.info(`Accessi initialized. Tempo totale bootstrap: ${elapsedMs.toFixed(2)} ms`);\n\n    } catch (error) {\n        failAccessiAuthInitialization(error);\n        logger.error(\n            \"Errore in initialize AccessiModule:\",\n            error instanceof Error\n                ? { name: error.name, message: error.message, stack: error.stack }\n                : { error: String(error) }\n        );\n        throw error;\n    }\n}\n\nexport { AccessiModule } from \"./AccessiModule\";\nexport { AccessiDatabaseUpdater } from \"./database-updates/AccessiDatabaseUpdater\";\nexport type { AccessiOptions, EmailOptions, JwtOptions, ExtensionFieldsOptions, PublicAuthRateLimitOptions, PublicAuthRateLimitRuleOptions } from \"./AccessiModule\";\nexport type { PublicRegistrationOptions, FederatedAuthenticationOptions, ServiceTokenOptions } from \"./AccessiModule\";\nexport type { CatalogScriptsOptions, CatalogScriptChecksumPolicy } from \"./AccessiModule\";\nexport {\n    AccessiCatalogMigrator,\n    applyCatalogScripts,\n    listPendingCatalogScripts,\n    splitSqlStatements,\n    analyzeCatalogScript,\n    leadingStatementKeyword,\n    computeCatalogScriptChecksum,\n    discoverCatalogScripts\n} from \"./database-updates/AccessiCatalogMigrator\";\nexport type { CatalogMigrationReport, CatalogScriptMigration } from \"./database-updates/AccessiCatalogMigrator\";\nexport { ServiceTokenService } from './Services/ServiceTokenService/ServiceTokenService';\nexport type {\n    ServiceTokenMetadata,\n    IssuedServiceToken,\n    VerifiedServiceToken,\n    IssueServiceTokenInput\n} from './Services/ServiceTokenService/ServiceTokenService';\nexport { SchemaExportService } from './Services/SchemaExportService/SchemaExportService';\nexport type { SchemaDdlResult, SchemaDdlSection, SchemaEntitiesResult } from './Services/SchemaExportService/SchemaExportService';\nexport { AdminBootstrapService } from './Services/AdminBootstrapService/AdminBootstrapService';\nexport type { BootstrapAdminResult } from './Services/AdminBootstrapService/AdminBootstrapService';\nexport {\n    getOrCreateAdminBootstrapToken,\n    getAdminBootstrapToken,\n    clearAdminBootstrapToken,\n    isValidAdminBootstrapToken\n} from './security/adminBootstrap';\nexport { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';\nexport { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';\nexport { FederatedAuthService } from './federated-auth/FederatedAuthService';\nexport type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';\nexport * from \"./Dtos\";\nexport {\n    authorizeAccessi,\n    authenticateGen\n} from \"./middleware/authenticateGen\";\nexport { accessiRequirement } from \"./middleware/accessiRequirements\";\nexport {\n    registerAccessiModuleServices,\n    getAccessiModuleServices,\n    ACCESSI_MODULE_SERVICES_LOCALS_KEY\n} from \"./accessiRuntime\";\nexport type { AccessiModuleServices } from \"./accessiRuntime\";\nexport type {\n    AccessiAuthorizationOptions,\n    AccessiRequirementNode,\n    AccessiCustomRequirementContext,\n    AccessiCustomRequirementHandler\n} from \"./middleware/accessiRequirements\";\n"]}

package/dist/accessi-module/jwt/jwt.strategy.d.ts

@@ -1,5 +1,5 @@
 import { CanActivate, ExecutionContext } from '@nestjs/common';
-import { AccessiOptions } from '../AccessiModule';
+import type { AccessiOptions } from '../AccessiModule';
 import { UserService } from '../Services/UserService/UserService';
 export declare class JwtSimpleGuard implements CanActivate {
     private readonly accessiOptions;

package/dist/accessi-module/jwt/jwt.strategy.js

@@ -59,6 +59,7 @@ const common_1 = require("@nestjs/common");
 const jwt = __importStar(require("jsonwebtoken"));
 const UserService_1 = require("../Services/UserService/UserService");
 const authenticatedToken_1 = require("../security/authenticatedToken");
+const passwordResetToken_1 = require("../security/passwordResetToken");
 let JwtSimpleGuard = class JwtSimpleGuard {
     constructor(accessiOptions, userService) {
         this.accessiOptions = accessiOptions;
@@ -66,26 +67,34 @@ let JwtSimpleGuard = class JwtSimpleGuard {
     }
     canActivate(context) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
             const request = context.switchToHttp().getRequest();
             const authHeader = request.headers['authorization'];
             if (!authHeader)
                 throw new common_1.UnauthorizedException('Token mancante.');
-            const token = authHeader.split(' ')[1];
+            const token = (0, authenticatedToken_1.extractAccessiBearerToken)(authHeader);
             if (!token)
                 throw new common_1.UnauthorizedException('Formato token non valido.');
             try {
-                const secret = ((_b = (_a = this.accessiOptions) === null || _a === void 0 ? void 0 : _a.jwtOptions) === null || _b === void 0 ? void 0 : _b.secret) || process.env.ACC_JWT_SECRET;
-                if (!secret) {
+                let secret;
+                try {
+                    secret = (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions, 'access');
+                }
+                catch (_a) {
                     throw new common_1.InternalServerErrorException('JWT secret non configurato.');
                 }
-                const payload = jwt.verify(token, secret);
+                let payload;
+                try {
+                    payload = jwt.verify(token, secret, { algorithms: ['HS256'] });
+                }
+                catch (_b) {
+                    throw new common_1.UnauthorizedException('Token non valido o scaduto.');
+                }
                 const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(payload);
                 if (!codiceUtente) {
                     throw new common_1.UnauthorizedException('Token privo di un utente valido.');
                 }
                 const currentUser = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
-                if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+                if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(payload, currentUser)) {
                     throw new common_1.UnauthorizedException('Utente non piu autorizzato.');
                 }
                 request.user = (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(payload, currentUser);
@@ -95,7 +104,7 @@ let JwtSimpleGuard = class JwtSimpleGuard {
                 if (error instanceof common_1.InternalServerErrorException || error instanceof common_1.UnauthorizedException) {
                     throw error;
                 }
-                throw new common_1.UnauthorizedException('Token non valido o scaduto.');
+                throw new common_1.InternalServerErrorException('Errore durante la verifica dell utente.');
             }
         });
     }

package/dist/accessi-module/jwt/jwt.strategy.js.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kDAAoC;AAEpC,qEAAkE;AAClE,uEAIwC;AAGjC,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YACvC,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,CAAA,MAAA,MAAA,IAAI,CAAC,cAAc,0CAAE,UAAU,0CAAE,MAAM,KAAI,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;gBACrF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBAC1C,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;oBACnD,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;YACjE,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAxCY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CAwC1B","sourcesContent":["import {\r\n  CanActivate,\r\n  ExecutionContext,\r\n  Inject,\r\n  Injectable,\r\n  InternalServerErrorException,\r\n  UnauthorizedException,\r\n} from '@nestjs/common';\r\nimport * as jwt from 'jsonwebtoken';\r\nimport { AccessiOptions } from '../AccessiModule';\r\nimport { UserService } from '../Services/UserService/UserService';\r\nimport {\r\n  buildAuthenticatedTokenPayload,\r\n  isAuthenticatedUserEnabledForJwt,\r\n  resolveCodiceUtenteFromTokenPayload,\r\n} from '../security/authenticatedToken';\r\n\r\n@Injectable()\r\nexport class JwtSimpleGuard implements CanActivate {\r\n  constructor(\r\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\r\n    private readonly userService: UserService,\r\n  ) {}\r\n\r\n  async canActivate(context: ExecutionContext): Promise<boolean> {\r\n    const request = context.switchToHttp().getRequest();\r\n\r\n    const authHeader = request.headers['authorization'];\r\n    if (!authHeader) throw new UnauthorizedException('Token mancante.');\r\n\r\n    const token = authHeader.split(' ')[1];\r\n    if (!token) throw new UnauthorizedException('Formato token non valido.');\r\n\r\n    try {\r\n      const secret = this.accessiOptions?.jwtOptions?.secret || process.env.ACC_JWT_SECRET;\r\n      if (!secret) {\r\n        throw new InternalServerErrorException('JWT secret non configurato.');\r\n      }\r\n      const payload = jwt.verify(token, secret);\r\n      const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\r\n      if (!codiceUtente) {\r\n        throw new UnauthorizedException('Token privo di un utente valido.');\r\n      }\r\n\r\n      const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\r\n      if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\r\n        throw new UnauthorizedException('Utente non piu autorizzato.');\r\n      }\r\n\r\n      request.user = buildAuthenticatedTokenPayload(payload, currentUser);\r\n      return true;\r\n    } catch (error) {\r\n      if (error instanceof InternalServerErrorException || error instanceof UnauthorizedException) {\r\n        throw error;\r\n      }\r\n      throw new UnauthorizedException('Token non valido o scaduto.');\r\n    }\r\n  }\r\n}\r\n"]}
+{"version":3,"file":"jwt.strategy.js","sourceRoot":"","sources":["../../../src/accessi-module/jwt/jwt.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAOwB;AACxB,kDAAoC;AAEpC,qEAAkE;AAClE,uEAMwC;AACxC,uEAAqE;AAG9D,IAAM,cAAc,GAApB,MAAM,cAAc;IACzB,YAC8C,cAA8B,EACzD,WAAwB;QADG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEE,WAAW,CAAC,OAAyB;;YACzC,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,UAAU,EAAE,CAAC;YAEpD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,UAAU;gBAAE,MAAM,IAAI,8BAAqB,CAAC,iBAAiB,CAAC,CAAC;YAEpE,MAAM,KAAK,GAAG,IAAA,8CAAyB,EAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,KAAK;gBAAE,MAAM,IAAI,8BAAqB,CAAC,2BAA2B,CAAC,CAAC;YAEzE,IAAI,CAAC;gBACH,IAAI,MAAc,CAAC;gBACnB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;gBAC9D,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,qCAA4B,CAAC,6BAA6B,CAAC,CAAC;gBACxE,CAAC;gBACD,IAAI,OAAgC,CAAC;gBACrC,IAAI,CAAC;oBACC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;gBACrE,CAAC;gBAAC,WAAM,CAAC;oBACP,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBACD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;gBAClE,IAAI,CAAC,YAAY,EAAE,CAAC;oBAClB,MAAM,IAAI,8BAAqB,CAAC,kCAAkC,CAAC,CAAC;gBACtE,CAAC;gBAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;gBACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;oBAC1G,MAAM,IAAI,8BAAqB,CAAC,6BAA6B,CAAC,CAAC;gBACjE,CAAC;gBAED,OAAO,CAAC,IAAI,GAAG,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;gBACpE,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qCAA4B,IAAI,KAAK,YAAY,8BAAqB,EAAE,CAAC;oBAC5F,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,IAAI,qCAA4B,CAAC,yCAAyC,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA/CY,wCAAc;yBAAd,cAAc;IAD1B,IAAA,mBAAU,GAAE;IAGR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;GAHhC,cAAc,CA+C1B","sourcesContent":["import {\n  CanActivate,\n  ExecutionContext,\n  Inject,\n  Injectable,\n  InternalServerErrorException,\n  UnauthorizedException,\n} from '@nestjs/common';\nimport * as jwt from 'jsonwebtoken';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { UserService } from '../Services/UserService/UserService';\nimport {\n  buildAuthenticatedTokenPayload,\n  extractAccessiBearerToken,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from '../security/authenticatedToken';\nimport { getAccessiJwtSecret } from '../security/passwordResetToken';\n\n@Injectable()\nexport class JwtSimpleGuard implements CanActivate {\n  constructor(\n    @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n    private readonly userService: UserService,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const request = context.switchToHttp().getRequest();\n\n    const authHeader = request.headers['authorization'];\n    if (!authHeader) throw new UnauthorizedException('Token mancante.');\n\n    const token = extractAccessiBearerToken(authHeader);\n    if (!token) throw new UnauthorizedException('Formato token non valido.');\n\n    try {\n      let secret: string;\n      try {\n        secret = getAccessiJwtSecret(this.accessiOptions, 'access');\n      } catch {\n        throw new InternalServerErrorException('JWT secret non configurato.');\n      }\n      let payload: jwt.JwtPayload | string;\n      try {\n            payload = jwt.verify(token, secret, { algorithms: ['HS256'] });\n      } catch {\n        throw new UnauthorizedException('Token non valido o scaduto.');\n      }\n      const codiceUtente = resolveCodiceUtenteFromTokenPayload(payload);\n      if (!codiceUtente) {\n        throw new UnauthorizedException('Token privo di un utente valido.');\n      }\n\n      const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n      if (!isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(payload, currentUser)) {\n        throw new UnauthorizedException('Utente non piu autorizzato.');\n      }\n\n      request.user = buildAuthenticatedTokenPayload(payload, currentUser);\n      return true;\n    } catch (error) {\n      if (error instanceof InternalServerErrorException || error instanceof UnauthorizedException) {\n        throw error;\n      }\n      throw new InternalServerErrorException('Errore durante la verifica dell utente.');\n    }\n  }\n}\n"]}

package/dist/accessi-module/middleware/accessiRequirements.d.ts

@@ -1,42 +1,57 @@
 import { Request } from "express";
+/** Grant effettivo letto da Accessi. Il confronto usa `tipoAbilitazione >= minPermissionLevel`. */
 export type AccessiGrant = {
     codiceMenu: string;
     tipoAbilitazione?: number;
 };
+/** Risultato memoizzato durante una singola autorizzazione. Non modificarlo nel custom handler. */
 export type GrantsResult = {
     grants?: AccessiGrant[];
     [key: string]: unknown;
 };
+/** Richiede l'accesso a un menu con almeno il livello indicato. Valori convenzionali: 10 lettura, 20 scrittura. */
 export type AccessiPermissionRequirement = {
     type: "permission";
     menuCode: string;
     minPermissionLevel: number;
 };
+/** Tutti i requisiti figli devono essere soddisfatti. Una lista vuota e una configurazione non valida. */
 export type AccessiAllRequirement = {
     type: "and";
     requirements: AccessiRequirementNode[];
 };
+/** Almeno un requisito figlio deve essere soddisfatto. Una lista vuota e una configurazione non valida. */
 export type AccessiAnyRequirement = {
     type: "or";
     requirements: AccessiRequirementNode[];
 };
+/** Nega il risultato del requisito figlio. Usarlo con cautela per non creare policy difficili da verificare. */
 export type AccessiNotRequirement = {
     type: "not";
     requirement: AccessiRequirementNode;
 };
+/** Delega una condizione applicativa a un handler registrato dal backend. */
 export type AccessiCustomRequirement = {
     type: "custom";
     key: string;
     payload?: unknown;
 };
+/** Nodo composabile dell'albero di autorizzazione valutato da `authorizeAccessi`. */
 export type AccessiRequirementNode = AccessiPermissionRequirement | AccessiAllRequirement | AccessiAnyRequirement | AccessiNotRequirement | AccessiCustomRequirement;
+/** Contesto in sola lettura consegnato a un requisito personalizzato. */
 export type AccessiCustomRequirementContext = {
     req: Request;
-    decodedToken: any;
+    decodedToken: Record<string, unknown>;
     userCode: number;
     getGrantsResult: () => Promise<GrantsResult>;
 };
+/** Handler applicativo per `accessiRequirement.custom`; `false` nega la richiesta, un errore produce 500. */
 export type AccessiCustomRequirementHandler = (context: AccessiCustomRequirementContext, payload?: unknown) => boolean | Promise<boolean>;
+/**
+ * Policy passata a `authorizeAccessi`.
+ * `requirements` e la forma compatibile storica ed equivale a un AND; `requirementTree`
+ * permette policy annidate e ha precedenza quando entrambi sono presenti.
+ */
 export type AccessiAuthorizationOptions = {
     requirements?: {
         menuCode: string;
@@ -45,10 +60,12 @@ export type AccessiAuthorizationOptions = {
     requirementTree?: AccessiRequirementNode;
     customRequirementHandlers?: Record<string, AccessiCustomRequirementHandler>;
 };
+/** Errore di configurazione di una policy, distinto dal normale diniego 403. */
 export declare class RequirementEvaluationError extends Error {
     readonly code: string;
     constructor(code: string, message: string);
 }
+/** Factory tipizzata per costruire policy leggibili senza dipendere dalla struttura interna dei nodi. */
 export declare const accessiRequirement: {
     permission: (menuCode: string, minPermissionLevel: number) => AccessiPermissionRequirement;
     and: (...requirements: AccessiRequirementNode[]) => AccessiAllRequirement;
@@ -56,5 +73,10 @@ export declare const accessiRequirement: {
     not: (requirement: AccessiRequirementNode) => AccessiNotRequirement;
     custom: (key: string, payload?: unknown) => AccessiCustomRequirement;
 };
+/** Normalizza la forma compatibile `requirements` nell'albero interno. */
 export declare function buildRequirementTree(options?: AccessiAuthorizationOptions): AccessiRequirementNode | undefined;
+/**
+ * Valuta ricorsivamente una policy. I grant sono caricati solo se necessari tramite `getGrantsResult`.
+ * Questa funzione e pubblica per test e integrazioni avanzate; normalmente usare `authorizeAccessi`.
+ */
 export declare function evaluateRequirement(requirement: AccessiRequirementNode, context: AccessiCustomRequirementContext, options?: AccessiAuthorizationOptions): Promise<boolean>;