emilsoftware-utilities 2.0.0-dev.58 → 2.0.0-dev.59

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (28) hide show
  1. package/README.MD +1 -1
  2. package/dist/accessi-module/Console/console.css +9 -0
  3. package/dist/accessi-module/Console/console.js +8 -8
  4. package/dist/accessi-module/Console/console.js.map +1 -1
  5. package/dist/accessi-module/Console/generated/accessiApi.d.ts +1 -1
  6. package/dist/accessi-module/Console/generated/accessiApi.js.map +1 -1
  7. package/dist/accessi-module/Console/generated/model/loginAsResult.d.ts +1 -1
  8. package/dist/accessi-module/Console/generated/model/loginAsResult.js.map +1 -1
  9. package/dist/accessi-module/Console/help.js +1 -1
  10. package/dist/accessi-module/Console/help.js.map +1 -1
  11. package/dist/accessi-module/Console/wiki.js +2 -2
  12. package/dist/accessi-module/Console/wiki.js.map +1 -1
  13. package/dist/accessi-module/Controllers/UserController.js +7 -3
  14. package/dist/accessi-module/Controllers/UserController.js.map +1 -1
  15. package/dist/accessi-module/Dtos/LoginAsDtos.js +4 -1
  16. package/dist/accessi-module/Dtos/LoginAsDtos.js.map +1 -1
  17. package/dist/accessi-module/Services/AuthService/AuthService.d.ts +2 -2
  18. package/dist/accessi-module/Services/AuthService/AuthService.js +2 -4
  19. package/dist/accessi-module/Services/AuthService/AuthService.js.map +1 -1
  20. package/dist/accessi-module/index.d.ts +1 -1
  21. package/dist/accessi-module/index.js +1 -2
  22. package/dist/accessi-module/index.js.map +1 -1
  23. package/dist/accessi-module/security/loginAs.d.ts +0 -2
  24. package/dist/accessi-module/security/loginAs.js +1 -3
  25. package/dist/accessi-module/security/loginAs.js.map +1 -1
  26. package/dist/emilsoftware-utilities-2.0.0-dev.59.tgz +0 -0
  27. package/package.json +1 -1
  28. package/dist/emilsoftware-utilities-2.0.0-dev.58.tgz +0 -0
package/dist/accessi-module/Controllers/UserController.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAoBwB;AAExB,6CASyB;AACzB,+BAA4B;AAC5B,yCAAsC;AACtC,+CAAgD;AAEhD,uDAAqE;AACrE,+DAA4D;AAC5D,qDAAsE;AACtE,yEAAsE;AACtE,+DAA4D;AAC5D,6DAA0D;AAC1D,yEAAyE;AACzE,2EAAwE;AACxE,6CAA0C;AAC1C,qEAAkE;AAClE,wEAAqE;AACrE,qEAAkE;AAClE,sDAAqD;AACrD,yEAGyC;AACzC,6DAQmC;AAEnC,uEAAuE;AACvE,iDAAkF;AAClF,mEAAgE;AAQzD,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YAC6B,cAA+C,EACzD,WAAwB,EACxB,YAA0B,EAC1B,WAAwB;QAHG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAa;QAN1B,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAOvD,CAAC;IAEI,mBAAmB,CAAC,GAAa,EAAE,KAAc;QACvD,gFAAgF;QAChF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACW,sBAAsB,CAClC,KAA+B,EAC/B,YAAoB;;YAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAAiB,CAAC,4BAA4B,YAAY,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,IAAA,yCAAyB,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAYK,sBAAsB,CAAQ,GAAa,EAAkB,MAAc;;YAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAqDK,QAAQ,CACL,OAAgB,EAChB,GAAa,EACJ,KAAc,EAC+B,YAAqB,EAElF,sBAAgC,EAEhC,aAAuB,EAC+B,KAAc,EACb,MAAe;;YAEtE,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,wDAAwD,CACzD,CAAC;gBAEF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG;oBACd,sBAAsB,EAAE,sBAAsB,aAAtB,sBAAsB,cAAtB,sBAAsB,GAAI,IAAI;oBACtD,aAAa,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,IAAI;iBACrC,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAuBK,UAAU,CACP,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAqBK,qBAAqB,CAClB,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,2BAAW,EACT,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;gBAEF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,4BAAmB,CAAC,0DAA0D,CAAC,CAAC;gBAC5F,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAcK,kBAAkB,CACf,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,qCAAqC,YAAY,GAAG,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAYK,wBAAwB,CAAQ,OAAgB,EAAS,GAAa;;YAC1E,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oCAAoC,EAAE,CAAC;gBAC3E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,IAAI,8BAA8B,CAAC,CAAC;YAC1G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAiBK,gBAAgB,CACb,OAAgB,EACc,YAAoB,EACjD,IAAoB,EACrB,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;gBACF,iFAAiF;gBACjF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,IAAA,yBAAe,EAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,oCAA0B,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAEzF,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,iBAAiB,CAAC,YAAY,YAAY,YAAY,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CACtH,CAAC;gBAEF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE;oBACzC,QAAQ;oBACR,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,gBAAgB,EAAE,oCAA0B;oBAC5C,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAeK,eAAe,CACZ,OAAgB,EACc,YAAoB,EACjD,IAA4B,EAC7B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,qEAAqE,CACtE,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACnE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,wBAAwB,YAAY,cAAc,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAyBK,qBAAqB,CAClB,OAAgB,EACf,IAA8B,EAC/B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;gBAEF,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;gBAClD,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;gBACvF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,kBAAkB,KAAK,uCAAkB,CAAC,MAAM;uBAC7D,kBAAkB,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBACrD,IAAI,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,wBAAwB,YAAY,0BAA0B,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,QAAQ,CACL,OAAgB,EACf,gBAAuC,EACxC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,kBAAkB,0CAAE,OAAO,MAAK,IAAI,EAAE,CAAC;oBAC7D,MAAM,IAAI,sBAAa,CACrB,mFAAmF,EACnF,mBAAU,CAAC,SAAS,CACrB,CAAC;gBACJ,CAAC;gBAED,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,cAAc,EACnB,UAAU,EACV,OAAO,EACP,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,KAAK,CAAC,CAC1B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,KAAK;iBAC7B,CAAC,CAAC;gBAEH,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACrK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,2DAA2D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,uBAAuB;qBACjK,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GACV,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAAC;gBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;IAQK,iBAAiB,CAAQ,OAAgB,EAAU,gBAAiC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;gBAC1F,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;gBAEhE,wEAAwE;gBACxE,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACpG,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,qFAAqF;oBACrF,iEAAiE;oBACjE,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACjK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,0DAA0D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,oEAAoE;qBAC7M,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,YAAY,CACT,OAAgB,EACc,YAAoB,EACjD,IAAa,EACd,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,kBAAkB,GAAG,IAAA,wCAAwB,EAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,KAAK,YAAY,CAAC;gBAE/D,mFAAmF;gBACnF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,IAAI,kBAAkB,EAAE,CAAC;oBACvB,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,iFAAiF,CAClF,CAAC;oBACF,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;oBACpD,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;wBAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,sCAAsC,CACvC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBAC1E,MAAM,IAAI,4BAAmB,CAAC,6DAA6D,CAAC,CAAC;gBAC/F,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE;oBACpD,sBAAsB,EAAE,iBAAiB,CAAC,SAAS,IAAI,iBAAiB,CAAC,SAAS;iBACnF,CAAC,CAAC;gBAEH,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,YAAY,YAAY,oCAAoC,CAC7D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAsBK,OAAO,CACJ,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,6CAA6C,CAC9C,CAAC;gBACF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,YAAY,wBAAwB,CAAC,CAAC;YAC5F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAxoBY,wCAAc;AA0CnB;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,4BAA4B;KAC1C,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,YAAG,EAAC,uBAAuB,CAAC;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;4DAEjE;AAqDK;IAnDL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8BAA8B;QAC3C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+DAA+D;QAC5E,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4CAA4C;QACzD,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,WAAW,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3D,WAAA,IAAA,cAAK,EAAC,wBAAwB,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEtE,WAAA,IAAA,cAAK,EAAC,eAAe,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE7D,WAAA,IAAA,cAAK,EAAC,OAAO,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;;;;8CAsBvD;AAuBK;IArBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,qEAAqE;KACnF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,2BAA2B,CAAC;IAEjC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gDAmBP;AAqBK;IAnBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,2FAA2F;KACzG,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gEAAgE;QAC7E,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,qCAAqC,CAAC;IAE3C,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAuBP;AAcK;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,yHAAyH;KACvI,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,oCAAoC,CAAC;IAExC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAcP;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kEAAkE;QAC3E,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,+JAA+J;KAC7K,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,6BAA6B,CAAC;IACJ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAW7D;AAiBK;IAfL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0DAA0D;QACnE,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EACT,gUAAgU;KACnU,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAc,EAAE,CAAC;IACjC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,6BAAe,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,wBAAwB,CAAC;IAE5B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,4BAAc;;sDA8B7B;AAeK;IAbL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,6GAA6G;KAC3H,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,+CAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACtF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACrF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAEhC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,+CAAsB;;qDAgBrC;AAyBK;IAvBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EAAE,uBAAuB;KACrC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,gDAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,WAAW,CAAC;IAEf,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,gDAAwB;;2DA+BvC;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,8IAA8I;QAC3J,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,6CAAqB;QAC3B,WAAW,EAAE,iDAAiD;KAC/D,CAAC;IACD,IAAA,4BAAkB,EAAC;QAClB,WAAW,EACT,kGAAkG;QACpG,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,WAAW;QAC9B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,qBAAqB;QACxC,WAAW,EAAE,sEAAsE;QACnF,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,UAAU,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADoB,6CAAqB;;8CA8ChD;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;IAC5N,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAAe,EAAE,CAAC;IAClC,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,mCAAgB,EAAE,CAAC;IAC9C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,qBAAqB,CAAC;IACH,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAqC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAvB,iCAAe;;uDA6BzF;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,cAAc;KAC5B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,iBAAO;QACb,WAAW,EAAE,6BAA6B;KAC3C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,EAAE;QACrB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAE9B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,iBAAO;;kDA6CtB;AAsBK;IApBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,SAAS;KACvB,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,cAAK,EAAC,wBAAwB,CAAC;IAE7B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6CAkBP;yBAvoBU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAKE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACV,2BAAY;QACb,yBAAW;GAPhC,cAAc,CAwoB1B","sourcesContent":["import {\n BadRequestException,\n Body,\n Controller,\n Delete,\n Get,\n HttpException,\n HttpStatus,\n NotFoundException,\n Param,\n ParseBoolPipe,\n ParseIntPipe,\n Patch,\n Post,\n Put,\n Query,\n Inject,\n Req,\n Res,\n UseGuards,\n} from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport {\n ApiBearerAuth,\n ApiBody,\n ApiCreatedResponse,\n ApiOperation,\n ApiParam,\n ApiQuery,\n ApiResponse,\n ApiTags,\n} from '@nestjs/swagger';\nimport { join } from 'path';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { GetUsersResponse } from '../Dtos/GetUsersResponse';\nimport { LoginAsRequest, LoginAsResponse } from '../Dtos/LoginAsDtos';\nimport { PublicRegisterRequest } from '../Dtos/PublicRegisterRequest';\nimport { RegisterResponse } from '../Dtos/RegisterResponse';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { SetStatoRegistrazioneDto } from '../Dtos/SetStatoRegistrazione';\nimport { SetUserPasswordRequest } from '../Dtos/SetUserPasswordRequest';\nimport { UserDto } from '../Dtos/UserDto';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport {\n checkPublicAuthRateLimit,\n sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\nimport {\n ensureAdmin,\n ensureCanManageTargetUser,\n ensurePrivilegeFlagChanges,\n ensureSelfOrSuperUser,\n ensureUserManagement,\n getAuthenticatedAccessiUser,\n hasPrivilegedUserChanges,\n} from '../security/accessControl';\nimport type { AuthenticatedAccessiUser } from '../security/accessControl';\nimport { assertEmailConfigured } from '../security/emailConfiguration';\nimport { buildLoginAsUrl, LOGIN_AS_TOKEN_TTL_SECONDS } from '../security/loginAs';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\n\n@ApiTags('User')\n@Controller('accessi/user')\n/**\n * Gestione utenti: la registrazione pubblica e opt-in, mentre creazione, stato e profili privilegiati\n * richiedono un superutente Accessi. Le API restituiscono sempre il wrapper `BaseResponse` storico.\n */\nexport class UserController {\n private readonly logger = new Logger(UserController.name);\n\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n private readonly userService: UserService,\n private readonly emailService: EmailService,\n private readonly authService: AuthService,\n ) {}\n\n private sendControllerError(res: Response, error: unknown) {\n // Lo status viene derivato centralmente da RestUtilities (HttpException o 500).\n return RestUtilities.sendErrorMessage(res, error, UserController.name);\n }\n\n /**\n * Verifica che il target esista e che l'attore possa gestirlo (rango attore >=\n * rango target: ADMIN > SUPER > utente). Restituisce lo snapshot corrente del\n * target, così i chiamanti possono controllare se e' admin.\n */\n private async ensureManageableTarget(\n actor: AuthenticatedAccessiUser,\n codiceUtente: number,\n ) {\n const target = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!target) {\n throw new NotFoundException(`Nessun utente con codice ${codiceUtente}.`);\n }\n ensureCanManageTargetUser(actor, target);\n return target;\n }\n\n @ApiOperation({\n summary: 'Serve la pagina di reset password',\n operationId: 'serveResetPasswordPageUser',\n })\n @ApiParam({\n name: 'token',\n description: 'Token per il reset della password',\n required: true,\n })\n @Get('reset-password/:token')\n async serveResetPasswordPage(@Res() res: Response, @Param('token') _token: string) {\n return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n }\n\n @ApiOperation({\n summary: 'Recupera la lista degli utenti',\n operationId: 'getUsers',\n })\n @ApiResponse({\n status: 200,\n description: 'Lista utenti recuperata con successo',\n type: GetUsersResponse,\n })\n @ApiResponse({ status: 401, description: 'Credenziali non valide', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiQuery({\n name: 'email',\n required: false,\n description: \"Email dell'utente da cercare\",\n type: String,\n })\n @ApiQuery({\n name: 'codiceUtente',\n required: false,\n description: \"Codice dell'utente da cercare\",\n type: Number,\n })\n @ApiQuery({\n name: 'includeExtensionFields',\n required: false,\n description: 'Includi extension fields',\n type: Boolean,\n })\n @ApiQuery({\n name: 'includeGrants',\n required: false,\n description: 'Includi permessi',\n type: Boolean,\n })\n @ApiQuery({\n name: 'limit',\n required: false,\n description: 'Numero massimo di utenti restituiti (1-1000). Omesso = tutti.',\n type: Number,\n })\n @ApiQuery({\n name: 'offset',\n required: false,\n description: 'Numero di utenti da saltare (paginazione).',\n type: Number,\n })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Get('get-users')\n async getUsers(\n @Req() request: Request,\n @Res() res: Response,\n @Query('email') email?: string,\n @Query('codiceUtente', new ParseIntPipe({ optional: true })) codiceUtente?: number,\n @Query('includeExtensionFields', new ParseBoolPipe({ optional: true }))\n includeExtensionFields?: boolean,\n @Query('includeGrants', new ParseBoolPipe({ optional: true }))\n includeGrants?: boolean,\n @Query('limit', new ParseIntPipe({ optional: true })) limit?: number,\n @Query('offset', new ParseIntPipe({ optional: true })) offset?: number,\n ) {\n try {\n ensureUserManagement(\n getAuthenticatedAccessiUser(request),\n 'Solo gli amministratori possono consultare gli utenti.',\n );\n\n const filters = { email, codiceUtente, limit, offset };\n const options = {\n includeExtensionFields: includeExtensionFields ?? true,\n includeGrants: includeGrants ?? true,\n };\n\n const users = await this.userService.getUsers(filters, options);\n const total = await this.userService.countUsers({ email, codiceUtente });\n res.setHeader('X-Total-Count', String(total));\n return RestUtilities.sendBaseResponse(res, users);\n } catch (error) {\n this.logger.error('Errore durante il recupero degli utenti: ', error);\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Elimina un utente',\n operationId: 'deleteUser',\n description: 'Imposta lo stato di un utente a eliminato senza rimuovere i record.',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da eliminare\",\n required: true,\n example: 123,\n })\n @ApiResponse({ status: 200, description: 'Utente eliminato con successo', type: ActionResponse })\n @ApiResponse({\n status: 400,\n description: 'Errore nei parametri della richiesta',\n type: ErrorResponse,\n })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Delete('delete-user/:codiceUtente')\n async deleteUser(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono eliminare utenti.',\n );\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n if (target.flagAdmin) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.deleteUser(codiceUtente);\n return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato con successo.\");\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Elimina definitivamente un utente',\n operationId: 'deleteUserPermanently',\n description: 'Rimuove l utente e tutti i record collegati. Operazione distruttiva riservata agli admin.',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da eliminare definitivamente\",\n required: true,\n example: 123,\n })\n @ApiResponse({ status: 200, description: 'Utente eliminato definitivamente', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Errore nei parametri della richiesta', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Delete('delete-user-permanent/:codiceUtente')\n async deleteUserPermanently(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureAdmin(\n authenticatedUser,\n 'Solo gli admin possono eliminare definitivamente un utente.',\n );\n\n if (authenticatedUser.codiceUtente === codiceUtente) {\n throw new BadRequestException('Non puoi eliminare definitivamente il tuo stesso utente.');\n }\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n if (target.flagAdmin) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.deleteUserPermanently(codiceUtente);\n return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato definitivamente.\");\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Forza l invio dell email di reset password a un utente',\n operationId: 'forcePasswordReset',\n description: 'Riservato al superutente. Richiede un servizio email configurato; altrimenti risponde con ACCESSI_EMAIL_NOT_CONFIGURED.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n @ApiResponse({ status: 200, description: 'Email di reset inviata', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('force-password-reset/:codiceUtente')\n async forcePasswordReset(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono forzare il reset password.',\n );\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n await this.userService.forcePasswordReset(codiceUtente);\n return RestUtilities.sendOKMessage(res, `Email di reset inviata all utente ${codiceUtente}.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Forza il reset password per tutti gli utenti con password legacy',\n operationId: 'forcePasswordResetLegacy',\n description: 'Riservato al superutente. Invia l email di reset a tutti gli utenti la cui password non e ancora nel formato moderno. Richiede un servizio email configurato.',\n })\n @ApiResponse({ status: 200, description: 'Email di reset inviate', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('force-password-reset-legacy')\n async forcePasswordResetLegacy(@Req() request: Request, @Res() res: Response) {\n try {\n ensureUserManagement(\n getAuthenticatedAccessiUser(request),\n 'Solo gli amministratori possono forzare il reset password.',\n );\n const sent = await this.userService.forcePasswordResetForLegacyPasswords();\n return RestUtilities.sendOKMessage(res, `Email di reset inviata a ${sent} utenti con password legacy.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Genera un URL di accesso temporaneo come un altro utente',\n operationId: 'createLoginAsUrl',\n description:\n 'Riservato a superutenti e admin (con la gerarchia ADMIN > SUPER). Genera un token per l utente target, valido 5 minuti, e lo allega all URL indicato come query parameter loginAsToken. Il token e una credenziale: non condividerlo e non registrarlo. Da quel momento l applicazione di destinazione decide come consumarlo.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Utente da impersonare', required: true, example: 123, type: Number })\n @ApiBody({ type: LoginAsRequest })\n @ApiResponse({ status: 200, description: 'URL di accesso temporaneo generato', type: LoginAsResponse })\n @ApiResponse({ status: 400, description: 'URL non valido', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('login-as/:codiceUtente')\n async createLoginAsUrl(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() body: LoginAsRequest,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo superutenti e admin possono generare un accesso temporaneo.',\n );\n // Stessa gerarchia della gestione utenti: un superutente non impersona un admin.\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n const loginResult = await this.authService.getLoginResultForUser(codiceUtente);\n const issued = this.authService.createLoginAsToken(loginResult.utente, authenticatedUser);\n const loginUrl = buildLoginAsUrl(body?.url, issued.value);\n const expiresAt = new Date(Date.now() + LOGIN_AS_TOKEN_TTL_SECONDS * 1000).toISOString();\n\n this.logger.info(\n `Login as generato: attore=${authenticatedUser.codiceUtente}, target=${codiceUtente}, host=${new URL(loginUrl).host}`,\n );\n\n return RestUtilities.sendBaseResponse(res, {\n loginUrl,\n token: issued.value,\n expiresInSeconds: LOGIN_AS_TOKEN_TTL_SECONDS,\n expiresAt,\n });\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta direttamente la password di un utente',\n operationId: 'setUserPassword',\n description: 'Riservato agli amministratori. Hasha la password, aggiorna la scadenza secondo la policy e non invia email.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n @ApiBody({ type: SetUserPasswordRequest })\n @ApiResponse({ status: 200, description: 'Password aggiornata', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Password non valida', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('set-password/:codiceUtente')\n async setUserPassword(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() body: SetUserPasswordRequest,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono impostare la password di un utente.',\n );\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n await this.authService.setPassword(codiceUtente, body.newPassword);\n return RestUtilities.sendOKMessage(res, `Password dell utente ${codiceUtente} aggiornata.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta lo stato di registrazione di un utente',\n operationId: 'setStatoRegistrazione',\n })\n @ApiResponse({\n status: 200,\n description: 'Stato registrazione aggiornato con successo',\n type: ActionResponse,\n })\n @ApiResponse({\n status: 400,\n description: 'Errore nei parametri della richiesta',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: 500,\n description: 'Errore interno del server',\n type: ErrorResponse,\n })\n @ApiBody({ type: SetStatoRegistrazioneDto })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('set-stato')\n async setStatoRegistrazione(\n @Req() request: Request,\n @Body() body: SetStatoRegistrazioneDto,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono modificare lo stato di registrazione.',\n );\n\n const { codiceUtente, statoRegistrazione } = body;\n if (!codiceUtente) throw new BadRequestException('Il codice utente e\\' obbligatorio.');\n if (statoRegistrazione === undefined) {\n throw new BadRequestException('Lo stato registrazione e\\' obbligatorio.');\n }\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n const disabling = statoRegistrazione === StatoRegistrazione.DELETE\n || statoRegistrazione === StatoRegistrazione.BLOCC;\n if (target.flagAdmin && disabling) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.setStato(codiceUtente, statoRegistrazione);\n return RestUtilities.sendOKMessage(\n res,\n `Lo stato dell'utente ${codiceUtente} e' stato aggiornato a ${statoRegistrazione}.`,\n );\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Registra un nuovo utente',\n description: 'Disponibile soltanto quando publicRegistration.enabled e true. Per utenti SSO usare il provisioning master nel tag Federated authentication.',\n operationId: 'register',\n })\n @ApiBody({\n type: PublicRegisterRequest,\n description: \"Dati necessari per la registrazione dell'utente\",\n })\n @ApiCreatedResponse({\n description:\n 'Utente registrato con successo. Restituisce il codice utente e invia una mail di reset password.',\n type: RegisterResponse,\n })\n @ApiResponse({\n status: HttpStatus.BAD_REQUEST,\n description: 'Errore nella registrazione.',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: HttpStatus.INTERNAL_SERVER_ERROR,\n description: 'Errore interno del server durante la registrazione o l\\'invio email.',\n type: ErrorResponse,\n })\n @Post('register')\n async register(\n @Req() request: Request,\n @Body() registrationData: PublicRegisterRequest,\n @Res() res: Response,\n ) {\n try {\n if (this.accessiOptions.publicRegistration?.enabled !== true) {\n throw new HttpException(\n 'La registrazione pubblica e disabilitata. Un amministratore deve creare l utente.',\n HttpStatus.FORBIDDEN,\n );\n }\n\n const rateLimitDecision = checkPublicAuthRateLimit(\n this.accessiOptions,\n 'register',\n request,\n [registrationData?.email],\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n assertEmailConfigured(this.accessiOptions);\n\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: false,\n });\n\n try {\n await this.emailService.sendPasswordResetEmail(registrationData.email);\n } catch (emailError) {\n try {\n await this.userService.deleteUserPermanently(codiceUtente);\n } catch (rollbackError) {\n this.logger.error(`Rollback registrazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n }\n throw new BadRequestException({\n code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n message: `Registrazione non completata: invio email non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova piu tardi.`,\n });\n }\n return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n } catch (error) {\n const status =\n error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST;\n return RestUtilities.sendErrorMessage(res, error, UserController.name, status);\n }\n }\n\n @ApiOperation({ summary: 'Crea un utente locale da amministrazione', operationId: 'createManagedUser', description: 'Riservato a superutente. Crea un utente in attesa di impostazione password e invia la mail di reset.' })\n @ApiBody({ type: RegisterRequest })\n @ApiCreatedResponse({ type: RegisterResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('create-managed-user')\n async createManagedUser(@Req() request: Request, @Body() registrationData: RegisterRequest, @Res() res: Response) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono creare utenti.');\n ensurePrivilegeFlagChanges(authenticatedUser, registrationData);\n\n // Fail-fast prima di scrivere: senza SMTP non si crea un utente orfano.\n assertEmailConfigured(this.accessiOptions);\n\n const codiceUtente = await this.userService.register(registrationData, { allowPrivilegedFields: true });\n try {\n await this.emailService.sendPasswordResetEmail(registrationData.email, registrationData.htmlMail);\n } catch (emailError) {\n // L'invio e' esterno: se fallisce annulliamo la creazione per non lasciare un utente\n // senza password e senza email di invito (rollback best-effort).\n try {\n await this.userService.deleteUserPermanently(codiceUtente);\n } catch (rollbackError) {\n this.logger.error(`Rollback creazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n }\n throw new BadRequestException({\n code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n message: `Utente non creato: invio email di invito non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova oppure crea l utente e imposta la password manualmente.`,\n });\n }\n return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Aggiorna un utente esistente',\n operationId: 'updateUtente',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da aggiornare\",\n required: true,\n example: 123,\n })\n @ApiBody({\n type: UserDto,\n description: \"Dati aggiornati dell'utente\",\n })\n @ApiResponse({\n status: HttpStatus.OK,\n description: 'Utente aggiornato con successo',\n type: ActionResponse,\n })\n @ApiResponse({ status: 400, description: \"Errore nell'aggiornamento\", type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Put('update-user/:codiceUtente')\n async updateUtente(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() user: UserDto,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n const isPrivilegedUpdate = hasPrivilegedUserChanges(user);\n const isSelf = authenticatedUser.codiceUtente === codiceUtente;\n\n // ADMIN > SUPER: un superutente non puo' toccare un admin. Self sempre consentito.\n if (!isSelf) {\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n }\n\n if (isPrivilegedUpdate) {\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono modificare ruoli, permessi o flag privilegiati.',\n );\n ensurePrivilegeFlagChanges(authenticatedUser, user);\n if (user.flagAdmin === false) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n } else {\n ensureSelfOrSuperUser(\n authenticatedUser,\n codiceUtente,\n 'Puoi modificare solo il tuo profilo.',\n );\n }\n\n if (user.codiceUtente !== undefined && user.codiceUtente !== codiceUtente) {\n throw new BadRequestException('Il codice utente nel body non coincide con quello del path.');\n }\n\n await this.userService.updateUser(codiceUtente, user, {\n allowPrivilegedChanges: authenticatedUser.flagSuper || authenticatedUser.flagAdmin,\n });\n\n return RestUtilities.sendOKMessage(\n res,\n `L'utente ${codiceUtente} e' stato aggiornato con successo.`,\n );\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta il consenso GDPR per un utente',\n operationId: 'setGdpr',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente che accetta il GDPR\",\n required: true,\n example: 123,\n })\n @ApiResponse({\n status: 200,\n description: 'Consenso GDPR impostato con successo',\n type: ActionResponse,\n })\n @ApiResponse({ status: 400, description: 'Errore nella richiesta', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Patch('set-gdpr/:codiceUtente')\n async setGdpr(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureSelfOrSuperUser(\n authenticatedUser,\n codiceUtente,\n 'Puoi impostare il GDPR solo sul tuo utente.',\n );\n if (authenticatedUser.codiceUtente !== codiceUtente) {\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n }\n\n await this.userService.setGdpr(codiceUtente);\n return RestUtilities.sendOKMessage(res, `L'utente ${codiceUtente} ha accettato il GDPR.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n}\n"]}
1
+ {"version":3,"file":"UserController.js","sourceRoot":"","sources":["../../../src/accessi-module/Controllers/UserController.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAoBwB;AAExB,6CASyB;AACzB,+BAA4B;AAC5B,yCAAsC;AACtC,+CAAgD;AAEhD,uDAAqE;AACrE,+DAA4D;AAC5D,qDAAsE;AACtE,yEAAsE;AACtE,+DAA4D;AAC5D,6DAA0D;AAC1D,yEAAyE;AACzE,2EAAwE;AACxE,6CAA0C;AAC1C,qEAAkE;AAClE,wEAAqE;AACrE,qEAAkE;AAClE,sDAAqD;AACrD,yEAGyC;AACzC,6DAQmC;AAEnC,uEAAuE;AACvE,iDAAsD;AACtD,mEAAgE;AAQzD,IAAM,cAAc,sBAApB,MAAM,cAAc;IAGzB,YAC6B,cAA+C,EACzD,WAAwB,EACxB,YAA0B,EAC1B,WAAwB;QAHG,mBAAc,GAAd,cAAc,CAAgB;QACzD,gBAAW,GAAX,WAAW,CAAa;QACxB,iBAAY,GAAZ,YAAY,CAAc;QAC1B,gBAAW,GAAX,WAAW,CAAa;QAN1B,WAAM,GAAG,IAAI,eAAM,CAAC,gBAAc,CAAC,IAAI,CAAC,CAAC;IAOvD,CAAC;IAEI,mBAAmB,CAAC,GAAa,EAAE,KAAc;QACvD,gFAAgF;QAChF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACW,sBAAsB,CAClC,KAA+B,EAC/B,YAAoB;;YAEpB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACjF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,0BAAiB,CAAC,4BAA4B,YAAY,GAAG,CAAC,CAAC;YAC3E,CAAC;YACD,IAAA,yCAAyB,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAYK,sBAAsB,CAAQ,GAAa,EAAkB,MAAc;;YAC/E,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAA,WAAI,EAAC,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC,CAAC,CAAC;QAC7E,CAAC;KAAA;IAqDK,QAAQ,CACL,OAAgB,EAChB,GAAa,EACJ,KAAc,EAC+B,YAAqB,EAElF,sBAAgC,EAEhC,aAAuB,EAC+B,KAAc,EACb,MAAe;;YAEtE,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,wDAAwD,CACzD,CAAC;gBAEF,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;gBACvD,MAAM,OAAO,GAAG;oBACd,sBAAsB,EAAE,sBAAsB,aAAtB,sBAAsB,cAAtB,sBAAsB,GAAI,IAAI;oBACtD,aAAa,EAAE,aAAa,aAAb,aAAa,cAAb,aAAa,GAAI,IAAI;iBACrC,CAAC;gBAEF,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAChE,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC9C,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,2CAA2C,EAAE,KAAK,CAAC,CAAC;gBACtE,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAuBK,UAAU,CACP,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,mDAAmD,CACpD,CAAC;gBAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;gBAChD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,2CAA2C,CAAC,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAqBK,qBAAqB,CAClB,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,2BAAW,EACT,iBAAiB,EACjB,6DAA6D,CAC9D,CAAC;gBAEF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,4BAAmB,CAAC,0DAA0D,CAAC,CAAC;gBAC5F,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;oBACrB,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC3D,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,8CAA8C,CAAC,CAAC;YAC1F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAcK,kBAAkB,CACf,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACnE,MAAM,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,qCAAqC,YAAY,GAAG,CAAC,CAAC;YAChG,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAYK,wBAAwB,CAAQ,OAAgB,EAAS,GAAa;;YAC1E,IAAI,CAAC;gBACH,IAAA,oCAAoB,EAClB,IAAA,2CAA2B,EAAC,OAAO,CAAC,EACpC,4DAA4D,CAC7D,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,oCAAoC,EAAE,CAAC;gBAC3E,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,4BAA4B,IAAI,8BAA8B,CAAC,CAAC;YAC1G,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAiBK,gBAAgB,CACb,OAAgB,EACc,YAAoB,EACjD,IAAoB,EACrB,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,kEAAkE,CACnE,CAAC;gBACF,iFAAiF;gBACjF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;gBAC/E,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,kBAAkB,CAAC,WAAW,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;gBAC1F,MAAM,QAAQ,GAAG,IAAA,yBAAe,EAAC,IAAI,aAAJ,IAAI,uBAAJ,IAAI,CAAE,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,gBAAgB,IAAI,CAAC,EAAE,CAAC;oBAChE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;gBAE/E,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,6BAA6B,iBAAiB,CAAC,YAAY,YAAY,YAAY,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CACtH,CAAC;gBAEF,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE;oBACzC,QAAQ;oBACR,KAAK,EAAE,MAAM,CAAC,KAAK;oBACnB,gBAAgB;oBAChB,SAAS;iBACV,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAeK,eAAe,CACZ,OAAgB,EACc,YAAoB,EACjD,IAA4B,EAC7B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,qEAAqE,CACtE,CAAC;gBACF,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAEnE,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,YAAY,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACnE,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,wBAAwB,YAAY,cAAc,CAAC,CAAC;YAC9F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAyBK,qBAAqB,CAClB,OAAgB,EACf,IAA8B,EAC/B,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,uEAAuE,CACxE,CAAC;gBAEF,MAAM,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;gBAClD,IAAI,CAAC,YAAY;oBAAE,MAAM,IAAI,4BAAmB,CAAC,oCAAoC,CAAC,CAAC;gBACvF,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;oBACrC,MAAM,IAAI,4BAAmB,CAAC,0CAA0C,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBAClF,MAAM,SAAS,GAAG,kBAAkB,KAAK,uCAAkB,CAAC,MAAM;uBAC7D,kBAAkB,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBACrD,IAAI,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;gBAChE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;gBAClE,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,wBAAwB,YAAY,0BAA0B,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,QAAQ,CACL,OAAgB,EACf,gBAAuC,EACxC,GAAa;;;YAEpB,IAAI,CAAC;gBACH,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,kBAAkB,0CAAE,OAAO,MAAK,IAAI,EAAE,CAAC;oBAC7D,MAAM,IAAI,sBAAa,CACrB,mFAAmF,EACnF,mBAAU,CAAC,SAAS,CACrB,CAAC;gBACJ,CAAC;gBAED,MAAM,iBAAiB,GAAG,IAAA,8CAAwB,EAChD,IAAI,CAAC,cAAc,EACnB,UAAU,EACV,OAAO,EACP,CAAC,gBAAgB,aAAhB,gBAAgB,uBAAhB,gBAAgB,CAAE,KAAK,CAAC,CAC1B,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC;oBAC/B,OAAO,IAAA,qDAA+B,EAAC,GAAG,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,CAAC;gBACnF,CAAC;gBAED,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE;oBACrE,qBAAqB,EAAE,KAAK;iBAC7B,CAAC,CAAC;gBAEH,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;gBACzE,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACrK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,2DAA2D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,uBAAuB;qBACjK,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GACV,KAAK,YAAY,sBAAa,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,mBAAU,CAAC,WAAW,CAAC;gBAC9E,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,KAAK,EAAE,gBAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjF,CAAC;QACH,CAAC;KAAA;IAQK,iBAAiB,CAAQ,OAAgB,EAAU,gBAAiC,EAAS,GAAa;;YAC9G,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,oCAAoB,EAAC,iBAAiB,EAAE,gDAAgD,CAAC,CAAC;gBAC1F,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC;gBAEhE,wEAAwE;gBACxE,IAAA,0CAAqB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBAE3C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,gBAAgB,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE,CAAC,CAAC;gBACxG,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,YAAY,CAAC,sBAAsB,CAAC,gBAAgB,CAAC,KAAK,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;gBACpG,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,qFAAqF;oBACrF,iEAAiE;oBACjE,IAAI,CAAC;wBACH,MAAM,IAAI,CAAC,WAAW,CAAC,qBAAqB,CAAC,YAAY,CAAC,CAAC;oBAC7D,CAAC;oBAAC,OAAO,aAAa,EAAE,CAAC;wBACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,6BAA6B,YAAY,kBAAkB,aAAa,YAAY,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC;oBACjK,CAAC;oBACD,MAAM,IAAI,4BAAmB,CAAC;wBAC5B,IAAI,EAAE,kCAAkC;wBACxC,OAAO,EAAE,0DAA0D,UAAU,YAAY,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,oEAAoE;qBAC7M,CAAC,CAAC;gBACL,CAAC;gBACD,OAAO,yBAAa,CAAC,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,mBAAU,CAAC,OAAO,CAAC,CAAC;YAC/E,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IA2BK,YAAY,CACT,OAAgB,EACc,YAAoB,EACjD,IAAa,EACd,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,kBAAkB,GAAG,IAAA,wCAAwB,EAAC,IAAI,CAAC,CAAC;gBAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,YAAY,KAAK,YAAY,CAAC;gBAE/D,mFAAmF;gBACnF,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,IAAI,kBAAkB,EAAE,CAAC;oBACvB,IAAA,oCAAoB,EAClB,iBAAiB,EACjB,iFAAiF,CAClF,CAAC;oBACF,IAAA,0CAA0B,EAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;oBACpD,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;wBAC7B,MAAM,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAC,YAAY,CAAC,CAAC;oBAChE,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,sCAAsC,CACvC,CAAC;gBACJ,CAAC;gBAED,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBAC1E,MAAM,IAAI,4BAAmB,CAAC,6DAA6D,CAAC,CAAC;gBAC/F,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,YAAY,EAAE,IAAI,EAAE;oBACpD,sBAAsB,EAAE,iBAAiB,CAAC,SAAS,IAAI,iBAAiB,CAAC,SAAS;iBACnF,CAAC,CAAC;gBAEH,OAAO,yBAAa,CAAC,aAAa,CAChC,GAAG,EACH,YAAY,YAAY,oCAAoC,CAC7D,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;IAsBK,OAAO,CACJ,OAAgB,EACc,YAAoB,EAClD,GAAa;;YAEpB,IAAI,CAAC;gBACH,MAAM,iBAAiB,GAAG,IAAA,2CAA2B,EAAC,OAAO,CAAC,CAAC;gBAC/D,IAAA,qCAAqB,EACnB,iBAAiB,EACjB,YAAY,EACZ,6CAA6C,CAC9C,CAAC;gBACF,IAAI,iBAAiB,CAAC,YAAY,KAAK,YAAY,EAAE,CAAC;oBACpD,MAAM,IAAI,CAAC,sBAAsB,CAAC,iBAAiB,EAAE,YAAY,CAAC,CAAC;gBACrE,CAAC;gBAED,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7C,OAAO,yBAAa,CAAC,aAAa,CAAC,GAAG,EAAE,YAAY,YAAY,wBAAwB,CAAC,CAAC;YAC5F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,IAAI,CAAC,mBAAmB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA5oBY,wCAAc;AA0CnB;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,4BAA4B;KAC1C,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,mCAAmC;QAChD,QAAQ,EAAE,IAAI;KACf,CAAC;IACD,IAAA,YAAG,EAAC,uBAAuB,CAAC;IACC,WAAA,IAAA,YAAG,GAAE,CAAA;IAAiB,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;;;;4DAEjE;AAqDK;IAnDL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gCAAgC;QACzC,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,8BAA8B;QAC3C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+BAA+B;QAC5C,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,0BAA0B;QACvC,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,eAAe;QACrB,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,kBAAkB;QAC/B,IAAI,EAAE,OAAO;KACd,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,OAAO;QACb,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,+DAA+D;QAC5E,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,KAAK;QACf,WAAW,EAAE,4CAA4C;QACzD,IAAI,EAAE,MAAM;KACb,CAAC;IACD,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,WAAW,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,OAAO,CAAC,CAAA;IACd,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAC3D,WAAA,IAAA,cAAK,EAAC,wBAAwB,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAEtE,WAAA,IAAA,cAAK,EAAC,eAAe,EAAE,IAAI,sBAAa,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IAE7D,WAAA,IAAA,cAAK,EAAC,OAAO,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;IACpD,WAAA,IAAA,cAAK,EAAC,QAAQ,EAAE,IAAI,qBAAY,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAA;;;;8CAsBvD;AAuBK;IArBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mBAAmB;QAC5B,WAAW,EAAE,YAAY;QACzB,WAAW,EAAE,qEAAqE;KACnF,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gDAAgD;QAC7D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,+BAA+B,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,2BAA2B,CAAC;IAEjC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;gDAmBP;AAqBK;IAnBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,mCAAmC;QAC5C,WAAW,EAAE,uBAAuB;QACpC,WAAW,EAAE,2FAA2F;KACzG,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,gEAAgE;QAC7E,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,kCAAkC,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACnG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,sCAAsC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,eAAM,EAAC,qCAAqC,CAAC;IAE3C,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;2DAuBP;AAcK;IAZL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,yHAAyH;KACvI,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,oCAAoC,CAAC;IAExC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;wDAcP;AAYK;IAVL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,kEAAkE;QAC3E,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,+JAA+J;KAC7K,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACzF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gCAAgC,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChG,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,6BAA6B,CAAC;IACJ,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,YAAG,GAAE,CAAA;;;;8DAW7D;AAiBK;IAfL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0DAA0D;QACnE,WAAW,EAAE,kBAAkB;QAC/B,WAAW,EACT,4XAA4X;KAC/X,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,uBAAuB,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACpH,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,4BAAc,EAAE,CAAC;IACjC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oCAAoC,EAAE,IAAI,EAAE,6BAAe,EAAE,CAAC;IACtG,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,gBAAgB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAChF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACpF,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,wBAAwB,CAAC;IAE5B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,4BAAc;;sDAkC7B;AAeK;IAbL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,+CAA+C;QACxD,WAAW,EAAE,iBAAiB;QAC9B,WAAW,EAAE,6GAA6G;KAC3H,CAAC;IACD,IAAA,kBAAQ,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,WAAW,EAAE,mCAAmC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAChI,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,+CAAsB,EAAE,CAAC;IACzC,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,6BAAc,EAAE,CAAC;IACtF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACrF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,4BAA4B,CAAC;IAEhC,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,+CAAsB;;qDAgBrC;AAyBK;IAvBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,gDAAgD;QACzD,WAAW,EAAE,uBAAuB;KACrC,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,2BAA2B;QACxC,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,gDAAwB,EAAE,CAAC;IAC3C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,WAAW,CAAC;IAEf,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADQ,gDAAwB;;2DA+BvC;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,8IAA8I;QAC3J,WAAW,EAAE,UAAU;KACxB,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,6CAAqB;QAC3B,WAAW,EAAE,iDAAiD;KAC/D,CAAC;IACD,IAAA,4BAAkB,EAAC;QAClB,WAAW,EACT,kGAAkG;QACpG,IAAI,EAAE,mCAAgB;KACvB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,WAAW;QAC9B,WAAW,EAAE,6BAA6B;QAC1C,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,qBAAqB;QACxC,WAAW,EAAE,sEAAsE;QACnF,IAAI,EAAE,4BAAa;KACpB,CAAC;IACD,IAAA,aAAI,EAAC,UAAU,CAAC;IAEd,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;6CADoB,6CAAqB;;8CA8ChD;AAQK;IANL,IAAA,sBAAY,EAAC,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,mBAAmB,EAAE,WAAW,EAAE,sGAAsG,EAAE,CAAC;IAC5N,IAAA,iBAAO,EAAC,EAAE,IAAI,EAAE,iCAAe,EAAE,CAAC;IAClC,IAAA,4BAAkB,EAAC,EAAE,IAAI,EAAE,mCAAgB,EAAE,CAAC;IAC9C,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,aAAI,EAAC,qBAAqB,CAAC;IACH,WAAA,IAAA,YAAG,GAAE,CAAA;IAAoB,WAAA,IAAA,aAAI,GAAE,CAAA;IAAqC,WAAA,IAAA,YAAG,GAAE,CAAA;;6CAAvB,iCAAe;;uDA6BzF;AA2BK;IAzBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,cAAc;KAC5B,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,iDAAiD;QAC9D,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,iBAAO,EAAC;QACP,IAAI,EAAE,iBAAO;QACb,WAAW,EAAE,6BAA6B;KAC3C,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,mBAAU,CAAC,EAAE;QACrB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,2BAA2B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC3F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,YAAG,EAAC,2BAA2B,CAAC;IAE9B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,aAAI,GAAE,CAAA;IACN,WAAA,IAAA,YAAG,GAAE,CAAA;;qDADQ,iBAAO;;kDA6CtB;AAsBK;IApBL,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,wCAAwC;QACjD,WAAW,EAAE,SAAS;KACvB,CAAC;IACD,IAAA,kBAAQ,EAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EAAE,uDAAuD;QACpE,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG;KACb,CAAC;IACD,IAAA,qBAAW,EAAC;QACX,MAAM,EAAE,GAAG;QACX,WAAW,EAAE,sCAAsC;QACnD,IAAI,EAAE,6BAAc;KACrB,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,wBAAwB,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IACxF,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,4BAA4B,EAAE,IAAI,EAAE,4BAAa,EAAE,CAAC;IAC5F,IAAA,uBAAa,GAAE;IACf,IAAA,kBAAS,EAAC,6BAAc,CAAC;IACzB,IAAA,cAAK,EAAC,wBAAwB,CAAC;IAE7B,WAAA,IAAA,YAAG,GAAE,CAAA;IACL,WAAA,IAAA,cAAK,EAAC,cAAc,EAAE,qBAAY,CAAC,CAAA;IACnC,WAAA,IAAA,YAAG,GAAE,CAAA;;;;6CAkBP;yBA3oBU,cAAc;IAN1B,IAAA,iBAAO,EAAC,MAAM,CAAC;IACf,IAAA,mBAAU,EAAC,cAAc,CAAC;IAC3B;;;OAGG;;IAKE,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;6CACI,yBAAW;QACV,2BAAY;QACb,yBAAW;GAPhC,cAAc,CA4oB1B","sourcesContent":["import {\n BadRequestException,\n Body,\n Controller,\n Delete,\n Get,\n HttpException,\n HttpStatus,\n NotFoundException,\n Param,\n ParseBoolPipe,\n ParseIntPipe,\n Patch,\n Post,\n Put,\n Query,\n Inject,\n Req,\n Res,\n UseGuards,\n} from '@nestjs/common';\nimport { Request, Response } from 'express';\nimport {\n ApiBearerAuth,\n ApiBody,\n ApiCreatedResponse,\n ApiOperation,\n ApiParam,\n ApiQuery,\n ApiResponse,\n ApiTags,\n} from '@nestjs/swagger';\nimport { join } from 'path';\nimport { Logger } from '../../Logger';\nimport { RestUtilities } from '../../Utilities';\nimport type { AccessiOptions } from '../AccessiModule';\nimport { ActionResponse, ErrorResponse } from '../Dtos/BaseResponse';\nimport { GetUsersResponse } from '../Dtos/GetUsersResponse';\nimport { LoginAsRequest, LoginAsResponse } from '../Dtos/LoginAsDtos';\nimport { PublicRegisterRequest } from '../Dtos/PublicRegisterRequest';\nimport { RegisterResponse } from '../Dtos/RegisterResponse';\nimport { RegisterRequest } from '../Dtos/RegisterRequest';\nimport { SetStatoRegistrazioneDto } from '../Dtos/SetStatoRegistrazione';\nimport { SetUserPasswordRequest } from '../Dtos/SetUserPasswordRequest';\nimport { UserDto } from '../Dtos/UserDto';\nimport { AuthService } from '../Services/AuthService/AuthService';\nimport { EmailService } from '../Services/EmailService/EmailService';\nimport { UserService } from '../Services/UserService/UserService';\nimport { JwtSimpleGuard } from '../jwt/jwt.strategy';\nimport {\n checkPublicAuthRateLimit,\n sendPublicAuthRateLimitExceeded,\n} from '../security/publicAuthRateLimit';\nimport {\n ensureAdmin,\n ensureCanManageTargetUser,\n ensurePrivilegeFlagChanges,\n ensureSelfOrSuperUser,\n ensureUserManagement,\n getAuthenticatedAccessiUser,\n hasPrivilegedUserChanges,\n} from '../security/accessControl';\nimport type { AuthenticatedAccessiUser } from '../security/accessControl';\nimport { assertEmailConfigured } from '../security/emailConfiguration';\nimport { buildLoginAsUrl } from '../security/loginAs';\nimport { StatoRegistrazione } from '../Dtos/StatoRegistrazione';\n\n@ApiTags('User')\n@Controller('accessi/user')\n/**\n * Gestione utenti: la registrazione pubblica e opt-in, mentre creazione, stato e profili privilegiati\n * richiedono un superutente Accessi. Le API restituiscono sempre il wrapper `BaseResponse` storico.\n */\nexport class UserController {\n private readonly logger = new Logger(UserController.name);\n\n constructor(\n @Inject('ACCESSI_OPTIONS') private readonly accessiOptions: AccessiOptions,\n private readonly userService: UserService,\n private readonly emailService: EmailService,\n private readonly authService: AuthService,\n ) {}\n\n private sendControllerError(res: Response, error: unknown) {\n // Lo status viene derivato centralmente da RestUtilities (HttpException o 500).\n return RestUtilities.sendErrorMessage(res, error, UserController.name);\n }\n\n /**\n * Verifica che il target esista e che l'attore possa gestirlo (rango attore >=\n * rango target: ADMIN > SUPER > utente). Restituisce lo snapshot corrente del\n * target, così i chiamanti possono controllare se e' admin.\n */\n private async ensureManageableTarget(\n actor: AuthenticatedAccessiUser,\n codiceUtente: number,\n ) {\n const target = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!target) {\n throw new NotFoundException(`Nessun utente con codice ${codiceUtente}.`);\n }\n ensureCanManageTargetUser(actor, target);\n return target;\n }\n\n @ApiOperation({\n summary: 'Serve la pagina di reset password',\n operationId: 'serveResetPasswordPageUser',\n })\n @ApiParam({\n name: 'token',\n description: 'Token per il reset della password',\n required: true,\n })\n @Get('reset-password/:token')\n async serveResetPasswordPage(@Res() res: Response, @Param('token') _token: string) {\n return res.sendFile(join(__dirname, '..', 'Views', 'reset-password.html'));\n }\n\n @ApiOperation({\n summary: 'Recupera la lista degli utenti',\n operationId: 'getUsers',\n })\n @ApiResponse({\n status: 200,\n description: 'Lista utenti recuperata con successo',\n type: GetUsersResponse,\n })\n @ApiResponse({ status: 401, description: 'Credenziali non valide', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiQuery({\n name: 'email',\n required: false,\n description: \"Email dell'utente da cercare\",\n type: String,\n })\n @ApiQuery({\n name: 'codiceUtente',\n required: false,\n description: \"Codice dell'utente da cercare\",\n type: Number,\n })\n @ApiQuery({\n name: 'includeExtensionFields',\n required: false,\n description: 'Includi extension fields',\n type: Boolean,\n })\n @ApiQuery({\n name: 'includeGrants',\n required: false,\n description: 'Includi permessi',\n type: Boolean,\n })\n @ApiQuery({\n name: 'limit',\n required: false,\n description: 'Numero massimo di utenti restituiti (1-1000). Omesso = tutti.',\n type: Number,\n })\n @ApiQuery({\n name: 'offset',\n required: false,\n description: 'Numero di utenti da saltare (paginazione).',\n type: Number,\n })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Get('get-users')\n async getUsers(\n @Req() request: Request,\n @Res() res: Response,\n @Query('email') email?: string,\n @Query('codiceUtente', new ParseIntPipe({ optional: true })) codiceUtente?: number,\n @Query('includeExtensionFields', new ParseBoolPipe({ optional: true }))\n includeExtensionFields?: boolean,\n @Query('includeGrants', new ParseBoolPipe({ optional: true }))\n includeGrants?: boolean,\n @Query('limit', new ParseIntPipe({ optional: true })) limit?: number,\n @Query('offset', new ParseIntPipe({ optional: true })) offset?: number,\n ) {\n try {\n ensureUserManagement(\n getAuthenticatedAccessiUser(request),\n 'Solo gli amministratori possono consultare gli utenti.',\n );\n\n const filters = { email, codiceUtente, limit, offset };\n const options = {\n includeExtensionFields: includeExtensionFields ?? true,\n includeGrants: includeGrants ?? true,\n };\n\n const users = await this.userService.getUsers(filters, options);\n const total = await this.userService.countUsers({ email, codiceUtente });\n res.setHeader('X-Total-Count', String(total));\n return RestUtilities.sendBaseResponse(res, users);\n } catch (error) {\n this.logger.error('Errore durante il recupero degli utenti: ', error);\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Elimina un utente',\n operationId: 'deleteUser',\n description: 'Imposta lo stato di un utente a eliminato senza rimuovere i record.',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da eliminare\",\n required: true,\n example: 123,\n })\n @ApiResponse({ status: 200, description: 'Utente eliminato con successo', type: ActionResponse })\n @ApiResponse({\n status: 400,\n description: 'Errore nei parametri della richiesta',\n type: ErrorResponse,\n })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Delete('delete-user/:codiceUtente')\n async deleteUser(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono eliminare utenti.',\n );\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n if (target.flagAdmin) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.deleteUser(codiceUtente);\n return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato con successo.\");\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Elimina definitivamente un utente',\n operationId: 'deleteUserPermanently',\n description: 'Rimuove l utente e tutti i record collegati. Operazione distruttiva riservata agli admin.',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da eliminare definitivamente\",\n required: true,\n example: 123,\n })\n @ApiResponse({ status: 200, description: 'Utente eliminato definitivamente', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Errore nei parametri della richiesta', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Delete('delete-user-permanent/:codiceUtente')\n async deleteUserPermanently(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureAdmin(\n authenticatedUser,\n 'Solo gli admin possono eliminare definitivamente un utente.',\n );\n\n if (authenticatedUser.codiceUtente === codiceUtente) {\n throw new BadRequestException('Non puoi eliminare definitivamente il tuo stesso utente.');\n }\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n if (target.flagAdmin) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.deleteUserPermanently(codiceUtente);\n return RestUtilities.sendOKMessage(res, \"L'utente e' stato eliminato definitivamente.\");\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Forza l invio dell email di reset password a un utente',\n operationId: 'forcePasswordReset',\n description: 'Riservato al superutente. Richiede un servizio email configurato; altrimenti risponde con ACCESSI_EMAIL_NOT_CONFIGURED.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n @ApiResponse({ status: 200, description: 'Email di reset inviata', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('force-password-reset/:codiceUtente')\n async forcePasswordReset(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono forzare il reset password.',\n );\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n await this.userService.forcePasswordReset(codiceUtente);\n return RestUtilities.sendOKMessage(res, `Email di reset inviata all utente ${codiceUtente}.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Forza il reset password per tutti gli utenti con password legacy',\n operationId: 'forcePasswordResetLegacy',\n description: 'Riservato al superutente. Invia l email di reset a tutti gli utenti la cui password non e ancora nel formato moderno. Richiede un servizio email configurato.',\n })\n @ApiResponse({ status: 200, description: 'Email di reset inviate', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Servizio email non configurato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('force-password-reset-legacy')\n async forcePasswordResetLegacy(@Req() request: Request, @Res() res: Response) {\n try {\n ensureUserManagement(\n getAuthenticatedAccessiUser(request),\n 'Solo gli amministratori possono forzare il reset password.',\n );\n const sent = await this.userService.forcePasswordResetForLegacyPasswords();\n return RestUtilities.sendOKMessage(res, `Email di reset inviata a ${sent} utenti con password legacy.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Genera un URL di accesso temporaneo come un altro utente',\n operationId: 'createLoginAsUrl',\n description:\n 'Riservato a superutenti e admin (con la gerarchia ADMIN > SUPER). Genera un token per l utente target, con la stessa durata della sessione Accessi standard (jwtOptions.expiresIn), e lo allega all URL indicato come query parameter loginAsToken. Il token e una credenziale: non condividerlo e non registrarlo. Da quel momento l applicazione di destinazione decide come consumarlo.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Utente da impersonare', required: true, example: 123, type: Number })\n @ApiBody({ type: LoginAsRequest })\n @ApiResponse({ status: 200, description: 'URL di accesso temporaneo generato', type: LoginAsResponse })\n @ApiResponse({ status: 400, description: 'URL non valido', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 404, description: 'Utente non trovato', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('login-as/:codiceUtente')\n async createLoginAsUrl(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() body: LoginAsRequest,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo superutenti e admin possono generare un accesso temporaneo.',\n );\n // Stessa gerarchia della gestione utenti: un superutente non impersona un admin.\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n const loginResult = await this.authService.getLoginResultForUser(codiceUtente);\n const issued = this.authService.createLoginAsToken(loginResult.utente, authenticatedUser);\n const loginUrl = buildLoginAsUrl(body?.url, issued.value);\n const expiresInSeconds = Number(issued.expiresIn);\n if (!Number.isFinite(expiresInSeconds) || expiresInSeconds <= 0) {\n throw new Error('Token Login as emesso senza una scadenza valida.');\n }\n const expiresAt = new Date(Date.now() + expiresInSeconds * 1000).toISOString();\n\n this.logger.info(\n `Login as generato: attore=${authenticatedUser.codiceUtente}, target=${codiceUtente}, host=${new URL(loginUrl).host}`,\n );\n\n return RestUtilities.sendBaseResponse(res, {\n loginUrl,\n token: issued.value,\n expiresInSeconds,\n expiresAt,\n });\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta direttamente la password di un utente',\n operationId: 'setUserPassword',\n description: 'Riservato agli amministratori. Hasha la password, aggiorna la scadenza secondo la policy e non invia email.',\n })\n @ApiParam({ name: 'codiceUtente', description: 'Codice identificativo dell utente', required: true, example: 123, type: Number })\n @ApiBody({ type: SetUserPasswordRequest })\n @ApiResponse({ status: 200, description: 'Password aggiornata', type: ActionResponse })\n @ApiResponse({ status: 400, description: 'Password non valida', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('set-password/:codiceUtente')\n async setUserPassword(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() body: SetUserPasswordRequest,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono impostare la password di un utente.',\n );\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n\n await this.authService.setPassword(codiceUtente, body.newPassword);\n return RestUtilities.sendOKMessage(res, `Password dell utente ${codiceUtente} aggiornata.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta lo stato di registrazione di un utente',\n operationId: 'setStatoRegistrazione',\n })\n @ApiResponse({\n status: 200,\n description: 'Stato registrazione aggiornato con successo',\n type: ActionResponse,\n })\n @ApiResponse({\n status: 400,\n description: 'Errore nei parametri della richiesta',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: 500,\n description: 'Errore interno del server',\n type: ErrorResponse,\n })\n @ApiBody({ type: SetStatoRegistrazioneDto })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('set-stato')\n async setStatoRegistrazione(\n @Req() request: Request,\n @Body() body: SetStatoRegistrazioneDto,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono modificare lo stato di registrazione.',\n );\n\n const { codiceUtente, statoRegistrazione } = body;\n if (!codiceUtente) throw new BadRequestException('Il codice utente e\\' obbligatorio.');\n if (statoRegistrazione === undefined) {\n throw new BadRequestException('Lo stato registrazione e\\' obbligatorio.');\n }\n\n const target = await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n const disabling = statoRegistrazione === StatoRegistrazione.DELETE\n || statoRegistrazione === StatoRegistrazione.BLOCC;\n if (target.flagAdmin && disabling) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n\n await this.userService.setStato(codiceUtente, statoRegistrazione);\n return RestUtilities.sendOKMessage(\n res,\n `Lo stato dell'utente ${codiceUtente} e' stato aggiornato a ${statoRegistrazione}.`,\n );\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Registra un nuovo utente',\n description: 'Disponibile soltanto quando publicRegistration.enabled e true. Per utenti SSO usare il provisioning master nel tag Federated authentication.',\n operationId: 'register',\n })\n @ApiBody({\n type: PublicRegisterRequest,\n description: \"Dati necessari per la registrazione dell'utente\",\n })\n @ApiCreatedResponse({\n description:\n 'Utente registrato con successo. Restituisce il codice utente e invia una mail di reset password.',\n type: RegisterResponse,\n })\n @ApiResponse({\n status: HttpStatus.BAD_REQUEST,\n description: 'Errore nella registrazione.',\n type: ErrorResponse,\n })\n @ApiResponse({\n status: HttpStatus.INTERNAL_SERVER_ERROR,\n description: 'Errore interno del server durante la registrazione o l\\'invio email.',\n type: ErrorResponse,\n })\n @Post('register')\n async register(\n @Req() request: Request,\n @Body() registrationData: PublicRegisterRequest,\n @Res() res: Response,\n ) {\n try {\n if (this.accessiOptions.publicRegistration?.enabled !== true) {\n throw new HttpException(\n 'La registrazione pubblica e disabilitata. Un amministratore deve creare l utente.',\n HttpStatus.FORBIDDEN,\n );\n }\n\n const rateLimitDecision = checkPublicAuthRateLimit(\n this.accessiOptions,\n 'register',\n request,\n [registrationData?.email],\n );\n if (!rateLimitDecision.allowed) {\n return sendPublicAuthRateLimitExceeded(res, rateLimitDecision.retryAfterSeconds);\n }\n\n assertEmailConfigured(this.accessiOptions);\n\n const codiceUtente = await this.userService.register(registrationData, {\n allowPrivilegedFields: false,\n });\n\n try {\n await this.emailService.sendPasswordResetEmail(registrationData.email);\n } catch (emailError) {\n try {\n await this.userService.deleteUserPermanently(codiceUtente);\n } catch (rollbackError) {\n this.logger.error(`Rollback registrazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n }\n throw new BadRequestException({\n code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n message: `Registrazione non completata: invio email non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova piu tardi.`,\n });\n }\n return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n } catch (error) {\n const status =\n error instanceof HttpException ? error.getStatus() : HttpStatus.BAD_REQUEST;\n return RestUtilities.sendErrorMessage(res, error, UserController.name, status);\n }\n }\n\n @ApiOperation({ summary: 'Crea un utente locale da amministrazione', operationId: 'createManagedUser', description: 'Riservato a superutente. Crea un utente in attesa di impostazione password e invia la mail di reset.' })\n @ApiBody({ type: RegisterRequest })\n @ApiCreatedResponse({ type: RegisterResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Post('create-managed-user')\n async createManagedUser(@Req() request: Request, @Body() registrationData: RegisterRequest, @Res() res: Response) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureUserManagement(authenticatedUser, 'Solo gli amministratori possono creare utenti.');\n ensurePrivilegeFlagChanges(authenticatedUser, registrationData);\n\n // Fail-fast prima di scrivere: senza SMTP non si crea un utente orfano.\n assertEmailConfigured(this.accessiOptions);\n\n const codiceUtente = await this.userService.register(registrationData, { allowPrivilegedFields: true });\n try {\n await this.emailService.sendPasswordResetEmail(registrationData.email, registrationData.htmlMail);\n } catch (emailError) {\n // L'invio e' esterno: se fallisce annulliamo la creazione per non lasciare un utente\n // senza password e senza email di invito (rollback best-effort).\n try {\n await this.userService.deleteUserPermanently(codiceUtente);\n } catch (rollbackError) {\n this.logger.error(`Rollback creazione utente ${codiceUtente} non riuscita: ${rollbackError instanceof Error ? rollbackError.message : String(rollbackError)}`);\n }\n throw new BadRequestException({\n code: 'ACCESSI_USER_INVITE_EMAIL_FAILED',\n message: `Utente non creato: invio email di invito non riuscito (${emailError instanceof Error ? emailError.message : String(emailError)}). Riprova oppure crea l utente e imposta la password manualmente.`,\n });\n }\n return RestUtilities.sendBaseResponse(res, codiceUtente, HttpStatus.CREATED);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Aggiorna un utente esistente',\n operationId: 'updateUtente',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente da aggiornare\",\n required: true,\n example: 123,\n })\n @ApiBody({\n type: UserDto,\n description: \"Dati aggiornati dell'utente\",\n })\n @ApiResponse({\n status: HttpStatus.OK,\n description: 'Utente aggiornato con successo',\n type: ActionResponse,\n })\n @ApiResponse({ status: 400, description: \"Errore nell'aggiornamento\", type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiResponse({ status: 500, description: 'Errore interno del server', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Put('update-user/:codiceUtente')\n async updateUtente(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Body() user: UserDto,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n const isPrivilegedUpdate = hasPrivilegedUserChanges(user);\n const isSelf = authenticatedUser.codiceUtente === codiceUtente;\n\n // ADMIN > SUPER: un superutente non puo' toccare un admin. Self sempre consentito.\n if (!isSelf) {\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n }\n\n if (isPrivilegedUpdate) {\n ensureUserManagement(\n authenticatedUser,\n 'Solo gli amministratori possono modificare ruoli, permessi o flag privilegiati.',\n );\n ensurePrivilegeFlagChanges(authenticatedUser, user);\n if (user.flagAdmin === false) {\n await this.userService.assertNotLastActiveAdmin(codiceUtente);\n }\n } else {\n ensureSelfOrSuperUser(\n authenticatedUser,\n codiceUtente,\n 'Puoi modificare solo il tuo profilo.',\n );\n }\n\n if (user.codiceUtente !== undefined && user.codiceUtente !== codiceUtente) {\n throw new BadRequestException('Il codice utente nel body non coincide con quello del path.');\n }\n\n await this.userService.updateUser(codiceUtente, user, {\n allowPrivilegedChanges: authenticatedUser.flagSuper || authenticatedUser.flagAdmin,\n });\n\n return RestUtilities.sendOKMessage(\n res,\n `L'utente ${codiceUtente} e' stato aggiornato con successo.`,\n );\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n\n @ApiOperation({\n summary: 'Imposta il consenso GDPR per un utente',\n operationId: 'setGdpr',\n })\n @ApiParam({\n name: 'codiceUtente',\n description: \"Codice identificativo dell'utente che accetta il GDPR\",\n required: true,\n example: 123,\n })\n @ApiResponse({\n status: 200,\n description: 'Consenso GDPR impostato con successo',\n type: ActionResponse,\n })\n @ApiResponse({ status: 400, description: 'Errore nella richiesta', type: ErrorResponse })\n @ApiResponse({ status: 403, description: 'Operazione non autorizzata', type: ErrorResponse })\n @ApiBearerAuth()\n @UseGuards(JwtSimpleGuard)\n @Patch('set-gdpr/:codiceUtente')\n async setGdpr(\n @Req() request: Request,\n @Param('codiceUtente', ParseIntPipe) codiceUtente: number,\n @Res() res: Response,\n ) {\n try {\n const authenticatedUser = getAuthenticatedAccessiUser(request);\n ensureSelfOrSuperUser(\n authenticatedUser,\n codiceUtente,\n 'Puoi impostare il GDPR solo sul tuo utente.',\n );\n if (authenticatedUser.codiceUtente !== codiceUtente) {\n await this.ensureManageableTarget(authenticatedUser, codiceUtente);\n }\n\n await this.userService.setGdpr(codiceUtente);\n return RestUtilities.sendOKMessage(res, `L'utente ${codiceUtente} ha accettato il GDPR.`);\n } catch (error) {\n return this.sendControllerError(res, error);\n }\n }\n}\n"]}
package/dist/accessi-module/Dtos/LoginAsDtos.js CHANGED
@@ -45,7 +45,10 @@ __decorate([
45
45
  __metadata("design:type", String)
46
46
  ], LoginAsResult.prototype, "token", void 0);
47
47
  __decorate([
48
- (0, swagger_1.ApiProperty)({ description: 'Validita del token in secondi.', example: 300 }),
48
+ (0, swagger_1.ApiProperty)({
49
+ description: 'Validita del token in secondi, la stessa della sessione Accessi standard.',
50
+ example: 86400,
51
+ }),
49
52
  __metadata("design:type", Number)
50
53
  ], LoginAsResult.prototype, "expiresInSeconds", void 0);
51
54
  __decorate([
package/dist/accessi-module/Dtos/LoginAsDtos.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"LoginAsDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/LoginAsDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAAmD;AACnD,iDAA8C;AAE9C,2EAA2E;AAC3E,MAAa,cAAc;CAQ1B;AARD,wCAQC;AADC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,mCAAmC;KAC7C,CAAC;IACD,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACvD,IAAA,wBAAM,EAAC,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;;2CACtE;AAGf,0DAA0D;AAC1D,MAAa,aAAa;CAqBzB;AArBD,sCAqBC;AAhBC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,gFAAgF;QAC7F,OAAO,EAAE,wFAAwF;KAClG,CAAC;;+CACgB;AAMlB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,yCAAyC;KACnD,CAAC;;4CACa;AAGf;IADC,IAAA,qBAAW,EAAC,EAAE,WAAW,EAAE,gCAAgC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;;uDACnD;AAM1B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,0BAA0B;KACpC,CAAC;;gDACiB;AAGrB,MAAa,eAAgB,SAAQ,2BAAY;CAGhD;AAHD,0CAGC;AADC;IADC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BAC5B,aAAa;+CAAC","sourcesContent":["import { ApiProperty } from '@nestjs/swagger';\nimport { IsString, Length } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\n\n/** Body per generare un URL di accesso temporaneo come un altro utente. */\nexport class LoginAsRequest {\n @ApiProperty({\n description: 'URL assoluto (http/https) dell applicazione a cui accedere.',\n example: 'https://app.example.com/dashboard',\n })\n @IsString({ message: 'L URL deve essere una stringa.' })\n @Length(1, 2048, { message: 'L URL deve essere compreso tra 1 e 2048 caratteri.' })\n url!: string;\n}\n\n/** Esito della generazione dell'URL di impersonazione. */\nexport class LoginAsResult {\n @ApiProperty({\n description: 'URL dell applicazione con il token allegato come query parameter loginAsToken.',\n example: 'https://app.example.com/dashboard?loginAsToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',\n })\n loginUrl!: string;\n\n @ApiProperty({\n description: 'Token JWT di accesso temporaneo per l utente target.',\n example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',\n })\n token!: string;\n\n @ApiProperty({ description: 'Validita del token in secondi.', example: 300 })\n expiresInSeconds!: number;\n\n @ApiProperty({\n description: 'Scadenza del token in formato ISO 8601.',\n example: '2026-10-23T14:05:00.000Z',\n })\n expiresAt!: string;\n}\n\nexport class LoginAsResponse extends BaseResponse {\n @ApiProperty({ type: LoginAsResult })\n Result!: LoginAsResult;\n}\n"]}
1
+ {"version":3,"file":"LoginAsDtos.js","sourceRoot":"","sources":["../../../src/accessi-module/Dtos/LoginAsDtos.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAA8C;AAC9C,qDAAmD;AACnD,iDAA8C;AAE9C,2EAA2E;AAC3E,MAAa,cAAc;CAQ1B;AARD,wCAQC;AADC;IANC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,6DAA6D;QAC1E,OAAO,EAAE,mCAAmC;KAC7C,CAAC;IACD,IAAA,0BAAQ,EAAC,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC;IACvD,IAAA,wBAAM,EAAC,CAAC,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,oDAAoD,EAAE,CAAC;;2CACtE;AAGf,0DAA0D;AAC1D,MAAa,aAAa;CAwBzB;AAxBD,sCAwBC;AAnBC;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,gFAAgF;QAC7F,OAAO,EAAE,wFAAwF;KAClG,CAAC;;+CACgB;AAMlB;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,sDAAsD;QACnE,OAAO,EAAE,yCAAyC;KACnD,CAAC;;4CACa;AAMf;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,2EAA2E;QACxF,OAAO,EAAE,KAAK;KACf,CAAC;;uDACwB;AAM1B;IAJC,IAAA,qBAAW,EAAC;QACX,WAAW,EAAE,yCAAyC;QACtD,OAAO,EAAE,0BAA0B;KACpC,CAAC;;gDACiB;AAGrB,MAAa,eAAgB,SAAQ,2BAAY;CAGhD;AAHD,0CAGC;AADC;IADC,IAAA,qBAAW,EAAC,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BAC5B,aAAa;+CAAC","sourcesContent":["import { ApiProperty } from '@nestjs/swagger';\nimport { IsString, Length } from 'class-validator';\nimport { BaseResponse } from './BaseResponse';\n\n/** Body per generare un URL di accesso temporaneo come un altro utente. */\nexport class LoginAsRequest {\n @ApiProperty({\n description: 'URL assoluto (http/https) dell applicazione a cui accedere.',\n example: 'https://app.example.com/dashboard',\n })\n @IsString({ message: 'L URL deve essere una stringa.' })\n @Length(1, 2048, { message: 'L URL deve essere compreso tra 1 e 2048 caratteri.' })\n url!: string;\n}\n\n/** Esito della generazione dell'URL di impersonazione. */\nexport class LoginAsResult {\n @ApiProperty({\n description: 'URL dell applicazione con il token allegato come query parameter loginAsToken.',\n example: 'https://app.example.com/dashboard?loginAsToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',\n })\n loginUrl!: string;\n\n @ApiProperty({\n description: 'Token JWT di accesso temporaneo per l utente target.',\n example: 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9...',\n })\n token!: string;\n\n @ApiProperty({\n description: 'Validita del token in secondi, la stessa della sessione Accessi standard.',\n example: 86400,\n })\n expiresInSeconds!: number;\n\n @ApiProperty({\n description: 'Scadenza del token in formato ISO 8601.',\n example: '2026-10-23T14:05:00.000Z',\n })\n expiresAt!: string;\n}\n\nexport class LoginAsResponse extends BaseResponse {\n @ApiProperty({ type: LoginAsResult })\n Result!: LoginAsResult;\n}\n"]}
package/dist/accessi-module/Services/AuthService/AuthService.d.ts CHANGED
@@ -25,8 +25,8 @@ export declare class AuthService {
25
25
  /** Creates the normal internal JWT consumed by all existing Accessi guards. */
26
26
  createAccessiToken(utente: LoginResult['utente'], methods?: string[], tokenOptions?: AccessiTokenIssueOptions): TokenResult;
27
27
  /**
28
- * Emette un access token breve per l'utente target, con l'attore registrato
29
- * nelle claim `act` e `loginAs`. La durata e' fissa a 5 minuti.
28
+ * Emette l'access token per l'utente target, con l'attore registrato nelle
29
+ * claim `act` e `loginAs`. La durata e' quella standard di jwtOptions.expiresIn.
30
30
  */
31
31
  createLoginAsToken(utente: LoginResult['utente'], actor: {
32
32
  codiceUtente: number;
package/dist/accessi-module/Services/AuthService/AuthService.js CHANGED
@@ -67,7 +67,6 @@ const FiltriService_1 = require("../FiltriService/FiltriService");
67
67
  const authenticatedToken_1 = require("../../security/authenticatedToken");
68
68
  const passwordResetToken_1 = require("../../security/passwordResetToken");
69
69
  const passwordPolicy_1 = require("../../security/passwordPolicy");
70
- const loginAs_1 = require("../../security/loginAs");
71
70
  const Logger_1 = require("../../../Logger");
72
71
  /** Error code deliberately returned when a user is configured as SSO-only. */
73
72
  exports.PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';
@@ -137,12 +136,11 @@ let AuthService = AuthService_1 = class AuthService {
137
136
  };
138
137
  }
139
138
  /**
140
- * Emette un access token breve per l'utente target, con l'attore registrato
141
- * nelle claim `act` e `loginAs`. La durata e' fissa a 5 minuti.
139
+ * Emette l'access token per l'utente target, con l'attore registrato nelle
140
+ * claim `act` e `loginAs`. La durata e' quella standard di jwtOptions.expiresIn.
142
141
  */
143
142
  createLoginAsToken(utente, actor) {
144
143
  return this.createAccessiToken(utente, ['login_as'], {
145
- expiresIn: loginAs_1.LOGIN_AS_TOKEN_TTL_SECONDS,
146
144
  extraClaims: {
147
145
  loginAs: true,
148
146
  act: {
package/dist/accessi-module/Services/AuthService/AuthService.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AuthService/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA2E;AAC3E,2EAAwF;AACxF,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,sEAAmE;AACnE,4DAAyD;AACzD,kEAA+D;AAC/D,0EAK2C;AAC3C,0EAG2C;AAC3C,kEAAqE;AACrE,oDAAoE;AACpE,4CAAyC;AAGzC,8EAA8E;AACjE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAU1D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,aAA4B,EACT,cAA+C,EACzD,gBAAkC;QAH3C,gBAAW,GAAX,WAAW,CAAa;QACxB,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QACzD,qBAAgB,GAAhB,gBAAgB,CAAkB;QANpC,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qFAAqF;QACrF,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,CAAC;IAClC,CAAC;IAED,+EAA+E;IACxE,kBAAkB,CACvB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,eAAyC,EAAE;;QAE3C,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACpH,MAAM,IAAI,8BAAqB,CAAC,2CAA2C,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,YAAY,CAAC,SAAS,mCAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QACrF,MAAM,gBAAgB,GAAG,OAAO,SAAS,KAAK,QAAQ;YACpD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,iCACf,CAAC,MAAA,YAAY,CAAC,WAAW,mCAAI,EAAE,CAAC,KAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,KAC1E,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,EACxC,EAAE,SAAS,EAAE,SAAyC,EAAE,CACzD,CAAC;QAEF,wFAAwF;QACxF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,cAAc,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,IAAI,OAAO,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG,CAAA,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,8EAA8E;QAC9E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7G,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC;QAEhF,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,kBAAkB,CACvB,MAA6B,EAC7B,KAA+C;QAE/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;YACnD,SAAS,EAAE,oCAA0B;YACrC,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE;oBACH,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;oBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IAC5E,qBAAqB,CAAC,YAAoB;;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAC3C,EAAE,YAAY,EAAE,EAChB,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CACtD,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAA,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,CAAC,IAAA,qDAAgC,EAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YACzG,MAAM,CAAC,MAAM,mCAAQ,MAAM,CAAC,MAAM,GAAK,OAAO,CAAE,CAAC;YAEjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC;QACJ,CAAC;KAAA;IAED,8EAA8E;IAChE,sBAAsB,CAAC,YAAoB;;;YACvD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE/E,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAmD,CAAC;YACnH,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,GAAG,CAAC;QAC9H,CAAC;KAAA;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAqB;;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,wBAAwB,EAAE,CAAC;gBACxH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YAChK,CAAC;YACD,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAEzD,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,+BAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB;oBAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,CAAC,CAAC,SAAS,CAAC;gBAEd,qGAAqG;gBACrG,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACnJ,CAAC;YAED,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;KAAA;IAED;;;OAGG;IACU,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAElE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1H,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,CAAC;KAAA;IAED,+FAA+F;IAClF,uBAAuB,CAAC,YAAoB,EAAE,WAAmB;;;YAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACvG,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACrI,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAqB;;;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrF,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7I,MAAM,IAAI,8BAAqB,CAAC,8DAA8D,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAAE,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;YAC7I,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;YACzJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,CAAA;oBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;gBAC7F,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAC9D,6KAA6K,EAC7K,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB,EAAE,IAAY;;YAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,qEAAqE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACpJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,kFAAkF,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAClK,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB;;YAC9C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,CAAC;KAAA;IAED;;;;OAIG;IACU,WAAW,CACtB,YAAoB,EACpB,aAAqB,EACrB,OAAqC;;YAErC,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,MAAK,KAAK,EAAE,CAAC;gBACrC,IAAA,qCAAoB,EAAC,aAAa,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACU,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAED,yGAAyG;IACnG,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEvC,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChF,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,6BAAiB,CAAC,sBAAsB,CACpE,cAAc,EACd,uBAAuB,CACxB,CAAC;YAEF,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAED,8GAA8G;IACxG,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,2EAA2E;IAC3E,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACU,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IAAA,qCAAoB,EAAC,WAAW,CAAC,CAAC;gBAElC,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACjE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAEnE,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;;oBACnF,6EAA6E;oBAC7E,+EAA+E;oBAC/E,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,gBAAgB,CACxC,WAAW,EACX,mHAAmH,EACnH,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uCAAkB,CAAC,IAAI,EAAE,uCAAkB,CAAC,KAAK,CAAC,CAClG,CAAC;oBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;oBACnG,IAAI,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBAC3E,CAAC;oBAED,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,gFAAgF,EAChF,CAAC,YAAY,EAAE,cAAc,CAAC,CAC/B,CAAC;oBAEF,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;wBAChE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,yCAAyC,cAAc,6CAA6C,EACpG,CAAC,YAAY,CAAC,CACf,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAA,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAhiBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFL,yBAAW;QACT,6BAAa,UAED,mCAAgB;GAP1C,WAAW,CAgiBvB","sourcesContent":["import { Inject, Injectable, UnauthorizedException } from \"@nestjs/common\";\nimport { TwoFactorService, TwoFactorProof } from '../TwoFactorService/TwoFactorService';\nimport * as jwt from \"jsonwebtoken\";\nimport { Orm } from \"../../../Orm\";\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\nimport type { AccessiOptions } from \"../../AccessiModule\";\nimport { LoginRequest } from \"../../Dtos/LoginRequest\";\nimport { LoginResult } from \"../../Dtos/LoginResponse\";\nimport { StatoRegistrazione } from \"../../Dtos/StatoRegistrazione\";\nimport { UserService } from \"../UserService/UserService\";\nimport { FiltriService } from \"../FiltriService/FiltriService\";\nimport {\n buildAuthenticatedTokenPayload,\n isAuthenticatedUserEnabledForJwt,\n isAccessiTokenAllowedForUser,\n resolveCodiceUtenteFromTokenPayload,\n} from \"../../security/authenticatedToken\";\nimport {\n getAccessiJwtSecret,\n verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport { assertStrongPassword } from '../../security/passwordPolicy';\nimport { LOGIN_AS_TOKEN_TTL_SECONDS } from '../../security/loginAs';\nimport { Logger } from \"../../../Logger\";\nimport { TokenResult } from '../../Dtos/TokenResult';\n\n/** Error code deliberately returned when a user is configured as SSO-only. */\nexport const PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';\n\ninterface AccessiTokenIssueOptions {\n /** Sovrascrive jwtOptions.expiresIn per token a durata ridotta (es. Login as). */\n expiresIn?: string | number;\n /** Claim aggiuntive, per esempio l'attore che ha generato un token di impersonazione. */\n extraClaims?: Record<string, unknown>;\n}\n\n@Injectable()\nexport class AuthService {\n private readonly logger = new Logger(AuthService.name);\n\n constructor(\n private userService: UserService,\n private filtriService: FiltriService,\n @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions,\n private readonly twoFactorService: TwoFactorService,\n ) {}\n\n private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\n if (!this.accessiOptions.passwordExpiration) {\n return;\n }\n\n const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\n const expirationDays =\n Number.isFinite(configuredDays) && configuredDays > 0\n ? Math.trunc(configuredDays)\n : 90;\n\n const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\n await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n }\n\n private isMockDemoUserEnabled(): boolean {\n if (!this.accessiOptions.mockDemoUser) {\n return false;\n }\n\n // La backdoor mock non e mai attiva in produzione, nemmeno con variabili d'ambiente,\n // perche emette un superutente senza verifica password.\n const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\n return nodeEnv !== \"production\";\n }\n\n /** Creates the normal internal JWT consumed by all existing Accessi guards. */\n public createAccessiToken(\n utente: LoginResult['utente'],\n methods: string[] = [],\n tokenOptions: AccessiTokenIssueOptions = {},\n ): TokenResult {\n if (!utente?.codiceUtente) {\n throw new Error('Impossibile creare un token senza un utente Accessi valido.');\n }\n const loginAs = methods.includes('login_as');\n if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp') && !loginAs) {\n throw new UnauthorizedException('Verifica del codice di accesso richiesta.');\n }\n\n const expiresIn = tokenOptions.expiresIn ?? this.accessiOptions.jwtOptions.expiresIn;\n const expiresInIsValid = typeof expiresIn === 'number'\n ? Number.isFinite(expiresIn) && expiresIn > 0\n : typeof expiresIn === 'string' && expiresIn.trim() !== '';\n if (!expiresInIsValid) {\n throw new Error('jwtOptions.expiresIn non configurato: impossibile emettere token senza scadenza.');\n }\n\n const token = jwt.sign(\n { ...(tokenOptions.extraClaims ?? {}), utente, typ: 'access', amr: methods },\n getAccessiJwtSecret(this.accessiOptions),\n { expiresIn: expiresIn as jwt.SignOptions['expiresIn'] },\n );\n\n // Difesa in profondita: un `expiresIn` malformato farebbe emettere un token permanente.\n const decoded = jwt.decode(token);\n const decodedPayload = decoded && typeof decoded === 'object' ? decoded as jwt.JwtPayload : undefined;\n if (typeof decodedPayload?.exp !== 'number') {\n throw new Error('Token emesso senza scadenza: configurazione JWT non valida.');\n }\n\n // Il contratto TokenResult espone sempre la validita in secondi, anche quando\n // jwtOptions.expiresIn usa un formato leggibile come '24h'.\n const issuedAt = typeof decodedPayload.iat === 'number' ? decodedPayload.iat : Math.floor(Date.now() / 1000);\n const expiresInSeconds = Math.max(0, Math.trunc(decodedPayload.exp - issuedAt));\n\n return {\n expiresIn: String(expiresInSeconds),\n value: token,\n type: 'Bearer',\n };\n }\n\n /**\n * Emette un access token breve per l'utente target, con l'attore registrato\n * nelle claim `act` e `loginAs`. La durata e' fissa a 5 minuti.\n */\n public createLoginAsToken(\n utente: LoginResult['utente'],\n actor: { codiceUtente: number; email?: string },\n ): TokenResult {\n return this.createAccessiToken(utente, ['login_as'], {\n expiresIn: LOGIN_AS_TOKEN_TTL_SECONDS,\n extraClaims: {\n loginAs: true,\n act: {\n sub: String(actor.codiceUtente),\n email: actor.email,\n },\n },\n });\n }\n\n /** Builds the standard login response for a user authenticated by a supported method. */\n public async getLoginResultForUser(codiceUtente: number): Promise<LoginResult> {\n const users = await this.userService.getUsers(\n { codiceUtente },\n { includeExtensionFields: true, includeGrants: true },\n );\n const result = users[0];\n if (!result?.utente) {\n throw new Error('Utente Accessi non trovato.');\n }\n const current = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(current)) throw new UnauthorizedException('Utente non abilitato.');\n result.utente = { ...result.utente, ...current };\n\n return {\n utente: result.utente,\n filtri: await this.filtriService.getFiltriUser(codiceUtente),\n userGrants: result.userGrants,\n extensionFields: result.extensionFields,\n };\n }\n\n /** Users without a row retain the historic password-login enabled default. */\n private async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n if (this.accessiOptions.federatedAuthentication?.enabled !== true) return true;\n\n const rows = await Orm.query(\n this.accessiOptions.databaseOptions,\n 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n [codiceUtente],\n );\n const policy = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { passwordLoginEnabled?: unknown } | undefined;\n return policy?.passwordLoginEnabled !== false && policy?.passwordLoginEnabled !== 0 && policy?.passwordLoginEnabled !== '0';\n }\n\n /**\n * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.\n * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.\n * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.\n */\n async login(request: LoginRequest): Promise<LoginResult> {\n const mockDemoUserEnabled = this.isMockDemoUserEnabled();\n\n if (\n mockDemoUserEnabled &&\n request.email.toLowerCase() === \"demo\"\n ) {\n return this.getDemoUser();\n }\n\n if (\n mockDemoUserEnabled &&\n request.email.toLowerCase() === \"admin\"\n ) {\n return this.getAdminUser();\n }\n\n const utente = await this.userService.getUserByEmail(\n request.email.trim().toLowerCase()\n );\n if (!utente) {\n if (!request.password) return { passwordRequired: true };\n throw new Error(\"Nome utente o password errata!\");\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);\n if (isAuthenticatedUserEnabledForJwt(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {\n return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: (currentUser.email ?? '').trim(), mode: 'passwordless' }) };\n }\n // The email-only step has the same response for unknown and ordinary local accounts.\n if (!request.password) return { passwordRequired: true };\n\n switch (utente.statoRegistrazione) {\n case undefined:\n throw new Error(\n \"Struttura dati compromessa: Stato Registrazione inesistente.\"\n );\n case StatoRegistrazione.BLOCC:\n case StatoRegistrazione.DELETE:\n throw new Error(\"Utente non abilitato\");\n case StatoRegistrazione.INVIO:\n throw new Error(\"Rinnovo password necessario.\");\n }\n\n if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\n throw new Error(\n `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\n );\n }\n\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) throw new Error('Utente non abilitato');\n if (!(await this.isPasswordLoginEnabled(utente.codiceUtente))) {\n throw new Error(PASSWORD_LOGIN_DISABLED);\n }\n\n if (typeof request.password !== 'string' || request.password.length === 0) {\n throw new Error('Nome utente o password errata!');\n }\n\n const isPasswordValid = await this.verifyPassword(\n utente.codiceUtente,\n request.password\n );\n if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\n\n if (\n this.accessiOptions.passwordExpiration &&\n this.accessiOptions.passwordExpiration == true\n ) {\n const today = new Date();\n const targetDate = utente.dataScadenzaPassword\n ? new Date(utente.dataScadenzaPassword)\n : undefined;\n\n // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.\n if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {\n throw new Error(\"PASSWORD_EXPIRED\");\n }\n }\n\n if (currentUser.flagDueFattori) {\n return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email ?? '', mode: 'password' }) };\n }\n\n const updateLastAccessDateQuery =\n \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\n await Orm.query(\n this.accessiOptions.databaseOptions,\n updateLastAccessDateQuery,\n [utente.codiceUtente]\n );\n\n return this.getLoginResultForUser(utente.codiceUtente);\n }\n\n /**\n * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.\n * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.\n */\n public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\n if (typeof token !== \"string\" || token.trim() === \"\") {\n throw new Error(\"Token non fornito.\");\n }\n\n const secret = getAccessiJwtSecret(this.accessiOptions);\n const decoded = jwt.verify(token.trim(), secret, { algorithms: ['HS256'] });\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n\n if (!codiceUtente) {\n throw new Error(\"Token non valido.\");\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!currentUser || !isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n throw new Error(\"Token non valido o utente non autorizzato.\");\n }\n\n return buildAuthenticatedTokenPayload(decoded, currentUser);\n }\n\n /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */\n public async beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult> {\n const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori) throw new UnauthorizedException();\n return { challenge: await this.twoFactorService.issue({ codiceUtente, email: user.email ?? '', mode: 'federated', identityKey }) };\n }\n\n private async validateTwoFactorProof(proof: TwoFactorProof): Promise<void> {\n const user = await this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori || user.email?.trim().toLowerCase() !== proof.email.trim().toLowerCase()) {\n throw new UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');\n }\n if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled) throw new UnauthorizedException('Accesso senza password disabilitato.');\n if (proof.mode === 'password' && !(await this.isPasswordLoginEnabled(proof.codiceUtente))) throw new UnauthorizedException('Login locale disabilitato.');\n if (proof.mode === 'federated') {\n if (!this.accessiOptions.federatedAuthentication?.enabled) throw new UnauthorizedException();\n const rows = await Orm.query(this.accessiOptions.databaseOptions,\n 'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1',\n [proof.identityKey, proof.codiceUtente], false);\n if (!rows.length) throw new UnauthorizedException('Identita SSO non piu abilitata.');\n }\n }\n\n public async verifyTwoFactor(challengeId: string, code: string): Promise<LoginResult> {\n const proof = await this.twoFactorService.consume(challengeId, code);\n await this.validateTwoFactorProof(proof);\n const result = await this.getLoginResultForUser(proof.codiceUtente);\n result.token = this.createAccessiToken(result.utente, [proof.mode, 'otp']);\n await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);\n if (proof.mode === 'federated') {\n await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);\n }\n return result;\n }\n\n public async resendTwoFactor(challengeId: string): Promise<LoginResult> {\n await this.validateTwoFactorProof(await this.twoFactorService.describe(challengeId));\n return { challenge: await this.twoFactorService.resend(challengeId) };\n }\n\n /**\n * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.\n * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di\n * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.\n */\n public async setPassword(\n codiceUtente: number,\n nuovaPassword: string,\n options?: { enforcePolicy?: boolean },\n ) {\n if (options?.enforcePolicy !== false) {\n assertStrongPassword(nuovaPassword);\n }\n try {\n const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\n const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\n\n const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\n codiceUtente,\n hashedPassword,\n ]);\n await this.refreshPasswordExpiration(codiceUtente);\n return result;\n } catch (error) {\n throw error;\n }\n }\n\n /**\n * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.\n * E idempotente: hash moderni e gia migrati vengono ignorati.\n */\n public async migrateLegacyEncryptedPasswords(): Promise<void> {\n const startedAt = performance.now();\n this.logger.info(\"Avvio migrazione password legacy accessi.\");\n const results = await Orm.query(\n this.accessiOptions.databaseOptions,\n \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n []\n );\n\n const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\n codiceUtente?: number;\n password?: string;\n }[];\n let migratedCount = 0;\n let skippedCount = 0;\n\n for (const row of rows) {\n const codiceUtente = Number(row.codiceUtente);\n const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\n if (\n !codiceUtente ||\n !storedPassword ||\n PasswordUtilities.isPasswordHash(storedPassword) ||\n PasswordUtilities.isLegacyPasswordHash(storedPassword)\n ) {\n skippedCount += 1;\n continue;\n }\n\n const protectedLegacyPassword =\n PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\n\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n [protectedLegacyPassword, codiceUtente, storedPassword]\n );\n migratedCount += 1;\n }\n\n this.logger.info(\n `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n );\n }\n\n /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */\n async verifyPassword(\n codiceUtente: number,\n plainPassword: string\n ): Promise<boolean> {\n const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\n const result = (await Orm.query(\n this.accessiOptions.databaseOptions,\n query,\n [codiceUtente]\n ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\n password: string;\n }[];\n\n const stored = result[0];\n if (!stored || typeof stored.password !== \"string\") {\n return false;\n }\n\n const storedPassword = stored.password;\n\n if (PasswordUtilities.isPasswordHash(storedPassword)) {\n return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\n }\n\n const legacyEncryptedPassword = CryptUtilities.encrypt(\n plainPassword,\n this.accessiOptions.encryptionKey\n );\n\n if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\n const isMigratedLegacyPasswordValid =\n PasswordUtilities.verifyLegacyEncryptedPassword(\n legacyEncryptedPassword,\n storedPassword\n );\n\n if (isMigratedLegacyPasswordValid) {\n await this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });\n }\n\n return isMigratedLegacyPasswordValid;\n }\n\n const isLegacyPasswordValid = PasswordUtilities.timingSafeStringEquals(\n storedPassword,\n legacyEncryptedPassword,\n );\n\n if (isLegacyPasswordValid) {\n await this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });\n }\n\n return isLegacyPasswordValid;\n }\n\n /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */\n async getAdminUser(): Promise<LoginResult> {\n return {\n utente: {\n codiceUtente: 6789,\n email: \"admin\",\n statoRegistrazione: StatoRegistrazione.CONF,\n cognome: \"Admin\",\n nome: \"Admin\",\n flagGdpr: true,\n avatar: \"/path/to/avatar.jpg\",\n flagDueFattori: false,\n codiceLingua: \"IT\",\n cellulare: \"+391234567890\",\n flagSuper: true,\n roles: [],\n permissions: [],\n },\n filtri: null,\n userGrants: {\n abilitazioni: [],\n grants: [],\n ruoli: [],\n },\n };\n }\n\n /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */\n getDemoUser(): LoginResult {\n return {\n utente: {\n codiceUtente: 12345,\n email: \"jdoe\",\n statoRegistrazione: StatoRegistrazione.CONF,\n cognome: \"Doe\",\n nome: \"John\",\n flagGdpr: true,\n avatar: \"/path/to/avatar.jpg\",\n flagDueFattori: false,\n codiceLingua: \"IT\",\n cellulare: \"+391234567890\",\n flagSuper: false,\n roles: [],\n permissions: [],\n },\n filtri: null,\n userGrants: {\n abilitazioni: [],\n grants: [],\n ruoli: [],\n },\n };\n }\n\n /**\n * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.\n * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.\n */\n public async confirmResetPassword(\n token: string,\n newPassword: string\n ): Promise<void> {\n try {\n if (typeof token !== \"string\" || token.trim() === \"\") {\n throw new Error(\"Token non valido.\");\n }\n\n assertStrongPassword(newPassword);\n\n const secret = getAccessiJwtSecret(this.accessiOptions, 'reset');\n const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\n\n const hashedPassword = PasswordUtilities.hashPassword(newPassword);\n\n await Orm.withTransaction(this.accessiOptions.databaseOptions, async (transaction) => {\n // A conditional write claims the nonce under the database row lock. A second\n // concurrent reset cannot also consume it; failures roll the whole reset back.\n const claimed = await Orm.transactionQuery<unknown>(\n transaction,\n 'UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE',\n [StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione.CONF, StatoRegistrazione.INVIO],\n );\n const row = (Array.isArray(claimed) ? claimed[0] : claimed) as Record<string, unknown> | undefined;\n if (Number(row?.CODUTE ?? row?.codute) !== codiceUtente) {\n throw new Error('Token non valido, gia usato o utente non autorizzato.');\n }\n\n await Orm.transactionQuery(\n transaction,\n 'UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)',\n [codiceUtente, hashedPassword],\n );\n\n if (this.accessiOptions.passwordExpiration) {\n const days = Number(this.accessiOptions.passwordExpirationDays);\n const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;\n await Orm.transactionQuery(\n transaction,\n `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`,\n [codiceUtente],\n );\n }\n });\n } catch (error) {\n throw error;\n }\n }\n}\n"]}
1
+ {"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AuthService/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA2E;AAC3E,2EAAwF;AACxF,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,sEAAmE;AACnE,4DAAyD;AACzD,kEAA+D;AAC/D,0EAK2C;AAC3C,0EAG2C;AAC3C,kEAAqE;AACrE,4CAAyC;AAGzC,8EAA8E;AACjE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAU1D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,aAA4B,EACT,cAA+C,EACzD,gBAAkC;QAH3C,gBAAW,GAAX,WAAW,CAAa;QACxB,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QACzD,qBAAgB,GAAhB,gBAAgB,CAAkB;QANpC,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qFAAqF;QACrF,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,CAAC;IAClC,CAAC;IAED,+EAA+E;IACxE,kBAAkB,CACvB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,eAAyC,EAAE;;QAE3C,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACpH,MAAM,IAAI,8BAAqB,CAAC,2CAA2C,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,YAAY,CAAC,SAAS,mCAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QACrF,MAAM,gBAAgB,GAAG,OAAO,SAAS,KAAK,QAAQ;YACpD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,iCACf,CAAC,MAAA,YAAY,CAAC,WAAW,mCAAI,EAAE,CAAC,KAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,KAC1E,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,EACxC,EAAE,SAAS,EAAE,SAAyC,EAAE,CACzD,CAAC;QAEF,wFAAwF;QACxF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,cAAc,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,IAAI,OAAO,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG,CAAA,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,8EAA8E;QAC9E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7G,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC;QAEhF,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,kBAAkB,CACvB,MAA6B,EAC7B,KAA+C;QAE/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;YACnD,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE;oBACH,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;oBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IAC5E,qBAAqB,CAAC,YAAoB;;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAC3C,EAAE,YAAY,EAAE,EAChB,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CACtD,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAA,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,CAAC,IAAA,qDAAgC,EAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YACzG,MAAM,CAAC,MAAM,mCAAQ,MAAM,CAAC,MAAM,GAAK,OAAO,CAAE,CAAC;YAEjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC;QACJ,CAAC;KAAA;IAED,8EAA8E;IAChE,sBAAsB,CAAC,YAAoB;;;YACvD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE/E,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAmD,CAAC;YACnH,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,GAAG,CAAC;QAC9H,CAAC;KAAA;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAqB;;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,wBAAwB,EAAE,CAAC;gBACxH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YAChK,CAAC;YACD,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAEzD,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,+BAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB;oBAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,CAAC,CAAC,SAAS,CAAC;gBAEd,qGAAqG;gBACrG,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACnJ,CAAC;YAED,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;KAAA;IAED;;;OAGG;IACU,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAElE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1H,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,CAAC;KAAA;IAED,+FAA+F;IAClF,uBAAuB,CAAC,YAAoB,EAAE,WAAmB;;;YAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACvG,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACrI,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAqB;;;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrF,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7I,MAAM,IAAI,8BAAqB,CAAC,8DAA8D,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAAE,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;YAC7I,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;YACzJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,CAAA;oBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;gBAC7F,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAC9D,6KAA6K,EAC7K,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB,EAAE,IAAY;;YAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,qEAAqE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACpJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,kFAAkF,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAClK,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB;;YAC9C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,CAAC;KAAA;IAED;;;;OAIG;IACU,WAAW,CACtB,YAAoB,EACpB,aAAqB,EACrB,OAAqC;;YAErC,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,MAAK,KAAK,EAAE,CAAC;gBACrC,IAAA,qCAAoB,EAAC,aAAa,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACU,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAED,yGAAyG;IACnG,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEvC,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChF,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,6BAAiB,CAAC,sBAAsB,CACpE,cAAc,EACd,uBAAuB,CACxB,CAAC;YAEF,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAED,8GAA8G;IACxG,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,2EAA2E;IAC3E,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACU,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IAAA,qCAAoB,EAAC,WAAW,CAAC,CAAC;gBAElC,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACjE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAEnE,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;;oBACnF,6EAA6E;oBAC7E,+EAA+E;oBAC/E,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,gBAAgB,CACxC,WAAW,EACX,mHAAmH,EACnH,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uCAAkB,CAAC,IAAI,EAAE,uCAAkB,CAAC,KAAK,CAAC,CAClG,CAAC;oBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;oBACnG,IAAI,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBAC3E,CAAC;oBAED,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,gFAAgF,EAChF,CAAC,YAAY,EAAE,cAAc,CAAC,CAC/B,CAAC;oBAEF,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;wBAChE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,yCAAyC,cAAc,6CAA6C,EACpG,CAAC,YAAY,CAAC,CACf,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAA,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA/hBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFL,yBAAW;QACT,6BAAa,UAED,mCAAgB;GAP1C,WAAW,CA+hBvB","sourcesContent":["import { Inject, Injectable, UnauthorizedException } from \"@nestjs/common\";\nimport { TwoFactorService, TwoFactorProof } from '../TwoFactorService/TwoFactorService';\nimport * as jwt from \"jsonwebtoken\";\nimport { Orm } from \"../../../Orm\";\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\nimport type { AccessiOptions } from \"../../AccessiModule\";\nimport { LoginRequest } from \"../../Dtos/LoginRequest\";\nimport { LoginResult } from \"../../Dtos/LoginResponse\";\nimport { StatoRegistrazione } from \"../../Dtos/StatoRegistrazione\";\nimport { UserService } from \"../UserService/UserService\";\nimport { FiltriService } from \"../FiltriService/FiltriService\";\nimport {\n buildAuthenticatedTokenPayload,\n isAuthenticatedUserEnabledForJwt,\n isAccessiTokenAllowedForUser,\n resolveCodiceUtenteFromTokenPayload,\n} from \"../../security/authenticatedToken\";\nimport {\n getAccessiJwtSecret,\n verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport { assertStrongPassword } from '../../security/passwordPolicy';\nimport { Logger } from \"../../../Logger\";\nimport { TokenResult } from '../../Dtos/TokenResult';\n\n/** Error code deliberately returned when a user is configured as SSO-only. */\nexport const PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';\n\ninterface AccessiTokenIssueOptions {\n /** Sovrascrive jwtOptions.expiresIn per token a durata ridotta (es. Login as). */\n expiresIn?: string | number;\n /** Claim aggiuntive, per esempio l'attore che ha generato un token di impersonazione. */\n extraClaims?: Record<string, unknown>;\n}\n\n@Injectable()\nexport class AuthService {\n private readonly logger = new Logger(AuthService.name);\n\n constructor(\n private userService: UserService,\n private filtriService: FiltriService,\n @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions,\n private readonly twoFactorService: TwoFactorService,\n ) {}\n\n private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\n if (!this.accessiOptions.passwordExpiration) {\n return;\n }\n\n const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\n const expirationDays =\n Number.isFinite(configuredDays) && configuredDays > 0\n ? Math.trunc(configuredDays)\n : 90;\n\n const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\n await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n }\n\n private isMockDemoUserEnabled(): boolean {\n if (!this.accessiOptions.mockDemoUser) {\n return false;\n }\n\n // La backdoor mock non e mai attiva in produzione, nemmeno con variabili d'ambiente,\n // perche emette un superutente senza verifica password.\n const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\n return nodeEnv !== \"production\";\n }\n\n /** Creates the normal internal JWT consumed by all existing Accessi guards. */\n public createAccessiToken(\n utente: LoginResult['utente'],\n methods: string[] = [],\n tokenOptions: AccessiTokenIssueOptions = {},\n ): TokenResult {\n if (!utente?.codiceUtente) {\n throw new Error('Impossibile creare un token senza un utente Accessi valido.');\n }\n const loginAs = methods.includes('login_as');\n if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp') && !loginAs) {\n throw new UnauthorizedException('Verifica del codice di accesso richiesta.');\n }\n\n const expiresIn = tokenOptions.expiresIn ?? this.accessiOptions.jwtOptions.expiresIn;\n const expiresInIsValid = typeof expiresIn === 'number'\n ? Number.isFinite(expiresIn) && expiresIn > 0\n : typeof expiresIn === 'string' && expiresIn.trim() !== '';\n if (!expiresInIsValid) {\n throw new Error('jwtOptions.expiresIn non configurato: impossibile emettere token senza scadenza.');\n }\n\n const token = jwt.sign(\n { ...(tokenOptions.extraClaims ?? {}), utente, typ: 'access', amr: methods },\n getAccessiJwtSecret(this.accessiOptions),\n { expiresIn: expiresIn as jwt.SignOptions['expiresIn'] },\n );\n\n // Difesa in profondita: un `expiresIn` malformato farebbe emettere un token permanente.\n const decoded = jwt.decode(token);\n const decodedPayload = decoded && typeof decoded === 'object' ? decoded as jwt.JwtPayload : undefined;\n if (typeof decodedPayload?.exp !== 'number') {\n throw new Error('Token emesso senza scadenza: configurazione JWT non valida.');\n }\n\n // Il contratto TokenResult espone sempre la validita in secondi, anche quando\n // jwtOptions.expiresIn usa un formato leggibile come '24h'.\n const issuedAt = typeof decodedPayload.iat === 'number' ? decodedPayload.iat : Math.floor(Date.now() / 1000);\n const expiresInSeconds = Math.max(0, Math.trunc(decodedPayload.exp - issuedAt));\n\n return {\n expiresIn: String(expiresInSeconds),\n value: token,\n type: 'Bearer',\n };\n }\n\n /**\n * Emette l'access token per l'utente target, con l'attore registrato nelle\n * claim `act` e `loginAs`. La durata e' quella standard di jwtOptions.expiresIn.\n */\n public createLoginAsToken(\n utente: LoginResult['utente'],\n actor: { codiceUtente: number; email?: string },\n ): TokenResult {\n return this.createAccessiToken(utente, ['login_as'], {\n extraClaims: {\n loginAs: true,\n act: {\n sub: String(actor.codiceUtente),\n email: actor.email,\n },\n },\n });\n }\n\n /** Builds the standard login response for a user authenticated by a supported method. */\n public async getLoginResultForUser(codiceUtente: number): Promise<LoginResult> {\n const users = await this.userService.getUsers(\n { codiceUtente },\n { includeExtensionFields: true, includeGrants: true },\n );\n const result = users[0];\n if (!result?.utente) {\n throw new Error('Utente Accessi non trovato.');\n }\n const current = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(current)) throw new UnauthorizedException('Utente non abilitato.');\n result.utente = { ...result.utente, ...current };\n\n return {\n utente: result.utente,\n filtri: await this.filtriService.getFiltriUser(codiceUtente),\n userGrants: result.userGrants,\n extensionFields: result.extensionFields,\n };\n }\n\n /** Users without a row retain the historic password-login enabled default. */\n private async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n if (this.accessiOptions.federatedAuthentication?.enabled !== true) return true;\n\n const rows = await Orm.query(\n this.accessiOptions.databaseOptions,\n 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n [codiceUtente],\n );\n const policy = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { passwordLoginEnabled?: unknown } | undefined;\n return policy?.passwordLoginEnabled !== false && policy?.passwordLoginEnabled !== 0 && policy?.passwordLoginEnabled !== '0';\n }\n\n /**\n * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.\n * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.\n * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.\n */\n async login(request: LoginRequest): Promise<LoginResult> {\n const mockDemoUserEnabled = this.isMockDemoUserEnabled();\n\n if (\n mockDemoUserEnabled &&\n request.email.toLowerCase() === \"demo\"\n ) {\n return this.getDemoUser();\n }\n\n if (\n mockDemoUserEnabled &&\n request.email.toLowerCase() === \"admin\"\n ) {\n return this.getAdminUser();\n }\n\n const utente = await this.userService.getUserByEmail(\n request.email.trim().toLowerCase()\n );\n if (!utente) {\n if (!request.password) return { passwordRequired: true };\n throw new Error(\"Nome utente o password errata!\");\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);\n if (isAuthenticatedUserEnabledForJwt(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {\n return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: (currentUser.email ?? '').trim(), mode: 'passwordless' }) };\n }\n // The email-only step has the same response for unknown and ordinary local accounts.\n if (!request.password) return { passwordRequired: true };\n\n switch (utente.statoRegistrazione) {\n case undefined:\n throw new Error(\n \"Struttura dati compromessa: Stato Registrazione inesistente.\"\n );\n case StatoRegistrazione.BLOCC:\n case StatoRegistrazione.DELETE:\n throw new Error(\"Utente non abilitato\");\n case StatoRegistrazione.INVIO:\n throw new Error(\"Rinnovo password necessario.\");\n }\n\n if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\n throw new Error(\n `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\n );\n }\n\n if (!isAuthenticatedUserEnabledForJwt(currentUser)) throw new Error('Utente non abilitato');\n if (!(await this.isPasswordLoginEnabled(utente.codiceUtente))) {\n throw new Error(PASSWORD_LOGIN_DISABLED);\n }\n\n if (typeof request.password !== 'string' || request.password.length === 0) {\n throw new Error('Nome utente o password errata!');\n }\n\n const isPasswordValid = await this.verifyPassword(\n utente.codiceUtente,\n request.password\n );\n if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\n\n if (\n this.accessiOptions.passwordExpiration &&\n this.accessiOptions.passwordExpiration == true\n ) {\n const today = new Date();\n const targetDate = utente.dataScadenzaPassword\n ? new Date(utente.dataScadenzaPassword)\n : undefined;\n\n // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.\n if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {\n throw new Error(\"PASSWORD_EXPIRED\");\n }\n }\n\n if (currentUser.flagDueFattori) {\n return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email ?? '', mode: 'password' }) };\n }\n\n const updateLastAccessDateQuery =\n \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\n await Orm.query(\n this.accessiOptions.databaseOptions,\n updateLastAccessDateQuery,\n [utente.codiceUtente]\n );\n\n return this.getLoginResultForUser(utente.codiceUtente);\n }\n\n /**\n * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.\n * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.\n */\n public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\n if (typeof token !== \"string\" || token.trim() === \"\") {\n throw new Error(\"Token non fornito.\");\n }\n\n const secret = getAccessiJwtSecret(this.accessiOptions);\n const decoded = jwt.verify(token.trim(), secret, { algorithms: ['HS256'] });\n const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n\n if (!codiceUtente) {\n throw new Error(\"Token non valido.\");\n }\n\n const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!currentUser || !isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n throw new Error(\"Token non valido o utente non autorizzato.\");\n }\n\n return buildAuthenticatedTokenPayload(decoded, currentUser);\n }\n\n /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */\n public async beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult> {\n const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori) throw new UnauthorizedException();\n return { challenge: await this.twoFactorService.issue({ codiceUtente, email: user.email ?? '', mode: 'federated', identityKey }) };\n }\n\n private async validateTwoFactorProof(proof: TwoFactorProof): Promise<void> {\n const user = await this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);\n if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori || user.email?.trim().toLowerCase() !== proof.email.trim().toLowerCase()) {\n throw new UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');\n }\n if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled) throw new UnauthorizedException('Accesso senza password disabilitato.');\n if (proof.mode === 'password' && !(await this.isPasswordLoginEnabled(proof.codiceUtente))) throw new UnauthorizedException('Login locale disabilitato.');\n if (proof.mode === 'federated') {\n if (!this.accessiOptions.federatedAuthentication?.enabled) throw new UnauthorizedException();\n const rows = await Orm.query(this.accessiOptions.databaseOptions,\n 'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1',\n [proof.identityKey, proof.codiceUtente], false);\n if (!rows.length) throw new UnauthorizedException('Identita SSO non piu abilitata.');\n }\n }\n\n public async verifyTwoFactor(challengeId: string, code: string): Promise<LoginResult> {\n const proof = await this.twoFactorService.consume(challengeId, code);\n await this.validateTwoFactorProof(proof);\n const result = await this.getLoginResultForUser(proof.codiceUtente);\n result.token = this.createAccessiToken(result.utente, [proof.mode, 'otp']);\n await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);\n if (proof.mode === 'federated') {\n await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);\n }\n return result;\n }\n\n public async resendTwoFactor(challengeId: string): Promise<LoginResult> {\n await this.validateTwoFactorProof(await this.twoFactorService.describe(challengeId));\n return { challenge: await this.twoFactorService.resend(challengeId) };\n }\n\n /**\n * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.\n * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di\n * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.\n */\n public async setPassword(\n codiceUtente: number,\n nuovaPassword: string,\n options?: { enforcePolicy?: boolean },\n ) {\n if (options?.enforcePolicy !== false) {\n assertStrongPassword(nuovaPassword);\n }\n try {\n const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\n const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\n\n const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\n codiceUtente,\n hashedPassword,\n ]);\n await this.refreshPasswordExpiration(codiceUtente);\n return result;\n } catch (error) {\n throw error;\n }\n }\n\n /**\n * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.\n * E idempotente: hash moderni e gia migrati vengono ignorati.\n */\n public async migrateLegacyEncryptedPasswords(): Promise<void> {\n const startedAt = performance.now();\n this.logger.info(\"Avvio migrazione password legacy accessi.\");\n const results = await Orm.query(\n this.accessiOptions.databaseOptions,\n \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n []\n );\n\n const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\n codiceUtente?: number;\n password?: string;\n }[];\n let migratedCount = 0;\n let skippedCount = 0;\n\n for (const row of rows) {\n const codiceUtente = Number(row.codiceUtente);\n const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\n if (\n !codiceUtente ||\n !storedPassword ||\n PasswordUtilities.isPasswordHash(storedPassword) ||\n PasswordUtilities.isLegacyPasswordHash(storedPassword)\n ) {\n skippedCount += 1;\n continue;\n }\n\n const protectedLegacyPassword =\n PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\n\n await Orm.execute(\n this.accessiOptions.databaseOptions,\n \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n [protectedLegacyPassword, codiceUtente, storedPassword]\n );\n migratedCount += 1;\n }\n\n this.logger.info(\n `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n );\n }\n\n /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */\n async verifyPassword(\n codiceUtente: number,\n plainPassword: string\n ): Promise<boolean> {\n const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\n const result = (await Orm.query(\n this.accessiOptions.databaseOptions,\n query,\n [codiceUtente]\n ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\n password: string;\n }[];\n\n const stored = result[0];\n if (!stored || typeof stored.password !== \"string\") {\n return false;\n }\n\n const storedPassword = stored.password;\n\n if (PasswordUtilities.isPasswordHash(storedPassword)) {\n return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\n }\n\n const legacyEncryptedPassword = CryptUtilities.encrypt(\n plainPassword,\n this.accessiOptions.encryptionKey\n );\n\n if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\n const isMigratedLegacyPasswordValid =\n PasswordUtilities.verifyLegacyEncryptedPassword(\n legacyEncryptedPassword,\n storedPassword\n );\n\n if (isMigratedLegacyPasswordValid) {\n await this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });\n }\n\n return isMigratedLegacyPasswordValid;\n }\n\n const isLegacyPasswordValid = PasswordUtilities.timingSafeStringEquals(\n storedPassword,\n legacyEncryptedPassword,\n );\n\n if (isLegacyPasswordValid) {\n await this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });\n }\n\n return isLegacyPasswordValid;\n }\n\n /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */\n async getAdminUser(): Promise<LoginResult> {\n return {\n utente: {\n codiceUtente: 6789,\n email: \"admin\",\n statoRegistrazione: StatoRegistrazione.CONF,\n cognome: \"Admin\",\n nome: \"Admin\",\n flagGdpr: true,\n avatar: \"/path/to/avatar.jpg\",\n flagDueFattori: false,\n codiceLingua: \"IT\",\n cellulare: \"+391234567890\",\n flagSuper: true,\n roles: [],\n permissions: [],\n },\n filtri: null,\n userGrants: {\n abilitazioni: [],\n grants: [],\n ruoli: [],\n },\n };\n }\n\n /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */\n getDemoUser(): LoginResult {\n return {\n utente: {\n codiceUtente: 12345,\n email: \"jdoe\",\n statoRegistrazione: StatoRegistrazione.CONF,\n cognome: \"Doe\",\n nome: \"John\",\n flagGdpr: true,\n avatar: \"/path/to/avatar.jpg\",\n flagDueFattori: false,\n codiceLingua: \"IT\",\n cellulare: \"+391234567890\",\n flagSuper: false,\n roles: [],\n permissions: [],\n },\n filtri: null,\n userGrants: {\n abilitazioni: [],\n grants: [],\n ruoli: [],\n },\n };\n }\n\n /**\n * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.\n * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.\n */\n public async confirmResetPassword(\n token: string,\n newPassword: string\n ): Promise<void> {\n try {\n if (typeof token !== \"string\" || token.trim() === \"\") {\n throw new Error(\"Token non valido.\");\n }\n\n assertStrongPassword(newPassword);\n\n const secret = getAccessiJwtSecret(this.accessiOptions, 'reset');\n const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\n\n const hashedPassword = PasswordUtilities.hashPassword(newPassword);\n\n await Orm.withTransaction(this.accessiOptions.databaseOptions, async (transaction) => {\n // A conditional write claims the nonce under the database row lock. A second\n // concurrent reset cannot also consume it; failures roll the whole reset back.\n const claimed = await Orm.transactionQuery<unknown>(\n transaction,\n 'UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE',\n [StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione.CONF, StatoRegistrazione.INVIO],\n );\n const row = (Array.isArray(claimed) ? claimed[0] : claimed) as Record<string, unknown> | undefined;\n if (Number(row?.CODUTE ?? row?.codute) !== codiceUtente) {\n throw new Error('Token non valido, gia usato o utente non autorizzato.');\n }\n\n await Orm.transactionQuery(\n transaction,\n 'UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)',\n [codiceUtente, hashedPassword],\n );\n\n if (this.accessiOptions.passwordExpiration) {\n const days = Number(this.accessiOptions.passwordExpirationDays);\n const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;\n await Orm.transactionQuery(\n transaction,\n `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`,\n [codiceUtente],\n );\n }\n });\n } catch (error) {\n throw error;\n }\n }\n}\n"]}
package/dist/accessi-module/index.d.ts CHANGED
@@ -28,7 +28,7 @@ export type { BootstrapAdminResult } from './Services/AdminBootstrapService/Admi
28
28
  export { getOrCreateAdminBootstrapToken, getAdminBootstrapToken, clearAdminBootstrapToken, isValidAdminBootstrapToken } from './security/adminBootstrap';
29
29
  export { ServiceTokenGuard, RequireServiceTokenScopes, getAccessiServiceToken } from './security/serviceTokenGuard';
30
30
  export { assertEmailConfigured, isEmailConfigured, AccessiEmailNotConfiguredError, ACCESSI_EMAIL_NOT_CONFIGURED } from './security/emailConfiguration';
31
- export { buildLoginAsUrl, LOGIN_AS_QUERY_PARAM, LOGIN_AS_TOKEN_TTL_SECONDS } from './security/loginAs';
31
+ export { buildLoginAsUrl, LOGIN_AS_QUERY_PARAM } from './security/loginAs';
32
32
  export { FederatedAuthService } from './federated-auth/FederatedAuthService';
33
33
  export type { FederatedAuthenticationResult, FederatedIdentity, FederatedProvider, VerifiedFederatedIdentity } from './federated-auth/FederatedAuthTypes';
34
34
  export * from "./Dtos";
package/dist/accessi-module/index.js CHANGED
@@ -26,7 +26,7 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
26
26
  return (mod && mod.__esModule) ? mod : { "default": mod };
27
27
  };
28
28
  Object.defineProperty(exports, "__esModule", { value: true });
29
- exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.LOGIN_AS_TOKEN_TTL_SECONDS = exports.LOGIN_AS_QUERY_PARAM = exports.buildLoginAsUrl = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.isValidAdminBootstrapToken = exports.clearAdminBootstrapToken = exports.getAdminBootstrapToken = exports.getOrCreateAdminBootstrapToken = exports.AdminBootstrapService = exports.SchemaExportService = exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.leadingStatementKeyword = exports.analyzeCatalogScript = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
29
+ exports.ACCESSI_MODULE_SERVICES_LOCALS_KEY = exports.getAccessiModuleServices = exports.registerAccessiModuleServices = exports.accessiRequirement = exports.authenticateGen = exports.authorizeAccessi = exports.FederatedAuthService = exports.LOGIN_AS_QUERY_PARAM = exports.buildLoginAsUrl = exports.ACCESSI_EMAIL_NOT_CONFIGURED = exports.AccessiEmailNotConfiguredError = exports.isEmailConfigured = exports.assertEmailConfigured = exports.getAccessiServiceToken = exports.RequireServiceTokenScopes = exports.ServiceTokenGuard = exports.isValidAdminBootstrapToken = exports.clearAdminBootstrapToken = exports.getAdminBootstrapToken = exports.getOrCreateAdminBootstrapToken = exports.AdminBootstrapService = exports.SchemaExportService = exports.ServiceTokenService = exports.discoverCatalogScripts = exports.computeCatalogScriptChecksum = exports.leadingStatementKeyword = exports.analyzeCatalogScript = exports.splitSqlStatements = exports.listPendingCatalogScripts = exports.applyCatalogScripts = exports.AccessiCatalogMigrator = exports.AccessiDatabaseUpdater = exports.AccessiModule = void 0;
30
30
  exports.initializeAccessiModule = initializeAccessiModule;
31
31
  const express_1 = __importDefault(require("express"));
32
32
  const core_1 = require("@nestjs/core");
@@ -159,7 +159,6 @@ Object.defineProperty(exports, "ACCESSI_EMAIL_NOT_CONFIGURED", { enumerable: tru
159
159
  var loginAs_1 = require("./security/loginAs");
160
160
  Object.defineProperty(exports, "buildLoginAsUrl", { enumerable: true, get: function () { return loginAs_1.buildLoginAsUrl; } });
161
161
  Object.defineProperty(exports, "LOGIN_AS_QUERY_PARAM", { enumerable: true, get: function () { return loginAs_1.LOGIN_AS_QUERY_PARAM; } });
162
- Object.defineProperty(exports, "LOGIN_AS_TOKEN_TTL_SECONDS", { enumerable: true, get: function () { return loginAs_1.LOGIN_AS_TOKEN_TTL_SECONDS; } });
163
162
  var FederatedAuthService_1 = require("./federated-auth/FederatedAuthService");
164
163
  Object.defineProperty(exports, "FederatedAuthService", { enumerable: true, get: function () { return FederatedAuthService_1.FederatedAuthService; } });
165
164
  __exportStar(require("./Dtos"), exports);