npm - emilsoftware-utilities - Versions diffs - 2.0.0-dev.56 → 2.0.0-dev.58 - Mend

emilsoftware-utilities 2.0.0-dev.56 → 2.0.0-dev.58

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (47) hide show

package/dist/accessi-module/Controllers/UserController.js CHANGED Viewed

@@ -30,6 +30,7 @@ const Logger_1 = require("../../Logger");
 const Utilities_1 = require("../../Utilities");
 const BaseResponse_1 = require("../Dtos/BaseResponse");
 const GetUsersResponse_1 = require("../Dtos/GetUsersResponse");
+const LoginAsDtos_1 = require("../Dtos/LoginAsDtos");
 const PublicRegisterRequest_1 = require("../Dtos/PublicRegisterRequest");
 const RegisterResponse_1 = require("../Dtos/RegisterResponse");
 const RegisterRequest_1 = require("../Dtos/RegisterRequest");
@@ -43,6 +44,7 @@ const jwt_strategy_1 = require("../jwt/jwt.strategy");
 const publicAuthRateLimit_1 = require("../security/publicAuthRateLimit");
 const accessControl_1 = require("../security/accessControl");
 const emailConfiguration_1 = require("../security/emailConfiguration");
+const loginAs_1 = require("../security/loginAs");
 const StatoRegistrazione_1 = require("../Dtos/StatoRegistrazione");
 let UserController = UserController_1 = class UserController {
     constructor(accessiOptions, userService, emailService, authService) {
@@ -159,6 +161,30 @@ let UserController = UserController_1 = class UserController {
             }
         });
     }
+    createLoginAsUrl(request, codiceUtente, body, res) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                const authenticatedUser = (0, accessControl_1.getAuthenticatedAccessiUser)(request);
+                (0, accessControl_1.ensureUserManagement)(authenticatedUser, 'Solo superutenti e admin possono generare un accesso temporaneo.');
+                // Stessa gerarchia della gestione utenti: un superutente non impersona un admin.
+                yield this.ensureManageableTarget(authenticatedUser, codiceUtente);
+                const loginResult = yield this.authService.getLoginResultForUser(codiceUtente);
+                const issued = this.authService.createLoginAsToken(loginResult.utente, authenticatedUser);
+                const loginUrl = (0, loginAs_1.buildLoginAsUrl)(body === null || body === void 0 ? void 0 : body.url, issued.value);
+                const expiresAt = new Date(Date.now() + loginAs_1.LOGIN_AS_TOKEN_TTL_SECONDS * 1000).toISOString();
+                this.logger.info(`Login as generato: attore=${authenticatedUser.codiceUtente}, target=${codiceUtente}, host=${new URL(loginUrl).host}`);
+                return Utilities_1.RestUtilities.sendBaseResponse(res, {
+                    loginUrl,
+                    token: issued.value,
+                    expiresInSeconds: loginAs_1.LOGIN_AS_TOKEN_TTL_SECONDS,
+                    expiresAt,
+                });
+            }
+            catch (error) {
+                return this.sendControllerError(res, error);
+            }
+        });
+    }
     setUserPassword(request, codiceUtente, body, res) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
@@ -494,6 +520,29 @@ __decorate([
     __metadata("design:paramtypes", [Object, Object]),
     __metadata("design:returntype", Promise)
 ], UserController.prototype, "forcePasswordResetLegacy", null);
+__decorate([
+    (0, swagger_1.ApiOperation)({
+        summary: 'Genera un URL di accesso temporaneo come un altro utente',
+        operationId: 'createLoginAsUrl',
+        description: 'Riservato a superutenti e admin (con la gerarchia ADMIN > SUPER). Genera un token per l utente target, valido 5 minuti, e lo allega all URL indicato come query parameter loginAsToken. Il token e una credenziale: non condividerlo e non registrarlo. Da quel momento l applicazione di destinazione decide come consumarlo.',
+    }),
+    (0, swagger_1.ApiParam)({ name: 'codiceUtente', description: 'Utente da impersonare', required: true, example: 123, type: Number }),
+    (0, swagger_1.ApiBody)({ type: LoginAsDtos_1.LoginAsRequest }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'URL di accesso temporaneo generato', type: LoginAsDtos_1.LoginAsResponse }),
+    (0, swagger_1.ApiResponse)({ status: 400, description: 'URL non valido', type: BaseResponse_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 403, description: 'Operazione non autorizzata', type: BaseResponse_1.ErrorResponse }),
+    (0, swagger_1.ApiResponse)({ status: 404, description: 'Utente non trovato', type: BaseResponse_1.ErrorResponse }),
+    (0, swagger_1.ApiBearerAuth)(),
+    (0, common_1.UseGuards)(jwt_strategy_1.JwtSimpleGuard),
+    (0, common_1.Post)('login-as/:codiceUtente'),
+    __param(0, (0, common_1.Req)()),
+    __param(1, (0, common_1.Param)('codiceUtente', common_1.ParseIntPipe)),
+    __param(2, (0, common_1.Body)()),
+    __param(3, (0, common_1.Res)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object, Number, LoginAsDtos_1.LoginAsRequest, Object]),
+    __metadata("design:returntype", Promise)
+], UserController.prototype, "createLoginAsUrl", null);
 __decorate([
     (0, swagger_1.ApiOperation)({
         summary: 'Imposta direttamente la password di un utente',

package/dist/accessi-module/Controllers/UserController.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAoBwB;AAExB,6CASyB;AACzB,+BAA4B;AAC5B,yCAAsC;AACtC,+CAAgD;AAEhD,uDAAqE;AACrE,+DAA4D;AAC5D,yEAAsE;AACtE,+DAA4D;AAC5D,6DAA0D;AAC1D,yEAAyE;AACzE,2EAAwE;AACxE,6CAA0C;AAC1C,qEAAkE;AAClE,wEAAqE;AACrE,qEAAkE;AAClE,sDAAqD;AACrD,yEAGyC;AACzC,6DAQmC;AAEnC,uEAAuE;AACvE,mEAAgE;AAQzD,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YAC6B,cAA+C,EACzD,WAAwB,EACxB,YAA0B,EAC1B,WAAwB;QAHG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAa;QAN1B,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAOvD,CAAC;IAEI,mBAAmB,CAAC,GAAa,EAAE,KAAc;QACvD,gFAAgF;QAChF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACW,sBAAsB,CAClC,KAA+B,EAC/B,YAAoB;;YAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAAiB,CAAC,4BAA4B,YAAY,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,IAAA,yCAAyB,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAYK,sBAAsB,CAAQ,GAAa,EAAkB,MAAc;;YAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAqDK,QAAQ,CACL,OAAgB,EAChB,GAAa,EACJ,KAAc,EAC+B,YAAqB,EAElF,sBAAgC,EAEhC,aAAuB,EAC+B,KAAc,EACb,MAAe;;YAEtE,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,wDAAwD,CACzD,CAAC;gBAEF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG;oBACd,sBAAsB,EAAE,sBAAsB,aAAtB,sBAAsB,cAAtB,sBAAsB,GAAI,IAAI;oBACtD,aAAa,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,IAAI;iBACrC,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAuBK,UAAU,CACP,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAqBK,qBAAqB,CAClB,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,2BAAW,EACT,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;gBAEF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,4BAAmB,CAAC,0DAA0D,CAAC,CAAC;gBAC5F,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAcK,kBAAkB,CACf,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,qCAAqC,YAAY,GAAG,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAYK,wBAAwB,CAAQ,OAAgB,EAAS,GAAa;;YAC1E,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oCAAoC,EAAE,CAAC;gBAC3E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,IAAI,8BAA8B,CAAC,CAAC;YAC1G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAeK,eAAe,CACZ,OAAgB,EACc,YAAoB,EACjD,IAA4B,EAC7B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,qEAAqE,CACtE,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACnE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,wBAAwB,YAAY,cAAc,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAyBK,qBAAqB,CAClB,OAAgB,EACf,IAA8B,EAC/B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;gBAEF,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;gBAClD,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;gBACvF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,kBAAkB,KAAK,uCAAkB,CAAC,MAAM;uBAC7D,kBAAkB,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBACrD,IAAI,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,wBAAwB,YAAY,0BAA0B,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,QAAQ,CACL,OAAgB,EACf,gBAAuC,EACxC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,kBAAkB,0CAAE,OAAO,MAAK,IAAI,EAAE,CAAC;oBAC7D,MAAM,IAAI,sBAAa,CACrB,mFAAmF,EACnF,mBAAU,CAAC,SAAS,CACrB,CAAC;gBACJ,CAAC;gBAED,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,cAAc,EACnB,UAAU,EACV,OAAO,EACP,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,KAAK,CAAC,CAC1B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,KAAK;iBAC7B,CAAC,CAAC;gBAEH,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACrK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,2DAA2D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,uBAAuB;qBACjK,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GACV,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAAC;gBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;IAQK,iBAAiB,CAAQ,OAAgB,EAAU,gBAAiC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;gBAC1F,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;gBAEhE,wEAAwE;gBACxE,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACpG,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,qFAAqF;oBACrF,iEAAiE;oBACjE,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACjK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,0DAA0D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,oEAAoE;qBAC7M,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,YAAY,CACT,OAAgB,EACc,YAAoB,EACjD,IAAa,EACd,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,kBAAkB,GAAG,IAAA,wCAAwB,EAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,KAAK,YAAY,CAAC;gBAE/D,mFAAmF;gBACnF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,IAAI,kBAAkB,EAAE,CAAC;oBACvB,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,iFAAiF,CAClF,CAAC;oBACF,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;oBACpD,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;wBAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,sCAAsC,CACvC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBAC1E,MAAM,IAAI,4BAAmB,CAAC,6DAA6D,CAAC,CAAC;gBAC/F,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE;oBACpD,sBAAsB,EAAE,iBAAiB,CAAC,SAAS,IAAI,iBAAiB,CAAC,SAAS;iBACnF,CAAC,CAAC;gBAEH,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,YAAY,YAAY,oCAAoC,CAC7D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAsBK,OAAO,CACJ,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,6CAA6C,CAC9C,CAAC;gBACF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,YAAY,wBAAwB,CAAC,CAAC;YAC5F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAtlBY,wCAAc;AA0CnB;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,4BAA4B;KAC1C,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,YAAG,EAAC,uBAAuB,CAAC;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;4DAEjE;AAqDK;IAnDL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8BAA8B;QAC3C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+DAA+D;QAC5E,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4CAA4C;QACzD,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,WAAW,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3D,WAAA,IAAA,cAAK,EAAC,wBAAwB,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEtE,WAAA,IAAA,cAAK,EAAC,eAAe,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE7D,WAAA,IAAA,cAAK,EAAC,OAAO,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;;;;8CAsBvD;AAuBK;IArBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,qEAAqE;KACnF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,2BAA2B,CAAC;IAEjC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gDAmBP;AAqBK;IAnBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,2FAA2F;KACzG,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gEAAgE;QAC7E,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,qCAAqC,CAAC;IAE3C,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAuBP;AAcK;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,yHAAyH;KACvI,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,oCAAoC,CAAC;IAExC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAcP;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kEAAkE;QAC3E,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,+JAA+J;KAC7K,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,6BAA6B,CAAC;IACJ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAW7D;AAeK;IAbL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,6GAA6G;KAC3H,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,+CAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACtF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACrF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAEhC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,+CAAsB;;qDAgBrC;AAyBK;IAvBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EAAE,uBAAuB;KACrC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,gDAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,WAAW,CAAC;IAEf,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,gDAAwB;;2DA+BvC;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,8IAA8I;QAC3J,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,6CAAqB;QAC3B,WAAW,EAAE,iDAAiD;KAC/D,CAAC;IACD,IAAA,4BAAkB,EAAC;QAClB,WAAW,EACT,kGAAkG;QACpG,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,WAAW;QAC9B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,qBAAqB;QACxC,WAAW,EAAE,sEAAsE;QACnF,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,UAAU,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADoB,6CAAqB;;8CA8ChD;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;IAC5N,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAAe,EAAE,CAAC;IAClC,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,mCAAgB,EAAE,CAAC;IAC9C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,qBAAqB,CAAC;IACH,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAqC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAvB,iCAAe;;uDA6BzF;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,cAAc;KAC5B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,iBAAO;QACb,WAAW,EAAE,6BAA6B;KAC3C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,EAAE;QACrB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAE9B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,iBAAO;;kDA6CtB;AAsBK;IApBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,SAAS;KACvB,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,cAAK,EAAC,wBAAwB,CAAC;IAE7B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6CAkBP;yBArlBU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAKE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACV,2BAAY;QACb,yBAAW;GAPhC,cAAc,CAslB1B","sourcesContent":["import {\n BadRequestException,\n Body,\n Controller,\n Delete,\n Get,\n HttpException,\n HttpStatus,\n NotFoundException,\n Param,\n ParseBoolPipe,\n ParseIntPipe,\n Patch,\n Post,\n Put,\n Query,\n Inject,\n Req,\n Res,\n UseGuards,\n} from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport {\n ApiBearerAuth,\n ApiBody,\n ApiCreatedResponse,\n ApiOperation,\n ApiParam,\n ApiQuery,\n ApiResponse,\n ApiTags,\n} from '@nestjs/swagger';\nimport { join } from 'path';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { GetUsersResponse } from '../Dtos/GetUsersResponse';\nimport { PublicRegisterRequest } from '../Dtos/PublicRegisterRequest';\nimport { RegisterResponse } from '../Dtos/RegisterResponse';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { SetStatoRegistrazioneDto } from '../Dtos/SetStatoRegistrazione';\nimport { SetUserPasswordRequest } from '../Dtos/SetUserPasswordRequest';\nimport { UserDto } from '../Dtos/UserDto';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport {\n checkPublicAuthRateLimit,\n sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\nimport {\n ensureAdmin,\n ensureCanManageTargetUser,\n ensurePrivilegeFlagChanges,\n ensureSelfOrSuperUser,\n ensureUserManagement,\n getAuthenticatedAccessiUser,\n hasPrivilegedUserChanges,\n} from '../security/accessControl';\nimport type { AuthenticatedAccessiUser } from '../security/accessControl';\nimport { assertEmailConfigured } from '../security/emailConfiguration';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\n\n@ApiTags('User')\n@Controller('accessi/user')\n/*\n Gestione utenti: la registrazione pubblica e opt-in, mentre creazione, stato e profili privilegiati\n * richiedono un superutente Accessi. Le API restituiscono sempre il wrapper `BaseResponse` storico.\n /\nexport class UserController {\n private readonly logger = new Logger(UserController.name);\n\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n private readonly userService: UserService,\n private readonly emailService: EmailService,\n private readonly authService: AuthService,\n ) {}\n\n private sendControllerError(res: Response, error: unknown) {\n // Lo status viene derivato centralmente da RestUtilities (HttpException o 500).\n return RestUtilities.sendErrorMessage(res, error, UserController.name);\n }\n\n /\n Verifica che il target esista e che l'attore possa gestirlo (rango attore >=\n * rango target: ADMIN > SUPER > utente). Restituisce lo snapshot corrente del\n * target, così i chiamanti possono controllare se e' admin.\n */\n private async ensureManageableTarget(\n actor: AuthenticatedAccessiUser,\n codiceUtente: number,\n ) {\n const target = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!target) {\n throw new NotFoundException(`Nessun utente con codice ${codiceUtente}.`);\n }\n ensureCanManageTargetUser(actor, target);\n return target;\n }\n\n @ApiOperation({\n summary: 'Serve la pagina di reset password',\n operationId: 'serveResetPasswordPageUser',\n })\n @ApiParam({\n name: 'token',\n description: 'Token per il reset della password',\n required: true,\n })\n @Get('reset-password/:token')\n async serveResetPasswordPage(@Res() res: Response, @Param('token') _token: string) {\n return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n }\n\n @ApiOperation({\n summary: 'Recupera la lista degli utenti',\n operationId: 'getUsers',\n })\n @ApiResponse({\n status: 200,\n description: 'Lista utenti recuperata con successo',\n type: GetUsersResponse,\n })\n @ApiResponse({ status: 401, description: 'Credenziali non valide', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiQuery({\n name: 'email',\n required: false,\n description: \"Email dell'utente da cercare\",\n type: String,\n })\n @ApiQuery({\n name: 'codiceUtente',\n required: false,\n description: \"Codice dell'utente da cercare\",\n type: Number,\n })\n @ApiQuery({\n name: 'includeExtensionFields',\n required: false,\n description: 'Includi extension fields',\n type: Boolean,\n })\n @ApiQuery({\n name: 'includeGrants',\n required: false,\n description: 'Includi permessi',\n type: Boolean,\n })\n @ApiQuery({\n name: 'limit',\n required: false,\n description: 'Numero massimo di utenti restituiti (1-1000). Omesso = tutti.',\n type: Number,\n })\n @ApiQuery({\n name: 'offset',\n required: false,\n description: 'Numero di utenti da saltare (paginazione).',\n type: Number,\n })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Get('get-users')\n async getUsers(\n @Req() request: Request,\n @Res() res: Response,\n @Query('email') email?: string,\n @Query('codiceUtente', new ParseIntPipe({ optional: true })) codiceUtente?: number,\n @Query('includeExtensionFields', new ParseBoolPipe({ optional: true }))\n includeExtensionFields?: boolean,\n @Query('includeGrants', new ParseBoolPipe({ optional: true }))\n includeGrants?: boolean,\n @Query('limit', new ParseIntPipe({ optional: true })) limit?: number,\n @Query('offset', new ParseIntPipe({ optional: true })) offset?: number,\n ) {\n try {\n ensureUserManagement(\n getAuthenticatedAccessiUser(request),\n 'Solo gli amministratori possono consultare gli utenti.',\n );\n\n const filters = { email, codiceUtente, limit, offset };\n const options = {\n includeExtensionFields: includeExtensionFields ?? true,\n includeGrants: includeGrants ?? true,\n };\n\n const users = await this.userService.getUsers(filters, options);\n const total = await this.userService.countUsers({ email, codiceUtente });\n res.setHeader('X-Total-Count', String(total));\n return RestUtilities.sendBaseResponse(res, users);\n } catch (error) {\n this.logger.error('Errore durante il recupero degli utenti: ', error);\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Elimina un utente',\n operationId: 'deleteUser',\n description: 'Imposta lo stato di un utente a eliminato senza rimuovere i record.',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da eliminare\",\n required: true,\n example: 123,\n })\n @ApiResponse({ status: 200, description: 'Utente eliminato con successo', type: ActionResponse })\n @ApiResponse({\n status: 400,\n description: 'Errore nei parametri della richiesta',\n type: ErrorResponse,\n })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Delete('delete-user/:codiceUtente')\n async deleteUser(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono eliminare utenti.',\n );\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n if (target.flagAdmin) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.deleteUser(codiceUtente);\n return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato con successo.\");\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Elimina definitivamente un utente',\n operationId: 'deleteUserPermanently',\n description: 'Rimuove l utente e tutti i record collegati. Operazione distruttiva riservata agli admin.',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da eliminare definitivamente\",\n required: true,\n example: 123,\n })\n @ApiResponse({ status: 200, description: 'Utente eliminato definitivamente', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Errore nei parametri della richiesta', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Delete('delete-user-permanent/:codiceUtente')\n async deleteUserPermanently(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureAdmin(\n authenticatedUser,\n 'Solo gli admin possono eliminare definitivamente un utente.',\n );\n\n if (authenticatedUser.codiceUtente === codiceUtente) {\n throw new BadRequestException('Non puoi eliminare definitivamente il tuo stesso utente.');\n }\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n if (target.flagAdmin) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.deleteUserPermanently(codiceUtente);\n return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato definitivamente.\");\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Forza l invio dell email di reset password a un utente',\n operationId: 'forcePasswordReset',\n description: 'Riservato al superutente. Richiede un servizio email configurato; altrimenti risponde con ACCESSI_EMAIL_NOT_CONFIGURED.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n @ApiResponse({ status: 200, description: 'Email di reset inviata', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('force-password-reset/:codiceUtente')\n async forcePasswordReset(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono forzare il reset password.',\n );\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n await this.userService.forcePasswordReset(codiceUtente);\n return RestUtilities.sendOKMessage(res, `Email di reset inviata all utente ${codiceUtente}.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Forza il reset password per tutti gli utenti con password legacy',\n operationId: 'forcePasswordResetLegacy',\n description: 'Riservato al superutente. Invia l email di reset a tutti gli utenti la cui password non e ancora nel formato moderno. Richiede un servizio email configurato.',\n })\n @ApiResponse({ status: 200, description: 'Email di reset inviate', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('force-password-reset-legacy')\n async forcePasswordResetLegacy(@Req() request: Request, @Res() res: Response) {\n try {\n ensureUserManagement(\n getAuthenticatedAccessiUser(request),\n 'Solo gli amministratori possono forzare il reset password.',\n );\n const sent = await this.userService.forcePasswordResetForLegacyPasswords();\n return RestUtilities.sendOKMessage(res, `Email di reset inviata a ${sent} utenti con password legacy.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta direttamente la password di un utente',\n operationId: 'setUserPassword',\n description: 'Riservato agli amministratori. Hasha la password, aggiorna la scadenza secondo la policy e non invia email.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n @ApiBody({ type: SetUserPasswordRequest })\n @ApiResponse({ status: 200, description: 'Password aggiornata', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Password non valida', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('set-password/:codiceUtente')\n async setUserPassword(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() body: SetUserPasswordRequest,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono impostare la password di un utente.',\n );\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n await this.authService.setPassword(codiceUtente, body.newPassword);\n return RestUtilities.sendOKMessage(res, `Password dell utente ${codiceUtente} aggiornata.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta lo stato di registrazione di un utente',\n operationId: 'setStatoRegistrazione',\n })\n @ApiResponse({\n status: 200,\n description: 'Stato registrazione aggiornato con successo',\n type: ActionResponse,\n })\n @ApiResponse({\n status: 400,\n description: 'Errore nei parametri della richiesta',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: 500,\n description: 'Errore interno del server',\n type: ErrorResponse,\n })\n @ApiBody({ type: SetStatoRegistrazioneDto })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('set-stato')\n async setStatoRegistrazione(\n @Req() request: Request,\n @Body() body: SetStatoRegistrazioneDto,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono modificare lo stato di registrazione.',\n );\n\n const { codiceUtente, statoRegistrazione } = body;\n if (!codiceUtente) throw new BadRequestException('Il codice utente e\\' obbligatorio.');\n if (statoRegistrazione === undefined) {\n throw new BadRequestException('Lo stato registrazione e\\' obbligatorio.');\n }\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n const disabling = statoRegistrazione === StatoRegistrazione.DELETE\n \|\| statoRegistrazione === StatoRegistrazione.BLOCC;\n if (target.flagAdmin && disabling) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.setStato(codiceUtente, statoRegistrazione);\n return RestUtilities.sendOKMessage(\n res,\n `Lo stato dell'utente ${codiceUtente} e' stato aggiornato a ${statoRegistrazione}.`,\n );\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Registra un nuovo utente',\n description: 'Disponibile soltanto quando publicRegistration.enabled e true. Per utenti SSO usare il provisioning master nel tag Federated authentication.',\n operationId: 'register',\n })\n @ApiBody({\n type: PublicRegisterRequest,\n description: \"Dati necessari per la registrazione dell'utente\",\n })\n @ApiCreatedResponse({\n description:\n 'Utente registrato con successo. Restituisce il codice utente e invia una mail di reset password.',\n type: RegisterResponse,\n })\n @ApiResponse({\n status: HttpStatus.BAD_REQUEST,\n description: 'Errore nella registrazione.',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: HttpStatus.INTERNAL_SERVER_ERROR,\n description: 'Errore interno del server durante la registrazione o l\\'invio email.',\n type: ErrorResponse,\n })\n @Post('register')\n async register(\n @Req() request: Request,\n @Body() registrationData: PublicRegisterRequest,\n @Res() res: Response,\n ) {\n try {\n if (this.accessiOptions.publicRegistration?.enabled !== true) {\n throw new HttpException(\n 'La registrazione pubblica e disabilitata. Un amministratore deve creare l utente.',\n HttpStatus.FORBIDDEN,\n );\n }\n\n const rateLimitDecision = checkPublicAuthRateLimit(\n this.accessiOptions,\n 'register',\n request,\n [registrationData?.email],\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n assertEmailConfigured(this.accessiOptions);\n\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: false,\n });\n\n try {\n await this.emailService.sendPasswordResetEmail(registrationData.email);\n } catch (emailError) {\n try {\n await this.userService.deleteUserPermanently(codiceUtente);\n } catch (rollbackError) {\n this.logger.error(`Rollback registrazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n }\n throw new BadRequestException({\n code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n message: `Registrazione non completata: invio email non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova piu tardi.`,\n });\n }\n return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n } catch (error) {\n const status =\n error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST;\n return RestUtilities.sendErrorMessage(res, error, UserController.name, status);\n }\n }\n\n @ApiOperation({ summary: 'Crea un utente locale da amministrazione', operationId: 'createManagedUser', description: 'Riservato a superutente. Crea un utente in attesa di impostazione password e invia la mail di reset.' })\n @ApiBody({ type: RegisterRequest })\n @ApiCreatedResponse({ type: RegisterResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('create-managed-user')\n async createManagedUser(@Req() request: Request, @Body() registrationData: RegisterRequest, @Res() res: Response) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono creare utenti.');\n ensurePrivilegeFlagChanges(authenticatedUser, registrationData);\n\n // Fail-fast prima di scrivere: senza SMTP non si crea un utente orfano.\n assertEmailConfigured(this.accessiOptions);\n\n const codiceUtente = await this.userService.register(registrationData, { allowPrivilegedFields: true });\n try {\n await this.emailService.sendPasswordResetEmail(registrationData.email, registrationData.htmlMail);\n } catch (emailError) {\n // L'invio e' esterno: se fallisce annulliamo la creazione per non lasciare un utente\n // senza password e senza email di invito (rollback best-effort).\n try {\n await this.userService.deleteUserPermanently(codiceUtente);\n } catch (rollbackError) {\n this.logger.error(`Rollback creazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n }\n throw new BadRequestException({\n code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n message: `Utente non creato: invio email di invito non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova oppure crea l utente e imposta la password manualmente.`,\n });\n }\n return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Aggiorna un utente esistente',\n operationId: 'updateUtente',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da aggiornare\",\n required: true,\n example: 123,\n })\n @ApiBody({\n type: UserDto,\n description: \"Dati aggiornati dell'utente\",\n })\n @ApiResponse({\n status: HttpStatus.OK,\n description: 'Utente aggiornato con successo',\n type: ActionResponse,\n })\n @ApiResponse({ status: 400, description: \"Errore nell'aggiornamento\", type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Put('update-user/:codiceUtente')\n async updateUtente(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() user: UserDto,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n const isPrivilegedUpdate = hasPrivilegedUserChanges(user);\n const isSelf = authenticatedUser.codiceUtente === codiceUtente;\n\n // ADMIN > SUPER: un superutente non puo' toccare un admin. Self sempre consentito.\n if (!isSelf) {\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n }\n\n if (isPrivilegedUpdate) {\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono modificare ruoli, permessi o flag privilegiati.',\n );\n ensurePrivilegeFlagChanges(authenticatedUser, user);\n if (user.flagAdmin === false) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n } else {\n ensureSelfOrSuperUser(\n authenticatedUser,\n codiceUtente,\n 'Puoi modificare solo il tuo profilo.',\n );\n }\n\n if (user.codiceUtente !== undefined && user.codiceUtente !== codiceUtente) {\n throw new BadRequestException('Il codice utente nel body non coincide con quello del path.');\n }\n\n await this.userService.updateUser(codiceUtente, user, {\n allowPrivilegedChanges: authenticatedUser.flagSuper \|\| authenticatedUser.flagAdmin,\n });\n\n return RestUtilities.sendOKMessage(\n res,\n `L'utente ${codiceUtente} e' stato aggiornato con successo.`,\n );\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta il consenso GDPR per un utente',\n operationId: 'setGdpr',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente che accetta il GDPR\",\n required: true,\n example: 123,\n })\n @ApiResponse({\n status: 200,\n description: 'Consenso GDPR impostato con successo',\n type: ActionResponse,\n })\n @ApiResponse({ status: 400, description: 'Errore nella richiesta', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Patch('set-gdpr/:codiceUtente')\n async setGdpr(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureSelfOrSuperUser(\n authenticatedUser,\n codiceUtente,\n 'Puoi impostare il GDPR solo sul tuo utente.',\n );\n if (authenticatedUser.codiceUtente !== codiceUtente) {\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n }\n\n await this.userService.setGdpr(codiceUtente);\n return RestUtilities.sendOKMessage(res, `L'utente ${codiceUtente} ha accettato il GDPR.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n}\n"]}
1	+ {"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAoBwB;AAExB,6CASyB;AACzB,+BAA4B;AAC5B,yCAAsC;AACtC,+CAAgD;AAEhD,uDAAqE;AACrE,+DAA4D;AAC5D,qDAAsE;AACtE,yEAAsE;AACtE,+DAA4D;AAC5D,6DAA0D;AAC1D,yEAAyE;AACzE,2EAAwE;AACxE,6CAA0C;AAC1C,qEAAkE;AAClE,wEAAqE;AACrE,qEAAkE;AAClE,sDAAqD;AACrD,yEAGyC;AACzC,6DAQmC;AAEnC,uEAAuE;AACvE,iDAAkF;AAClF,mEAAgE;AAQzD,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YAC6B,cAA+C,EACzD,WAAwB,EACxB,YAA0B,EAC1B,WAAwB;QAHG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAa;QAN1B,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAOvD,CAAC;IAEI,mBAAmB,CAAC,GAAa,EAAE,KAAc;QACvD,gFAAgF;QAChF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACW,sBAAsB,CAClC,KAA+B,EAC/B,YAAoB;;YAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAAiB,CAAC,4BAA4B,YAAY,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,IAAA,yCAAyB,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAYK,sBAAsB,CAAQ,GAAa,EAAkB,MAAc;;YAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAqDK,QAAQ,CACL,OAAgB,EAChB,GAAa,EACJ,KAAc,EAC+B,YAAqB,EAElF,sBAAgC,EAEhC,aAAuB,EAC+B,KAAc,EACb,MAAe;;YAEtE,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,wDAAwD,CACzD,CAAC;gBAEF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG;oBACd,sBAAsB,EAAE,sBAAsB,aAAtB,sBAAsB,cAAtB,sBAAsB,GAAI,IAAI;oBACtD,aAAa,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,IAAI;iBACrC,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAuBK,UAAU,CACP,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAqBK,qBAAqB,CAClB,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,2BAAW,EACT,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;gBAEF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,4BAAmB,CAAC,0DAA0D,CAAC,CAAC;gBAC5F,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAcK,kBAAkB,CACf,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,qCAAqC,YAAY,GAAG,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAYK,wBAAwB,CAAQ,OAAgB,EAAS,GAAa;;YAC1E,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oCAAoC,EAAE,CAAC;gBAC3E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,IAAI,8BAA8B,CAAC,CAAC;YAC1G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAiBK,gBAAgB,CACb,OAAgB,EACc,YAAoB,EACjD,IAAoB,EACrB,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;gBACF,iFAAiF;gBACjF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,IAAA,yBAAe,EAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oCAA0B,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAEzF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,iBAAiB,CAAC,YAAY,YAAY,YAAY,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CACtH,CAAC;gBAEF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE;oBACzC,QAAQ;oBACR,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,gBAAgB,EAAE,oCAA0B;oBAC5C,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAeK,eAAe,CACZ,OAAgB,EACc,YAAoB,EACjD,IAA4B,EAC7B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,qEAAqE,CACtE,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACnE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,wBAAwB,YAAY,cAAc,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAyBK,qBAAqB,CAClB,OAAgB,EACf,IAA8B,EAC/B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;gBAEF,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;gBAClD,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;gBACvF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,kBAAkB,KAAK,uCAAkB,CAAC,MAAM;uBAC7D,kBAAkB,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBACrD,IAAI,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,wBAAwB,YAAY,0BAA0B,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,QAAQ,CACL,OAAgB,EACf,gBAAuC,EACxC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,kBAAkB,0CAAE,OAAO,MAAK,IAAI,EAAE,CAAC;oBAC7D,MAAM,IAAI,sBAAa,CACrB,mFAAmF,EACnF,mBAAU,CAAC,SAAS,CACrB,CAAC;gBACJ,CAAC;gBAED,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,cAAc,EACnB,UAAU,EACV,OAAO,EACP,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,KAAK,CAAC,CAC1B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,KAAK;iBAC7B,CAAC,CAAC;gBAEH,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACrK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,2DAA2D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,uBAAuB;qBACjK,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GACV,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAAC;gBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;IAQK,iBAAiB,CAAQ,OAAgB,EAAU,gBAAiC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;gBAC1F,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;gBAEhE,wEAAwE;gBACxE,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACpG,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,qFAAqF;oBACrF,iEAAiE;oBACjE,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACjK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,0DAA0D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,oEAAoE;qBAC7M,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,YAAY,CACT,OAAgB,EACc,YAAoB,EACjD,IAAa,EACd,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,kBAAkB,GAAG,IAAA,wCAAwB,EAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,KAAK,YAAY,CAAC;gBAE/D,mFAAmF;gBACnF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,IAAI,kBAAkB,EAAE,CAAC;oBACvB,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,iFAAiF,CAClF,CAAC;oBACF,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;oBACpD,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;wBAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,sCAAsC,CACvC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBAC1E,MAAM,IAAI,4BAAmB,CAAC,6DAA6D,CAAC,CAAC;gBAC/F,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE;oBACpD,sBAAsB,EAAE,iBAAiB,CAAC,SAAS,IAAI,iBAAiB,CAAC,SAAS;iBACnF,CAAC,CAAC;gBAEH,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,YAAY,YAAY,oCAAoC,CAC7D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAsBK,OAAO,CACJ,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,6CAA6C,CAC9C,CAAC;gBACF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,YAAY,wBAAwB,CAAC,CAAC;YAC5F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAxoBY,wCAAc;AA0CnB;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,4BAA4B;KAC1C,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,YAAG,EAAC,uBAAuB,CAAC;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;4DAEjE;AAqDK;IAnDL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8BAA8B;QAC3C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+DAA+D;QAC5E,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4CAA4C;QACzD,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,WAAW,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3D,WAAA,IAAA,cAAK,EAAC,wBAAwB,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEtE,WAAA,IAAA,cAAK,EAAC,eAAe,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE7D,WAAA,IAAA,cAAK,EAAC,OAAO,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;;;;8CAsBvD;AAuBK;IArBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,qEAAqE;KACnF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,2BAA2B,CAAC;IAEjC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gDAmBP;AAqBK;IAnBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,2FAA2F;KACzG,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gEAAgE;QAC7E,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,qCAAqC,CAAC;IAE3C,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAuBP;AAcK;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,yHAAyH;KACvI,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,oCAAoC,CAAC;IAExC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAcP;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kEAAkE;QAC3E,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,+JAA+J;KAC7K,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,6BAA6B,CAAC;IACJ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAW7D;AAiBK;IAfL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0DAA0D;QACnE,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EACT,gUAAgU;KACnU,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAc,EAAE,CAAC;IACjC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,6BAAe,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,wBAAwB,CAAC;IAE5B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,4BAAc;;sDA8B7B;AAeK;IAbL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,6GAA6G;KAC3H,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,+CAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACtF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACrF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAEhC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,+CAAsB;;qDAgBrC;AAyBK;IAvBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EAAE,uBAAuB;KACrC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,gDAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,WAAW,CAAC;IAEf,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,gDAAwB;;2DA+BvC;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,8IAA8I;QAC3J,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,6CAAqB;QAC3B,WAAW,EAAE,iDAAiD;KAC/D,CAAC;IACD,IAAA,4BAAkB,EAAC;QAClB,WAAW,EACT,kGAAkG;QACpG,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,WAAW;QAC9B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,qBAAqB;QACxC,WAAW,EAAE,sEAAsE;QACnF,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,UAAU,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADoB,6CAAqB;;8CA8ChD;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;IAC5N,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAAe,EAAE,CAAC;IAClC,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,mCAAgB,EAAE,CAAC;IAC9C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,qBAAqB,CAAC;IACH,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAqC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAvB,iCAAe;;uDA6BzF;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,cAAc;KAC5B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,iBAAO;QACb,WAAW,EAAE,6BAA6B;KAC3C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,EAAE;QACrB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAE9B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,iBAAO;;kDA6CtB;AAsBK;IApBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,SAAS;KACvB,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,cAAK,EAAC,wBAAwB,CAAC;IAE7B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6CAkBP;yBAvoBU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAKE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACV,2BAAY;QACb,yBAAW;GAPhC,cAAc,CAwoB1B","sourcesContent":["import {\n BadRequestException,\n Body,\n Controller,\n Delete,\n Get,\n HttpException,\n HttpStatus,\n NotFoundException,\n Param,\n ParseBoolPipe,\n ParseIntPipe,\n Patch,\n Post,\n Put,\n Query,\n Inject,\n Req,\n Res,\n UseGuards,\n} from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport {\n ApiBearerAuth,\n ApiBody,\n ApiCreatedResponse,\n ApiOperation,\n ApiParam,\n ApiQuery,\n ApiResponse,\n ApiTags,\n} from '@nestjs/swagger';\nimport { join } from 'path';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { GetUsersResponse } from '../Dtos/GetUsersResponse';\nimport { LoginAsRequest, LoginAsResponse } from '../Dtos/LoginAsDtos';\nimport { PublicRegisterRequest } from '../Dtos/PublicRegisterRequest';\nimport { RegisterResponse } from '../Dtos/RegisterResponse';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { SetStatoRegistrazioneDto } from '../Dtos/SetStatoRegistrazione';\nimport { SetUserPasswordRequest } from '../Dtos/SetUserPasswordRequest';\nimport { UserDto } from '../Dtos/UserDto';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport {\n checkPublicAuthRateLimit,\n sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\nimport {\n ensureAdmin,\n ensureCanManageTargetUser,\n ensurePrivilegeFlagChanges,\n ensureSelfOrSuperUser,\n ensureUserManagement,\n getAuthenticatedAccessiUser,\n hasPrivilegedUserChanges,\n} from '../security/accessControl';\nimport type { AuthenticatedAccessiUser } from '../security/accessControl';\nimport { assertEmailConfigured } from '../security/emailConfiguration';\nimport { buildLoginAsUrl, LOGIN_AS_TOKEN_TTL_SECONDS } from '../security/loginAs';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\n\n@ApiTags('User')\n@Controller('accessi/user')\n/*\n Gestione utenti: la registrazione pubblica e opt-in, mentre creazione, stato e profili privilegiati\n * richiedono un superutente Accessi. Le API restituiscono sempre il wrapper `BaseResponse` storico.\n /\nexport class UserController {\n private readonly logger = new Logger(UserController.name);\n\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n private readonly userService: UserService,\n private readonly emailService: EmailService,\n private readonly authService: AuthService,\n ) {}\n\n private sendControllerError(res: Response, error: unknown) {\n // Lo status viene derivato centralmente da RestUtilities (HttpException o 500).\n return RestUtilities.sendErrorMessage(res, error, UserController.name);\n }\n\n /\n Verifica che il target esista e che l'attore possa gestirlo (rango attore >=\n * rango target: ADMIN > SUPER > utente). Restituisce lo snapshot corrente del\n * target, così i chiamanti possono controllare se e' admin.\n /\n private async ensureManageableTarget(\n actor: AuthenticatedAccessiUser,\n codiceUtente: number,\n ) {\n const target = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!target) {\n throw new NotFoundException(`Nessun utente con codice ${codiceUtente}.`);\n }\n ensureCanManageTargetUser(actor, target);\n return target;\n }\n\n @ApiOperation({\n summary: 'Serve la pagina di reset password',\n operationId: 'serveResetPasswordPageUser',\n })\n @ApiParam({\n name: 'token',\n description: 'Token per il reset della password',\n required: true,\n })\n @Get('reset-password/:token')\n async serveResetPasswordPage(@Res() res: Response, @Param('token') _token: string) {\n return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n }\n\n @ApiOperation({\n summary: 'Recupera la lista degli utenti',\n operationId: 'getUsers',\n })\n @ApiResponse({\n status: 200,\n description: 'Lista utenti recuperata con successo',\n type: GetUsersResponse,\n })\n @ApiResponse({ status: 401, description: 'Credenziali non valide', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiQuery({\n name: 'email',\n required: false,\n description: \"Email dell'utente da cercare\",\n type: String,\n })\n @ApiQuery({\n name: 'codiceUtente',\n required: false,\n description: \"Codice dell'utente da cercare\",\n type: Number,\n })\n @ApiQuery({\n name: 'includeExtensionFields',\n required: false,\n description: 'Includi extension fields',\n type: Boolean,\n })\n @ApiQuery({\n name: 'includeGrants',\n required: false,\n description: 'Includi permessi',\n type: Boolean,\n })\n @ApiQuery({\n name: 'limit',\n required: false,\n description: 'Numero massimo di utenti restituiti (1-1000). Omesso = tutti.',\n type: Number,\n })\n @ApiQuery({\n name: 'offset',\n required: false,\n description: 'Numero di utenti da saltare (paginazione).',\n type: Number,\n })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Get('get-users')\n async getUsers(\n @Req() request: Request,\n @Res() res: Response,\n @Query('email') email?: string,\n @Query('codiceUtente', new ParseIntPipe({ optional: true })) codiceUtente?: number,\n @Query('includeExtensionFields', new ParseBoolPipe({ optional: true }))\n includeExtensionFields?: boolean,\n @Query('includeGrants', new ParseBoolPipe({ optional: true }))\n includeGrants?: boolean,\n @Query('limit', new ParseIntPipe({ optional: true })) limit?: number,\n @Query('offset', new ParseIntPipe({ optional: true })) offset?: number,\n ) {\n try {\n ensureUserManagement(\n getAuthenticatedAccessiUser(request),\n 'Solo gli amministratori possono consultare gli utenti.',\n );\n\n const filters = { email, codiceUtente, limit, offset };\n const options = {\n includeExtensionFields: includeExtensionFields ?? true,\n includeGrants: includeGrants ?? true,\n };\n\n const users = await this.userService.getUsers(filters, options);\n const total = await this.userService.countUsers({ email, codiceUtente });\n res.setHeader('X-Total-Count', String(total));\n return RestUtilities.sendBaseResponse(res, users);\n } catch (error) {\n this.logger.error('Errore durante il recupero degli utenti: ', error);\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Elimina un utente',\n operationId: 'deleteUser',\n description: 'Imposta lo stato di un utente a eliminato senza rimuovere i record.',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da eliminare\",\n required: true,\n example: 123,\n })\n @ApiResponse({ status: 200, description: 'Utente eliminato con successo', type: ActionResponse })\n @ApiResponse({\n status: 400,\n description: 'Errore nei parametri della richiesta',\n type: ErrorResponse,\n })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Delete('delete-user/:codiceUtente')\n async deleteUser(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono eliminare utenti.',\n );\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n if (target.flagAdmin) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.deleteUser(codiceUtente);\n return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato con successo.\");\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Elimina definitivamente un utente',\n operationId: 'deleteUserPermanently',\n description: 'Rimuove l utente e tutti i record collegati. Operazione distruttiva riservata agli admin.',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da eliminare definitivamente\",\n required: true,\n example: 123,\n })\n @ApiResponse({ status: 200, description: 'Utente eliminato definitivamente', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Errore nei parametri della richiesta', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Delete('delete-user-permanent/:codiceUtente')\n async deleteUserPermanently(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureAdmin(\n authenticatedUser,\n 'Solo gli admin possono eliminare definitivamente un utente.',\n );\n\n if (authenticatedUser.codiceUtente === codiceUtente) {\n throw new BadRequestException('Non puoi eliminare definitivamente il tuo stesso utente.');\n }\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n if (target.flagAdmin) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.deleteUserPermanently(codiceUtente);\n return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato definitivamente.\");\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Forza l invio dell email di reset password a un utente',\n operationId: 'forcePasswordReset',\n description: 'Riservato al superutente. Richiede un servizio email configurato; altrimenti risponde con ACCESSI_EMAIL_NOT_CONFIGURED.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n @ApiResponse({ status: 200, description: 'Email di reset inviata', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('force-password-reset/:codiceUtente')\n async forcePasswordReset(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono forzare il reset password.',\n );\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n await this.userService.forcePasswordReset(codiceUtente);\n return RestUtilities.sendOKMessage(res, `Email di reset inviata all utente ${codiceUtente}.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Forza il reset password per tutti gli utenti con password legacy',\n operationId: 'forcePasswordResetLegacy',\n description: 'Riservato al superutente. Invia l email di reset a tutti gli utenti la cui password non e ancora nel formato moderno. Richiede un servizio email configurato.',\n })\n @ApiResponse({ status: 200, description: 'Email di reset inviate', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('force-password-reset-legacy')\n async forcePasswordResetLegacy(@Req() request: Request, @Res() res: Response) {\n try {\n ensureUserManagement(\n getAuthenticatedAccessiUser(request),\n 'Solo gli amministratori possono forzare il reset password.',\n );\n const sent = await this.userService.forcePasswordResetForLegacyPasswords();\n return RestUtilities.sendOKMessage(res, `Email di reset inviata a ${sent} utenti con password legacy.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Genera un URL di accesso temporaneo come un altro utente',\n operationId: 'createLoginAsUrl',\n description:\n 'Riservato a superutenti e admin (con la gerarchia ADMIN > SUPER). Genera un token per l utente target, valido 5 minuti, e lo allega all URL indicato come query parameter loginAsToken. Il token e una credenziale: non condividerlo e non registrarlo. Da quel momento l applicazione di destinazione decide come consumarlo.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Utente da impersonare', required: true, example: 123, type: Number })\n @ApiBody({ type: LoginAsRequest })\n @ApiResponse({ status: 200, description: 'URL di accesso temporaneo generato', type: LoginAsResponse })\n @ApiResponse({ status: 400, description: 'URL non valido', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('login-as/:codiceUtente')\n async createLoginAsUrl(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() body: LoginAsRequest,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo superutenti e admin possono generare un accesso temporaneo.',\n );\n // Stessa gerarchia della gestione utenti: un superutente non impersona un admin.\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n const loginResult = await this.authService.getLoginResultForUser(codiceUtente);\n const issued = this.authService.createLoginAsToken(loginResult.utente, authenticatedUser);\n const loginUrl = buildLoginAsUrl(body?.url, issued.value);\n const expiresAt = new Date(Date.now() + LOGIN_AS_TOKEN_TTL_SECONDS 1000).toISOString();\n\n this.logger.info(\n `Login as generato: attore=${authenticatedUser.codiceUtente}, target=${codiceUtente}, host=${new URL(loginUrl).host}`,\n );\n\n return RestUtilities.sendBaseResponse(res, {\n loginUrl,\n token: issued.value,\n expiresInSeconds: LOGIN_AS_TOKEN_TTL_SECONDS,\n expiresAt,\n });\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta direttamente la password di un utente',\n operationId: 'setUserPassword',\n description: 'Riservato agli amministratori. Hasha la password, aggiorna la scadenza secondo la policy e non invia email.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n @ApiBody({ type: SetUserPasswordRequest })\n @ApiResponse({ status: 200, description: 'Password aggiornata', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Password non valida', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('set-password/:codiceUtente')\n async setUserPassword(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() body: SetUserPasswordRequest,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono impostare la password di un utente.',\n );\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n await this.authService.setPassword(codiceUtente, body.newPassword);\n return RestUtilities.sendOKMessage(res, `Password dell utente ${codiceUtente} aggiornata.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta lo stato di registrazione di un utente',\n operationId: 'setStatoRegistrazione',\n })\n @ApiResponse({\n status: 200,\n description: 'Stato registrazione aggiornato con successo',\n type: ActionResponse,\n })\n @ApiResponse({\n status: 400,\n description: 'Errore nei parametri della richiesta',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: 500,\n description: 'Errore interno del server',\n type: ErrorResponse,\n })\n @ApiBody({ type: SetStatoRegistrazioneDto })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('set-stato')\n async setStatoRegistrazione(\n @Req() request: Request,\n @Body() body: SetStatoRegistrazioneDto,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono modificare lo stato di registrazione.',\n );\n\n const { codiceUtente, statoRegistrazione } = body;\n if (!codiceUtente) throw new BadRequestException('Il codice utente e\\' obbligatorio.');\n if (statoRegistrazione === undefined) {\n throw new BadRequestException('Lo stato registrazione e\\' obbligatorio.');\n }\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n const disabling = statoRegistrazione === StatoRegistrazione.DELETE\n \|\| statoRegistrazione === StatoRegistrazione.BLOCC;\n if (target.flagAdmin && disabling) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.setStato(codiceUtente, statoRegistrazione);\n return RestUtilities.sendOKMessage(\n res,\n `Lo stato dell'utente ${codiceUtente} e' stato aggiornato a ${statoRegistrazione}.`,\n );\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Registra un nuovo utente',\n description: 'Disponibile soltanto quando publicRegistration.enabled e true. Per utenti SSO usare il provisioning master nel tag Federated authentication.',\n operationId: 'register',\n })\n @ApiBody({\n type: PublicRegisterRequest,\n description: \"Dati necessari per la registrazione dell'utente\",\n })\n @ApiCreatedResponse({\n description:\n 'Utente registrato con successo. Restituisce il codice utente e invia una mail di reset password.',\n type: RegisterResponse,\n })\n @ApiResponse({\n status: HttpStatus.BAD_REQUEST,\n description: 'Errore nella registrazione.',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: HttpStatus.INTERNAL_SERVER_ERROR,\n description: 'Errore interno del server durante la registrazione o l\\'invio email.',\n type: ErrorResponse,\n })\n @Post('register')\n async register(\n @Req() request: Request,\n @Body() registrationData: PublicRegisterRequest,\n @Res() res: Response,\n ) {\n try {\n if (this.accessiOptions.publicRegistration?.enabled !== true) {\n throw new HttpException(\n 'La registrazione pubblica e disabilitata. Un amministratore deve creare l utente.',\n HttpStatus.FORBIDDEN,\n );\n }\n\n const rateLimitDecision = checkPublicAuthRateLimit(\n this.accessiOptions,\n 'register',\n request,\n [registrationData?.email],\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n assertEmailConfigured(this.accessiOptions);\n\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: false,\n });\n\n try {\n await this.emailService.sendPasswordResetEmail(registrationData.email);\n } catch (emailError) {\n try {\n await this.userService.deleteUserPermanently(codiceUtente);\n } catch (rollbackError) {\n this.logger.error(`Rollback registrazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n }\n throw new BadRequestException({\n code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n message: `Registrazione non completata: invio email non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova piu tardi.`,\n });\n }\n return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n } catch (error) {\n const status =\n error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST;\n return RestUtilities.sendErrorMessage(res, error, UserController.name, status);\n }\n }\n\n @ApiOperation({ summary: 'Crea un utente locale da amministrazione', operationId: 'createManagedUser', description: 'Riservato a superutente. Crea un utente in attesa di impostazione password e invia la mail di reset.' })\n @ApiBody({ type: RegisterRequest })\n @ApiCreatedResponse({ type: RegisterResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('create-managed-user')\n async createManagedUser(@Req() request: Request, @Body() registrationData: RegisterRequest, @Res() res: Response) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono creare utenti.');\n ensurePrivilegeFlagChanges(authenticatedUser, registrationData);\n\n // Fail-fast prima di scrivere: senza SMTP non si crea un utente orfano.\n assertEmailConfigured(this.accessiOptions);\n\n const codiceUtente = await this.userService.register(registrationData, { allowPrivilegedFields: true });\n try {\n await this.emailService.sendPasswordResetEmail(registrationData.email, registrationData.htmlMail);\n } catch (emailError) {\n // L'invio e' esterno: se fallisce annulliamo la creazione per non lasciare un utente\n // senza password e senza email di invito (rollback best-effort).\n try {\n await this.userService.deleteUserPermanently(codiceUtente);\n } catch (rollbackError) {\n this.logger.error(`Rollback creazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n }\n throw new BadRequestException({\n code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n message: `Utente non creato: invio email di invito non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova oppure crea l utente e imposta la password manualmente.`,\n });\n }\n return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Aggiorna un utente esistente',\n operationId: 'updateUtente',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da aggiornare\",\n required: true,\n example: 123,\n })\n @ApiBody({\n type: UserDto,\n description: \"Dati aggiornati dell'utente\",\n })\n @ApiResponse({\n status: HttpStatus.OK,\n description: 'Utente aggiornato con successo',\n type: ActionResponse,\n })\n @ApiResponse({ status: 400, description: \"Errore nell'aggiornamento\", type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Put('update-user/:codiceUtente')\n async updateUtente(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() user: UserDto,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n const isPrivilegedUpdate = hasPrivilegedUserChanges(user);\n const isSelf = authenticatedUser.codiceUtente === codiceUtente;\n\n // ADMIN > SUPER: un superutente non puo' toccare un admin. Self sempre consentito.\n if (!isSelf) {\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n }\n\n if (isPrivilegedUpdate) {\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono modificare ruoli, permessi o flag privilegiati.',\n );\n ensurePrivilegeFlagChanges(authenticatedUser, user);\n if (user.flagAdmin === false) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n } else {\n ensureSelfOrSuperUser(\n authenticatedUser,\n codiceUtente,\n 'Puoi modificare solo il tuo profilo.',\n );\n }\n\n if (user.codiceUtente !== undefined && user.codiceUtente !== codiceUtente) {\n throw new BadRequestException('Il codice utente nel body non coincide con quello del path.');\n }\n\n await this.userService.updateUser(codiceUtente, user, {\n allowPrivilegedChanges: authenticatedUser.flagSuper \|\| authenticatedUser.flagAdmin,\n });\n\n return RestUtilities.sendOKMessage(\n res,\n `L'utente ${codiceUtente} e' stato aggiornato con successo.`,\n );\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta il consenso GDPR per un utente',\n operationId: 'setGdpr',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente che accetta il GDPR\",\n required: true,\n example: 123,\n })\n @ApiResponse({\n status: 200,\n description: 'Consenso GDPR impostato con successo',\n type: ActionResponse,\n })\n @ApiResponse({ status: 400, description: 'Errore nella richiesta', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Patch('set-gdpr/:codiceUtente')\n async setGdpr(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureSelfOrSuperUser(\n authenticatedUser,\n codiceUtente,\n 'Puoi impostare il GDPR solo sul tuo utente.',\n );\n if (authenticatedUser.codiceUtente !== codiceUtente) {\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n }\n\n await this.userService.setGdpr(codiceUtente);\n return RestUtilities.sendOKMessage(res, `L'utente ${codiceUtente} ha accettato il GDPR.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n}\n"]}

package/dist/accessi-module/Dtos/LoginAsDtos.d.ts ADDED Viewed

@@ -0,0 +1,15 @@
+import { BaseResponse } from './BaseResponse';
+/** Body per generare un URL di accesso temporaneo come un altro utente. */
+export declare class LoginAsRequest {
+    url: string;
+}
+/** Esito della generazione dell'URL di impersonazione. */
+export declare class LoginAsResult {
+    loginUrl: string;
+    token: string;
+    expiresInSeconds: number;
+    expiresAt: string;
+}
+export declare class LoginAsResponse extends BaseResponse {
+    Result: LoginAsResult;
+}

package/dist/accessi-module/Dtos/LoginAsDtos.js ADDED Viewed

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LoginAsResponse = exports.LoginAsResult = exports.LoginAsRequest = void 0;
+const swagger_1 = require("@nestjs/swagger");
+const class_validator_1 = require("class-validator");
+const BaseResponse_1 = require("./BaseResponse");
+/** Body per generare un URL di accesso temporaneo come un altro utente. */
+class LoginAsRequest {
+}
+exports.LoginAsRequest = LoginAsRequest;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'URL assoluto (http/https) dell applicazione a cui accedere.',
+        example: 'https://app.example.com/dashboard',
+    }),
+    (0, class_validator_1.IsString)({ message: 'L URL deve essere una stringa.' }),
+    (0, class_validator_1.Length)(1, 2048, { message: 'L URL deve essere compreso tra 1 e 2048 caratteri.' }),
+    __metadata("design:type", String)
+], LoginAsRequest.prototype, "url", void 0);
+/** Esito della generazione dell'URL di impersonazione. */
+class LoginAsResult {
+}
+exports.LoginAsResult = LoginAsResult;
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'URL dell applicazione con il token allegato come query parameter loginAsToken.',
+        example: 'https://app.example.com/dashboard?loginAsToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
+    }),
+    __metadata("design:type", String)
+], LoginAsResult.prototype, "loginUrl", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Token JWT di accesso temporaneo per l utente target.',
+        example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',
+    }),
+    __metadata("design:type", String)
+], LoginAsResult.prototype, "token", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({ description: 'Validita del token in secondi.', example: 300 }),
+    __metadata("design:type", Number)
+], LoginAsResult.prototype, "expiresInSeconds", void 0);
+__decorate([
+    (0, swagger_1.ApiProperty)({
+        description: 'Scadenza del token in formato ISO 8601.',
+        example: '2026-10-23T14:05:00.000Z',
+    }),
+    __metadata("design:type", String)
+], LoginAsResult.prototype, "expiresAt", void 0);
+class LoginAsResponse extends BaseResponse_1.BaseResponse {
+}
+exports.LoginAsResponse = LoginAsResponse;
+__decorate([
+    (0, swagger_1.ApiProperty)({ type: LoginAsResult }),
+    __metadata("design:type", LoginAsResult)
+], LoginAsResponse.prototype, "Result", void 0);
+//# sourceMappingURL=LoginAsDtos.js.map

package/dist/accessi-module/Dtos/LoginAsDtos.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"LoginAsDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/LoginAsDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAAmD;AACnD,iDAA8C;AAE9C,2EAA2E;AAC3E,MAAa,cAAc;CAQ1B;AARD,wCAQC;AADC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,mCAAmC;KAC7C,CAAC;IACD,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACvD,IAAA,wBAAM,EAAC,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;;2CACtE;AAGf,0DAA0D;AAC1D,MAAa,aAAa;CAqBzB;AArBD,sCAqBC;AAhBC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,gFAAgF;QAC7F,OAAO,EAAE,wFAAwF;KAClG,CAAC;;+CACgB;AAMlB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,yCAAyC;KACnD,CAAC;;4CACa;AAGf;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;;uDACnD;AAM1B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,0BAA0B;KACpC,CAAC;;gDACiB;AAGrB,MAAa,eAAgB,SAAQ,2BAAY;CAGhD;AAHD,0CAGC;AADC;IADC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BAC5B,aAAa;+CAAC","sourcesContent":["import { ApiProperty } from '@nestjs/swagger';\nimport { IsString, Length } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\n\n/** Body per generare un URL di accesso temporaneo come un altro utente. */\nexport class LoginAsRequest {\n @ApiProperty({\n description: 'URL assoluto (http/https) dell applicazione a cui accedere.',\n example: 'https://app.example.com/dashboard',\n })\n @IsString({ message: 'L URL deve essere una stringa.' })\n @Length(1, 2048, { message: 'L URL deve essere compreso tra 1 e 2048 caratteri.' })\n url!: string;\n}\n\n/** Esito della generazione dell'URL di impersonazione. */\nexport class LoginAsResult {\n @ApiProperty({\n description: 'URL dell applicazione con il token allegato come query parameter loginAsToken.',\n example: 'https://app.example.com/dashboard?loginAsToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',\n })\n loginUrl!: string;\n\n @ApiProperty({\n description: 'Token JWT di accesso temporaneo per l utente target.',\n example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',\n })\n token!: string;\n\n @ApiProperty({ description: 'Validita del token in secondi.', example: 300 })\n expiresInSeconds!: number;\n\n @ApiProperty({\n description: 'Scadenza del token in formato ISO 8601.',\n example: '2026-10-23T14:05:00.000Z',\n })\n expiresAt!: string;\n}\n\nexport class LoginAsResponse extends BaseResponse {\n @ApiProperty({ type: LoginAsResult })\n Result!: LoginAsResult;\n}\n"]}

package/dist/accessi-module/Dtos/index.d.ts CHANGED Viewed

@@ -12,6 +12,7 @@ export * from "./FiltriUtente";
 export * from "./FederatedIdentityDtos";
 export * from "./GetUserByTokenRequest";
 export * from "./GetUserByTokenResponse";
+export * from "./LoginAsDtos";
 export * from "./LoginRequest";
 export * from "./LoginResponse";
 export * from "./Permission";

package/dist/accessi-module/Dtos/index.js CHANGED Viewed

@@ -28,6 +28,7 @@ __exportStar(require("./FiltriUtente"), exports);
 __exportStar(require("./FederatedIdentityDtos"), exports);
 __exportStar(require("./GetUserByTokenRequest"), exports);
 __exportStar(require("./GetUserByTokenResponse"), exports);
+__exportStar(require("./LoginAsDtos"), exports);
 __exportStar(require("./LoginRequest"), exports);
 __exportStar(require("./LoginResponse"), exports);
 __exportStar(require("./Permission"), exports);

package/dist/accessi-module/Dtos/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,mEAAiD;AACjD,6DAA2C;AAC3C,gEAA8C;AAC9C,iDAA+B;AAC/B,gDAA8B;AAC9B,gEAA8C;AAC9C,+DAA4C;AAE5C,iDAA+B;AAC/B,0DAAwC;AACxC,0DAAwC;AACxC,2DAAyC;AACzC,iDAA+B;AAC/B,kDAAgC;AAChC,+CAA6B;AAC7B,0DAAwC;AACxC,yCAAuB;AACvB,+CAA6B;AAC7B,kEAAgD;AAChD,uDAAqC;AACrC,qDAAmC;AACnC,gDAA8B;AAC9B,4CAA0B;AAC1B,uDAAqC;AAErC,8CAA2B;AAE3B,iDAA+B;AAE/B,kDAAgC","sourcesContent":["export * from \"./Abilitazione\";\nexport * from \"./AdminBootstrapDtos\";\nexport * from \"./AbilitazioneMenu\";\nexport * from \"./AssignPermissionsToUserRequest\";\nexport * from \"./AssignRolesToUserRequest\";\nexport * from \"./AuthenticatedUserPayloadDto\";\nexport * from \"./BaseResponse\";\nexport * from \"./CatalogDtos\";\nexport * from \"./ConfirmResetPasswordRequest\";\nexport * from \"./UpdateEnabledStatusRequest\"\n\nexport * from \"./FiltriUtente\";\nexport * from \"./FederatedIdentityDtos\";\nexport * from \"./GetUserByTokenRequest\";\nexport * from \"./GetUserByTokenResponse\";\nexport * from \"./LoginRequest\";\nexport * from \"./LoginResponse\";\nexport * from \"./Permission\";\nexport * from \"./PublicRegisterRequest\";\nexport * from \"./Role\";\nexport * from \"./SchemaDtos\";\nexport * from \"./SendResetPasswordEmailRequest\";\nexport * from \"./StatoRegistrazione\";\nexport * from \"./TipoAbilitazione\";\nexport * from \"./TokenResult\";\nexport * from \"./UserDto\";\nexport * from \"./UserGrantsResponse\";\n\nexport * from \"./RuoliMenu\"\n\nexport * from \"./ServiceToken\";\n\nexport * from './TwoFactorDtos';\n"]}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,iDAA+B;AAC/B,uDAAqC;AACrC,qDAAmC;AACnC,mEAAiD;AACjD,6DAA2C;AAC3C,gEAA8C;AAC9C,iDAA+B;AAC/B,gDAA8B;AAC9B,gEAA8C;AAC9C,+DAA4C;AAE5C,iDAA+B;AAC/B,0DAAwC;AACxC,0DAAwC;AACxC,2DAAyC;AACzC,gDAA8B;AAC9B,iDAA+B;AAC/B,kDAAgC;AAChC,+CAA6B;AAC7B,0DAAwC;AACxC,yCAAuB;AACvB,+CAA6B;AAC7B,kEAAgD;AAChD,uDAAqC;AACrC,qDAAmC;AACnC,gDAA8B;AAC9B,4CAA0B;AAC1B,uDAAqC;AAErC,8CAA2B;AAE3B,iDAA+B;AAE/B,kDAAgC","sourcesContent":["export * from \"./Abilitazione\";\nexport * from \"./AdminBootstrapDtos\";\nexport * from \"./AbilitazioneMenu\";\nexport * from \"./AssignPermissionsToUserRequest\";\nexport * from \"./AssignRolesToUserRequest\";\nexport * from \"./AuthenticatedUserPayloadDto\";\nexport * from \"./BaseResponse\";\nexport * from \"./CatalogDtos\";\nexport * from \"./ConfirmResetPasswordRequest\";\nexport * from \"./UpdateEnabledStatusRequest\"\n\nexport * from \"./FiltriUtente\";\nexport * from \"./FederatedIdentityDtos\";\nexport * from \"./GetUserByTokenRequest\";\nexport * from \"./GetUserByTokenResponse\";\nexport * from \"./LoginAsDtos\";\nexport * from \"./LoginRequest\";\nexport * from \"./LoginResponse\";\nexport * from \"./Permission\";\nexport * from \"./PublicRegisterRequest\";\nexport * from \"./Role\";\nexport * from \"./SchemaDtos\";\nexport * from \"./SendResetPasswordEmailRequest\";\nexport * from \"./StatoRegistrazione\";\nexport * from \"./TipoAbilitazione\";\nexport * from \"./TokenResult\";\nexport * from \"./UserDto\";\nexport * from \"./UserGrantsResponse\";\n\nexport * from \"./RuoliMenu\"\n\nexport * from \"./ServiceToken\";\n\nexport * from './TwoFactorDtos';\n"]}

package/dist/accessi-module/Services/AuthService/AuthService.d.ts CHANGED Viewed

@@ -7,6 +7,12 @@ import { FiltriService } from "../FiltriService/FiltriService";
 import { TokenResult } from '../../Dtos/TokenResult';
 /** Error code deliberately returned when a user is configured as SSO-only. */
 export declare const PASSWORD_LOGIN_DISABLED = "PASSWORD_LOGIN_DISABLED";
+interface AccessiTokenIssueOptions {
+    /** Sovrascrive jwtOptions.expiresIn per token a durata ridotta (es. Login as). */
+    expiresIn?: string | number;
+    /** Claim aggiuntive, per esempio l'attore che ha generato un token di impersonazione. */
+    extraClaims?: Record<string, unknown>;
+}
 export declare class AuthService {
     private userService;
     private filtriService;
@@ -17,7 +23,15 @@ export declare class AuthService {
     private refreshPasswordExpiration;
     private isMockDemoUserEnabled;
     /** Creates the normal internal JWT consumed by all existing Accessi guards. */
-    createAccessiToken(utente: LoginResult['utente'], methods?: string[]): TokenResult;
+    createAccessiToken(utente: LoginResult['utente'], methods?: string[], tokenOptions?: AccessiTokenIssueOptions): TokenResult;
+    /**
+     * Emette un access token breve per l'utente target, con l'attore registrato
+     * nelle claim `act` e `loginAs`. La durata e' fissa a 5 minuti.
+     */
+    createLoginAsToken(utente: LoginResult['utente'], actor: {
+        codiceUtente: number;
+        email?: string;
+    }): TokenResult;
     /** Builds the standard login response for a user authenticated by a supported method. */
     getLoginResultForUser(codiceUtente: number): Promise<LoginResult>;
     /** Users without a row retain the historic password-login enabled default. */
@@ -63,3 +77,4 @@ export declare class AuthService {
      */
     confirmResetPassword(token: string, newPassword: string): Promise<void>;
 }
+export {};

package/dist/accessi-module/Services/AuthService/AuthService.js CHANGED Viewed

@@ -67,6 +67,7 @@ const FiltriService_1 = require("../FiltriService/FiltriService");
 const authenticatedToken_1 = require("../../security/authenticatedToken");
 const passwordResetToken_1 = require("../../security/passwordResetToken");
 const passwordPolicy_1 = require("../../security/passwordPolicy");
+const loginAs_1 = require("../../security/loginAs");
 const Logger_1 = require("../../../Logger");
 /** Error code deliberately returned when a user is configured as SSO-only. */
 exports.PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';
@@ -102,31 +103,55 @@ let AuthService = AuthService_1 = class AuthService {
         return nodeEnv !== "production";
     }
     /** Creates the normal internal JWT consumed by all existing Accessi guards. */
-    createAccessiToken(utente, methods = []) {
+    createAccessiToken(utente, methods = [], tokenOptions = {}) {
+        var _a, _b;
         if (!(utente === null || utente === void 0 ? void 0 : utente.codiceUtente)) {
             throw new Error('Impossibile creare un token senza un utente Accessi valido.');
         }
-        if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp')) {
+        const loginAs = methods.includes('login_as');
+        if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp') && !loginAs) {
             throw new common_1.UnauthorizedException('Verifica del codice di accesso richiesta.');
         }
-        const expiresIn = this.accessiOptions.jwtOptions.expiresIn;
-        if (typeof expiresIn !== 'string' || expiresIn.trim() === '') {
+        const expiresIn = (_a = tokenOptions.expiresIn) !== null && _a !== void 0 ? _a : this.accessiOptions.jwtOptions.expiresIn;
+        const expiresInIsValid = typeof expiresIn === 'number'
+            ? Number.isFinite(expiresIn) && expiresIn > 0
+            : typeof expiresIn === 'string' && expiresIn.trim() !== '';
+        if (!expiresInIsValid) {
             throw new Error('jwtOptions.expiresIn non configurato: impossibile emettere token senza scadenza.');
         }
-        const token = jwt.sign({ utente, typ: 'access', amr: methods }, (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions), {
-            expiresIn: expiresIn,
-        });
+        const token = jwt.sign(Object.assign(Object.assign({}, ((_b = tokenOptions.extraClaims) !== null && _b !== void 0 ? _b : {})), { utente, typ: 'access', amr: methods }), (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions), { expiresIn: expiresIn });
         // Difesa in profondita: un `expiresIn` malformato farebbe emettere un token permanente.
         const decoded = jwt.decode(token);
-        if (!decoded || typeof decoded !== 'object' || typeof decoded.exp !== 'number') {
+        const decodedPayload = decoded && typeof decoded === 'object' ? decoded : undefined;
+        if (typeof (decodedPayload === null || decodedPayload === void 0 ? void 0 : decodedPayload.exp) !== 'number') {
             throw new Error('Token emesso senza scadenza: configurazione JWT non valida.');
         }
+        // Il contratto TokenResult espone sempre la validita in secondi, anche quando
+        // jwtOptions.expiresIn usa un formato leggibile come '24h'.
+        const issuedAt = typeof decodedPayload.iat === 'number' ? decodedPayload.iat : Math.floor(Date.now() / 1000);
+        const expiresInSeconds = Math.max(0, Math.trunc(decodedPayload.exp - issuedAt));
         return {
-            expiresIn,
+            expiresIn: String(expiresInSeconds),
             value: token,
             type: 'Bearer',
         };
     }
+    /**
+     * Emette un access token breve per l'utente target, con l'attore registrato
+     * nelle claim `act` e `loginAs`. La durata e' fissa a 5 minuti.
+     */
+    createLoginAsToken(utente, actor) {
+        return this.createAccessiToken(utente, ['login_as'], {
+            expiresIn: loginAs_1.LOGIN_AS_TOKEN_TTL_SECONDS,
+            extraClaims: {
+                loginAs: true,
+                act: {
+                    sub: String(actor.codiceUtente),
+                    email: actor.email,
+                },
+            },
+        });
+    }
     /** Builds the standard login response for a user authenticated by a supported method. */
     getLoginResultForUser(codiceUtente) {
         return __awaiter(this, void 0, void 0, function* () {