emilsoftware-utilities 2.0.0-dev.5 → 2.0.0-dev.51

package/dist/accessi-module/federated-auth/FederatedAuthController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"FederatedAuthController.js","sourceRoot":"","sources":["../../../src/accessi-module/federated-auth/FederatedAuthController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoK;AACpK,6CAA0I;AAE1I,+CAAgD;AAChD,uDAAqE;AACrE,yEAA8V;AAC9V,sDAAqD;AACrD,6DAAkK;AAElK,qEAAkE;AAClE,iEAA8D;AAE9D;;;;GAIG;AAKI,IAAM,uBAAuB,+BAA7B,MAAM,uBAAuB;IAClC,YACmB,oBAA0C,EAC1C,WAAwB;QADxB,yBAAoB,GAApB,oBAAoB,CAAsB;QAC1C,gBAAW,GAAX,WAAW,CAAa;IACxC,CAAC;IAEJ;;;OAGG;IACW,sBAAsB,CAClC,KAA+B,EAC/B,YAAoB;;YAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAAiB,CAAC,4BAA4B,YAAY,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,IAAA,yCAAyB,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;KAAA;IAED,yFAAyF;IAC3E,wBAAwB,CACpC,KAA+B,EAC/B,WAAmB;;YAEnB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,0BAAiB,CAAC,+BAA+B,CAAC,CAAC;YAC/D,CAAC;YACD,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAClD,CAAC;KAAA;IAKK,YAAY,CAAQ,OAAgB,EAAS,GAAa;;YAC9D,IAAI,CAAC;gBACH,mFAAmF;gBACnF,uDAAuD;gBACvD,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,yDAAyD,CAC1D,CAAC;gBACF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,cAAc,CAAQ,OAAgB,EAAU,IAAoC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YACvH,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAU,IAAoC,EAAS,GAAa;;YACnJ,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;YAC7G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAqB,QAAgB,EAAS,GAAa;;YACrG,IAAI,CAAC;gBACH,IAAA,2BAAW,EAAC,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC,CAAC;gBAClD,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC;gBACzD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,gBAAgB,QAAQ,aAAa,CAAC,CAAC;YACjF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,aAAa,CAAQ,OAAgB,EAAuC,YAAoB,EAAS,GAAa;;YAC1H,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,0DAA0D,CAC3D,CAAC;gBACF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,IAAI,CAAC,oBAAoB,CAAC,iBAAiB,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,YAAY,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAoC,EAAS,GAAa;;YACvK,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,yDAAyD,CAAC,CAAC;gBACnG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,YAAY,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7F,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAWK,UAAU,CAAQ,OAAgB,EAAU,IAAgC,EAAS,GAAa;;YACtG,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,oDAAoD,CAAC,CAAC;gBAC9F,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,oBAAoB,KAAK,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC5I,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,QAAQ,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,iBAAiB,CAAQ,OAAgB,EAAuC,YAAoB,EAAU,IAAmC,EAAS,GAAa;;YAC3K,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,kEAAkE,CAAC,CAAC;gBAC5G,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,oBAAoB,CAAC,uBAAuB,CAAC,YAAY,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBACjG,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,sCAAsC,CAAC,CAAC;YAClF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAMK,eAAe,CAAQ,OAAgB,EAAwB,WAAmB,EAAS,GAAa;;YAC5G,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,4DAA4D,CAAC,CAAC;gBACtG,MAAM,IAAI,CAAC,wBAAwB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBACpE,MAAM,IAAI,CAAC,oBAAoB,CAAC,eAAe,CAAC,WAAW,CAAC,CAAC;gBAC7D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,CAAC,CAAC;YACxE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAQK,cAAc,CAAQ,OAAgB,EAAuC,YAAoB,EAAwB,WAAmB,EAAS,GAAa;;YACtK,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,6DAA6D,CAAC,CAAC;gBACvG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAC1E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,6CAA6C,CAAC,CAAC;YACzF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAOK,cAAc,CAAQ,OAAgB,EAAwB,WAAmB,EAAU,IAAoC,EAAS,GAAa;;YACzJ,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,8DAA8D,CAAC,CAAC;gBACxG,MAAM,IAAI,CAAC,wBAAwB,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBACpE,MAAM,IAAI,CAAC,oBAAoB,CAAC,cAAc,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8BAA8B,CAAC,CAAC;YAC1E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpC,CAAC;QACH,CAAC;KAAA;IAEO,SAAS,CAAC,GAAa,EAAE,KAAc;QAC7C,MAAM,MAAM,GAAG,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,qBAAqB,CAAC;QACrG,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,yBAAuB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1F,CAAC;CACF,CAAA;AA5NY,0DAAuB;AAoC5B;IAHL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,+BAA+B,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,8HAA8H,EAAE,CAAC;IAC7O,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,YAAG,EAAC,WAAW,CAAC;IACG,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAYjD;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,8IAA8I,EAAE,CAAC;IAC1P,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,WAAW,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAtC,sDAA8B;;6DAOzF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,uCAAuC,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oIAAoI,EAAE,CAAC;IAC7P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IAClD,IAAA,cAAK,EAAC,qBAAqB,CAAC;IACP,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAO9H;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC/N,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,0BAA0B,EAAE,WAAW,EAAE,sCAAsC,EAAE,CAAC;IACxH,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,0BAA0B,EAAE,CAAC;IAC1F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mDAAmD,EAAE,CAAC;IACnH,IAAA,eAAM,EAAC,qBAAqB,CAAC;IACR,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,UAAU,CAAC,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAQxF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,8EAA8E,EAAE,CAAC;IACpM,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IACtD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACjD,IAAA,YAAG,EAAC,gCAAgC,CAAC;IACjB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;4DAU7G;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,qDAAqD,EAAE,WAAW,EAAE,uBAAuB,EAAE,WAAW,EAAE,qIAAqI,EAAE,CAAC;IAC1Q,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,aAAI,EAAC,gCAAgC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;2DAUlJ;AAWK;IATL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,mCAAmC,EAAE,WAAW,EAAE,qBAAqB,EAAE,WAAW,EAAE,qHAAqH,EAAE,CAAC;IACtO,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,kDAA0B,EAAE,CAAC;IAC7C,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,iDAAyB,EAAE,CAAC;IACvD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,2BAA2B,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,iDAAiD,EAAE,CAAC;IACjH,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,gCAAgC,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,mGAAmG,EAAE,CAAC;IACnK,IAAA,aAAI,EAAC,OAAO,CAAC;IACI,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAoC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAlC,kDAA0B;;yDAUjF;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4CAA4C,EAAE,WAAW,EAAE,wBAAwB,EAAE,WAAW,EAAE,6GAA6G,EAAE,CAAC;IAC1O,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,qDAA6B,EAAE,CAAC;IAChD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,oCAAoC,CAAC;IACnB,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAuC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAArC,qDAA6B;;gEAUtJ;AAMK;IAJL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE,WAAW,EAAE,0BAA0B,EAAE,WAAW,EAAE,yEAAyE,EAAE,CAAC;IACxL,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,eAAM,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAU/F;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,6CAA6C,EAAE,WAAW,EAAE,oCAAoC,EAAE,WAAW,EAAE,oHAAoH,EAAE,CAAC;IAC9P,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAChD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,wCAAwC,EAAE,CAAC;IACxF,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,4BAAa,EAAE,WAAW,EAAE,qDAAqD,EAAE,CAAC;IACrH,IAAA,eAAM,EAAC,6CAA6C,CAAC;IAChC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IAAwB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6DAUzJ;AAOK;IALL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,WAAW,EAAE,yBAAyB,EAAE,WAAW,EAAE,kHAAkH,EAAE,CAAC;IAClO,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,0DAA0D,EAAE,CAAC;IAC1G,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,sDAA8B,EAAE,CAAC;IACjD,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACvC,IAAA,cAAK,EAAC,yBAAyB,CAAC;IACX,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,cAAK,EAAC,aAAa,CAAC,CAAA;IAAuB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAwC,WAAA,IAAA,YAAG,GAAE,CAAA;;qDAAtC,sDAA8B;;6DAUpI;kCAtNU,uBAAuB;IAJnC,IAAA,iBAAO,EAAC,0BAA0B,CAAC;IACnC,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,mBAAU,EAAC,wBAAwB,CAAC;qCAGM,2CAAoB;QAC7B,yBAAW;GAHhC,uBAAuB,CA4NnC","sourcesContent":["import { Body, Controller, Delete, Get, HttpException, HttpStatus, NotFoundException, Param, ParseIntPipe, Patch, Post, Req, Res, UseGuards } from '@nestjs/common';\nimport { ApiBearerAuth, ApiBody, ApiCreatedResponse, ApiOkResponse, ApiOperation, ApiParam, ApiResponse, ApiTags } from '@nestjs/swagger';\nimport { Request, Response } from 'express';\nimport { RestUtilities } from '../../Utilities';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { CreateFederatedIdentityRequest, CreateFederatedProviderRequest, CreateFederatedUserRequest, FederatedIdentityListResponse, FederatedIdentityResponse, FederatedProviderListResponse, FederatedProviderResponse, SetPasswordLoginPolicyRequest, UpdateFederatedIdentityRequest, UpdateFederatedProviderRequest } from '../Dtos/FederatedIdentityDtos';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport { ensureAdmin, ensureCanManageTargetUser, ensurePrivilegeFlagChanges, ensureUserManagement, getAuthenticatedAccessiUser } from '../security/accessControl';\nimport type { AuthenticatedAccessiUser } from '../security/accessControl';\nimport { UserService } from '../Services/UserService/UserService';\nimport { FederatedAuthService } from './FederatedAuthService';\n\n/**\n * Master-only administration API. Authentication itself is intentionally not\n * exposed over HTTP: the hosting backend validates its SSO and calls\n * FederatedAuthService.authenticate({ provider, subject }) directly.\n */\n@ApiTags('Federated authentication')\n@ApiBearerAuth()\n@UseGuards(JwtSimpleGuard)\n@Controller('accessi/federated-auth')\nexport class FederatedAuthController {\n  constructor(\n    private readonly federatedAuthService: FederatedAuthService,\n    private readonly userService: UserService,\n  ) {}\n\n  /**\n   * Verifica che l'attore possa gestire il target (ADMIN > SUPER > utente):\n   * un superutente non puo' toccare le identita SSO di un admin.\n   */\n  private async ensureManageableTarget(\n    actor: AuthenticatedAccessiUser,\n    codiceUtente: number,\n  ): Promise<void> {\n    const target = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!target) {\n      throw new NotFoundException(`Nessun utente con codice ${codiceUtente}.`);\n    }\n    ensureCanManageTargetUser(actor, target);\n  }\n\n  /** Risolve il proprietario di un'identita SSO e verifica che l'attore possa gestirlo. */\n  private async ensureManageableIdentity(\n    actor: AuthenticatedAccessiUser,\n    identityKey: string,\n  ): Promise<void> {\n    const owner = await this.federatedAuthService.getIdentityOwner(identityKey);\n    if (!owner) {\n      throw new NotFoundException('Collegamento SSO non trovato.');\n    }\n    await this.ensureManageableTarget(actor, owner);\n  }\n\n  @ApiOperation({ summary: 'Elenca i provider SSO censiti', operationId: 'getFederatedProviders', description: 'Riservato a superutente. Restituisce solo catalogo e stato Accessi; issuer, secret e configurazioni SSO restano nel backend.' })\n  @ApiOkResponse({ type: FederatedProviderListResponse })\n  @Get('providers')\n  async getProviders(@Req() request: Request, @Res() res: Response) {\n    try {\n      // Lettura del catalogo provider: serve anche al superutente per creare utenti SSO.\n      // La modifica del catalogo resta riservata agli admin.\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono leggere i provider SSO.',\n      );\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getProviders());\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Censisce un provider SSO', operationId: 'createFederatedProvider', description: 'Riservato a superutente. La chiave provider deve corrispondere alla configurazione stabile del backend; non salvare segreti, issuer o token.' })\n  @ApiBody({ type: CreateFederatedProviderRequest })\n  @ApiCreatedResponse({ type: FederatedProviderResponse })\n  @Post('providers')\n  async createProvider(@Req() request: Request, @Body() body: CreateFederatedProviderRequest, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.createProvider(body), HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Aggiorna o disabilita un provider SSO', operationId: 'updateFederatedProvider', description: 'Riservato a superutente. La chiave provider è immutabile: disabilitarla blocca nuovi login SSO ma conserva i collegamenti storici.' })\n  @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n  @ApiBody({ type: UpdateFederatedProviderRequest })\n  @ApiOkResponse({ type: FederatedProviderResponse })\n  @Patch('providers/:provider')\n  async updateProvider(@Req() request: Request, @Param('provider') provider: string, @Body() body: UpdateFederatedProviderRequest, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.updateProvider(provider, body));\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Elimina un provider SSO', operationId: 'deleteFederatedProvider', description: 'Riservato a superutente. Consentito solo se nessuna identita e collegata al provider; in alternativa disabilitalo.' })\n  @ApiParam({ name: 'provider', example: 'azure-ad-acme-produzione', description: 'Chiave stabile del provider censito.' })\n  @ApiOkResponse({ type: ActionResponse })\n  @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider non registrato.' })\n  @ApiResponse({ status: 409, type: ErrorResponse, description: 'Provider ancora utilizzato da identita collegate.' })\n  @Delete('providers/:provider')\n  async deleteProvider(@Req() request: Request, @Param('provider') provider: string, @Res() res: Response) {\n    try {\n      ensureAdmin(getAuthenticatedAccessiUser(request));\n      await this.federatedAuthService.deleteProvider(provider);\n      return RestUtilities.sendOKMessage(res, `Provider SSO ${provider} eliminato.`);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Elenca le identita SSO di un utente', operationId: 'getFederatedIdentities', description: 'Riservato a superutente. Non restituisce token esterni o claim del provider.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiOkResponse({ type: FederatedIdentityListResponse })\n  @ApiResponse({ status: 403, type: ErrorResponse })\n  @Get('users/:codiceUtente/identities')\n  async getIdentities(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Res() res: Response) {\n    try {\n      ensureUserManagement(\n        getAuthenticatedAccessiUser(request),\n        'Solo gli amministratori possono leggere le identita SSO.',\n      );\n      return RestUtilities.sendBaseResponse(res, await this.federatedAuthService.getUserIdentities(codiceUtente));\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Associa un SSO gia verificato a un utente esistente', operationId: 'linkFederatedIdentity', description: 'Il master deve fornire un provider e subject ottenuti da una verifica SSO lato backend; questo endpoint non verifica token esterni.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiBody({ type: CreateFederatedIdentityRequest })\n  @ApiCreatedResponse({ type: FederatedIdentityResponse })\n  @Post('users/:codiceUtente/identities')\n  async linkIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: CreateFederatedIdentityRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono collegare identita SSO.');\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      const identity = await this.federatedAuthService.linkIdentity(codiceUtente, body, body.note);\n      return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Crea un utente gestito e SSO-only', operationId: 'createFederatedUser', description: 'Riservato a superutente. L utente nasce confermato, con identita collegata e senza password salvo opt-in esplicito.' })\n  @ApiBody({ type: CreateFederatedUserRequest })\n  @ApiCreatedResponse({ type: FederatedIdentityResponse })\n  @ApiResponse({ status: 400, type: ErrorResponse, description: 'Provider o subject non validi.' })\n  @ApiResponse({ status: 404, type: ErrorResponse, description: 'Provider SSO non censito.' })\n  @ApiResponse({ status: 409, type: ErrorResponse, description: 'Email o identità SSO già associate a un utente.' })\n  @ApiResponse({ status: 503, type: ErrorResponse, description: 'Schema Accessi non aggiornato.' })\n  @ApiResponse({ status: 500, type: ErrorResponse, description: 'Errore inatteso durante il provisioning; la risposta contiene FEDERATED_USER_PROVISIONING_FAILED.' })\n  @Post('users')\n  async createUser(@Req() request: Request, @Body() body: CreateFederatedUserRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono creare utenti SSO.');\n      ensurePrivilegeFlagChanges(authenticatedUser, body.user);\n      const identity = await this.federatedAuthService.createManagedFederatedUser(body.user, body, body.passwordLoginEnabled === true, body.note);\n      return RestUtilities.sendBaseResponse(res, identity, HttpStatus.CREATED);\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Abilita o disabilita il login con password', operationId: 'setPasswordLoginPolicy', description: 'Con false il login locale restituisce PASSWORD_LOGIN_DISABLED; le identita SSO attive restano utilizzabili.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiBody({ type: SetPasswordLoginPolicyRequest })\n  @ApiOkResponse({ type: ActionResponse })\n  @Patch('users/:codiceUtente/password-login')\n  async setPasswordPolicy(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Body() body: SetPasswordLoginPolicyRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono modificare la policy di accesso.');\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      await this.federatedAuthService.setPasswordLoginEnabled(codiceUtente, body.passwordLoginEnabled);\n      return RestUtilities.sendOKMessage(res, 'Policy di autenticazione aggiornata.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Disabilita un identita SSO', operationId: 'disableFederatedIdentity', description: 'Soft delete: l associazione resta tracciata ma non puo piu autenticare.' })\n  @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n  @ApiOkResponse({ type: ActionResponse })\n  @Delete('identities/:identityKey')\n  async disableIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono disabilitare identita SSO.');\n      await this.ensureManageableIdentity(authenticatedUser, identityKey);\n      await this.federatedAuthService.disableIdentity(identityKey);\n      return RestUtilities.sendOKMessage(res, 'Identita SSO disabilitata.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Elimina definitivamente un collegamento SSO', operationId: 'deleteFederatedIdentityPermanently', description: 'Riservato a superutente. Rimuove il collegamento provider e subject dall’utente, senza eliminare l’utente Accessi.' })\n  @ApiParam({ name: 'codiceUtente', example: 123 })\n  @ApiParam({ name: 'identityKey', description: 'SHA-256 del collegamento da eliminare.' })\n  @ApiOkResponse({ type: ActionResponse })\n  @ApiResponse({ status: 404, type: ErrorResponse, description: 'Collegamento assente o non appartenente all’utente.' })\n  @Delete('users/:codiceUtente/identities/:identityKey')\n  async deleteIdentity(@Req() request: Request, @Param('codiceUtente', ParseIntPipe) codiceUtente: number, @Param('identityKey') identityKey: string, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono eliminare collegamenti SSO.');\n      await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n      await this.federatedAuthService.deleteIdentity(codiceUtente, identityKey);\n      return RestUtilities.sendOKMessage(res, 'Collegamento SSO eliminato definitivamente.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  @ApiOperation({ summary: 'Aggiorna un collegamento SSO', operationId: 'updateFederatedIdentity', description: 'Consente di modificare nota e stato attivo del collegamento. identityKey e una chiave tecnica, non un token SSO.' })\n  @ApiParam({ name: 'identityKey', description: 'SHA-256 restituito dagli endpoint di elenco o creazione.' })\n  @ApiBody({ type: UpdateFederatedIdentityRequest })\n  @ApiOkResponse({ type: ActionResponse })\n  @Patch('identities/:identityKey')\n  async updateIdentity(@Req() request: Request, @Param('identityKey') identityKey: string, @Body() body: UpdateFederatedIdentityRequest, @Res() res: Response) {\n    try {\n      const authenticatedUser = getAuthenticatedAccessiUser(request);\n      ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono aggiornare collegamenti SSO.');\n      await this.ensureManageableIdentity(authenticatedUser, identityKey);\n      await this.federatedAuthService.updateIdentity(identityKey, body);\n      return RestUtilities.sendOKMessage(res, 'Collegamento SSO aggiornato.');\n    } catch (error) {\n      return this.sendError(res, error);\n    }\n  }\n\n  private sendError(res: Response, error: unknown) {\n    const status = error instanceof HttpException ? error.getStatus() : HttpStatus.INTERNAL_SERVER_ERROR;\n    return RestUtilities.sendErrorMessage(res, error, FederatedAuthController.name, status);\n  }\n}\n"]}

package/dist/accessi-module/federated-auth/FederatedAuthService.d.ts

@@ -0,0 +1,102 @@
+import { OnModuleInit } from '@nestjs/common';
+import type { AccessiOptions } from '../AccessiModule';
+import { RegisterRequest } from '../Dtos/RegisterRequest';
+import { AuthService } from '../Services/AuthService/AuthService';
+import { UserService } from '../Services/UserService/UserService';
+import { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './FederatedAuthTypes';
+/**
+ * Maps externally verified identities to Accessi users and issues the usual
+ * Accessi JWT. It deliberately has no provider SDK dependency: validating an
+ * Azure, Google, Apple, SAML, or custom token is always the hosting backend's job.
+ */
+export declare class FederatedAuthService implements OnModuleInit {
+    private readonly options;
+    private readonly userService;
+    private readonly authService;
+    constructor(options: AccessiOptions, userService: UserService, authService: AuthService);
+    /** Await the same schema barrier as the module updater; never race two DDL implementations. */
+    onModuleInit(): Promise<void>;
+    /** Returns true only when the host application opted in to federated authentication. */
+    isEnabled(): boolean;
+    /**
+     * Exchanges a backend-verified identity for the same login result and JWT
+     * emitted by the local password endpoint. No raw external token is accepted.
+     */
+    authenticate(identity: VerifiedFederatedIdentity): Promise<FederatedAuthenticationResult>;
+    /** Links an external identity to an existing Accessi user. It never changes that user's password policy. */
+    linkIdentity(codiceUtente: number, identity: VerifiedFederatedIdentity, note?: string): Promise<FederatedIdentity>;
+    /** Creates a confirmed Accessi user, associates an SSO identity and defaults the new user to SSO-only. */
+    createManagedFederatedUser(registrationData: RegisterRequest, identity: VerifiedFederatedIdentity, passwordLoginEnabled?: boolean, note?: string): Promise<FederatedIdentity>;
+    /**
+     * Allows self-provisioning only when explicitly enabled. The caller must have
+     * verified the external identity and decide which profile fields are trusted.
+     */
+    registerSelfServiceFederatedUser(registrationData: RegisterRequest, identity: VerifiedFederatedIdentity): Promise<FederatedIdentity>;
+    /** Returns all linked identities for administration; disabled identities are included. */
+    getUserIdentities(codiceUtente: number): Promise<FederatedIdentity[]>;
+    /** Returns the complete provider catalog, including inactive providers, for superuser administration. */
+    getProviders(): Promise<FederatedProvider[]>;
+    /** Registers a provider key that must match the backend's SSO configuration exactly. */
+    createProvider(input: {
+        provider: string;
+        description: string;
+        note?: string;
+    }): Promise<FederatedProvider>;
+    /** Updates provider metadata or disables the provider without removing its identity history. */
+    /**
+     * Aggiorna metadati amministrativi del catalogo. La chiave provider e immutabile perche parte dell'identita
+     * persistita e deve coincidere esattamente con la configurazione del backend validante.
+     */
+    updateProvider(providerValue: string, update: {
+        description?: string;
+        active?: boolean;
+        note?: string;
+    }): Promise<FederatedProvider>;
+    /**
+     * Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK
+     * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un
+     * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.
+     */
+    deleteProvider(providerValue: string): Promise<void>;
+    /** Enables or disables all local password authentication for one user. */
+    /**
+     * Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso
+     * email/password, che restituisce `PASSWORD_LOGIN_DISABLED`. L'assenza della riga mantiene il default legacy `true`.
+     */
+    setPasswordLoginEnabled(codiceUtente: number, enabled: boolean): Promise<void>;
+    /** Returns the effective local password policy. Users without a policy row retain the historic enabled default. */
+    /** Restituisce la policy effettiva; utenti precedenti alla migrazione restano abilitati alla password. */
+    isPasswordLoginEnabled(codiceUtente: number): Promise<boolean>;
+    /** Soft-disables a linked identity without deleting operational history. */
+    /** Disabilita logicamente un collegamento SSO conservando audit e possibilita di successiva riattivazione. */
+    disableIdentity(identityKey: string): Promise<void>;
+    /** Restituisce il CODUTE proprietario di un collegamento SSO, o null se assente. */
+    getIdentityOwner(identityKey: string): Promise<number | null>;
+    /** Permanently removes one identity link from its owning user after administrative confirmation. */
+    /**
+     * Elimina fisicamente un collegamento SSO soltanto dopo aver verificato che appartenga all'utente indicato.
+     * Non elimina mai l'utente Accessi, password, ruoli o grant associati.
+     */
+    deleteIdentity(codiceUtente: number, identityKey: string): Promise<void>;
+    /** Aggiorna lo stato o la nota di un collegamento SSO usando la sua chiave tecnica amministrativa. */
+    /** Aggiorna stato o nota amministrativa senza modificare provider e subject, che identificano la persona. */
+    updateIdentity(identityKey: string, update: {
+        active?: boolean;
+        note?: string;
+    }): Promise<void>;
+    /** Explicit administrative schema reconciliation, shared with the standard updater. */
+    ensureSchema(): Promise<void>;
+    private findIdentity;
+    private assertUserExists;
+    private assertEnabled;
+    /** Validates the opaque SHA-256 key used only by administrative identity endpoints. */
+    private assertIdentityKey;
+    private normalizeIdentity;
+    private normalizeProvider;
+    private normalizeDescription;
+    private assertProviderActive;
+    private findProvider;
+    private getIdentityKey;
+    private toIdentity;
+    private toProvider;
+}

package/dist/accessi-module/federated-auth/FederatedAuthService.js

@@ -0,0 +1,461 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.FederatedAuthService = void 0;
+const common_1 = require("@nestjs/common");
+const crypto_1 = require("crypto");
+const AccessiDatabaseUpdater_1 = require("../database-updates/AccessiDatabaseUpdater");
+const Orm_1 = require("../../Orm");
+const Utilities_1 = require("../../Utilities");
+const StatoRegistrazione_1 = require("../Dtos/StatoRegistrazione");
+const AuthService_1 = require("../Services/AuthService/AuthService");
+const UserService_1 = require("../Services/UserService/UserService");
+const authenticatedToken_1 = require("../security/authenticatedToken");
+/**
+ * Maps externally verified identities to Accessi users and issues the usual
+ * Accessi JWT. It deliberately has no provider SDK dependency: validating an
+ * Azure, Google, Apple, SAML, or custom token is always the hosting backend's job.
+ */
+let FederatedAuthService = class FederatedAuthService {
+    constructor(options, userService, authService) {
+        this.options = options;
+        this.userService = userService;
+        this.authService = authService;
+    }
+    /** Await the same schema barrier as the module updater; never race two DDL implementations. */
+    onModuleInit() {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.initialize(this.options);
+        });
+    }
+    /** Returns true only when the host application opted in to federated authentication. */
+    isEnabled() {
+        var _a;
+        return ((_a = this.options.federatedAuthentication) === null || _a === void 0 ? void 0 : _a.enabled) === true;
+    }
+    /**
+     * Exchanges a backend-verified identity for the same login result and JWT
+     * emitted by the local password endpoint. No raw external token is accepted.
+     */
+    authenticate(identity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertEnabled();
+            const normalized = this.normalizeIdentity(identity);
+            yield this.assertProviderActive(normalized.provider);
+            const linkedIdentity = yield this.findIdentity(normalized, true);
+            if (!linkedIdentity) {
+                throw new common_1.NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_LINKED', message: 'Identita esterna non associata a un utente Accessi.' });
+            }
+            const currentUser = yield this.userService.getAuthenticatedUserSnapshot(linkedIdentity.codiceUtente);
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+                throw new common_1.ForbiddenException({ code: 'FEDERATED_USER_DISABLED', message: 'Utente Accessi non abilitato.' });
+            }
+            if (currentUser.flagDueFattori) {
+                const login = yield this.authService.beginFederatedTwoFactor(linkedIdentity.codiceUtente, linkedIdentity.identityKey);
+                return { codiceUtente: linkedIdentity.codiceUtente, login };
+            }
+            yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [linkedIdentity.identityKey]);
+            yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [linkedIdentity.codiceUtente]);
+            const login = yield this.authService.getLoginResultForUser(linkedIdentity.codiceUtente);
+            return {
+                codiceUtente: linkedIdentity.codiceUtente,
+                login,
+                token: this.authService.createAccessiToken(login.utente, ['federated']),
+            };
+        });
+    }
+    /** Links an external identity to an existing Accessi user. It never changes that user's password policy. */
+    linkIdentity(codiceUtente, identity, note) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            this.assertEnabled();
+            yield this.assertUserExists(codiceUtente);
+            const normalized = this.normalizeIdentity(identity);
+            yield this.assertProviderActive(normalized.provider);
+            const existing = yield this.findIdentity(normalized, false);
+            if (existing && existing.codiceUtente !== codiceUtente) {
+                throw new common_1.ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identita esterna gia associata a un altro utente.' });
+            }
+            if (existing) {
+                yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 1, DATDISATT = NULL, NOTA = ? WHERE IDNKEY = ?', [(_a = note !== null && note !== void 0 ? note : existing.note) !== null && _a !== void 0 ? _a : null, existing.identityKey]);
+            }
+            else {
+                yield Orm_1.Orm.execute(this.options.databaseOptions, `INSERT INTO UTENTI_IDENTITA_EXT (IDNKEY, CODUTE, PROVIDER, SUBJECT, FLGATTIVO, NOTA)
+         VALUES (?, ?, ?, ?, 1, ?)`, [this.getIdentityKey(normalized), codiceUtente, normalized.provider, normalized.subject, note !== null && note !== void 0 ? note : null]);
+            }
+            return (yield this.findIdentity(normalized, false));
+        });
+    }
+    /** Creates a confirmed Accessi user, associates an SSO identity and defaults the new user to SSO-only. */
+    createManagedFederatedUser(registrationData_1, identity_1) {
+        return __awaiter(this, arguments, void 0, function* (registrationData, identity, passwordLoginEnabled = false, note) {
+            this.assertEnabled();
+            const normalizedIdentity = this.normalizeIdentity(identity);
+            yield this.assertProviderActive(normalizedIdentity.provider);
+            if (yield this.findIdentity(normalizedIdentity, false)) {
+                throw new common_1.ConflictException({ code: 'FEDERATED_IDENTITY_ALREADY_LINKED', message: 'Identità esterna già associata a un utente Accessi.' });
+            }
+            try {
+                const codiceUtente = yield this.userService.register(registrationData, {
+                    allowPrivilegedFields: true,
+                    initialState: StatoRegistrazione_1.StatoRegistrazione.CONF,
+                });
+                yield this.setPasswordLoginEnabled(codiceUtente, passwordLoginEnabled);
+                return yield this.linkIdentity(codiceUtente, normalizedIdentity, note);
+            }
+            catch (error) {
+                if (error instanceof common_1.BadRequestException || error instanceof common_1.ConflictException || error instanceof common_1.ForbiddenException || error instanceof common_1.NotFoundException || error instanceof common_1.ServiceUnavailableException) {
+                    throw error;
+                }
+                if (Utilities_1.RestUtilities.isDatabaseSchemaError(error)) {
+                    throw new common_1.ServiceUnavailableException({ code: 'ACCESSI_DATABASE_SCHEMA_OUTDATED', message: 'Lo schema del database Accessi non è aggiornato. Eseguire la migrazione database e riprovare.' });
+                }
+                throw new common_1.InternalServerErrorException({ code: 'FEDERATED_USER_PROVISIONING_FAILED', message: 'La creazione dell’utente SSO non è stata completata. Verificare il log del backend e l’eventuale utente creato senza identità SSO.' });
+            }
+        });
+    }
+    /**
+     * Allows self-provisioning only when explicitly enabled. The caller must have
+     * verified the external identity and decide which profile fields are trusted.
+     */
+    registerSelfServiceFederatedUser(registrationData, identity) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            this.assertEnabled();
+            if (((_a = this.options.federatedAuthentication) === null || _a === void 0 ? void 0 : _a.allowSelfRegistration) !== true) {
+                throw new common_1.ForbiddenException({ code: 'FEDERATED_SELF_REGISTRATION_DISABLED', message: 'Auto-registrazione SSO non abilitata.' });
+            }
+            const codiceUtente = yield this.userService.register(registrationData, {
+                allowPrivilegedFields: false,
+                initialState: StatoRegistrazione_1.StatoRegistrazione.CONF,
+            });
+            yield this.setPasswordLoginEnabled(codiceUtente, false);
+            return this.linkIdentity(codiceUtente, identity);
+        });
+    }
+    /** Returns all linked identities for administration; disabled identities are included. */
+    getUserIdentities(codiceUtente) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertEnabled();
+            const rows = yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,
+              I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,
+              I.DATDISATT AS disabled_at, I.NOTA,
+              COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled
+       FROM UTENTI_IDENTITA_EXT I
+       LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE
+       WHERE I.CODUTE = ?
+       ORDER BY I.DATINS DESC`, [codiceUtente]);
+            return rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase).map((row) => this.toIdentity(row));
+        });
+    }
+    /** Returns the complete provider catalog, including inactive providers, for superuser administration. */
+    getProviders() {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertEnabled();
+            const rows = yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,
+              DATINS AS created_at, NOTA AS note
+       FROM SSO_PROVIDER
+       ORDER BY FLGATTIVO DESC, DESCRIZIONE, PROVIDER`);
+            return rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase).map((row) => this.toProvider(row));
+        });
+    }
+    /** Registers a provider key that must match the backend's SSO configuration exactly. */
+    createProvider(input) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            this.assertEnabled();
+            const provider = this.normalizeProvider(input.provider);
+            const description = this.normalizeDescription(input.description);
+            const existing = yield this.findProvider(provider);
+            if (existing) {
+                throw new common_1.ConflictException({ code: 'FEDERATED_PROVIDER_ALREADY_EXISTS', message: 'Il provider SSO è già registrato.' });
+            }
+            yield Orm_1.Orm.execute(this.options.databaseOptions, 'INSERT INTO SSO_PROVIDER (PROVIDER, DESCRIZIONE, FLGATTIVO, NOTA) VALUES (?, ?, 1, ?)', [provider, description, ((_a = input.note) === null || _a === void 0 ? void 0 : _a.trim()) || null]);
+            return (yield this.findProvider(provider));
+        });
+    }
+    /** Updates provider metadata or disables the provider without removing its identity history. */
+    /**
+     * Aggiorna metadati amministrativi del catalogo. La chiave provider e immutabile perche parte dell'identita
+     * persistita e deve coincidere esattamente con la configurazione del backend validante.
+     */
+    updateProvider(providerValue, update) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertEnabled();
+            const provider = this.normalizeProvider(providerValue);
+            if (!(yield this.findProvider(provider))) {
+                throw new common_1.NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });
+            }
+            const changes = [];
+            const params = [];
+            if (update.description !== undefined) {
+                changes.push('DESCRIZIONE = ?');
+                params.push(this.normalizeDescription(update.description));
+            }
+            if (update.active !== undefined) {
+                changes.push('FLGATTIVO = ?');
+                params.push(update.active ? 1 : 0);
+            }
+            if (update.note !== undefined) {
+                changes.push('NOTA = ?');
+                params.push(update.note.trim() || null);
+            }
+            if (changes.length > 0) {
+                params.push(provider);
+                yield Orm_1.Orm.execute(this.options.databaseOptions, `UPDATE SSO_PROVIDER SET ${changes.join(', ')} WHERE PROVIDER = ?`, params);
+            }
+            return (yield this.findProvider(provider));
+        });
+    }
+    /**
+     * Elimina un provider dal catalogo. Consentito solo se nessuna identita lo referenzia: la FK
+     * `FK_UTEIDEXT_PROVIDER` impedirebbe comunque la delete, ma verifichiamo prima per restituire un
+     * messaggio amministrativo chiaro. I collegamenti storici vanno rimossi o il provider disabilitato.
+     */
+    deleteProvider(providerValue) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c;
+            this.assertEnabled();
+            const provider = this.normalizeProvider(providerValue);
+            if (!(yield this.findProvider(provider))) {
+                throw new common_1.NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });
+            }
+            const usage = yield Orm_1.Orm.query(this.options.databaseOptions, 'SELECT COUNT(*) AS total FROM UTENTI_IDENTITA_EXT WHERE PROVIDER = ?', [provider]);
+            const rawTotal = (_b = (_a = usage === null || usage === void 0 ? void 0 : usage[0]) === null || _a === void 0 ? void 0 : _a.TOTAL) !== null && _b !== void 0 ? _b : (_c = usage === null || usage === void 0 ? void 0 : usage[0]) === null || _c === void 0 ? void 0 : _c.total;
+            const total = typeof rawTotal === 'number' ? rawTotal : Number.parseInt(`${rawTotal !== null && rawTotal !== void 0 ? rawTotal : '0'}`, 10);
+            if (total > 0) {
+                throw new common_1.ConflictException({
+                    code: 'FEDERATED_PROVIDER_IN_USE',
+                    message: `Impossibile eliminare il provider ${provider}: ${total} identita collegate. Disabilitalo oppure rimuovi prima i collegamenti.`,
+                });
+            }
+            yield Orm_1.Orm.execute(this.options.databaseOptions, 'DELETE FROM SSO_PROVIDER WHERE PROVIDER = ?', [provider]);
+        });
+    }
+    /** Enables or disables all local password authentication for one user. */
+    /**
+     * Imposta la policy di login locale. `false` non rimuove password ne identita SSO: blocca solo il percorso
+     * email/password, che restituisce `PASSWORD_LOGIN_DISABLED`. L'assenza della riga mantiene il default legacy `true`.
+     */
+    setPasswordLoginEnabled(codiceUtente, enabled) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertEnabled();
+            yield this.assertUserExists(codiceUtente);
+            // Upsert: per utenti legacy senza riga in UTENTI_CONFIG una UPDATE a vuoto
+            // lasciava la policy al default, rendendo la disattivazione un no-op silenzioso.
+            yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE OR INSERT INTO UTENTI_CONFIG (CODUTE, FLGPASSWORD) VALUES (?, ?) MATCHING (CODUTE)', [codiceUtente, enabled ? 1 : 0]);
+        });
+    }
+    /** Returns the effective local password policy. Users without a policy row retain the historic enabled default. */
+    /** Restituisce la policy effettiva; utenti precedenti alla migrazione restano abilitati alla password. */
+    isPasswordLoginEnabled(codiceUtente) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (!this.isEnabled())
+                return true;
+            const rows = yield Orm_1.Orm.query(this.options.databaseOptions, 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?', [codiceUtente]);
+            const row = rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
+            return (row === null || row === void 0 ? void 0 : row.passwordLoginEnabled) !== false && (row === null || row === void 0 ? void 0 : row.passwordLoginEnabled) !== 0 && (row === null || row === void 0 ? void 0 : row.passwordLoginEnabled) !== '0';
+        });
+    }
+    /** Soft-disables a linked identity without deleting operational history. */
+    /** Disabilita logicamente un collegamento SSO conservando audit e possibilita di successiva riattivazione. */
+    disableIdentity(identityKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertEnabled();
+            this.assertIdentityKey(identityKey);
+            yield Orm_1.Orm.execute(this.options.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET FLGATTIVO = 0, DATDISATT = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [identityKey]);
+        });
+    }
+    /** Restituisce il CODUTE proprietario di un collegamento SSO, o null se assente. */
+    getIdentityOwner(identityKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertIdentityKey(identityKey);
+            const rows = (yield Orm_1.Orm.query(this.options.databaseOptions, 'SELECT CODUTE AS codice_utente FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ?', [identityKey]));
+            const row = rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
+            const owner = Number(row === null || row === void 0 ? void 0 : row.codiceUtente);
+            return Number.isSafeInteger(owner) && owner > 0 ? owner : null;
+        });
+    }
+    /** Permanently removes one identity link from its owning user after administrative confirmation. */
+    /**
+     * Elimina fisicamente un collegamento SSO soltanto dopo aver verificato che appartenga all'utente indicato.
+     * Non elimina mai l'utente Accessi, password, ruoli o grant associati.
+     */
+    deleteIdentity(codiceUtente, identityKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertEnabled();
+            this.assertIdentityKey(identityKey);
+            const identity = (yield this.getUserIdentities(codiceUtente)).find((item) => item.identityKey === identityKey);
+            if (!identity) {
+                throw new common_1.NotFoundException({ code: 'FEDERATED_IDENTITY_NOT_FOUND', message: 'Collegamento SSO non trovato per questo utente.' });
+            }
+            yield Orm_1.Orm.execute(this.options.databaseOptions, 'DELETE FROM UTENTI_IDENTITA_EXT WHERE IDNKEY = ? AND CODUTE = ?', [identityKey, codiceUtente]);
+        });
+    }
+    /** Aggiorna lo stato o la nota di un collegamento SSO usando la sua chiave tecnica amministrativa. */
+    /** Aggiorna stato o nota amministrativa senza modificare provider e subject, che identificano la persona. */
+    updateIdentity(identityKey, update) {
+        return __awaiter(this, void 0, void 0, function* () {
+            this.assertEnabled();
+            this.assertIdentityKey(identityKey);
+            const changes = [];
+            const params = [];
+            if (update.active !== undefined) {
+                changes.push('FLGATTIVO = ?');
+                params.push(update.active ? 1 : 0);
+                if (update.active)
+                    changes.push('DATDISATT = NULL');
+                else
+                    changes.push('DATDISATT = CURRENT_TIMESTAMP');
+            }
+            if (update.note !== undefined) {
+                changes.push('NOTA = ?');
+                params.push(update.note);
+            }
+            if (changes.length === 0)
+                return;
+            params.push(identityKey);
+            yield Orm_1.Orm.execute(this.options.databaseOptions, `UPDATE UTENTI_IDENTITA_EXT SET ${changes.join(', ')} WHERE IDNKEY = ?`, params);
+        });
+    }
+    /** Explicit administrative schema reconciliation, shared with the standard updater. */
+    ensureSchema() {
+        return __awaiter(this, void 0, void 0, function* () {
+            if (this.isEnabled())
+                yield AccessiDatabaseUpdater_1.AccessiDatabaseUpdater.run(this.options);
+        });
+    }
+    findIdentity(identity, onlyActive) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const rows = yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT I.IDNKEY AS identity_key, I.CODUTE AS codice_utente, I.PROVIDER, I.SUBJECT,
+              I.FLGATTIVO AS active, I.DATINS AS created_at, I.DATLASTLOGIN AS last_login_at,
+              I.DATDISATT AS disabled_at, I.NOTA,
+              COALESCE(C.FLGPASSWORD, 1) AS password_login_enabled
+       FROM UTENTI_IDENTITA_EXT I
+       LEFT JOIN UTENTI_CONFIG C ON C.CODUTE = I.CODUTE
+       WHERE I.IDNKEY = ? AND I.PROVIDER = ? AND I.SUBJECT = ?${onlyActive ? ' AND I.FLGATTIVO = 1' : ''}`, [this.getIdentityKey(identity), identity.provider, identity.subject]);
+            const row = rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
+            return row ? this.toIdentity(row) : null;
+        });
+    }
+    assertUserExists(codiceUtente) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const user = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
+            if (!user)
+                throw new common_1.NotFoundException('Utente Accessi non trovato.');
+        });
+    }
+    assertEnabled() {
+        if (!this.isEnabled()) {
+            throw new common_1.ForbiddenException({ code: 'FEDERATED_AUTH_DISABLED', message: 'Autenticazione federata non abilitata in AccessiOptions.' });
+        }
+    }
+    /** Validates the opaque SHA-256 key used only by administrative identity endpoints. */
+    assertIdentityKey(identityKey) {
+        if (!/^[a-f0-9]{64}$/i.test(identityKey)) {
+            throw new common_1.BadRequestException({ code: 'FEDERATED_IDENTITY_KEY_INVALID', message: 'Chiave del collegamento SSO non valida.' });
+        }
+    }
+    normalizeIdentity(identity) {
+        const provider = this.normalizeProvider(identity === null || identity === void 0 ? void 0 : identity.provider);
+        const subject = typeof (identity === null || identity === void 0 ? void 0 : identity.subject) === 'string' ? identity.subject.trim() : '';
+        if (!subject || Buffer.byteLength(subject, 'utf8') > 512) {
+            throw new common_1.BadRequestException({ code: 'FEDERATED_SUBJECT_INVALID', message: 'Subject non valido: è obbligatorio e può occupare al massimo 512 byte UTF-8.' });
+        }
+        return { provider, subject };
+    }
+    normalizeProvider(value) {
+        const provider = typeof value === 'string' ? value.trim().toLowerCase() : '';
+        if (!/^[a-z0-9][a-z0-9._-]{0,63}$/.test(provider)) {
+            throw new common_1.BadRequestException({ code: 'FEDERATED_PROVIDER_INVALID', message: 'Provider non valido: usare un namespace ASCII stabile di massimo 64 caratteri.' });
+        }
+        return provider;
+    }
+    normalizeDescription(value) {
+        const description = typeof value === 'string' ? value.trim() : '';
+        if (!description || description.length > 160) {
+            throw new common_1.BadRequestException({ code: 'FEDERATED_PROVIDER_DESCRIPTION_INVALID', message: 'La descrizione del provider deve contenere da 1 a 160 caratteri.' });
+        }
+        return description;
+    }
+    assertProviderActive(provider) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const registered = yield this.findProvider(provider);
+            if (!registered) {
+                throw new common_1.NotFoundException({ code: 'FEDERATED_PROVIDER_NOT_FOUND', message: 'Provider SSO non registrato.' });
+            }
+            if (!registered.active) {
+                throw new common_1.ForbiddenException({ code: 'FEDERATED_PROVIDER_DISABLED', message: 'Provider SSO disabilitato.' });
+            }
+            return registered;
+        });
+    }
+    findProvider(provider) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const rows = yield Orm_1.Orm.query(this.options.databaseOptions, `SELECT PROVIDER AS provider, DESCRIZIONE AS description, FLGATTIVO AS active,
+              DATINS AS created_at, NOTA AS note
+       FROM SSO_PROVIDER
+       WHERE PROVIDER = ?`, [provider]);
+            const row = rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
+            return row ? this.toProvider(row) : null;
+        });
+    }
+    getIdentityKey(identity) {
+        const provider = Buffer.from(identity.provider, 'utf8');
+        const subject = Buffer.from(identity.subject, 'utf8');
+        const payload = Buffer.concat([Buffer.from('accessi:federated:v1:'), Buffer.from(`${provider.length}:`), provider, Buffer.from(`${subject.length}:`), subject]);
+        return (0, crypto_1.createHash)('sha256').update(payload).digest('hex');
+    }
+    toIdentity(row) {
+        return {
+            identityKey: String(row.identityKey),
+            codiceUtente: Number(row.codiceUtente),
+            provider: String(row.provider).trim(),
+            subject: String(row.subject),
+            active: row.active === true || row.active === 1 || row.active === '1',
+            passwordLoginEnabled: !(row.passwordLoginEnabled === false || row.passwordLoginEnabled === 0 || row.passwordLoginEnabled === '0'),
+            createdAt: row.createdAt,
+            lastLoginAt: row.lastLoginAt,
+            disabledAt: row.disabledAt,
+            note: row.note,
+        };
+    }
+    toProvider(row) {
+        var _a;
+        return {
+            provider: String(row.provider).trim(),
+            description: String((_a = row.description) !== null && _a !== void 0 ? _a : '').trim(),
+            active: row.active === true || row.active === 1 || row.active === '1',
+            createdAt: row.createdAt,
+            note: row.note,
+        };
+    }
+};
+exports.FederatedAuthService = FederatedAuthService;
+exports.FederatedAuthService = FederatedAuthService = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
+    __metadata("design:paramtypes", [Object, UserService_1.UserService,
+        AuthService_1.AuthService])
+], FederatedAuthService);
+//# sourceMappingURL=FederatedAuthService.js.map