emilsoftware-utilities 2.0.0-dev.6 → 2.0.0-dev.60

package/dist/accessi-module/Services/AuthService/AuthService.js

@@ -55,24 +55,27 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 var AuthService_1;
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuthService = void 0;
+exports.AuthService = exports.PASSWORD_LOGIN_DISABLED = void 0;
 const common_1 = require("@nestjs/common");
+const TwoFactorService_1 = require("../TwoFactorService/TwoFactorService");
 const jwt = __importStar(require("jsonwebtoken"));
 const Orm_1 = require("../../../Orm");
 const Utilities_1 = require("../../../Utilities");
 const StatoRegistrazione_1 = require("../../Dtos/StatoRegistrazione");
 const UserService_1 = require("../UserService/UserService");
-const PermissionService_1 = require("../PermissionService/PermissionService");
 const FiltriService_1 = require("../FiltriService/FiltriService");
 const authenticatedToken_1 = require("../../security/authenticatedToken");
 const passwordResetToken_1 = require("../../security/passwordResetToken");
+const passwordPolicy_1 = require("../../security/passwordPolicy");
 const Logger_1 = require("../../../Logger");
+/** Error code deliberately returned when a user is configured as SSO-only. */
+exports.PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';
 let AuthService = AuthService_1 = class AuthService {
-    constructor(userService, permissionService, filtriService, accessiOptions) {
+    constructor(userService, filtriService, accessiOptions, twoFactorService) {
         this.userService = userService;
-        this.permissionService = permissionService;
         this.filtriService = filtriService;
         this.accessiOptions = accessiOptions;
+        this.twoFactorService = twoFactorService;
         this.logger = new Logger_1.Logger(AuthService_1.name);
     }
     refreshPasswordExpiration(codiceUtente) {
@@ -93,11 +96,99 @@ let AuthService = AuthService_1 = class AuthService {
         if (!this.accessiOptions.mockDemoUser) {
             return false;
         }
+        // La backdoor mock non e mai attiva in produzione, nemmeno con variabili d'ambiente,
+        // perche emette un superutente senza verifica password.
         const nodeEnv = ((_a = process.env.NODE_ENV) !== null && _a !== void 0 ? _a : "production").toLowerCase();
-        return nodeEnv !== "production" || process.env.ACCESSI_ALLOW_MOCK_DEMO_USER === "true";
+        return nodeEnv !== "production";
     }
+    /** Creates the normal internal JWT consumed by all existing Accessi guards. */
+    createAccessiToken(utente, methods = [], tokenOptions = {}) {
+        var _a, _b;
+        if (!(utente === null || utente === void 0 ? void 0 : utente.codiceUtente)) {
+            throw new Error('Impossibile creare un token senza un utente Accessi valido.');
+        }
+        const loginAs = methods.includes('login_as');
+        if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp') && !loginAs) {
+            throw new common_1.UnauthorizedException('Verifica del codice di accesso richiesta.');
+        }
+        const expiresIn = (_a = tokenOptions.expiresIn) !== null && _a !== void 0 ? _a : this.accessiOptions.jwtOptions.expiresIn;
+        const expiresInIsValid = typeof expiresIn === 'number'
+            ? Number.isFinite(expiresIn) && expiresIn > 0
+            : typeof expiresIn === 'string' && expiresIn.trim() !== '';
+        if (!expiresInIsValid) {
+            throw new Error('jwtOptions.expiresIn non configurato: impossibile emettere token senza scadenza.');
+        }
+        const token = jwt.sign(Object.assign(Object.assign({}, ((_b = tokenOptions.extraClaims) !== null && _b !== void 0 ? _b : {})), { utente, typ: 'access', amr: methods }), (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions), { expiresIn: expiresIn });
+        // Difesa in profondita: un `expiresIn` malformato farebbe emettere un token permanente.
+        const decoded = jwt.decode(token);
+        const decodedPayload = decoded && typeof decoded === 'object' ? decoded : undefined;
+        if (typeof (decodedPayload === null || decodedPayload === void 0 ? void 0 : decodedPayload.exp) !== 'number') {
+            throw new Error('Token emesso senza scadenza: configurazione JWT non valida.');
+        }
+        // Il contratto TokenResult espone sempre la validita in secondi, anche quando
+        // jwtOptions.expiresIn usa un formato leggibile come '24h'.
+        const issuedAt = typeof decodedPayload.iat === 'number' ? decodedPayload.iat : Math.floor(Date.now() / 1000);
+        const expiresInSeconds = Math.max(0, Math.trunc(decodedPayload.exp - issuedAt));
+        return {
+            expiresIn: String(expiresInSeconds),
+            value: token,
+            type: 'Bearer',
+        };
+    }
+    /**
+     * Emette l'access token per l'utente target, con l'attore registrato nelle
+     * claim `act` e `loginAs`. La durata e' quella standard di jwtOptions.expiresIn.
+     */
+    createLoginAsToken(utente, actor) {
+        return this.createAccessiToken(utente, ['login_as'], {
+            extraClaims: {
+                loginAs: true,
+                act: {
+                    sub: String(actor.codiceUtente),
+                    email: actor.email,
+                },
+            },
+        });
+    }
+    /** Builds the standard login response for a user authenticated by a supported method. */
+    getLoginResultForUser(codiceUtente) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const users = yield this.userService.getUsers({ codiceUtente }, { includeExtensionFields: true, includeGrants: true });
+            const result = users[0];
+            if (!(result === null || result === void 0 ? void 0 : result.utente)) {
+                throw new Error('Utente Accessi non trovato.');
+            }
+            const current = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(current))
+                throw new common_1.UnauthorizedException('Utente non abilitato.');
+            result.utente = Object.assign(Object.assign({}, result.utente), current);
+            return {
+                utente: result.utente,
+                filtri: yield this.filtriService.getFiltriUser(codiceUtente),
+                userGrants: result.userGrants,
+                extensionFields: result.extensionFields,
+            };
+        });
+    }
+    /** Users without a row retain the historic password-login enabled default. */
+    isPasswordLoginEnabled(codiceUtente) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            if (((_a = this.accessiOptions.federatedAuthentication) === null || _a === void 0 ? void 0 : _a.enabled) !== true)
+                return true;
+            const rows = yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, 'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?', [codiceUtente]);
+            const policy = rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)[0];
+            return (policy === null || policy === void 0 ? void 0 : policy.passwordLoginEnabled) !== false && (policy === null || policy === void 0 ? void 0 : policy.passwordLoginEnabled) !== 0 && (policy === null || policy === void 0 ? void 0 : policy.passwordLoginEnabled) !== '0';
+        });
+    }
+    /**
+     * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.
+     * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.
+     * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.
+     */
     login(request) {
         return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
             const mockDemoUserEnabled = this.isMockDemoUserEnabled();
             if (mockDemoUserEnabled &&
                 request.email.toLowerCase() === "demo") {
@@ -107,9 +198,19 @@ let AuthService = AuthService_1 = class AuthService {
                 request.email.toLowerCase() === "admin") {
                 return this.getAdminUser();
             }
-            const utente = yield this.userService.getUserByEmail(request.email.toLowerCase());
-            if (!utente)
+            const utente = yield this.userService.getUserByEmail(request.email.trim().toLowerCase());
+            if (!utente) {
+                if (!request.password)
+                    return { passwordRequired: true };
                 throw new Error("Nome utente o password errata!");
+            }
+            const currentUser = yield this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);
+            if ((0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {
+                return { challenge: yield this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: ((_a = currentUser.email) !== null && _a !== void 0 ? _a : '').trim(), mode: 'passwordless' }) };
+            }
+            // The email-only step has the same response for unknown and ordinary local accounts.
+            if (!request.password)
+                return { passwordRequired: true };
             switch (utente.statoRegistrazione) {
                 case undefined:
                     throw new Error("Struttura dati compromessa: Stato Registrazione inesistente.");
@@ -122,52 +223,117 @@ let AuthService = AuthService_1 = class AuthService {
             if (utente.statoRegistrazione !== StatoRegistrazione_1.StatoRegistrazione.CONF) {
                 throw new Error(`Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`);
             }
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser))
+                throw new Error('Utente non abilitato');
+            if (!(yield this.isPasswordLoginEnabled(utente.codiceUtente))) {
+                throw new Error(exports.PASSWORD_LOGIN_DISABLED);
+            }
+            if (typeof request.password !== 'string' || request.password.length === 0) {
+                throw new Error('Nome utente o password errata!');
+            }
             const isPasswordValid = yield this.verifyPassword(utente.codiceUtente, request.password);
             if (!isPasswordValid)
                 throw new Error("Nome utente o password errata!");
             if (this.accessiOptions.passwordExpiration &&
                 this.accessiOptions.passwordExpiration == true) {
                 const today = new Date();
-                const targetDate = new Date(utente.dataScadenzaPassword);
-                if (today >= targetDate) {
+                const targetDate = utente.dataScadenzaPassword
+                    ? new Date(utente.dataScadenzaPassword)
+                    : undefined;
+                // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.
+                if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {
                     throw new Error("PASSWORD_EXPIRED");
                 }
             }
-            const userGrants = yield this.permissionService.getUserRolesAndGrants(utente.codiceUtente);
-            const filtri = yield this.filtriService.getFiltriUser(utente.codiceUtente);
+            if (currentUser.flagDueFattori) {
+                return { challenge: yield this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: (_b = currentUser.email) !== null && _b !== void 0 ? _b : '', mode: 'password' }) };
+            }
             const updateLastAccessDateQuery = "UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?";
             yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, updateLastAccessDateQuery, [utente.codiceUtente]);
-            const extensionFields = {};
-            if (this.accessiOptions.extensionFieldsOptions &&
-                this.accessiOptions.extensionFieldsOptions.length > 0) {
-                for (const ext of this.accessiOptions.extensionFieldsOptions) {
-                    const values = (yield Orm_1.Orm.query(ext.databaseOptions, `SELECT ${ext.tableFields.join(",")} FROM ${ext.tableName} WHERE ${ext.tableJoinFieldName} = ?`, [utente.codiceUtente])).map(Utilities_1.RestUtilities.convertKeysToCamelCase);
-                    extensionFields[ext.objectKey] = values;
-                }
-            }
-            return { utente, filtri, userGrants, extensionFields };
+            return this.getLoginResultForUser(utente.codiceUtente);
         });
     }
+    /**
+     * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.
+     * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.
+     */
     getAuthenticatedTokenPayload(token) {
         return __awaiter(this, void 0, void 0, function* () {
             if (typeof token !== "string" || token.trim() === "") {
                 throw new Error("Token non fornito.");
             }
             const secret = (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions);
-            const decoded = jwt.verify(token.trim(), secret);
+            const decoded = jwt.verify(token.trim(), secret, { algorithms: ['HS256'] });
             const codiceUtente = (0, authenticatedToken_1.resolveCodiceUtenteFromTokenPayload)(decoded);
             if (!codiceUtente) {
                 throw new Error("Token non valido.");
             }
             const currentUser = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
-            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser)) {
+            if (!currentUser || !(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(currentUser) || !(0, authenticatedToken_1.isAccessiTokenAllowedForUser)(decoded, currentUser)) {
                 throw new Error("Token non valido o utente non autorizzato.");
             }
             return (0, authenticatedToken_1.buildAuthenticatedTokenPayload)(decoded, currentUser);
         });
     }
-    setPassword(codiceUtente, nuovaPassword) {
+    /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */
+    beginFederatedTwoFactor(codiceUtente, identityKey) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            const user = yield this.userService.getAuthenticatedUserSnapshot(codiceUtente);
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(user) || !user.flagDueFattori)
+                throw new common_1.UnauthorizedException();
+            return { challenge: yield this.twoFactorService.issue({ codiceUtente, email: (_a = user.email) !== null && _a !== void 0 ? _a : '', mode: 'federated', identityKey }) };
+        });
+    }
+    validateTwoFactorProof(proof) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b;
+            const user = yield this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);
+            if (!(0, authenticatedToken_1.isAuthenticatedUserEnabledForJwt)(user) || !user.flagDueFattori || ((_a = user.email) === null || _a === void 0 ? void 0 : _a.trim().toLowerCase()) !== proof.email.trim().toLowerCase()) {
+                throw new common_1.UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');
+            }
+            if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled)
+                throw new common_1.UnauthorizedException('Accesso senza password disabilitato.');
+            if (proof.mode === 'password' && !(yield this.isPasswordLoginEnabled(proof.codiceUtente)))
+                throw new common_1.UnauthorizedException('Login locale disabilitato.');
+            if (proof.mode === 'federated') {
+                if (!((_b = this.accessiOptions.federatedAuthentication) === null || _b === void 0 ? void 0 : _b.enabled))
+                    throw new common_1.UnauthorizedException();
+                const rows = yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, 'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1', [proof.identityKey, proof.codiceUtente], false);
+                if (!rows.length)
+                    throw new common_1.UnauthorizedException('Identita SSO non piu abilitata.');
+            }
+        });
+    }
+    verifyTwoFactor(challengeId, code) {
         return __awaiter(this, void 0, void 0, function* () {
+            const proof = yield this.twoFactorService.consume(challengeId, code);
+            yield this.validateTwoFactorProof(proof);
+            const result = yield this.getLoginResultForUser(proof.codiceUtente);
+            result.token = this.createAccessiToken(result.utente, [proof.mode, 'otp']);
+            yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);
+            if (proof.mode === 'federated') {
+                yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);
+            }
+            return result;
+        });
+    }
+    resendTwoFactor(challengeId) {
+        return __awaiter(this, void 0, void 0, function* () {
+            yield this.validateTwoFactorProof(yield this.twoFactorService.describe(challengeId));
+            return { challenge: yield this.twoFactorService.resend(challengeId) };
+        });
+    }
+    /**
+     * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.
+     * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di
+     * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.
+     */
+    setPassword(codiceUtente, nuovaPassword, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            if ((options === null || options === void 0 ? void 0 : options.enforcePolicy) !== false) {
+                (0, passwordPolicy_1.assertStrongPassword)(nuovaPassword);
+            }
             try {
                 const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;
                 const hashedPassword = Utilities_1.PasswordUtilities.hashPassword(nuovaPassword);
@@ -183,6 +349,10 @@ let AuthService = AuthService_1 = class AuthService {
             }
         });
     }
+    /**
+     * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.
+     * E idempotente: hash moderni e gia migrati vengono ignorati.
+     */
     migrateLegacyEncryptedPasswords() {
         return __awaiter(this, void 0, void 0, function* () {
             const startedAt = performance.now();
@@ -208,14 +378,16 @@ let AuthService = AuthService_1 = class AuthService {
             this.logger.info(`Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`);
         });
     }
+    /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */
     verifyPassword(codiceUtente, plainPassword) {
         return __awaiter(this, void 0, void 0, function* () {
             const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;
             const result = (yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, query, [codiceUtente]).then((results) => results.map(Utilities_1.RestUtilities.convertKeysToCamelCase)));
-            if (result.length === 0 || typeof result[0].password !== "string") {
+            const stored = result[0];
+            if (!stored || typeof stored.password !== "string") {
                 return false;
             }
-            const storedPassword = result[0].password;
+            const storedPassword = stored.password;
             if (Utilities_1.PasswordUtilities.isPasswordHash(storedPassword)) {
                 return Utilities_1.PasswordUtilities.verifyPassword(plainPassword, storedPassword);
             }
@@ -223,17 +395,18 @@ let AuthService = AuthService_1 = class AuthService {
             if (Utilities_1.PasswordUtilities.isLegacyPasswordHash(storedPassword)) {
                 const isMigratedLegacyPasswordValid = Utilities_1.PasswordUtilities.verifyLegacyEncryptedPassword(legacyEncryptedPassword, storedPassword);
                 if (isMigratedLegacyPasswordValid) {
-                    yield this.setPassword(codiceUtente, plainPassword);
+                    yield this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });
                 }
                 return isMigratedLegacyPasswordValid;
             }
-            const isLegacyPasswordValid = storedPassword === legacyEncryptedPassword;
+            const isLegacyPasswordValid = Utilities_1.PasswordUtilities.timingSafeStringEquals(storedPassword, legacyEncryptedPassword);
             if (isLegacyPasswordValid) {
-                yield this.setPassword(codiceUtente, plainPassword);
+                yield this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });
             }
             return isLegacyPasswordValid;
         });
     }
+    /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */
     getAdminUser() {
         return __awaiter(this, void 0, void 0, function* () {
             return {
@@ -249,7 +422,6 @@ let AuthService = AuthService_1 = class AuthService {
                     codiceLingua: "IT",
                     cellulare: "+391234567890",
                     flagSuper: true,
-                    paginaDefault: "/home",
                     roles: [],
                     permissions: [],
                 },
@@ -262,6 +434,7 @@ let AuthService = AuthService_1 = class AuthService {
             };
         });
     }
+    /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */
     getDemoUser() {
         return {
             utente: {
@@ -276,7 +449,6 @@ let AuthService = AuthService_1 = class AuthService {
                 codiceLingua: "IT",
                 cellulare: "+391234567890",
                 flagSuper: false,
-                paginaDefault: "/home",
                 roles: [],
                 permissions: [],
             },
@@ -288,30 +460,36 @@ let AuthService = AuthService_1 = class AuthService {
             },
         };
     }
+    /**
+     * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.
+     * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.
+     */
     confirmResetPassword(token, newPassword) {
         return __awaiter(this, void 0, void 0, function* () {
             try {
                 if (typeof token !== "string" || token.trim() === "") {
                     throw new Error("Token non valido.");
                 }
-                if (typeof newPassword !== "string" ||
-                    newPassword.length < 8 ||
-                    newPassword.length > 100) {
-                    throw new Error("La nuova password deve essere compresa tra 8 e 100 caratteri.");
-                }
-                const secret = (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions);
+                (0, passwordPolicy_1.assertStrongPassword)(newPassword);
+                const secret = (0, passwordResetToken_1.getAccessiJwtSecret)(this.accessiOptions, 'reset');
                 const { codiceUtente, nonce } = (0, passwordResetToken_1.verifyPasswordResetToken)(token.trim(), secret);
-                const result = (yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, "SELECT CODUTE AS codice_utente, STAREG AS stato_registrazione FROM UTENTI WHERE CODUTE = ? AND KEYREG = ?", [codiceUtente, nonce]).then((rows) => rows.map(Utilities_1.RestUtilities.convertKeysToCamelCase)));
-                if (result.length === 0) {
-                    throw new Error("Token non valido o gia usato.");
-                }
-                const currentState = Number(result[0].statoRegistrazione);
-                if (currentState === StatoRegistrazione_1.StatoRegistrazione.BLOCC ||
-                    currentState === StatoRegistrazione_1.StatoRegistrazione.DELETE) {
-                    throw new Error("Utente non autorizzato a completare il reset password.");
-                }
-                yield Orm_1.Orm.query(this.accessiOptions.databaseOptions, "UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ?", [StatoRegistrazione_1.StatoRegistrazione.CONF, codiceUtente]);
-                yield this.setPassword(codiceUtente, newPassword);
+                const hashedPassword = Utilities_1.PasswordUtilities.hashPassword(newPassword);
+                yield Orm_1.Orm.withTransaction(this.accessiOptions.databaseOptions, (transaction) => __awaiter(this, void 0, void 0, function* () {
+                    var _a;
+                    // A conditional write claims the nonce under the database row lock. A second
+                    // concurrent reset cannot also consume it; failures roll the whole reset back.
+                    const claimed = yield Orm_1.Orm.transactionQuery(transaction, 'UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE', [StatoRegistrazione_1.StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione_1.StatoRegistrazione.CONF, StatoRegistrazione_1.StatoRegistrazione.INVIO]);
+                    const row = (Array.isArray(claimed) ? claimed[0] : claimed);
+                    if (Number((_a = row === null || row === void 0 ? void 0 : row.CODUTE) !== null && _a !== void 0 ? _a : row === null || row === void 0 ? void 0 : row.codute) !== codiceUtente) {
+                        throw new Error('Token non valido, gia usato o utente non autorizzato.');
+                    }
+                    yield Orm_1.Orm.transactionQuery(transaction, 'UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)', [codiceUtente, hashedPassword]);
+                    if (this.accessiOptions.passwordExpiration) {
+                        const days = Number(this.accessiOptions.passwordExpirationDays);
+                        const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;
+                        yield Orm_1.Orm.transactionQuery(transaction, `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`, [codiceUtente]);
+                    }
+                }));
             }
             catch (error) {
                 throw error;
@@ -322,9 +500,8 @@ let AuthService = AuthService_1 = class AuthService {
 exports.AuthService = AuthService;
 exports.AuthService = AuthService = AuthService_1 = __decorate([
     (0, common_1.Injectable)(),
-    __param(3, (0, common_1.Inject)("ACCESSI_OPTIONS")),
+    __param(2, (0, common_1.Inject)("ACCESSI_OPTIONS")),
     __metadata("design:paramtypes", [UserService_1.UserService,
-        PermissionService_1.PermissionService,
-        FiltriService_1.FiltriService, Object])
+        FiltriService_1.FiltriService, Object, TwoFactorService_1.TwoFactorService])
 ], AuthService);
 //# sourceMappingURL=AuthService.js.map

package/dist/accessi-module/Services/AuthService/AuthService.js.map

@@ -1 +1 @@
-{"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AuthService/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,sEAAmE;AACnE,4DAAyD;AACzD,8EAA2E;AAC3E,kEAA+D;AAC/D,0EAI2C;AAC3C,0EAG2C;AAC3C,4CAAyC;AAGlC,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,iBAAoC,EACpC,aAA4B,EACT,cAA+C;QAHlE,gBAAW,GAAX,WAAW,CAAa;QACxB,sBAAiB,GAAjB,iBAAiB,CAAmB;QACpC,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QAN3D,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,KAAK,MAAM,CAAC;IACzF,CAAC;IAEK,KAAK,CAAC,OAAqB;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,CAC5B,CAAC;YACF,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAE/D,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAEzD,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,CAAC,qBAAqB,CACnE,MAAM,CAAC,YAAY,CACpB,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAE3E,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,MAAM,eAAe,GAAG,EAAE,CAAC;YAE3B,IACE,IAAI,CAAC,cAAc,CAAC,sBAAsB;gBAC1C,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,MAAM,GAAG,CAAC,EACrD,CAAC;gBACD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,sBAAsB,EAAE,CAAC;oBAC7D,MAAM,MAAM,GAAG,CACb,MAAM,SAAG,CAAC,KAAK,CACb,GAAG,CAAC,eAAe,EACnB,UAAU,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,GAAG,CAAC,SAAS,UACvD,GAAG,CAAC,kBACN,MAAM,EACN,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CACF,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC;oBAE5C,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,MAAM,CAAC;gBAC1C,CAAC;YACH,CAAC;YAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,eAAe,EAAE,CAAC;QACzD,CAAC;KAAA;IAEY,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;YACjD,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAElE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,EAAE,CAAC;gBACnD,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,CAAC;KAAA;IAEY,WAAW,CAAC,YAAoB,EAAE,aAAqB;;YAClE,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAEY,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAEK,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAClE,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YAE1C,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;gBACtD,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,cAAc,KAAK,uBAAuB,CAAC;YAEzE,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;YACtD,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAEK,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,aAAa,EAAE,OAAO;oBACtB,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,aAAa,EAAE,OAAO;gBACtB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAEY,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IACE,OAAO,WAAW,KAAK,QAAQ;oBAC/B,WAAW,CAAC,MAAM,GAAG,CAAC;oBACtB,WAAW,CAAC,MAAM,GAAG,GAAG,EACxB,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;gBACnF,CAAC;gBAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;gBACxD,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,2GAA2G,EAC3G,CAAC,YAAY,EAAE,KAAK,CAAC,CACtB,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAG7D,CAAC;gBAEJ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxB,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;gBACnD,CAAC;gBAED,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;gBAC1D,IACE,YAAY,KAAK,uCAAkB,CAAC,KAAK;oBACzC,YAAY,KAAK,uCAAkB,CAAC,MAAM,EAC1C,CAAC;oBACD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;gBAC5E,CAAC;gBAED,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,8DAA8D,EAC9D,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,CAAC,CACxC,CAAC;gBAEF,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YACpD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AAlXY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAQR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAHL,yBAAW;QACL,qCAAiB;QACrB,6BAAa;GAN3B,WAAW,CAkXvB","sourcesContent":["import { Inject, Injectable } from \"@nestjs/common\";\r\nimport * as jwt from \"jsonwebtoken\";\r\nimport { Orm } from \"../../../Orm\";\r\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\r\nimport { AccessiOptions } from \"../../AccessiModule\";\r\nimport { LoginRequest } from \"../../Dtos/LoginRequest\";\r\nimport { LoginResult } from \"../../Dtos/LoginResponse\";\r\nimport { StatoRegistrazione } from \"../../Dtos/StatoRegistrazione\";\r\nimport { UserService } from \"../UserService/UserService\";\r\nimport { PermissionService } from \"../PermissionService/PermissionService\";\r\nimport { FiltriService } from \"../FiltriService/FiltriService\";\r\nimport {\r\n  buildAuthenticatedTokenPayload,\r\n  isAuthenticatedUserEnabledForJwt,\r\n  resolveCodiceUtenteFromTokenPayload,\r\n} from \"../../security/authenticatedToken\";\r\nimport {\n  getAccessiJwtSecret,\n  verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport { Logger } from \"../../../Logger\";\n\n@Injectable()\nexport class AuthService {\n  private readonly logger = new Logger(AuthService.name);\n\n  constructor(\r\n    private userService: UserService,\r\n    private permissionService: PermissionService,\r\n    private filtriService: FiltriService,\r\n    @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions\r\n  ) {}\r\n\r\n  private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\r\n    if (!this.accessiOptions.passwordExpiration) {\r\n      return;\r\n    }\r\n\r\n    const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\r\n    const expirationDays =\r\n      Number.isFinite(configuredDays) && configuredDays > 0\r\n        ? Math.trunc(configuredDays)\r\n        : 90;\r\n\r\n    const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\r\n    await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\r\n  }\r\n\r\n  private isMockDemoUserEnabled(): boolean {\r\n    if (!this.accessiOptions.mockDemoUser) {\r\n      return false;\r\n    }\r\n\r\n    const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\r\n    return nodeEnv !== \"production\" || process.env.ACCESSI_ALLOW_MOCK_DEMO_USER === \"true\";\r\n  }\r\n\r\n  async login(request: LoginRequest): Promise<LoginResult> {\r\n    const mockDemoUserEnabled = this.isMockDemoUserEnabled();\r\n\r\n    if (\r\n      mockDemoUserEnabled &&\r\n      request.email.toLowerCase() === \"demo\"\r\n    ) {\r\n      return this.getDemoUser();\r\n    }\r\n\r\n    if (\r\n      mockDemoUserEnabled &&\r\n      request.email.toLowerCase() === \"admin\"\r\n    ) {\r\n      return this.getAdminUser();\r\n    }\r\n\r\n    const utente = await this.userService.getUserByEmail(\r\n      request.email.toLowerCase()\r\n    );\r\n    if (!utente) throw new Error(\"Nome utente o password errata!\");\r\n\r\n    switch (utente.statoRegistrazione) {\r\n      case undefined:\r\n        throw new Error(\r\n          \"Struttura dati compromessa: Stato Registrazione inesistente.\"\r\n        );\r\n      case StatoRegistrazione.BLOCC:\r\n      case StatoRegistrazione.DELETE:\r\n        throw new Error(\"Utente non abilitato\");\r\n      case StatoRegistrazione.INVIO:\r\n        throw new Error(\"Rinnovo password necessario.\");\r\n    }\r\n\r\n    if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\r\n      throw new Error(\r\n        `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\r\n      );\r\n    }\r\n\r\n    const isPasswordValid = await this.verifyPassword(\r\n      utente.codiceUtente,\r\n      request.password\r\n    );\r\n    if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\r\n\r\n    if (\r\n      this.accessiOptions.passwordExpiration &&\r\n      this.accessiOptions.passwordExpiration == true\r\n    ) {\r\n      const today = new Date();\r\n      const targetDate = new Date(utente.dataScadenzaPassword);\r\n\r\n      if (today >= targetDate) {\r\n        throw new Error(\"PASSWORD_EXPIRED\");\r\n      }\r\n    }\r\n\r\n    const userGrants = await this.permissionService.getUserRolesAndGrants(\r\n      utente.codiceUtente\r\n    );\r\n\r\n    const filtri = await this.filtriService.getFiltriUser(utente.codiceUtente);\r\n\r\n    const updateLastAccessDateQuery =\r\n      \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\r\n    await Orm.query(\r\n      this.accessiOptions.databaseOptions,\r\n      updateLastAccessDateQuery,\r\n      [utente.codiceUtente]\r\n    );\r\n\r\n    const extensionFields = {};\r\n\r\n    if (\r\n      this.accessiOptions.extensionFieldsOptions &&\r\n      this.accessiOptions.extensionFieldsOptions.length > 0\r\n    ) {\r\n      for (const ext of this.accessiOptions.extensionFieldsOptions) {\r\n        const values = (\r\n          await Orm.query(\r\n            ext.databaseOptions,\r\n            `SELECT ${ext.tableFields.join(\",\")} FROM ${ext.tableName} WHERE ${\r\n              ext.tableJoinFieldName\r\n            } = ?`,\r\n            [utente.codiceUtente]\r\n          )\r\n        ).map(RestUtilities.convertKeysToCamelCase);\r\n\r\n        extensionFields[ext.objectKey] = values;\r\n      }\r\n    }\r\n\r\n    return { utente, filtri, userGrants, extensionFields };\r\n  }\r\n\r\n  public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\r\n    if (typeof token !== \"string\" || token.trim() === \"\") {\r\n      throw new Error(\"Token non fornito.\");\r\n    }\r\n\r\n    const secret = getAccessiJwtSecret(this.accessiOptions);\r\n    const decoded = jwt.verify(token.trim(), secret);\r\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\r\n\r\n    if (!codiceUtente) {\r\n      throw new Error(\"Token non valido.\");\r\n    }\r\n\r\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\r\n    if (!isAuthenticatedUserEnabledForJwt(currentUser)) {\r\n      throw new Error(\"Token non valido o utente non autorizzato.\");\r\n    }\r\n\r\n    return buildAuthenticatedTokenPayload(decoded, currentUser);\r\n  }\r\n\r\n  public async setPassword(codiceUtente: number, nuovaPassword: string) {\r\n    try {\r\n      const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\r\n      const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\r\n\r\n      const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\r\n        codiceUtente,\r\n        hashedPassword,\r\n      ]);\r\n      await this.refreshPasswordExpiration(codiceUtente);\r\n      return result;\r\n    } catch (error) {\r\n      throw error;\r\n    }\r\n  }\r\n\r\n  public async migrateLegacyEncryptedPasswords(): Promise<void> {\n    const startedAt = performance.now();\n    this.logger.info(\"Avvio migrazione password legacy accessi.\");\n    const results = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n      []\n    );\n\r\n    const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\r\n      codiceUtente?: number;\n      password?: string;\n    }[];\n    let migratedCount = 0;\n    let skippedCount = 0;\n\n    for (const row of rows) {\n      const codiceUtente = Number(row.codiceUtente);\n      const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\r\n      if (\r\n        !codiceUtente ||\r\n        !storedPassword ||\n        PasswordUtilities.isPasswordHash(storedPassword) ||\n        PasswordUtilities.isLegacyPasswordHash(storedPassword)\n      ) {\n        skippedCount += 1;\n        continue;\n      }\n\r\n      const protectedLegacyPassword =\r\n        PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\r\n\r\n      await Orm.execute(\n        this.accessiOptions.databaseOptions,\n        \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n        [protectedLegacyPassword, codiceUtente, storedPassword]\n      );\n      migratedCount += 1;\n    }\n\n    this.logger.info(\n      `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n    );\n  }\n\r\n  async verifyPassword(\r\n    codiceUtente: number,\r\n    plainPassword: string\r\n  ): Promise<boolean> {\r\n    const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\r\n    const result = (await Orm.query(\r\n      this.accessiOptions.databaseOptions,\r\n      query,\r\n      [codiceUtente]\r\n    ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\r\n      password: string;\r\n    }[];\r\n\r\n    if (result.length === 0 || typeof result[0].password !== \"string\") {\r\n      return false;\r\n    }\r\n\r\n    const storedPassword = result[0].password;\r\n\r\n    if (PasswordUtilities.isPasswordHash(storedPassword)) {\r\n      return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\r\n    }\r\n\r\n    const legacyEncryptedPassword = CryptUtilities.encrypt(\r\n      plainPassword,\r\n      this.accessiOptions.encryptionKey\r\n    );\r\n\r\n    if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\r\n      const isMigratedLegacyPasswordValid =\r\n        PasswordUtilities.verifyLegacyEncryptedPassword(\r\n          legacyEncryptedPassword,\r\n          storedPassword\r\n        );\r\n\r\n      if (isMigratedLegacyPasswordValid) {\r\n        await this.setPassword(codiceUtente, plainPassword);\r\n      }\r\n\r\n      return isMigratedLegacyPasswordValid;\r\n    }\r\n\r\n    const isLegacyPasswordValid = storedPassword === legacyEncryptedPassword;\r\n\r\n    if (isLegacyPasswordValid) {\r\n      await this.setPassword(codiceUtente, plainPassword);\r\n    }\r\n\r\n    return isLegacyPasswordValid;\r\n  }\r\n\r\n  async getAdminUser(): Promise<LoginResult> {\r\n    return {\r\n      utente: {\r\n        codiceUtente: 6789,\r\n        email: \"admin\",\r\n        statoRegistrazione: StatoRegistrazione.CONF,\r\n        cognome: \"Admin\",\r\n        nome: \"Admin\",\r\n        flagGdpr: true,\r\n        avatar: \"/path/to/avatar.jpg\",\r\n        flagDueFattori: false,\r\n        codiceLingua: \"IT\",\r\n        cellulare: \"+391234567890\",\r\n        flagSuper: true,\r\n        paginaDefault: \"/home\",\r\n        roles: [],\r\n        permissions: [],\r\n      },\r\n      filtri: null,\r\n      userGrants: {\r\n        abilitazioni: [],\r\n        grants: [],\r\n        ruoli: [],\r\n      },\r\n    };\r\n  }\r\n\r\n  getDemoUser(): LoginResult {\r\n    return {\r\n      utente: {\r\n        codiceUtente: 12345,\r\n        email: \"jdoe\",\r\n        statoRegistrazione: StatoRegistrazione.CONF,\r\n        cognome: \"Doe\",\r\n        nome: \"John\",\r\n        flagGdpr: true,\r\n        avatar: \"/path/to/avatar.jpg\",\r\n        flagDueFattori: false,\r\n        codiceLingua: \"IT\",\r\n        cellulare: \"+391234567890\",\r\n        flagSuper: false,\r\n        paginaDefault: \"/home\",\r\n        roles: [],\r\n        permissions: [],\r\n      },\r\n      filtri: null,\r\n      userGrants: {\r\n        abilitazioni: [],\r\n        grants: [],\r\n        ruoli: [],\r\n      },\r\n    };\r\n  }\r\n\r\n  public async confirmResetPassword(\r\n    token: string,\r\n    newPassword: string\r\n  ): Promise<void> {\r\n    try {\r\n      if (typeof token !== \"string\" || token.trim() === \"\") {\r\n        throw new Error(\"Token non valido.\");\r\n      }\r\n\r\n      if (\r\n        typeof newPassword !== \"string\" ||\r\n        newPassword.length < 8 ||\r\n        newPassword.length > 100\r\n      ) {\r\n        throw new Error(\"La nuova password deve essere compresa tra 8 e 100 caratteri.\");\r\n      }\r\n\r\n      const secret = getAccessiJwtSecret(this.accessiOptions);\r\n      const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\r\n\r\n      const result = (await Orm.query(\r\n        this.accessiOptions.databaseOptions,\r\n        \"SELECT CODUTE AS codice_utente, STAREG AS stato_registrazione FROM UTENTI WHERE CODUTE = ? AND KEYREG = ?\",\r\n        [codiceUtente, nonce]\r\n      ).then((rows) => rows.map(RestUtilities.convertKeysToCamelCase))) as {\r\n        codiceUtente?: number;\r\n        statoRegistrazione?: StatoRegistrazione | number;\r\n      }[];\r\n\r\n      if (result.length === 0) {\r\n        throw new Error(\"Token non valido o gia usato.\");\r\n      }\r\n\r\n      const currentState = Number(result[0].statoRegistrazione);\r\n      if (\r\n        currentState === StatoRegistrazione.BLOCC ||\r\n        currentState === StatoRegistrazione.DELETE\r\n      ) {\r\n        throw new Error(\"Utente non autorizzato a completare il reset password.\");\r\n      }\r\n\r\n      await Orm.query(\r\n        this.accessiOptions.databaseOptions,\r\n        \"UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ?\",\r\n        [StatoRegistrazione.CONF, codiceUtente]\r\n      );\r\n\r\n      await this.setPassword(codiceUtente, newPassword);\r\n    } catch (error) {\r\n      throw error;\r\n    }\r\n  }\r\n}\r\n"]}
+{"version":3,"file":"AuthService.js","sourceRoot":"","sources":["../../../../src/accessi-module/Services/AuthService/AuthService.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,2CAA2E;AAC3E,2EAAwF;AACxF,kDAAoC;AACpC,sCAAmC;AACnC,kDAAsF;AAItF,sEAAmE;AACnE,4DAAyD;AACzD,kEAA+D;AAC/D,0EAK2C;AAC3C,0EAG2C;AAC3C,kEAAqE;AACrE,4CAAyC;AAGzC,8EAA8E;AACjE,QAAA,uBAAuB,GAAG,yBAAyB,CAAC;AAU1D,IAAM,WAAW,mBAAjB,MAAM,WAAW;IAGtB,YACU,WAAwB,EACxB,aAA4B,EACT,cAA+C,EACzD,gBAAkC;QAH3C,gBAAW,GAAX,WAAW,CAAa;QACxB,kBAAa,GAAb,aAAa,CAAe;QACQ,mBAAc,GAAd,cAAc,CAAgB;QACzD,qBAAgB,GAAhB,gBAAgB,CAAkB;QANpC,WAAM,GAAG,IAAI,eAAM,CAAC,aAAW,CAAC,IAAI,CAAC,CAAC;IAOpD,CAAC;IAEU,yBAAyB,CAAC,YAAoB;;YAC1D,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;gBAC5C,OAAO;YACT,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;YAC1E,MAAM,cAAc,GAClB,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,cAAc,GAAG,CAAC;gBACnD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC5B,CAAC,CAAC,EAAE,CAAC;YAET,MAAM,KAAK,GAAG,yCAAyC,cAAc,6CAA6C,CAAC;YACnH,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;QAChF,CAAC;KAAA;IAEO,qBAAqB;;QAC3B,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,CAAC;YACtC,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qFAAqF;QACrF,wDAAwD;QACxD,MAAM,OAAO,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,QAAQ,mCAAI,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,OAAO,OAAO,KAAK,YAAY,CAAC;IAClC,CAAC;IAED,+EAA+E;IACxE,kBAAkB,CACvB,MAA6B,EAC7B,UAAoB,EAAE,EACtB,eAAyC,EAAE;;QAE3C,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,YAAY,CAAA,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;QAC7C,IAAI,CAAC,MAAM,CAAC,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;YACpH,MAAM,IAAI,8BAAqB,CAAC,2CAA2C,CAAC,CAAC;QAC/E,CAAC;QAED,MAAM,SAAS,GAAG,MAAA,YAAY,CAAC,SAAS,mCAAI,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,SAAS,CAAC;QACrF,MAAM,gBAAgB,GAAG,OAAO,SAAS,KAAK,QAAQ;YACpD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC;YAC7C,CAAC,CAAC,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7D,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACtG,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,iCACf,CAAC,MAAA,YAAY,CAAC,WAAW,mCAAI,EAAE,CAAC,KAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,KAC1E,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,EACxC,EAAE,SAAS,EAAE,SAAyC,EAAE,CACzD,CAAC;QAEF,wFAAwF;QACxF,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,cAAc,GAAG,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAyB,CAAC,CAAC,CAAC,SAAS,CAAC;QACtG,IAAI,OAAO,CAAA,cAAc,aAAd,cAAc,uBAAd,cAAc,CAAE,GAAG,CAAA,KAAK,QAAQ,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;QACjF,CAAC;QAED,8EAA8E;QAC9E,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC7G,MAAM,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC;QAEhF,OAAO;YACL,SAAS,EAAE,MAAM,CAAC,gBAAgB,CAAC;YACnC,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,QAAQ;SACf,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,kBAAkB,CACvB,MAA6B,EAC7B,KAA+C;QAE/C,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE;YACnD,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI;gBACb,GAAG,EAAE;oBACH,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC;oBAC/B,KAAK,EAAE,KAAK,CAAC,KAAK;iBACnB;aACF;SACF,CAAC,CAAC;IACL,CAAC;IAED,yFAAyF;IAC5E,qBAAqB,CAAC,YAAoB;;YACrD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAC3C,EAAE,YAAY,EAAE,EAChB,EAAE,sBAAsB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CACtD,CAAC;YACF,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,MAAM,CAAA,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAClF,IAAI,CAAC,IAAA,qDAAgC,EAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,uBAAuB,CAAC,CAAC;YACzG,MAAM,CAAC,MAAM,mCAAQ,MAAM,CAAC,MAAM,GAAK,OAAO,CAAE,CAAC;YAEjD,OAAO;gBACL,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,IAAI,CAAC,aAAa,CAAC,aAAa,CAAC,YAAY,CAAC;gBAC5D,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;aACxC,CAAC;QACJ,CAAC;KAAA;IAED,8EAA8E;IAChE,sBAAsB,CAAC,YAAoB;;;YACvD,IAAI,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,MAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YAE/E,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAC1B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,+FAA+F,EAC/F,CAAC,YAAY,CAAC,CACf,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAAC,CAAmD,CAAC;YACnH,OAAO,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,KAAK,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,CAAC,IAAI,CAAA,MAAM,aAAN,MAAM,uBAAN,MAAM,CAAE,oBAAoB,MAAK,GAAG,CAAC;QAC9H,CAAC;KAAA;IAED;;;;OAIG;IACG,KAAK,CAAC,OAAqB;;;YAC/B,MAAM,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC;YAEzD,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,EACtC,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YAED,IACE,mBAAmB;gBACnB,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,EACvC,CAAC;gBACD,OAAO,IAAI,CAAC,YAAY,EAAE,CAAC;YAC7B,CAAC;YAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAClD,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CACnC,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,IAAI,CAAC,OAAO,CAAC,QAAQ;oBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;gBACzD,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YAC7F,IAAI,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,WAAW,CAAC,cAAc,IAAI,WAAW,CAAC,wBAAwB,EAAE,CAAC;gBACxH,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,CAAC,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC;YAChK,CAAC;YACD,qFAAqF;YACrF,IAAI,CAAC,OAAO,CAAC,QAAQ;gBAAE,OAAO,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;YAEzD,QAAQ,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAClC,KAAK,SAAS;oBACZ,MAAM,IAAI,KAAK,CACb,8DAA8D,CAC/D,CAAC;gBACJ,KAAK,uCAAkB,CAAC,KAAK,CAAC;gBAC9B,KAAK,uCAAkB,CAAC,MAAM;oBAC5B,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;gBAC1C,KAAK,uCAAkB,CAAC,KAAK;oBAC3B,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACpD,CAAC;YAED,IAAI,MAAM,CAAC,kBAAkB,KAAK,uCAAkB,CAAC,IAAI,EAAE,CAAC;gBAC1D,MAAM,IAAI,KAAK,CACb,uDAAuD,MAAM,CAAC,kBAAkB,GAAG,CACpF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAC5F,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,KAAK,CAAC,+BAAuB,CAAC,CAAC;YAC3C,CAAC;YAED,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1E,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YACpD,CAAC;YAED,MAAM,eAAe,GAAG,MAAM,IAAI,CAAC,cAAc,CAC/C,MAAM,CAAC,YAAY,EACnB,OAAO,CAAC,QAAQ,CACjB,CAAC;YACF,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAExE,IACE,IAAI,CAAC,cAAc,CAAC,kBAAkB;gBACtC,IAAI,CAAC,cAAc,CAAC,kBAAkB,IAAI,IAAI,EAC9C,CAAC;gBACD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;gBACzB,MAAM,UAAU,GAAG,MAAM,CAAC,oBAAoB;oBAC5C,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,oBAAoB,CAAC;oBACvC,CAAC,CAAC,SAAS,CAAC;gBAEd,qGAAqG;gBACrG,IAAI,UAAU,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,IAAI,KAAK,IAAI,UAAU,EAAE,CAAC;oBAC7E,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;gBACtC,CAAC;YACH,CAAC;YAED,IAAI,WAAW,CAAC,cAAc,EAAE,CAAC;gBAC/B,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,KAAK,EAAE,MAAA,WAAW,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;YACnJ,CAAC;YAED,MAAM,yBAAyB,GAC7B,qEAAqE,CAAC;YACxE,MAAM,SAAG,CAAC,KAAK,CACb,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,yBAAyB,EACzB,CAAC,MAAM,CAAC,YAAY,CAAC,CACtB,CAAC;YAEF,OAAO,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACzD,CAAC;KAAA;IAED;;;OAGG;IACU,4BAA4B,CAAC,KAAa;;YACrD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;gBACrD,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;YACxC,CAAC;YAED,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACxD,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAC5E,MAAM,YAAY,GAAG,IAAA,wDAAmC,EAAC,OAAO,CAAC,CAAC;YAElE,IAAI,CAAC,YAAY,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;YACvC,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YACtF,IAAI,CAAC,WAAW,IAAI,CAAC,IAAA,qDAAgC,EAAC,WAAW,CAAC,IAAI,CAAC,IAAA,iDAA4B,EAAC,OAAO,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC1H,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YAChE,CAAC;YAED,OAAO,IAAA,mDAA8B,EAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAC9D,CAAC;KAAA;IAED,+FAA+F;IAClF,uBAAuB,CAAC,YAAoB,EAAE,WAAmB;;;YAC5E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,YAAY,CAAC,CAAC;YAC/E,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc;gBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;YACvG,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,KAAK,EAAE,MAAA,IAAI,CAAC,KAAK,mCAAI,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;QACrI,CAAC;KAAA;IAEa,sBAAsB,CAAC,KAAqB;;;YACxD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,4BAA4B,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACrF,IAAI,CAAC,IAAA,qDAAgC,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,IAAI,CAAA,MAAA,IAAI,CAAC,KAAK,0CAAE,IAAI,GAAG,WAAW,EAAE,MAAK,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC7I,MAAM,IAAI,8BAAqB,CAAC,8DAA8D,CAAC,CAAC;YAClG,CAAC;YACD,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc,IAAI,CAAC,IAAI,CAAC,wBAAwB;gBAAE,MAAM,IAAI,8BAAqB,CAAC,sCAAsC,CAAC,CAAC;YAC7I,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;gBAAE,MAAM,IAAI,8BAAqB,CAAC,4BAA4B,CAAC,CAAC;YACzJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,CAAA,MAAA,IAAI,CAAC,cAAc,CAAC,uBAAuB,0CAAE,OAAO,CAAA;oBAAE,MAAM,IAAI,8BAAqB,EAAE,CAAC;gBAC7F,MAAM,IAAI,GAAG,MAAM,SAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAC9D,6KAA6K,EAC7K,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;gBAClD,IAAI,CAAC,IAAI,CAAC,MAAM;oBAAE,MAAM,IAAI,8BAAqB,CAAC,iCAAiC,CAAC,CAAC;YACvF,CAAC;QACH,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB,EAAE,IAAY;;YAC5D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;YACrE,MAAM,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,qBAAqB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpE,MAAM,CAAC,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;YAC3E,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,qEAAqE,EAAE,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC;YACpJ,IAAI,KAAK,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;gBAC/B,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,kFAAkF,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;YAClK,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;KAAA;IAEY,eAAe,CAAC,WAAmB;;YAC9C,MAAM,IAAI,CAAC,sBAAsB,CAAC,MAAM,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YACrF,OAAO,EAAE,SAAS,EAAE,MAAM,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QACxE,CAAC;KAAA;IAED;;;;OAIG;IACU,WAAW,CACtB,YAAoB,EACpB,aAAqB,EACrB,OAAqC;;YAErC,IAAI,CAAA,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,aAAa,MAAK,KAAK,EAAE,CAAC;gBACrC,IAAA,qCAAoB,EAAC,aAAa,CAAC,CAAC;YACtC,CAAC;YACD,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,8DAA8D,CAAC;gBAC7E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;gBAErE,MAAM,MAAM,GAAG,MAAM,SAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,KAAK,EAAE;oBAC3E,YAAY;oBACZ,cAAc;iBACf,CAAC,CAAC;gBACH,MAAM,IAAI,CAAC,yBAAyB,CAAC,YAAY,CAAC,CAAC;gBACnD,OAAO,MAAM,CAAC;YAChB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAED;;;OAGG;IACU,+BAA+B;;YAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;YACpC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;YAC9D,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,uFAAuF,EACvF,EAAE,CACH,CAAC;YAEF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAG1D,CAAC;YACJ,IAAI,aAAa,GAAG,CAAC,CAAC;YACtB,IAAI,YAAY,GAAG,CAAC,CAAC;YAErB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBAC9C,MAAM,cAAc,GAAG,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;gBAE9E,IACE,CAAC,YAAY;oBACb,CAAC,cAAc;oBACf,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC;oBAChD,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EACtD,CAAC;oBACD,YAAY,IAAI,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;gBAED,MAAM,uBAAuB,GAC3B,6BAAiB,CAAC,2BAA2B,CAAC,cAAc,CAAC,CAAC;gBAEhE,MAAM,SAAG,CAAC,OAAO,CACf,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,4DAA4D,EAC5D,CAAC,uBAAuB,EAAE,YAAY,EAAE,cAAc,CAAC,CACxD,CAAC;gBACF,aAAa,IAAI,CAAC,CAAC;YACrB,CAAC;YAED,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,wDAAwD,IAAI,CAAC,MAAM,aAAa,aAAa,cAAc,YAAY,cAAc,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAClL,CAAC;QACJ,CAAC;KAAA;IAED,yGAAyG;IACnG,cAAc,CAClB,YAAoB,EACpB,aAAqB;;YAErB,MAAM,KAAK,GAAG,yDAAyD,CAAC;YACxE,MAAM,MAAM,GAAG,CAAC,MAAM,SAAG,CAAC,KAAK,CAC7B,IAAI,CAAC,cAAc,CAAC,eAAe,EACnC,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,yBAAa,CAAC,sBAAsB,CAAC,CAAC,CAEnE,CAAC;YAEJ,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC;YACf,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC;YAEvC,IAAI,6BAAiB,CAAC,cAAc,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO,6BAAiB,CAAC,cAAc,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,uBAAuB,GAAG,0BAAc,CAAC,OAAO,CACpD,aAAa,EACb,IAAI,CAAC,cAAc,CAAC,aAAa,CAClC,CAAC;YAEF,IAAI,6BAAiB,CAAC,oBAAoB,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC3D,MAAM,6BAA6B,GACjC,6BAAiB,CAAC,6BAA6B,CAC7C,uBAAuB,EACvB,cAAc,CACf,CAAC;gBAEJ,IAAI,6BAA6B,EAAE,CAAC;oBAClC,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChF,CAAC;gBAED,OAAO,6BAA6B,CAAC;YACvC,CAAC;YAED,MAAM,qBAAqB,GAAG,6BAAiB,CAAC,sBAAsB,CACpE,cAAc,EACd,uBAAuB,CACxB,CAAC;YAEF,IAAI,qBAAqB,EAAE,CAAC;gBAC1B,MAAM,IAAI,CAAC,WAAW,CAAC,YAAY,EAAE,aAAa,EAAE,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAC;YAChF,CAAC;YAED,OAAO,qBAAqB,CAAC;QAC/B,CAAC;KAAA;IAED,8GAA8G;IACxG,YAAY;;YAChB,OAAO;gBACL,MAAM,EAAE;oBACN,YAAY,EAAE,IAAI;oBAClB,KAAK,EAAE,OAAO;oBACd,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;oBAC3C,OAAO,EAAE,OAAO;oBAChB,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,qBAAqB;oBAC7B,cAAc,EAAE,KAAK;oBACrB,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,eAAe;oBAC1B,SAAS,EAAE,IAAI;oBACf,KAAK,EAAE,EAAE;oBACT,WAAW,EAAE,EAAE;iBAChB;gBACD,MAAM,EAAE,IAAI;gBACZ,UAAU,EAAE;oBACV,YAAY,EAAE,EAAE;oBAChB,MAAM,EAAE,EAAE;oBACV,KAAK,EAAE,EAAE;iBACV;aACF,CAAC;QACJ,CAAC;KAAA;IAED,2EAA2E;IAC3E,WAAW;QACT,OAAO;YACL,MAAM,EAAE;gBACN,YAAY,EAAE,KAAK;gBACnB,KAAK,EAAE,MAAM;gBACb,kBAAkB,EAAE,uCAAkB,CAAC,IAAI;gBAC3C,OAAO,EAAE,KAAK;gBACd,IAAI,EAAE,MAAM;gBACZ,QAAQ,EAAE,IAAI;gBACd,MAAM,EAAE,qBAAqB;gBAC7B,cAAc,EAAE,KAAK;gBACrB,YAAY,EAAE,IAAI;gBAClB,SAAS,EAAE,eAAe;gBAC1B,SAAS,EAAE,KAAK;gBAChB,KAAK,EAAE,EAAE;gBACT,WAAW,EAAE,EAAE;aAChB;YACD,MAAM,EAAE,IAAI;YACZ,UAAU,EAAE;gBACV,YAAY,EAAE,EAAE;gBAChB,MAAM,EAAE,EAAE;gBACV,KAAK,EAAE,EAAE;aACV;SACF,CAAC;IACJ,CAAC;IAED;;;OAGG;IACU,oBAAoB,CAC/B,KAAa,EACb,WAAmB;;YAEnB,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBACrD,MAAM,IAAI,KAAK,CAAC,mBAAmB,CAAC,CAAC;gBACvC,CAAC;gBAED,IAAA,qCAAoB,EAAC,WAAW,CAAC,CAAC;gBAElC,MAAM,MAAM,GAAG,IAAA,wCAAmB,EAAC,IAAI,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;gBACjE,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,IAAA,6CAAwB,EAAC,KAAK,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,CAAC;gBAE/E,MAAM,cAAc,GAAG,6BAAiB,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;gBAEnE,MAAM,SAAG,CAAC,eAAe,CAAC,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,CAAO,WAAW,EAAE,EAAE;;oBACnF,6EAA6E;oBAC7E,+EAA+E;oBAC/E,MAAM,OAAO,GAAG,MAAM,SAAG,CAAC,gBAAgB,CACxC,WAAW,EACX,mHAAmH,EACnH,CAAC,uCAAkB,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,uCAAkB,CAAC,IAAI,EAAE,uCAAkB,CAAC,KAAK,CAAC,CAClG,CAAC;oBACF,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAwC,CAAC;oBACnG,IAAI,MAAM,CAAC,MAAA,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,mCAAI,GAAG,aAAH,GAAG,uBAAH,GAAG,CAAE,MAAM,CAAC,KAAK,YAAY,EAAE,CAAC;wBACxD,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;oBAC3E,CAAC;oBAED,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,gFAAgF,EAChF,CAAC,YAAY,EAAE,cAAc,CAAC,CAC/B,CAAC;oBAEF,IAAI,IAAI,CAAC,cAAc,CAAC,kBAAkB,EAAE,CAAC;wBAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,sBAAsB,CAAC,CAAC;wBAChE,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;wBACjF,MAAM,SAAG,CAAC,gBAAgB,CACxB,WAAW,EACX,yCAAyC,cAAc,6CAA6C,EACpG,CAAC,YAAY,CAAC,CACf,CAAC;oBACJ,CAAC;gBACH,CAAC,CAAA,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;KAAA;CACF,CAAA;AA/hBY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IAOR,WAAA,IAAA,eAAM,EAAC,iBAAiB,CAAC,CAAA;qCAFL,yBAAW;QACT,6BAAa,UAED,mCAAgB;GAP1C,WAAW,CA+hBvB","sourcesContent":["import { Inject, Injectable, UnauthorizedException } from \"@nestjs/common\";\nimport { TwoFactorService, TwoFactorProof } from '../TwoFactorService/TwoFactorService';\nimport * as jwt from \"jsonwebtoken\";\nimport { Orm } from \"../../../Orm\";\nimport { CryptUtilities, PasswordUtilities, RestUtilities } from \"../../../Utilities\";\nimport type { AccessiOptions } from \"../../AccessiModule\";\nimport { LoginRequest } from \"../../Dtos/LoginRequest\";\nimport { LoginResult } from \"../../Dtos/LoginResponse\";\nimport { StatoRegistrazione } from \"../../Dtos/StatoRegistrazione\";\nimport { UserService } from \"../UserService/UserService\";\nimport { FiltriService } from \"../FiltriService/FiltriService\";\nimport {\n  buildAuthenticatedTokenPayload,\n  isAuthenticatedUserEnabledForJwt,\n  isAccessiTokenAllowedForUser,\n  resolveCodiceUtenteFromTokenPayload,\n} from \"../../security/authenticatedToken\";\nimport {\n  getAccessiJwtSecret,\n  verifyPasswordResetToken,\n} from \"../../security/passwordResetToken\";\nimport { assertStrongPassword } from '../../security/passwordPolicy';\nimport { Logger } from \"../../../Logger\";\nimport { TokenResult } from '../../Dtos/TokenResult';\n\n/** Error code deliberately returned when a user is configured as SSO-only. */\nexport const PASSWORD_LOGIN_DISABLED = 'PASSWORD_LOGIN_DISABLED';\n\ninterface AccessiTokenIssueOptions {\n  /** Sovrascrive jwtOptions.expiresIn per token a durata ridotta (es. Login as). */\n  expiresIn?: string | number;\n  /** Claim aggiuntive, per esempio l'attore che ha generato un token di impersonazione. */\n  extraClaims?: Record<string, unknown>;\n}\n\n@Injectable()\nexport class AuthService {\n  private readonly logger = new Logger(AuthService.name);\n\n  constructor(\n    private userService: UserService,\n    private filtriService: FiltriService,\n    @Inject(\"ACCESSI_OPTIONS\") private readonly accessiOptions: AccessiOptions,\n    private readonly twoFactorService: TwoFactorService,\n  ) {}\n\n  private async refreshPasswordExpiration(codiceUtente: number): Promise<void> {\n    if (!this.accessiOptions.passwordExpiration) {\n      return;\n    }\n\n    const configuredDays = Number(this.accessiOptions.passwordExpirationDays);\n    const expirationDays =\n      Number.isFinite(configuredDays) && configuredDays > 0\n        ? Math.trunc(configuredDays)\n        : 90;\n\n    const query = `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`;\n    await Orm.execute(this.accessiOptions.databaseOptions, query, [codiceUtente]);\n  }\n\n  private isMockDemoUserEnabled(): boolean {\n    if (!this.accessiOptions.mockDemoUser) {\n      return false;\n    }\n\n    // La backdoor mock non e mai attiva in produzione, nemmeno con variabili d'ambiente,\n    // perche emette un superutente senza verifica password.\n    const nodeEnv = (process.env.NODE_ENV ?? \"production\").toLowerCase();\n    return nodeEnv !== \"production\";\n  }\n\n  /** Creates the normal internal JWT consumed by all existing Accessi guards. */\n  public createAccessiToken(\n    utente: LoginResult['utente'],\n    methods: string[] = [],\n    tokenOptions: AccessiTokenIssueOptions = {},\n  ): TokenResult {\n    if (!utente?.codiceUtente) {\n      throw new Error('Impossibile creare un token senza un utente Accessi valido.');\n    }\n    const loginAs = methods.includes('login_as');\n    if ((utente.flagDueFattori === true || Number(utente.flagDueFattori) === 1) && !methods.includes('otp') && !loginAs) {\n      throw new UnauthorizedException('Verifica del codice di accesso richiesta.');\n    }\n\n    const expiresIn = tokenOptions.expiresIn ?? this.accessiOptions.jwtOptions.expiresIn;\n    const expiresInIsValid = typeof expiresIn === 'number'\n      ? Number.isFinite(expiresIn) && expiresIn > 0\n      : typeof expiresIn === 'string' && expiresIn.trim() !== '';\n    if (!expiresInIsValid) {\n      throw new Error('jwtOptions.expiresIn non configurato: impossibile emettere token senza scadenza.');\n    }\n\n    const token = jwt.sign(\n      { ...(tokenOptions.extraClaims ?? {}), utente, typ: 'access', amr: methods },\n      getAccessiJwtSecret(this.accessiOptions),\n      { expiresIn: expiresIn as jwt.SignOptions['expiresIn'] },\n    );\n\n    // Difesa in profondita: un `expiresIn` malformato farebbe emettere un token permanente.\n    const decoded = jwt.decode(token);\n    const decodedPayload = decoded && typeof decoded === 'object' ? decoded as jwt.JwtPayload : undefined;\n    if (typeof decodedPayload?.exp !== 'number') {\n      throw new Error('Token emesso senza scadenza: configurazione JWT non valida.');\n    }\n\n    // Il contratto TokenResult espone sempre la validita in secondi, anche quando\n    // jwtOptions.expiresIn usa un formato leggibile come '24h'.\n    const issuedAt = typeof decodedPayload.iat === 'number' ? decodedPayload.iat : Math.floor(Date.now() / 1000);\n    const expiresInSeconds = Math.max(0, Math.trunc(decodedPayload.exp - issuedAt));\n\n    return {\n      expiresIn: String(expiresInSeconds),\n      value: token,\n      type: 'Bearer',\n    };\n  }\n\n  /**\n   * Emette l'access token per l'utente target, con l'attore registrato nelle\n   * claim `act` e `loginAs`. La durata e' quella standard di jwtOptions.expiresIn.\n   */\n  public createLoginAsToken(\n    utente: LoginResult['utente'],\n    actor: { codiceUtente: number; email?: string },\n  ): TokenResult {\n    return this.createAccessiToken(utente, ['login_as'], {\n      extraClaims: {\n        loginAs: true,\n        act: {\n          sub: String(actor.codiceUtente),\n          email: actor.email,\n        },\n      },\n    });\n  }\n\n  /** Builds the standard login response for a user authenticated by a supported method. */\n  public async getLoginResultForUser(codiceUtente: number): Promise<LoginResult> {\n    const users = await this.userService.getUsers(\n      { codiceUtente },\n      { includeExtensionFields: true, includeGrants: true },\n    );\n    const result = users[0];\n    if (!result?.utente) {\n      throw new Error('Utente Accessi non trovato.');\n    }\n    const current = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(current)) throw new UnauthorizedException('Utente non abilitato.');\n    result.utente = { ...result.utente, ...current };\n\n    return {\n      utente: result.utente,\n      filtri: await this.filtriService.getFiltriUser(codiceUtente),\n      userGrants: result.userGrants,\n      extensionFields: result.extensionFields,\n    };\n  }\n\n  /** Users without a row retain the historic password-login enabled default. */\n  private async isPasswordLoginEnabled(codiceUtente: number): Promise<boolean> {\n    if (this.accessiOptions.federatedAuthentication?.enabled !== true) return true;\n\n    const rows = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      'SELECT COALESCE(FLGPASSWORD, 1) AS password_login_enabled FROM UTENTI_CONFIG WHERE CODUTE = ?',\n      [codiceUtente],\n    );\n    const policy = rows.map(RestUtilities.convertKeysToCamelCase)[0] as { passwordLoginEnabled?: unknown } | undefined;\n    return policy?.passwordLoginEnabled !== false && policy?.passwordLoginEnabled !== 0 && policy?.passwordLoginEnabled !== '0';\n  }\n\n  /**\n   * Autentica con credenziali locali e restituisce profilo, filtri e grant effettivi.\n   * Non crea il JWT: il controller o il flusso SSO deve chiamare `createAccessiToken` sul risultato.\n   * Per utenti SSO-only genera `PASSWORD_LOGIN_DISABLED`, da trattare come istruzione a usare l'SSO.\n   */\n  async login(request: LoginRequest): Promise<LoginResult> {\n    const mockDemoUserEnabled = this.isMockDemoUserEnabled();\n\n    if (\n      mockDemoUserEnabled &&\n      request.email.toLowerCase() === \"demo\"\n    ) {\n      return this.getDemoUser();\n    }\n\n    if (\n      mockDemoUserEnabled &&\n      request.email.toLowerCase() === \"admin\"\n    ) {\n      return this.getAdminUser();\n    }\n\n    const utente = await this.userService.getUserByEmail(\n      request.email.trim().toLowerCase()\n    );\n    if (!utente) {\n      if (!request.password) return { passwordRequired: true };\n      throw new Error(\"Nome utente o password errata!\");\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(utente.codiceUtente);\n    if (isAuthenticatedUserEnabledForJwt(currentUser) && currentUser.flagDueFattori && currentUser.passwordlessLoginEnabled) {\n      return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: (currentUser.email ?? '').trim(), mode: 'passwordless' }) };\n    }\n    // The email-only step has the same response for unknown and ordinary local accounts.\n    if (!request.password) return { passwordRequired: true };\n\n    switch (utente.statoRegistrazione) {\n      case undefined:\n        throw new Error(\n          \"Struttura dati compromessa: Stato Registrazione inesistente.\"\n        );\n      case StatoRegistrazione.BLOCC:\n      case StatoRegistrazione.DELETE:\n        throw new Error(\"Utente non abilitato\");\n      case StatoRegistrazione.INVIO:\n        throw new Error(\"Rinnovo password necessario.\");\n    }\n\n    if (utente.statoRegistrazione !== StatoRegistrazione.CONF) {\n      throw new Error(\n        `Errore generico. Stato di registrazione non valido: ${utente.statoRegistrazione}.`\n      );\n    }\n\n    if (!isAuthenticatedUserEnabledForJwt(currentUser)) throw new Error('Utente non abilitato');\n    if (!(await this.isPasswordLoginEnabled(utente.codiceUtente))) {\n      throw new Error(PASSWORD_LOGIN_DISABLED);\n    }\n\n    if (typeof request.password !== 'string' || request.password.length === 0) {\n      throw new Error('Nome utente o password errata!');\n    }\n\n    const isPasswordValid = await this.verifyPassword(\n      utente.codiceUtente,\n      request.password\n    );\n    if (!isPasswordValid) throw new Error(\"Nome utente o password errata!\");\n\n    if (\n      this.accessiOptions.passwordExpiration &&\n      this.accessiOptions.passwordExpiration == true\n    ) {\n      const today = new Date();\n      const targetDate = utente.dataScadenzaPassword\n        ? new Date(utente.dataScadenzaPassword)\n        : undefined;\n\n      // Legacy users may not have an expiration date. Preserve the former non-expiring behaviour for them.\n      if (targetDate && !Number.isNaN(targetDate.getTime()) && today >= targetDate) {\n        throw new Error(\"PASSWORD_EXPIRED\");\n      }\n    }\n\n    if (currentUser.flagDueFattori) {\n      return { challenge: await this.twoFactorService.issue({ codiceUtente: utente.codiceUtente, email: currentUser.email ?? '', mode: 'password' }) };\n    }\n\n    const updateLastAccessDateQuery =\n      \"UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?\";\n    await Orm.query(\n      this.accessiOptions.databaseOptions,\n      updateLastAccessDateQuery,\n      [utente.codiceUtente]\n    );\n\n    return this.getLoginResultForUser(utente.codiceUtente);\n  }\n\n  /**\n   * Verifica un JWT Accessi e ricostruisce il profilo corrente dal database.\n   * Questo evita che privilegi, stato utente o flag amministrativi presenti in un token vecchio restino validi.\n   */\n  public async getAuthenticatedTokenPayload(token: string): Promise<Record<string, unknown>> {\n    if (typeof token !== \"string\" || token.trim() === \"\") {\n      throw new Error(\"Token non fornito.\");\n    }\n\n    const secret = getAccessiJwtSecret(this.accessiOptions);\n    const decoded = jwt.verify(token.trim(), secret, { algorithms: ['HS256'] });\n    const codiceUtente = resolveCodiceUtenteFromTokenPayload(decoded);\n\n    if (!codiceUtente) {\n      throw new Error(\"Token non valido.\");\n    }\n\n    const currentUser = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!currentUser || !isAuthenticatedUserEnabledForJwt(currentUser) || !isAccessiTokenAllowedForUser(decoded, currentUser)) {\n      throw new Error(\"Token non valido o utente non autorizzato.\");\n    }\n\n    return buildAuthenticatedTokenPayload(decoded, currentUser);\n  }\n\n  /** Starts a second-factor challenge after the hosting backend has verified an SSO identity. */\n  public async beginFederatedTwoFactor(codiceUtente: number, identityKey: string): Promise<LoginResult> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori) throw new UnauthorizedException();\n    return { challenge: await this.twoFactorService.issue({ codiceUtente, email: user.email ?? '', mode: 'federated', identityKey }) };\n  }\n\n  private async validateTwoFactorProof(proof: TwoFactorProof): Promise<void> {\n    const user = await this.userService.getAuthenticatedUserSnapshot(proof.codiceUtente);\n    if (!isAuthenticatedUserEnabledForJwt(user) || !user.flagDueFattori || user.email?.trim().toLowerCase() !== proof.email.trim().toLowerCase()) {\n      throw new UnauthorizedException('Profilo modificato o utente non abilitato. Ripeti l accesso.');\n    }\n    if (proof.mode === 'passwordless' && !user.passwordlessLoginEnabled) throw new UnauthorizedException('Accesso senza password disabilitato.');\n    if (proof.mode === 'password' && !(await this.isPasswordLoginEnabled(proof.codiceUtente))) throw new UnauthorizedException('Login locale disabilitato.');\n    if (proof.mode === 'federated') {\n      if (!this.accessiOptions.federatedAuthentication?.enabled) throw new UnauthorizedException();\n      const rows = await Orm.query(this.accessiOptions.databaseOptions,\n        'SELECT I.IDNKEY FROM UTENTI_IDENTITA_EXT I INNER JOIN SSO_PROVIDER P ON P.PROVIDER = I.PROVIDER WHERE I.IDNKEY = ? AND I.CODUTE = ? AND I.FLGATTIVO = 1 AND P.FLGATTIVO = 1',\n        [proof.identityKey, proof.codiceUtente], false);\n      if (!rows.length) throw new UnauthorizedException('Identita SSO non piu abilitata.');\n    }\n  }\n\n  public async verifyTwoFactor(challengeId: string, code: string): Promise<LoginResult> {\n    const proof = await this.twoFactorService.consume(challengeId, code);\n    await this.validateTwoFactorProof(proof);\n    const result = await this.getLoginResultForUser(proof.codiceUtente);\n    result.token = this.createAccessiToken(result.utente, [proof.mode, 'otp']);\n    await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE CODUTE = ?', [proof.codiceUtente]);\n    if (proof.mode === 'federated') {\n      await Orm.execute(this.accessiOptions.databaseOptions, 'UPDATE UTENTI_IDENTITA_EXT SET DATLASTLOGIN = CURRENT_TIMESTAMP WHERE IDNKEY = ?', [proof.identityKey]);\n    }\n    return result;\n  }\n\n  public async resendTwoFactor(challengeId: string): Promise<LoginResult> {\n    await this.validateTwoFactorProof(await this.twoFactorService.describe(challengeId));\n    return { challenge: await this.twoFactorService.resend(challengeId) };\n  }\n\n  /**\n   * Persiste una password hashata e aggiorna la scadenza, se la policy password e attiva. Non invia email.\n   * Con `enforcePolicy` (default true) valida la password secondo la policy moderna; i flussi di\n   * migrazione delle password legacy passano `enforcePolicy: false` per non bloccare password storiche.\n   */\n  public async setPassword(\n    codiceUtente: number,\n    nuovaPassword: string,\n    options?: { enforcePolicy?: boolean },\n  ) {\n    if (options?.enforcePolicy !== false) {\n      assertStrongPassword(nuovaPassword);\n    }\n    try {\n      const query = `UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?)`;\n      const hashedPassword = PasswordUtilities.hashPassword(nuovaPassword);\n\n      const result = await Orm.execute(this.accessiOptions.databaseOptions, query, [\n        codiceUtente,\n        hashedPassword,\n      ]);\n      await this.refreshPasswordExpiration(codiceUtente);\n      return result;\n    } catch (error) {\n      throw error;\n    }\n  }\n\n  /**\n   * Converte le password legacy cifrate nel formato hash compatibile, senza conoscere le password in chiaro.\n   * E idempotente: hash moderni e gia migrati vengono ignorati.\n   */\n  public async migrateLegacyEncryptedPasswords(): Promise<void> {\n    const startedAt = performance.now();\n    this.logger.info(\"Avvio migrazione password legacy accessi.\");\n    const results = await Orm.query(\n      this.accessiOptions.databaseOptions,\n      \"SELECT CODUTE AS codice_utente, PWD AS password FROM UTENTI_PWD WHERE PWD IS NOT NULL\",\n      []\n    );\n\n    const rows = results.map(RestUtilities.convertKeysToCamelCase) as {\n      codiceUtente?: number;\n      password?: string;\n    }[];\n    let migratedCount = 0;\n    let skippedCount = 0;\n\n    for (const row of rows) {\n      const codiceUtente = Number(row.codiceUtente);\n      const storedPassword = typeof row.password === \"string\" ? row.password : null;\n\n      if (\n        !codiceUtente ||\n        !storedPassword ||\n        PasswordUtilities.isPasswordHash(storedPassword) ||\n        PasswordUtilities.isLegacyPasswordHash(storedPassword)\n      ) {\n        skippedCount += 1;\n        continue;\n      }\n\n      const protectedLegacyPassword =\n        PasswordUtilities.hashLegacyEncryptedPassword(storedPassword);\n\n      await Orm.execute(\n        this.accessiOptions.databaseOptions,\n        \"UPDATE UTENTI_PWD SET PWD = ? WHERE CODUTE = ? AND PWD = ?\",\n        [protectedLegacyPassword, codiceUtente, storedPassword]\n      );\n      migratedCount += 1;\n    }\n\n    this.logger.info(\n      `Migrazione password legacy accessi completata. Letti=${rows.length}, migrati=${migratedCount}, ignorati=${skippedCount}, durataMs=${(performance.now() - startedAt).toFixed(2)}`\n    );\n  }\n\n  /** Verifica una password locale e migra automaticamente il formato legacy dopo una verifica positiva. */\n  async verifyPassword(\n    codiceUtente: number,\n    plainPassword: string\n  ): Promise<boolean> {\n    const query = `SELECT PWD AS password FROM UTENTI_PWD WHERE CODUTE = ?`;\n    const result = (await Orm.query(\n      this.accessiOptions.databaseOptions,\n      query,\n      [codiceUtente]\n    ).then((results) => results.map(RestUtilities.convertKeysToCamelCase))) as {\n      password: string;\n    }[];\n\n    const stored = result[0];\n    if (!stored || typeof stored.password !== \"string\") {\n      return false;\n    }\n\n    const storedPassword = stored.password;\n\n    if (PasswordUtilities.isPasswordHash(storedPassword)) {\n      return PasswordUtilities.verifyPassword(plainPassword, storedPassword);\n    }\n\n    const legacyEncryptedPassword = CryptUtilities.encrypt(\n      plainPassword,\n      this.accessiOptions.encryptionKey\n    );\n\n    if (PasswordUtilities.isLegacyPasswordHash(storedPassword)) {\n      const isMigratedLegacyPasswordValid =\n        PasswordUtilities.verifyLegacyEncryptedPassword(\n          legacyEncryptedPassword,\n          storedPassword\n        );\n\n      if (isMigratedLegacyPasswordValid) {\n        await this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });\n      }\n\n      return isMigratedLegacyPasswordValid;\n    }\n\n    const isLegacyPasswordValid = PasswordUtilities.timingSafeStringEquals(\n      storedPassword,\n      legacyEncryptedPassword,\n    );\n\n    if (isLegacyPasswordValid) {\n      await this.setPassword(codiceUtente, plainPassword, { enforcePolicy: false });\n    }\n\n    return isLegacyPasswordValid;\n  }\n\n  /** Restituisce l'utente fittizio amministratore; usabile solo con `mockDemoUser` esplicitamente abilitato. */\n  async getAdminUser(): Promise<LoginResult> {\n    return {\n      utente: {\n        codiceUtente: 6789,\n        email: \"admin\",\n        statoRegistrazione: StatoRegistrazione.CONF,\n        cognome: \"Admin\",\n        nome: \"Admin\",\n        flagGdpr: true,\n        avatar: \"/path/to/avatar.jpg\",\n        flagDueFattori: false,\n        codiceLingua: \"IT\",\n        cellulare: \"+391234567890\",\n        flagSuper: true,\n        roles: [],\n        permissions: [],\n      },\n      filtri: null,\n      userGrants: {\n        abilitazioni: [],\n        grants: [],\n        ruoli: [],\n      },\n    };\n  }\n\n  /** Restituisce l'utente demo fittizio; non contiene dati o grant reali. */\n  getDemoUser(): LoginResult {\n    return {\n      utente: {\n        codiceUtente: 12345,\n        email: \"jdoe\",\n        statoRegistrazione: StatoRegistrazione.CONF,\n        cognome: \"Doe\",\n        nome: \"John\",\n        flagGdpr: true,\n        avatar: \"/path/to/avatar.jpg\",\n        flagDueFattori: false,\n        codiceLingua: \"IT\",\n        cellulare: \"+391234567890\",\n        flagSuper: false,\n        roles: [],\n        permissions: [],\n      },\n      filtri: null,\n      userGrants: {\n        abilitazioni: [],\n        grants: [],\n        ruoli: [],\n      },\n    };\n  }\n\n  /**\n   * Consuma un token monouso di reset, riporta l'utente allo stato confermato e salva la nuova password.\n   * Il nonce in `UTENTI.KEYREG` viene annullato prima di impostare la password, impedendo il riuso del token.\n   */\n  public async confirmResetPassword(\n    token: string,\n    newPassword: string\n  ): Promise<void> {\n    try {\n      if (typeof token !== \"string\" || token.trim() === \"\") {\n        throw new Error(\"Token non valido.\");\n      }\n\n      assertStrongPassword(newPassword);\n\n      const secret = getAccessiJwtSecret(this.accessiOptions, 'reset');\n      const { codiceUtente, nonce } = verifyPasswordResetToken(token.trim(), secret);\n\n      const hashedPassword = PasswordUtilities.hashPassword(newPassword);\n\n      await Orm.withTransaction(this.accessiOptions.databaseOptions, async (transaction) => {\n        // A conditional write claims the nonce under the database row lock. A second\n        // concurrent reset cannot also consume it; failures roll the whole reset back.\n        const claimed = await Orm.transactionQuery<unknown>(\n          transaction,\n          'UPDATE UTENTI SET KEYREG = NULL, STAREG = ? WHERE CODUTE = ? AND KEYREG = ? AND STAREG IN (?, ?) RETURNING CODUTE',\n          [StatoRegistrazione.CONF, codiceUtente, nonce, StatoRegistrazione.CONF, StatoRegistrazione.INVIO],\n        );\n        const row = (Array.isArray(claimed) ? claimed[0] : claimed) as Record<string, unknown> | undefined;\n        if (Number(row?.CODUTE ?? row?.codute) !== codiceUtente) {\n          throw new Error('Token non valido, gia usato o utente non autorizzato.');\n        }\n\n        await Orm.transactionQuery(\n          transaction,\n          'UPDATE OR INSERT INTO UTENTI_PWD (CODUTE, PWD) VALUES (?, ?) MATCHING (CODUTE)',\n          [codiceUtente, hashedPassword],\n        );\n\n        if (this.accessiOptions.passwordExpiration) {\n          const days = Number(this.accessiOptions.passwordExpirationDays);\n          const expirationDays = Number.isFinite(days) && days > 0 ? Math.trunc(days) : 90;\n          await Orm.transactionQuery(\n            transaction,\n            `UPDATE UTENTI SET DATSCAPWD = DATEADD(${expirationDays} DAY TO CURRENT_TIMESTAMP) WHERE CODUTE = ?`,\n            [codiceUtente],\n          );\n        }\n      });\n    } catch (error) {\n      throw error;\n    }\n  }\n}\n"]}

package/dist/accessi-module/Services/ConfiguratorService/ConfiguratorService.d.ts

@@ -1,7 +1,9 @@
-import { AccessiOptions } from '../../AccessiModule';
+import type { AccessiOptions } from '../../AccessiModule';
 export declare class ConfiguratorService {
     private readonly accessiOptions;
     constructor(accessiOptions: AccessiOptions);
+    /** Enables or disables one menu in the runtime catalog. Disabled menus are excluded from normal grant resolution. */
     setMenuEnabled(codiceMenu: string, enabled: boolean): Promise<void>;
+    /** Enables or disables a whole group. Existing menus and role mappings are preserved for future reactivation. */
     setGroupEnabled(codiceGruppo: string, enabled: boolean): Promise<void>;
 }

package/dist/accessi-module/Services/ConfiguratorService/ConfiguratorService.js

@@ -29,6 +29,7 @@ let ConfiguratorService = class ConfiguratorService {
     constructor(accessiOptions) {
         this.accessiOptions = accessiOptions;
     }
+    /** Enables or disables one menu in the runtime catalog. Disabled menus are excluded from normal grant resolution. */
     setMenuEnabled(codiceMenu, enabled) {
         return __awaiter(this, void 0, void 0, function* () {
             const query = `UPDATE MENU SET FLGENABLED = ? WHERE CODMNU = ?`;
@@ -36,6 +37,7 @@ let ConfiguratorService = class ConfiguratorService {
             yield Orm_1.Orm.execute(this.accessiOptions.databaseOptions, query, [enabledValue, codiceMenu]);
         });
     }
+    /** Enables or disables a whole group. Existing menus and role mappings are preserved for future reactivation. */
     setGroupEnabled(codiceGruppo, enabled) {
         return __awaiter(this, void 0, void 0, function* () {
             const query = `UPDATE MENU_GRP SET FLGENABLED = ? WHERE CODGRP = ?`;
@@ -47,7 +49,9 @@ let ConfiguratorService = class ConfiguratorService {
 exports.ConfiguratorService = ConfiguratorService;
 exports.ConfiguratorService = ConfiguratorService = __decorate([
     autobind_1.autobind,
-    (0, common_1.Injectable)(),
+    (0, common_1.Injectable)()
+    /** Administrative catalog service. Disabling a menu or group does not delete grants already stored for it. */
+    ,
     __param(0, (0, common_1.Inject)('ACCESSI_OPTIONS')),
     __metadata("design:paramtypes", [Object])
 ], ConfiguratorService);